System Administrator interview questions

Linux selects the most specific matching route and then resolves ties using route preference attributes.

• Longest-prefix matching is decisive first, so a /24 route wins over a /16 route for an address covered by both.
• A metric is compared among otherwise eligible routes of equal prefix length, with the lower metric normally preferred.
• The default route, 0.0.0.0/0, matches every IPv4 destination but loses to any more specific matching prefix.
• If equal-cost routes remain, Linux may use an ECMP nexthop set rather than treating one route as a universal winner.

Policy-based routing chooses a routing table through ordered rules before performing a route lookup in that table.

• Rules can match properties such as source prefix, destination prefix, firewall mark, incoming interface, or priority.
• Each rule can direct the lookup to a named or numbered table that contains its own routes and default gateway.
• Rules are evaluated by ascending priority number, and a lookup can continue when the selected table has no usable route.
• This model supports cases such as source-specific uplinks while the main table continues to serve ordinary traffic.

IPv4 forwarding moves packets between interfaces, while source and destination NAT rewrite different endpoint addresses for distinct purposes.

• The net.ipv4.ip_forward setting permits the kernel to route IPv4 packets instead of accepting only locally addressed traffic.
• SNAT rewrites the source address, commonly giving private clients a stable public source address for outbound access.
• MASQUERADE is a source NAT variant that derives the translated address from the egress interface and suits dynamically assigned addresses.
• DNAT rewrites the destination address or port, commonly publishing an internal service through an address reachable by clients.

Netfilter exposes ordered hooks along the packet path, and nftables base chains register rules at selected hooks with explicit priorities.

• Incoming packets first encounter prerouting before the routing decision determines whether they are local or forwarded.
• Locally destined traffic reaches input, forwarded traffic reaches forward, and locally generated traffic starts at output.
• Routed and local outbound packets encounter postrouting before transmission through the egress interface.
• A base chain declares its family, hook, priority, and optional policy, while regular chains are reached only by jumps or gotos from evaluated chains.

nftables provides a unified ruleset and virtual machine that replace the separate legacy iptables family tools and rule handling model.

• nftables uses tables, typed chains, sets, maps, and expressions, allowing compact rules that avoid large repeated linear rule lists.
• Atomic transactions let nftables validate and replace a batch of rules without exposing a partially updated ruleset.
• Legacy iptables programs manage separate interfaces such as iptables, ip6tables, arptables, and ebtables with more protocol-specific duplication.
• The iptables-nft compatibility backend accepts iptables syntax but translates it to nftables kernel objects, whereas iptables-legacy uses the older backend and should not be mixed casually with it.

Stateful firewalling classifies packets through conntrack so rules can reason about a flow rather than each packet in isolation.

• NEW identifies a packet starting a flow or belonging to a flow that has not yet seen traffic in both directions.
• ESTABLISHED identifies packets in a tracked flow that has observed valid bidirectional communication.
• RELATED identifies a new flow associated with an existing one, such as certain helper-recognized data or control traffic and relevant ICMP errors.
• INVALID identifies packets that cannot be associated with a valid tracked flow, while UNTRACKED identifies packets deliberately exempted from tracking.

Remote-access VPNs connect individual clients to a private network, while site-to-site VPNs connect routed networks through gateways.

• Both encapsulate protected traffic in a tunnel, but remote-access endpoints are usually user devices and site-to-site endpoints are stable network gateways.
• Remote access commonly authenticates a user and device with certificates, credentials, or MFA, while site-to-site peers commonly use certificates or pre-shared keys.
• Routes determine which prefixes enter the tunnel, with site-to-site designs advertising or configuring remote subnets and remote-access designs pushing routes to clients.
• Split tunneling sends only selected prefixes through the VPN and reduces bandwidth and latency, but it weakens centralized inspection and can expose a client to trusted and untrusted networks simultaneously.

Authoritative, recursive, and caching DNS roles differ by whether a server owns answers, resolves them, or temporarily reuses them.

