🎯 OS Admin L3 Interview Prep

Mumbai · 10+ Years · Complete Reference Guide — 150+ Questions · 12 Topics · 6 OS Types

150+ Questions 12 Topics RHEL · Solaris · AIX · VMware · Linux · ITSM OCA/OCP Certified

🔧

Patching & Package Mgmt

8 questions · RHEL / Solaris / AIX

🚀

Boot Process & GRUB

6 questions · Kernel · initramfs

💾

LVM & Storage

10 questions · Multipath · Filesystem

🔐

Security & Hardening

10 questions · SELinux · PAM · Auditd

⚡

Performance & Troubleshoot

12 questions · iostat · vmstat · iotop

🌐

Networking & DNS

8 questions · Bonding · NFS · DNS

📜

Shell Scripting

6 questions · Bash · Cron · Ansible

🚨

Common Errors & Fixes

10 errors · Production scenarios

☁️

VMware Administration

10 questions · vMotion · Snapshots

🌞

Solaris 10/11 & ZFS

8 questions · Zones · SMF · ZFS

🔵

IBM AIX

6 questions · LVM · NIM · HACMP

📋

ITSM & Process

8 questions · ITIL · Incidents · Change

How to use this guide: Click any topic card above or use the sidebar to navigate. Each section contains expandable Q&A cards with exact commands, step-by-step answers, and interview tips. Questions marked ★ SCENARIO are most commonly asked in L3 interviews.

Key Interview Tips for OS Admin L3

Tip	Why It Matters
Always cite exact command syntax	Separates L3 from L2 engineers
Use the STAR method for scenarios	Structured, credible storytelling
Quantify everything: "200 servers", "40% reduction"	Shows real production scale
Connect every answer to business impact	Relevant in banking context
Never make a production change without a change ticket	Critical compliance point
Mention rollback plan for every change	Shows risk awareness
State "I escalate to IS team first" for security incidents	Mandatory in banking

01 Concept How do you perform Unix/Linux OS patching activity? ▾

Answer

OS patching is a structured, multi-phase activity performed during approved maintenance windows. The approach varies by OS but follows the same discipline.

Phase 1 — Pre-Patching Preparation

Identify applicable patches from vendor advisories, Red Hat Satellite, or internal patch baseline
Download and stage patches in a local repository (avoid patching directly from internet on production)
Raise a Change Request with implementation plan, rollback plan, and risk assessment
Take VM snapshot or system backup before starting
Notify application teams and obtain maintenance window approval from CAB

Phase 2 — RHEL / Oracle Linux

# Check available updates
yum check-update # RHEL 7
dnf check-update # RHEL 8/9
# Apply all updates
yum update -y
# Security patches only
yum update --security -y
# Apply patch for specific CVE
yum update --cve CVE-2024-1234 -y
# Check if reboot required
needs-restarting -r
# View patch history
yum history
yum history info <ID>
yum history rollback <ID> # Rollback if needed

Phase 2 — Solaris

# Solaris 11 — IPS
pkg update # Update all
pkg update pkg://solaris/kernel # Specific package
pkg list -u # List updatable packages
# Solaris 10 — patchadd
patchadd -M /patch_dir 123456-07
showrev -p | grep 123456 # Verify patch applied

Phase 2 — AIX

# AIX — Apply TL/SP via NIM or smitty
smitty update_all # Apply all available updates
oslevel -s # Check current TL/SP level
alt_disk_install -b bosboot -d hdisk1 # Zero-downtime via alt disk

Phase 3 — Post-Patch Validation

Verify kernel version: uname -r
Check all services: systemctl list-units --state=failed
Review logs: dmesg | tail -30, journalctl -p err -n 50
Run application smoke tests with app team sign-off
Delete snapshot after 48-hour stability confirmation
Update change ticket, CMDB, and patch inventory

Phased patching order: Dev → UAT/Staging → DR → Production. Never patch production without lower-env validation. Always have a rollback plan documented in the change ticket.

02 Scenario Server not booting after patching — how do you troubleshoot and recover? ▾

Answer

Step 1 — Access via Console

VM: Access VMware vCenter console (not SSH — network may be unavailable)
Physical server: Access via iLO / DRAC / IPMI remote console

Step 2 — Boot with Previous Kernel (Fastest Fix)

At GRUB menu, press Esc or hold Shift to interrupt automatic boot
Select the previous kernel entry from the list
If boots successfully → the new kernel caused the regression

# After booting with old kernel, remove bad kernel:
rpm -q kernel # List installed kernels
yum remove kernel-<new-version> # Remove bad kernel
grub2-mkconfig -o /boot/grub2/grub.cfg # Regenerate GRUB config
grub2-set-default 0 # Set default kernel

Step 3 — GRUB Broken (Rescue Mode)

# Boot from RHEL rescue ISO → Troubleshooting → Rescue
chroot /mnt/sysimage
# Reinstall GRUB (BIOS system):
grub2-install /dev/sda
grub2-mkconfig -o /boot/grub2/grub.cfg
# Reinstall GRUB (UEFI system):
grub2-install --target=x86_64-efi --efi-directory=/boot/efi
grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Step 4 — Rebuild initramfs

dracut -f /boot/initramfs-$(uname -r).img $(uname -r)
# Or for specific version:
dracut -f /boot/initramfs-4.18.0-305.el8.x86_64.img 4.18.0-305.el8.x86_64

Step 5 — Emergency Shell (fstab UUID issue)

journalctl -xb # See exact mount error
blkid # Get correct UUIDs
vi /etc/fstab # Fix UUID mismatch
mount -a # Test before reboot

Boot with previous kernel via GRUB is the fastest recovery path — know this step by heart. Always take a VM snapshot before patching.

