Linux Administrator ยท 3-5 Years
Real implementation, debugging, tools, logs, edge cases, and measurable fixes.
Try each answer before revealing the suggested coaching answer.
25 questions
01You are working on a production project and Linux filesystem hierarchy starts causing issues. How would you diagnose and fix it as a Linux Administrator?
A production answer
Say this first: Linux filesystem hierarchy should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply Linux filesystem hierarchy, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
02How have you implemented file permissions in a real Infrastructure project?
A production answer
Say this first: The important point about file permissions is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply file permissions, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
03A release is blocked because of a problem related to users and groups. What steps would you take?
A production answer
Say this first: users and groups should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply users and groups, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
04What logs, metrics, or artifacts would you check while troubleshooting process management?
A production answer
Say this first: The important point about process management is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply process management, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
05How would you make systemd services reliable enough for day-to-day production use?
A production answer
Say this first: systemd services should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply systemd services, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
06You are working on a production project and journalctl and logs starts causing issues. How would you diagnose and fix it as a Linux Administrator?
A production answer
Say this first: journalctl and logs should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply journalctl and logs, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
07How have you implemented package management in a real Infrastructure project?
A production answer
Say this first: The important point about package management is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply package management, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
08A release is blocked because of a problem related to shell scripting basics. What steps would you take?
A production answer
Say this first: shell scripting basics should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply shell scripting basics, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
09What logs, metrics, or artifacts would you check while troubleshooting cron jobs?
A production answer
Say this first: The important point about cron jobs is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply cron jobs, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
10How would you make network troubleshooting reliable enough for day-to-day production use?
A production answer
Say this first: The important point about network troubleshooting is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply network troubleshooting, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
11You are working on a production project and DNS troubleshooting starts causing issues. How would you diagnose and fix it as a Linux Administrator?
A production answer
Say this first: The important point about DNS troubleshooting is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply DNS troubleshooting, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
12How have you implemented SSH hardening in a real Infrastructure project?
A production answer
Say this first: The important point about SSH hardening is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply SSH hardening, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
13A release is blocked because of a problem related to firewalld/iptables. What steps would you take?
A production answer
Say this first: firewalld/iptables should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply firewalld/iptables, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
14What logs, metrics, or artifacts would you check while troubleshooting disk partitioning?
A production answer
Say this first: The important point about disk partitioning is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply disk partitioning, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
15How would you make LVM reliable enough for day-to-day production use?
A production answer
Say this first: LVM should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply LVM, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
16You are working on a production project and mounts and fstab starts causing issues. How would you diagnose and fix it as a Linux Administrator?
A production answer
Say this first: mounts and fstab should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply mounts and fstab, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
17How have you implemented CPU and memory troubleshooting in a real Infrastructure project?
A production answer
Say this first: The important point about CPU and memory troubleshooting is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply CPU and memory troubleshooting, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
18A release is blocked because of a problem related to disk full troubleshooting. What steps would you take?
A production answer
Say this first: The important point about disk full troubleshooting is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply disk full troubleshooting, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
19What logs, metrics, or artifacts would you check while troubleshooting log rotation?
A production answer
Say this first: The important point about log rotation is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply log rotation, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
20How would you make backup and restore reliable enough for day-to-day production use?
A production answer
Say this first: backup and restore should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply backup and restore, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
21You are working on a production project and patch management starts causing issues. How would you diagnose and fix it as a Linux Administrator?
A production answer
Say this first: patch management should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply patch management, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
22How have you implemented SELinux/AppArmor basics in a real Infrastructure project?
A production answer
Say this first: The important point about SELinux/AppArmor basics is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply SELinux/AppArmor basics, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
23A release is blocked because of a problem related to sudoers configuration. What steps would you take?
A production answer
Say this first: sudoers configuration should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply sudoers configuration, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
24What logs, metrics, or artifacts would you check while troubleshooting performance tuning?
A production answer
Say this first: The important point about performance tuning is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply performance tuning, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
25How would you make incident runbook creation reliable enough for day-to-day production use?
A production answer
Say this first: incident runbook creation should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine an internal support assistant that answers from approved policy documents. The team must decide how to apply incident runbook creation, verify the result, and explain the user impact. For a Linux Administrator, attach the explanation to an evaluation set and retrieval trace.
Show judgment
- describe the implementation path, the main trade-off, and the evidence you would collect.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out prompt injection and unsupported answers and the control that reduces it.
Concrete check
journalctl -u <service> --since "15 min ago"Evidence to mention
Track grounded-answer rate and p95 response time. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
Practice prompt: Use an internal support assistant that answers from approved policy documents as the example and show where you would stop a risky rollout.
No questions match. Try another term.
Further reading
These are original practice questions and suggested answers. Adapt them to your own work and explain evidence, trade-offs, and limitations.