• An authoritative server answers from zone data for which it is responsible and does not need to discover that data through recursion.
• A recursive resolver accepts a client query and follows referrals through the DNS hierarchy until it obtains an answer or a validated failure.
• A caching resolver stores positive and negative results for their allowed TTLs to reduce latency and upstream query volume.
• One server can combine recursive and caching roles, but public authoritative service is normally separated from recursion to limit abuse and operational coupling.

A BIND zone defines authoritative DNS data, delegation metadata, and a serial that secondaries use to detect newer versions.

• The SOA record identifies core zone authority parameters, and its serial must increase whenever zone content changes so secondaries recognize an update.
• NS records name the authoritative servers, while A and AAAA map names to addresses, CNAME creates an alias, MX selects mail exchangers, and TXT carries text attributes.
• The primary loads the writable zone source, while secondaries maintain read-only copies obtained through AXFR full transfers or IXFR incremental transfers.
• NOTIFY can prompt secondaries to check the serial promptly, while refresh timers provide periodic synchronization when notification is absent or lost.

DHCP uses the DORA exchange to allocate time-limited network configuration and can serve clients across subnets through relay agents.

• The client broadcasts Discover, a server returns Offer, the client sends Request for the selected offer, and the server confirms it with Acknowledgment.
• A lease grants an address for a defined period and is renewed before expiry, while a reservation consistently maps a client identifier or MAC address to a chosen address.
• Core options commonly provide the subnet mask, default gateway, DNS servers, domain search settings, and lease timers alongside the address.
• A relay forwards client broadcasts to a server on another subnet and supplies gateway-address information so the server selects the correct address pool.

LVM separates storage hardware from filesystem-visible block devices by pooling capacity and allocating it logically.

• A physical volume is an initialized disk, partition, or other block device divided into physical extents for LVM allocation.
• A volume group combines one or more physical volumes into a shared capacity pool with a common physical extent size.
• A logical volume receives logical extents from the volume group and appears to the operating system as a block device for a filesystem, swap, or raw data.
• The mapping layer lets administrators resize volumes, add or remove backing devices through data movement, and create snapshots without changing the consumer's device model.

LVM thin provisioning allocates physical blocks from a shared thin pool only when thin logical volumes actually write data.

• A thin pool contains separate data and metadata logical volumes, while virtual sizes assigned to thin volumes may exceed the pool's physical capacity.
• Thin snapshots initially share blocks with their origin and consume new pool space as either side changes, so creation is fast and space-efficient.
• Data or metadata pool exhaustion can suspend writes, return errors, or make thin volumes unavailable depending on configuration and failure handling.
• Safe operation requires monitoring both usage dimensions, reserving growth capacity, configuring threshold-based extension, and testing recovery before overcommitting storage.

The logical volume and its filesystem are separate layers that must be resized in a safe order supported by the filesystem.

• For extension, grow the logical volume first and then grow the filesystem, either as separate verified steps or with an integrated LVM resize option.
• ext4 can usually grow while mounted and can shrink only while unmounted after a filesystem check, with the filesystem reduced before the logical volume.
• XFS can grow online but cannot shrink, so reducing it requires creating a smaller filesystem and copying or restoring the data.
• Before any shrink, confirm actual space use, calculate margins, back up recoverable data, and never reduce the block device below the filesystem's size.

RAID levels trade usable capacity and write cost for different forms of redundancy and parallelism.

• RAID 0 uses all capacity and stripes for high throughput but tolerates no disk failure, while RAID 1 mirrors data, commonly provides half capacity, and tolerates a member failure per mirror set.
• RAID 5 provides capacity of N minus 1 disks and survives one failure, but parity writes and degraded reads are costly and a second failure loses the array.
• RAID 6 provides capacity of N minus 2 disks and survives two failures, with greater write and rebuild overhead from dual parity.
• RAID 10 stripes across mirrors, commonly provides half capacity, offers strong random I/O and rebuild performance, and can survive multiple failures if no mirror loses all members.

