Interview guide · Technology roles
System administrator interview questions
In short
Good system administrator interview questions test how a candidate keeps servers patched, backed up and secure, troubleshoots an outage under pressure, manages identity and access, and automates repeat work instead of doing it by hand. Below are 33 questions for sysadmins and IT administrators, with what strong answers include, red flags, sample answers and a weighted scorecard.
A system administrator is judged mostly on things that don't happen: the backup that was there when the file server died, the patch that went in before the exploit went public, the account that was disabled the day someone left. The job mixes routine care (patching, user and group management, monitoring, capacity) with sudden, high-stakes troubleshooting when something breaks at 2 a.m. The best sysadmins are methodical, a little paranoid about change, honest about mistakes and allergic to doing the same task by hand twice.
Use these questions for systems administrators, IT administrators at small and mid-sized companies, and infrastructure administrators in larger teams. Choose six to eight across the groups for a 60-minute technical interview, ask the core set of every candidate, and score right after against the scorecard at the bottom. Let candidates talk through their reasoning on the troubleshooting questions; the order of their checks tells you more than any single answer. Adjust the mix to your environment: a mostly Windows and Microsoft 365 shop and a Linux-heavy hosting team need different technical questions, but the judgment questions apply to both.
What to look for in a system administrator
- Change disciplineMost outages follow a change. Sysadmins who test, schedule, document and keep a rollback plan cause far fewer incidents than talented improvisers.
- Backup and recovery mindsetA backup nobody has restored is a hope, not a plan. Strong candidates talk about restore tests, retention and offline or immutable copies without being prompted.
- Structured troubleshootingUnder pressure, good admins narrow scope first, read logs, form a hypothesis and change one thing at a time. Weak ones reboot and hope.
- Security habitsAdmins hold the keys. Least privilege, separate admin accounts, MFA, timely patching and clean offboarding are daily habits, not a separate project.
- Automation instinctSomeone who scripts account creation or patch reporting in PowerShell, Bash or a configuration tool scales; someone who clicks through 50 servers doesn't.
- Clear communication with non-technical peopleAdmins explain maintenance windows, outages and risks to managers and users. Plain, honest updates during an incident build trust in IT.
Opening questions
Describe the environment you look after today: roughly how many servers, users and sites, and what's on-premises versus cloud.
- Why ask it
- Sets the scale and mix so you can calibrate the rest of the interview.
- A strong answer
- Gives concrete numbers, names the operating systems, directory, virtualization platform and cloud services, and explains which parts they own versus share with others.
- Red flags
- Vague about scale or can't say what they personally manage.
What does a normal week look like for you, and how much of it is planned work versus interruptions?
- Why ask it
- Shows how they balance projects with tickets and alerts.
- A strong answer
- Describes patch cycles, monitoring reviews, access requests, projects and on-call, with an honest split. Mentions how they protect time for planned work.
- Red flags
- Only reactive work, with no routine maintenance mentioned.
Which task in your current role have you automated, and what did it replace?
- Why ask it
- Tests the automation instinct with a real example.
- A strong answer
- Names a specific script or tool (onboarding accounts, disk space reports, certificate expiry checks), the language used, the time saved and how they made it safe to run.
- Red flags
- Has never automated anything, or only ran scripts someone else wrote.
Why are you interested in this role, given what you know about our environment?
- Why ask it
- Checks motivation and whether they researched the job.
- A strong answer
- Connects specific parts of the role (a cloud migration, a larger estate, Linux work) to what they want to learn or do more of.
- Red flags
- Generic answer that would fit any IT job.
How do you keep your skills current?
- Why ask it
- Infrastructure changes fast; stale admins become a risk.
- A strong answer
- Home lab, vendor documentation, certifications in progress, communities or newsletters they actually read, recent things they learned and applied.
- Red flags
- Relies only on employer training or names nothing recent.
Technical questions: servers, identity and storage
Walk me through how you patch servers in your current environment, from release to verification.
- Why ask it
- Patching is the core of the job and where many breaches start.
- A strong answer
- Describes a cycle: review release notes and severity, test on a pilot group, schedule maintenance windows, use a tool (WSUS, Intune, a configuration manager, or a Linux package workflow), stagger rollout, verify and report compliance, and handle emergency out-of-band patches.
