Sysops interview questions

The sysadmin/sysops interview canon — what actually gets asked, and what the answers reveal. The Senior mindset thesis applied to ops: definitions prove familiarity, debugging walks prove scar tissue.

The anchor: TecMint’s 20 networking questions (captured)

TecMint → “Networking Interview Questions” (22.8 KB, captured; full Q&A in the clipping). The 20, grouped by what they test:

• Model knowledge (screening): OSI vs TCP/IP layers · PAN/LAN/WLAN/MAN/WAN/SAN · IPv4 vs IPv6 · MAC address · crossover cables (legacy-trivia lane)
• Protocol fluency: DNS lookup walkthrough · DHCP DORA sequence · TCP vs UDP · three-way handshake · ARP · SMTP/POP3/IMAP · HTTP vs HTTPS
• Addressing/routing: subnet mask & CIDR (/24 means what) · private ranges + NAT · default gateway & reading a routing table · hub vs switch vs router
• Metrics literacy: bandwidth vs throughput vs latency · measuring reliability (uptime, packet loss, MTBF/SLA)
• The one that matters — Q20, the debugging walk: “A server can’t reach the Internet. Walk me through your troubleshooting.” The model answer is bottom-up: ip link show (is the interface UP) → ip addr show (valid IP? 169.254.x.x = DHCP failed) → ip route show + ping the gateway → ping 8.8.8.8 (connectivity vs DNS isolation) → dig/nslookup → mtr/traceroute for where it dies → ss -tulpn + firewall for service-specific. “Starting from the network interface and moving upward… instead of guessing.”

The pattern (why Q20 is the real interview)

Items 1–19 have dictionary answers — an LLM answers them perfectly, which is exactly why they’re fading as differentiators. Q20 is Senior mindset’s “tell the story behind the item”: the layer-by-bottom-layer elimination is procedure from scars, and each step has a diagnostic fork (APIPA → DHCP; ping-IP-works-but-DNS-fails → resolver). The 2026 interview drift: definitions get cheaper, debugging walks get dearer.

Extending the canon (the other lanes an L3 sysops interview hits)

• Storage/filesystems: LVM vs raw partitions, RAID levels, fsck/remount-ro recovery, NFS vs iSCSI vs FC, the S3 is not a filesystem object-vs-POSIX split
• Processes/perf: load average vs CPU utilization, OOM killer forensics (dmesg), iostat/vmstat/sar triage, the Performance engineering method
• Services: systemd unit internals (the doombox Quadlet lane), SSH hardening, NTP/chrony, log shipping
• Incident shape: postmortem walkthroughs, “tell me about your worst outage” — Decision models’ Rasmussen boundaries in story form
• Security: least-privilege, sudoers hygiene, firewall rule order, the Ops toolbelt OWASP-before-exposing checklist
• The cloud/IaC lane: PXE/kickstart → Ansible → NixOS’ declarative alternative — “how would you rebuild this machine from nothing?”

Interviewing with it (both sides of the table)

• As candidate: rehearse Q20-style walks, not definitions — narrate the fork at each step and why.
• As interviewer: swap one definition for one live diagnostic (“here’s ip addr output with 169.254 — what happened?”) — it separates the read-about from the done.
• COT-relevant: the oncall lane (Ops toolbelt) is the live version of this canon.

Vault kin

• Senior mindset — the scar-tesis this note operationalizes for ops
• Career development — the job-search lane
• Ops toolbelt / Homelabs — where these questions point at real infrastructure
• Git recovery — the same “walk the recovery” genre for git