Linux Systems Administrator Interview Questions for AI Training Work

I start with top-level resource checks, like CPU, memory, and disk I/O, using command-line tools such as top or iostat, to narrow down which resource is actually constrained before digging into application-level logs. I also check for anything scheduled to run around the time the slowdown started, since cron jobs are a common overlooked cause.

I verify routing tables and firewall rules explicitly rather than assuming default configuration handles cross-subnet traffic correctly, since a missing route or an overly restrictive firewall rule is a common cause of connectivity that works within a subnet but fails across it. I test connectivity from both directions before considering the configuration complete.

I start from the principle that nothing should be externally exposed unless there's a specific, documented reason, rather than leaving default exposure and locking down only what looks risky. I audit open ports periodically since services get added over time and exposure can drift without anyone noticing.

I use group-based permissions tied to role rather than granting access to individuals ad hoc, since individual grants become hard to audit and often outlive the reason they were given. I review permissions periodically to catch access that should have been revoked when someone's role changed.

I stage patches through a test environment before rolling out to production, and I schedule production patching during low-traffic windows with a rollback plan ready, rather than applying updates directly to production as soon as they're released. I prioritize security patches on a faster track than general updates given the risk of leaving known vulnerabilities unpatched.

I'd close the port immediately, then check logs for any suspicious access through it before assuming it was never exploited, since the priority is stopping ongoing exposure first and investigating impact second. If I find any sign of compromise, I'd escalate for a fuller security review rather than treating the closed port as the end of the incident.

I'd check the most common and quickest-to-diagnose causes first, like disk space or a crashed service, using command-line diagnostics, before assuming a deeper issue, since most outages have a mundane cause. I'd document what I find and fix as I go so there's a clear record even under time pressure.

I'd start with an inventory of what's actually running and its exposure, since you can't secure what you haven't accounted for, then prioritize fixes by risk level rather than trying to remediate everything at once. I'd expect to find systems that are safer to decommission than to patch, and I'd flag those rather than investing effort in securing something that shouldn't still be running.

During a routine audit I found a service running with default credentials that had never been changed after initial setup. I rotated the credentials immediately and added a check to our setup process so new services couldn't go live without a credential change, which prevented the same gap from recurring.

A subset of servers intermittently lost connectivity to a specific internal service, but the pattern wasn't obvious at first. Tracing it down to a misconfigured routing rule that only affected traffic from certain subnets took methodical elimination of other causes, and fixing the route resolved an issue that had been misattributed to the application itself.