- Red flags
- Patches everything at once in production, or only when something breaks.
What's your backup strategy for a file server and a database server, and how do you know it works?
- Why ask it
- Tests real recovery thinking, not just tool names.
- A strong answer
- Mentions the 3-2-1 approach or similar, different methods for files and databases (application-consistent backups, transaction logs), retention, offsite or immutable copies, and scheduled restore tests with documented results. Ties choices to recovery time and recovery point objectives.
- Red flags
- Never tested a restore, or relies on RAID or snapshots alone.
Explain how DNS resolution works when a user types an internal hostname, and what you check when it fails.
- Why ask it
- DNS causes a large share of mysterious outages.
- A strong answer
- Explains the client resolver, local cache and hosts file, configured DNS servers, internal zones and forwarders. Uses nslookup or dig, checks the record, TTL and which server answered, and flushes caches where needed.
- Red flags
- Can't explain resolution order or jumps straight to restarting the DNS service.
How are Active Directory or your directory service's groups, organizational units and Group Policy organized where you work, and what would you change?
- Why ask it
- Shows depth on identity management, which most admins own.
- A strong answer
- Describes a logical structure, role-based groups rather than per-user permissions, GPO scoping and naming, and a sensible improvement such as cleaning stale accounts or removing nested admin groups.
- Red flags
- Assigns permissions to individual users everywhere and sees no issue.
A Linux server's disk is 98% full. What do you run and what do you look for?
- Why ask it
- Common, practical and reveals command-line comfort.
- A strong answer
- Uses df to confirm the filesystem, du or ncdu to find large directories, checks logs that aren't rotating, old kernels, core dumps and files deleted but still held open (lsof). Fixes the cause, such as log rotation, not just the symptom.
- Red flags
- Deletes files at random or doesn't know about open deleted files.
How do you manage privileged access for yourself and other admins?
- Why ask it
- Admin credentials are the main target in most intrusions.
- A strong answer
- Separate admin and daily accounts, MFA, least privilege, just-in-time or time-limited elevation where available, a password vault, no shared accounts, logging and periodic access reviews.
- Red flags
- Uses a domain admin account for email and browsing.
What's the difference between a snapshot and a backup in a virtualized environment?
- Why ask it
- A frequent and dangerous misunderstanding.
- A strong answer
- Snapshots are point-in-time states that depend on the original disk, hurt performance if kept long and are meant for short-term rollback. Backups are independent copies stored separately with retention.
- Red flags
- Treats snapshots as backups.
How do you monitor your servers, and what do you alert on versus just record?
- Why ask it
- Tests whether they've tuned monitoring to be useful.
- A strong answer
- Names the tools, monitors availability, CPU, memory, disk, services, certificates and backup jobs, and alerts on conditions that need action. Talks about reducing noise so real alerts get attention.
- Red flags
- Hundreds of alerts nobody reads, or no monitoring beyond users calling.
Describe how you'd move a line-of-business application server to a cloud provider.
- Why ask it
- Many teams are mid-migration; shows planning ability.
- A strong answer
- Inventories dependencies, licensing and data flows, picks lift-and-shift versus rebuild, plans networking, identity and backup in the cloud, tests with users, schedules a cutover with rollback, and decommissions the old server afterwards.
- Red flags
- Treats it as copying a VM without considering dependencies or cost.
Troubleshooting and incident questions
Users report that a web application hosted on one of your servers is slow since this morning. Walk me through your first 15 minutes.
- Why ask it
- Shows structured troubleshooting under realistic pressure.
- A strong answer
- Confirms scope and timing, checks monitoring for resource spikes, reviews recent changes and logs, tests from different locations, looks at the database and network dependencies, communicates an initial update and escalates if needed.
- Red flags
- Restarts the server first without collecting any information.
A server won't boot after a patch night. What do you do?
- Why ask it
- Tests recovery skills and change discipline.
- A strong answer
- Checks console output, boots into recovery or safe mode, rolls back the update or restores from a snapshot or backup, communicates impact, and investigates root cause before re-applying. Notes whether the patch was tested first.
