Experienced Linux roles test how you think under pressure, not just which commands you remember. These Linux system administrator interview questions are scenario-based: each describes a real problem and a sensible way to investigate it. For fundamentals, start with our Linux interview questions.
Performance and resources
1. A server is slow. Where do you start?
Check load and resources: uptime for load averages, top or htop for CPU and memory, vmstat 1 for run queue and swapping, and iostat -x 1 for disk wait. Compare the load with the number of cores. Then identify the process responsible. Our guide to troubleshooting high CPU usage walks through it.
2. The disk is full. What do you do?
Run df -h to find the full file system, then du -xh --max-depth=1 /var | sort -h to find large directories. Common causes are logs, old kernels, container images and core dumps. If space does not return after deleting a file, a process may still hold it open; check with lsof +L1.
3. df shows free space, but you cannot create files. Why?
The file system may have run out of inodes. Check with df -i. Many tiny files, such as session or cache files, usually cause this.
4. A process uses too much memory. How do you investigate?
Use ps aux --sort=-%mem | head, check free -h and look in journalctl -k for out-of-memory killer messages. Then decide whether to tune the application, add memory or set limits with systemd.
Boot and services
5. A server does not boot after an update. What do you do?
Use the console to choose the previous kernel in the GRUB menu. If the boot stops at an emergency shell, check journalctl -xb and /etc/fstab for wrong entries; a bad mount line is a common cause. Use nofail for non-critical mounts.
6. A service fails to start. How do you debug it?
Run systemctl status service and journalctl -u service -b. Test the configuration with the service’s own check, such as nginx -t or sshd -t. Also check SELinux denials with ausearch -m avc on RHEL-family systems.
Access and permissions
7. A user cannot log in over SSH. What do you check?
Check that the account is not locked (passwd -S user), the shell is valid, ~/.ssh and authorized_keys have correct permissions (700 and 600) and owner, and sshd_config allows the user. Then read /var/log/auth.log or /var/log/secure, or journalctl -u sshd.
8. How do you give a user limited admin rights?
Add a file in /etc/sudoers.d/ that allows only the commands they need, and edit it with visudo -f to avoid syntax errors.
9. A web app cannot write to its upload directory. Why?
Check ownership and permissions with ls -ld, the user the service runs as, and SELinux labels with ls -Z. Fix with chown, chmod or semanage fcontext and restorecon, rather than disabling SELinux.
Networking
10. A server cannot reach the internet. How do you troubleshoot?
Work up the layers: ip link and ip addr for the interface, ip route for the default gateway, ping the gateway and a public IP, then test DNS with dig or resolvectl query. Finally, check firewalls with nft list ruleset or firewall-cmd --list-all.
11. How do you check which process is listening on a port?
ss -tulpn | grep :443.
Storage
12. How do you extend a full LVM volume?
Add a disk or partition, create a physical volume, extend the volume group, then the logical volume and file system in one step: lvextend -r -L +20G /dev/vg0/data. See our LVM guide.
Operations and security
13. How do you schedule a job?
Use cron (crontab -e) or systemd timers. Timers give better logging and dependency control.
14. How would you back up a server?
Back up data, configuration and databases separately, follow the 3-2-1 rule, keep one copy offline or immutable and test restores. Tools include rsync, Restic, BorgBackup and database-native tools.
15. You suspect a server is compromised. What are your first steps?
Do not reboot or wipe it immediately. Isolate it from the network, preserve evidence, such as memory, logs and a disk image, and inform the incident response team. Then look for unknown processes, new users, cron entries and unusual outbound connections.
16. How do you harden a new Linux server?
Patch it, disable root SSH login and password authentication, enable a host firewall, remove unused services, configure time sync and central logging, and apply a CIS Benchmark. Our free Linux server hardening checklist covers the details.
Keep preparing
Practise each answer out loud, and run the commands in a lab rather than memorising them. Interviewers often ask follow-up questions, so make sure you understand why each answer is true.
Sources
Preparing for an interview? Browse more questions in our interview preparation hub. For businesses, we also offer security services such as VAPT, server hardening and ISO 27001 readiness.