Linux md RAID combines block devices into arrays whose layout and state are managed by the kernel and mdadm metadata.

• RAID metadata records array identity, level, member role, geometry, and event counters, with metadata versions differing in where superblocks are stored and boot compatibility.
• mdadm assembles arrays from matching member metadata, creates and reshapes arrays, manages members, and reports state, while the kernel performs normal array I/O.
• A spare holds no normal data role until it replaces a failed member, and a redundant array may remain accessible in degraded mode with reduced fault tolerance.
• Rebuild resynchronizes all required blocks onto a replacement, consumes I/O bandwidth, and leaves the array exposed to additional failures until redundancy is restored.

ext4 is a broadly compatible general-purpose filesystem, while XFS is optimized for scalable parallel I/O and large filesystems.

• ext4 supports online growth and offline shrinking, has mature recovery tooling, and often fits boot, root, and mixed workloads with predictable behavior.
• XFS uses allocation groups and extent-based allocation to scale concurrent access, and it performs especially well with large files, high throughput, and large storage volumes.
• XFS supports online growth but not shrinking, and its repair and backup tools differ from the ext family, which affects capacity planning and recovery procedures.
• Workload fit depends on file sizes, metadata intensity, concurrency, resize requirements, kernel support, and operational familiarity rather than a universal performance winner.

Journaling records pending filesystem changes so recovery can restore a consistent structure after an interrupted update.

• Metadata journaling protects structural changes such as directory entries and allocation maps, but it does not by itself guarantee that recent application data is durable.
• Ordered data mode writes associated data before committing metadata that exposes it, while writeback mode allows weaker ordering and full data journaling records both data and metadata at higher cost.
• Recovery replays committed journal transactions and discards incomplete ones, reducing check time but not replacing backups or application-level consistency mechanisms.
• Mount options such as data mode, barrier behavior, synchronous writes, and journal commit interval change the balance among durability, latency, and throughput and must match storage guarantees.

Filesystem quotas account for space and inode consumption by an identity or project and enforce configured thresholds.

• User quotas limit each owning user, while group quotas charge a file to its owning group and can control shared-team consumption.
• Project quotas tag directory trees with project identifiers, making them suitable for limiting applications, tenants, or trees independently of Unix ownership.
• A soft limit may be exceeded temporarily until its grace period expires, after which further allocation is denied as if at the limit.
• A hard limit is enforced immediately, and reliable quota operation requires filesystem support, correct mount or feature settings, initialized accounting, and periodic reporting.

An inode stores a filesystem object's metadata and block references, so creating files requires both free data space and free inodes.

• Directory entries map names to inode numbers, while the inode records attributes such as ownership, permissions, timestamps, link count, size, and data location.
• Filesystems differ in allocation strategy: ext4 commonly creates a planned inode population at format time, while XFS allocates inodes dynamically within filesystem constraints.
• Workloads with huge numbers of small files can exhaust inodes or metadata capacity while many data blocks remain free, whereas large-file workloads consume proportionally fewer inodes.
• Inode sizing and monitoring should follow expected file count, average file size, directory distribution, and deletion behavior because deleting an open file may not release it immediately.

LUKS stores encryption metadata for a block device and exposes decrypted sectors through a device-mapper crypt mapping after successful unlock.

• The encrypted container sits below filesystems or LVM consumers, so data written through the mapped device is encrypted before reaching the underlying device.
• The LUKS header stores cipher parameters and keyslots whose passphrases or key files unlock the volume key rather than directly encrypting all data.
• Multiple keyslots allow independent credentials and rotation, but removing every usable slot or losing a damaged header can make the data permanently inaccessible.
• Protect header backups and recovery keys separately from the device, restrict key-file access, document boot-time unlocking, and test recovery without exposing secrets.