- Red flags
- No rollback plan and no thought about why testing missed it.
An account keeps locking out every few minutes. How do you find the cause?
- Why ask it
- Common identity problem that rewards methodical log work.
- A strong answer
- Finds the lockout source in domain controller security logs or a lockout tool, checks mapped drives, mobile devices, scheduled tasks or services using old credentials, and considers a password-spraying attack if many accounts are affected.
- Red flags
- Just clears the lockout repeatedly.
Tell me about the worst outage you've been part of. What happened, what did you do and what changed afterwards?
- Why ask it
- Reveals ownership, calm and learning.
- A strong answer
- Specific timeline, their own role, how they communicated, the root cause, and concrete fixes afterwards such as monitoring, runbooks or change controls. Talks about blameless review.
- Red flags
- Blames others entirely or can't name what changed.
You suspect a server has been compromised. What are your first steps?
- Why ask it
- Admins are often first on scene for security incidents.
- A strong answer
- Doesn't wipe it straight away. Isolates it from the network, preserves evidence and logs, notifies security or management per the incident plan, checks for related accounts and lateral movement, and rebuilds from known-good sources later.
- Red flags
- Reboots and reimages immediately, destroying evidence.
How do you write up an incident for management?
- Why ask it
- Tests communication to non-technical leaders.
- A strong answer
- A short summary of impact, timeline, cause, fix and prevention steps, in plain language, with honest ownership and follow-up actions with owners and dates.
- Red flags
- Pure jargon, or avoids saying what went wrong.
Behavioral questions
Tell me about a change you made that caused a problem. How did you handle it?
- Why ask it
- Everyone has broken something; honesty matters more than a clean record.
- A strong answer
- Owns the mistake, explains the quick rollback or fix, how they told people, and what they changed in their process to prevent a repeat.
- Red flags
- Claims they've never caused an issue.
Describe a time you pushed back on a request because it was a security or stability risk.
- Why ask it
- Admins must sometimes say no to senior people.
- A strong answer
- Explains the risk in business terms, offered an alternative, escalated properly if needed, and kept the relationship intact.
- Red flags
- Always says yes, or refuses without offering options.
Tell me about a time you documented something that later saved you or a colleague.
- Why ask it
- Documentation separates sustainable admins from heroes.
- A strong answer
- A runbook, network diagram or recovery guide that made a later incident faster to resolve, with detail on how they keep docs current.
- Red flags
- Sees documentation as optional.
Describe a time you had several urgent issues at once. How did you decide what to work on first?
- Why ask it
- Prioritization under pressure.
- A strong answer
- Uses impact and urgency, communicates with those waiting, delegates or escalates where possible, and explains the trade-off they made.
- Red flags
- Works on whatever is loudest.
Tell me about something you learned on your own that you then brought into your team's work.
- Why ask it
- Shows initiative and knowledge sharing.
- A strong answer
- A specific tool or practice learned in a lab or course, piloted safely, then documented or taught to others.
- Red flags
- Nothing self-initiated.
Situational questions
HR tells you at 4 p.m. that an employee is being terminated in 30 minutes. What do you do?
- Why ask it
- Tests offboarding discipline and discretion.
- A strong answer
- Prepares to disable accounts at the agreed moment, revoke sessions and tokens, MFA and VPN, remove from privileged groups, preserve mailbox and files per policy, collect devices, and keep it confidential.
- Red flags
- Disables only the AD account and forgets cloud apps and sessions.
A department head asks for local admin rights on their laptop so they can install software. How do you respond?
- Why ask it
- Balances service with security.
- A strong answer
- Explains the risk, offers an approved software process or temporary managed elevation, and escalates through policy if they insist.
- Red flags
- Grants it to avoid conflict.
You're on call and an alert fires for a non-critical service at 3 a.m. What do you do?
- Why ask it
- Checks judgment about urgency and alert hygiene.
- A strong answer
- Assesses impact, fixes or defers based on the runbook and severity, and the next day tunes the alert or fixes the cause so it doesn't wake anyone again.
- Red flags
- Ignores it, or never improves noisy alerts.
Your manager asks you to cut backup storage costs by 30%. How do you approach it?
