System Administrator Interview Prep Guide

Use a structured approach: 1) Check load average and CPU usage (top, htop, mpstat). 2) Check memory (free -h, vmstat for swap activity). 3) Check disk I/O (iostat, iotop for per-process I/O). 4) Check network (ss for connections, iftop for bandwidth). 5) Check processes (ps aux sorted by CPU/MEM, strace for stuck processes). 6) Check logs (dmesg, /var/log/syslog, journalctl). Discuss how you narrow down from symptoms to root cause and what the most common causes are: runaway process, memory leak, disk I/O saturation, or zombie processes.

Cover standard rwx permissions for owner, group, and others. setuid (4000): executes as file owner (used by passwd). setgid (2000) on directory: new files inherit group. Sticky bit (1000): only owner can delete files (used on /tmp). For the shared directory: create a group for the team, set group ownership, apply setgid so new files inherit group, set 2770 permissions, and use ACLs (setfacl) for granular access when multiple groups need different access levels.

Implement 3-2-1 backup strategy: 3 copies, 2 media types, 1 offsite. For 1-hour RPO: continuous replication for critical databases (async replication with < 1 hour lag), hourly incremental backups for file systems. For 4-hour RTO: warm standby for critical services, VM-level replication (Zerto, Veeam), and documented recovery procedures. Discuss full/incremental/differential strategies, backup verification testing, and how to handle the 50TB volume efficiently with deduplication and compression.

Cover the hierarchy: forest > tree > domain > OU. Design with a single forest, single domain (simpler management) or multi-domain if regulatory isolation is required. Deploy domain controllers in each country for local authentication (minimize WAN latency). Use sites and subnets for replication topology. Implement Group Policy for security baselines, software deployment, and user settings. DNS: AD-integrated zones with each DC as a DNS server. Discuss FSMO roles, password policies, and Azure AD Connect for hybrid identity.

Use df -h with awk to parse output, compare against threshold, and send alerts via email (mail command) or webhook (curl to Slack/Teams). Include: current usage for all partitions, hostname identification, exclude pseudo filesystems (/proc, /sys), log the check, and handle edge cases (NFS mounts timing out). Discuss how you would run this as a cron job and integrate it with a monitoring system for better alert management.

VMware: most mature, best management tools (vCenter), widest hardware compatibility, expensive licensing. Hyper-V: integrated with Windows ecosystem, good for Windows-heavy environments, included with Windows Server. KVM: open-source, Linux-native, excellent performance, used by cloud providers (AWS, GCP). Choose VMware for enterprise environments needing vMotion, HA, and DRS. Choose Hyper-V for Microsoft shops. Choose KVM for Linux environments, cloud infrastructure, and cost-conscious deployments. Discuss containers vs VMs and when each is appropriate.

Describe a specific automation: server provisioning, user account management, patching, or backup verification. Explain the tools used (Ansible, PowerShell, Python), how you designed the automation for reliability (error handling, logging, idempotency), and the before/after comparison. Quantify: reduced from X hours/week to Y minutes, eliminated human errors, and freed up time for higher-value work. Discuss how you documented the automation and trained the team.

Use an internal CA (Active Directory Certificate Services or HashiCorp Vault PKI) for internal services and a commercial/Let's Encrypt CA for public-facing services. Implement certificate management automation: cert-manager for Kubernetes, ACME protocol for automated renewal, and inventory tracking for all certificates. Discuss certificate lifecycle: provisioning, monitoring expiration (30-day alerts), automated renewal, and revocation procedures. Mention certificate pinning for critical services and the importance of key management.