- Why ask it
- Cost-versus-risk thinking.
- A strong answer
- Reviews retention against requirements, deduplication and compression, tiering older data to cheaper storage, removing backups of decommissioned systems, and documents the risk of any reduction for sign-off.
- Red flags
- Cuts retention without checking legal or business needs.
Questions for senior or lead system administrators
How would you assess an environment you've just inherited in your first 30 days?
- Why ask it
- Tests prioritization and leadership.
- A strong answer
- Inventory, backups and restore test, patch status, privileged accounts, monitoring, documentation gaps and single points of failure, then a prioritized risk list shared with management.
- Red flags
- Plans to rebuild everything immediately.
How do you decide what to automate, and with what tools?
- Why ask it
- Senior admins should move teams toward repeatable infrastructure.
- A strong answer
- Targets frequent, error-prone and well-understood tasks, chooses scripting or configuration management (Ansible, PowerShell DSC, Terraform for cloud) based on the team's skills, uses version control and code review.
- Red flags
- Automates everything with no review, or nothing at all.
How do you run a change advisory or change review process without slowing the team down?
- Why ask it
- Shows maturity about process.
- A strong answer
- Classifies changes (standard, normal, emergency), pre-approves low-risk standard changes, focuses review on risky ones, and measures change-related incidents.
- Red flags
- Either no change control or heavy approval for every small task.
How would you mentor a help desk technician who wants to move into systems work?
- Why ask it
- Leads build the bench.
- A strong answer
- Gives graded tasks with supervision, lab access, documented procedures to follow and review, and a plan with milestones.
- Red flags
- Sees no role in developing others.
Sample answers
For the file server, we take nightly image-level backups to a local backup repository and copy them to immutable cloud storage, keeping 30 dailies and 12 monthlies. For SQL Server, we do full backups nightly, differentials at noon and transaction log backups every 15 minutes, because finance agreed they could lose at most 15 minutes of data. The part people skip is testing. Every month I restore a random file set and one database to an isolated network, check the app can read it, and log how long it took. That's how we found last year that a database restore would take four hours, not one, and we changed the backup storage tier to fix it before we needed it for real.
First I confirm the exact time with HR so I act when the conversation starts, not before. I'd prepare a checklist: disable the directory account, revoke active sessions and refresh tokens in Microsoft 365, reset MFA methods, remove VPN access, and pull them from any privileged or shared groups. I'd check for service accounts or scheduled tasks running under their name so nothing breaks. Per policy, I'd convert the mailbox to shared or set forwarding to the manager and preserve their files. I'd make sure their laptop and badge are collected, and I'd keep it to myself and HR until it's done. Afterwards I log what was done in the ticket for audit.
I pushed a Group Policy change to tighten TLS settings and didn't realize an old label printer application used TLS 1.0. Shipping couldn't print labels the next morning. Once I saw the timing matched my change, I rolled the GPO back for that OU within 20 minutes and told the shipping lead what happened. Then I worked with the vendor to update the application before re-applying the policy. What changed for me: I now apply security policy changes to a pilot group for a week first, and I check our application inventory for legacy dependencies before changing protocol settings.
Interview scorecard
| Competency | Weight | Strong (4–5) | Weak (1–2) |
|---|---|---|---|
| Core systems knowledge (OS, identity, DNS, virtualization) | 25% | Explains how systems work underneath and names the right tools and logs for the environment. | Relies on memorized fixes, shaky on fundamentals like DNS or permissions. |
| Troubleshooting and incident handling | 20% | Narrows scope, gathers evidence, changes one thing at a time, communicates during incidents and fixes root causes. | Reboots first, guesses, or can't describe what they learned from incidents. |
| Backup, recovery and change discipline | 20% | Tests restores, plans rollbacks, schedules and documents changes. | Untested backups, changes made straight in production without a plan. |
| Security practices | 15% | Least privilege, separate admin accounts, timely patching, clean offboarding, preserves evidence. | Shared or over-privileged accounts, slow patching, careless incident response. |
| Automation and documentation | 10% | Scripts repeat work with version control and keeps runbooks current. | Manual work everywhere, knowledge kept only in their head. |
| Communication and collaboration | 10% | Plain-language updates, pushes back respectfully, shares knowledge. | Jargon-heavy, defensive, or works in isolation. |
Score each competency from 1 to 5 straight after the interview, before discussing the candidate with anyone else, then multiply by the weight.
How to structure a system administrator interview
Three stages work well for most sysadmin roles, finished within about two weeks:
- Recruiter screen (20 minutes). Confirm on-call expectations, onsite days, salary range and the environment the candidate has actually run. One question about their scale and one about backups filter out a surprising number of applicants.
- Technical interview (60 minutes) with a senior admin or the infrastructure lead. Use two troubleshooting scenarios, two technical depth questions matched to your stack, the backup question and one security question. Ask follow-ups such as 'what would you check next?' rather than accepting the first answer.
- Practical and team interview (60 to 90 minutes). A hands-on task in a sandbox (fix a broken service, write a short script to report disk usage across servers, review a misconfigured GPO) followed by behavioral questions with the hiring manager and a peer. A short online skills assessment can replace part of the sandbox for earlier screening.
Decide in advance what 'strong' looks like for each question and score independently before discussing. If you're also hiring for the network side of the team, the network engineer interview questions share some ground, and for infrastructure-as-code and pipeline-heavy roles the DevOps engineer interview questions are a better fit.
Mistakes interviewers make with sysadmin candidates
Trivia instead of reasoning. 'What port does LDAP use?' is easy to look up. 'Users can't authenticate since this morning, what do you check?' shows whether they can think.
Ignoring backups and change control. These are where sysadmins prevent disasters, and they're rarely asked about. Make the backup question mandatory.
Hiring the hero. The candidate who tells stories about fixing everything single-handedly at midnight may also be the one who never documents anything. Ask how others could do their job when they're on vacation.
Over-indexing on certifications. Certifications such as Microsoft, Red Hat or CompTIA show effort and baseline knowledge, but hands-on troubleshooting answers tell you more. Many strong admins came up through the help desk and learned in production.
Being vague about on-call. If the role carries a pager one week in four, say so in the first call and again in the offer stage. Surprise on-call is a common reason sysadmins leave in the first year.
Hiring several administrators at once
Managed service providers, outsourcing firms and large enterprises building an infrastructure team may hire five or ten admins in a quarter. Consistency matters more at that scale. Agree on a core set of six to eight questions from this page, write what a 1, 3 and 5 answer looks like, and have interviewers calibrate on the first few candidates together. A standard sandbox exercise scored against a rubric is fairer and more predictive than each interviewer inventing their own test.
Recruiters can run the first screen against a short checklist (environment size, operating systems, on-call willingness, salary), and asynchronous video or AI-assisted first interviews with two or three set technical questions help when applicant volume is high. Keep all scores in the applicant tracking system against the structured interview scorecard so hiring decisions are documented and comparable across interviewers.
Frequently asked questions
What questions are asked in a system administrator interview?
Expect questions about the environment you manage, patching and backup processes, DNS and directory services, a disk-full or slow-server troubleshooting scenario, privileged access and offboarding, an outage you handled, and how you automate routine work.
What are common sysadmin interview questions for Linux roles?
Disk space troubleshooting with df, du and lsof, service management with systemd, log locations and journalctl, file permissions and sudo, package updates, SSH key management, cron jobs and basic Bash scripting.
How is an IT administrator interview different from a systems administrator interview?
IT administrator roles at smaller companies usually cover more breadth: endpoints, Microsoft 365, printers, network basics and vendors. Systems administrator roles in larger teams go deeper on servers, virtualization, directory services, backup and automation.
What technical test is used for system administrators?
Common formats are a sandbox task to fix a broken service, a short scripting exercise, a troubleshooting walkthrough with an interviewer, or an online skills test for earlier screening. They usually take 30 to 90 minutes.
What should a sysadmin say about backups in an interview?
Describe the method, frequency, retention and where copies are stored, including an offline or immutable copy, and above all how often you test restores and what you learned from those tests.
What soft skills matter for a system administrator?
Clear communication during incidents, saying no to risky requests while offering alternatives, documenting work for others, prioritizing calmly under pressure and owning mistakes.