03 Concept How do you manage quarterly patching on 100+ servers with minimal downtime? ▾

Answer

Download patches to local Red Hat Satellite / YUM mirror — servers never hit internet directly
Create a patch schedule coordinated with change management and application owners
Test patches in UAT/Staging first — document any issues or conflicts
Patch in waves: DR first → Staging → Production clusters (rolling, not all at once)
Use Ansible playbooks to execute patching in parallel batches with health check validation between waves
Take VMware snapshots before each wave; remove after 48-hour stability confirmation
Submit post-patching report: patch compliance %, any failures, rollbacks performed

# Ansible patch playbook (simplified logic)
---
- hosts: staging_servers
  tasks:
    - name: Apply security patches
      yum: name=* state=latest security=yes
    - name: Check if reboot needed
      command: needs-restarting -r
      register: reboot_needed
    - name: Reboot if required
      reboot: reboot_timeout=300
      when: reboot_needed.rc == 1

Mention phased approach and Ansible automation — shows you can handle scale efficiently.

04 Critical A critical CVE (CVSS 9.5) is released for OpenSSH. You have 4 hours to patch 20 production servers. What do you do? ▾

Answer

Raise an Emergency Change Request immediately — get CAB or designated approver sign-off
Download the patched OpenSSH package to local repo and verify checksum
Test on one non-production server: update → verify SSH connectivity → check version
Write a remediation script with automatic rollback if SSH connectivity fails post-update
Execute in parallel batches using Ansible or pssh across all 20 servers
Validate SSH on each server after patching; log results in real time
Submit evidence report (before/after rpm -q openssh, CVE scan results) to security team within 24 hours

yum update openssh openssh-server -y
rpm -q openssh # Verify new version
systemctl restart sshd
ssh -o BatchMode=yes server01 'echo ok' # Test connectivity

Always raise an emergency change ticket FIRST — even if it takes 15 minutes. Making production changes without authorization exposes you and the bank to audit risk.

05 Concept How do you perform vulnerability remediation? ▾

Answer

CVSS Score	Priority	Timeline	Change Type
≥ 9.0 Critical	P1	72 hours	Emergency Change
7.0–8.9 High	P2	7–14 days	Normal Change
4.0–6.9 Medium	P3	Next quarterly cycle	Standard Change
< 4.0 Low	P4	Annual review	Deferred

# Check available security updates and CVEs:
yum updateinfo list security
yum update --cve CVE-2024-1234 -y
yum update --advisory RHSA-2024:1234 -y
# Verify remediation:
rpm -q --changelog <package> | grep CVE
openssl s_client -connect server:443 2>&1 | grep Protocol

Submit scan evidence after remediation — the security team runs a rescan and you must show the CVE is closed. Always document in the change ticket.

06 Commands What is the difference between hotfix, patch, and service pack? How do you prioritize them? ▾

Answer

Type	Scope	When Applied	Example
Hotfix	Single critical bug or CVE	Immediately / Emergency window	CVE OpenSSL patch
Patch	Multiple bug fixes, security updates	Scheduled monthly/quarterly	RHEL kernel update
Service Pack	All patches bundled for a version	Major maintenance window	RHEL 8.6 → 8.8 update, AIX TL

Prioritization is based on CVSS score. I never rely solely on vendor classification — I cross-reference with our asset inventory to determine actual exposure and impact.

01Concept Explain the Linux boot process. What is the role of initramfs during boot? ▾

Answer — 6 Stages

Stage	Component	What Happens	Failure Symptom
1	BIOS/UEFI	POST, locates bootloader from MBR/EFI partition	No display, beep codes
2	GRUB2	Loads vmlinuz + initramfs, passes kernel params	GRUB rescue prompt
3	Kernel	Decompresses, hardware init, mounts initramfs	Kernel panic at early boot
4	initramfs	Loads drivers, activates LVM, mounts real root	Emergency shell "cannot find root"
5	systemd	PID 1 — starts services per default target	Services fail, partial boot
6	Login	getty / sshd ready for user login	Login prompt not appearing

Role of initramfs

initramfs = Initial RAM Filesystem — a compressed cpio archive in /boot/
Provides minimal userspace environment BEFORE real root filesystem is accessible
Contains: storage drivers (SCSI, NVMe, FC HBA), LVM tools (to activate VGs), encryption modules (LUKS), udev for device naming
Without initramfs, kernel cannot access root on LVM, SAN, or encrypted disks
After mounting real root → hands control to systemd on disk

# Inspect initramfs contents:
lsinitrd /boot/initramfs-$(uname -r).img
# Rebuild initramfs (RHEL — uses dracut):
dracut -f /boot/initramfs-$(uname -r).img $(uname -r)
dracut -f --regenerate-all # Rebuild for ALL kernels

02Scenario Server boots to emergency shell: "Failed to mount /data". It's a production DB server. How do you recover? ▾

Answer

Emergency shell appears = systemd failed to mount a filesystem in /etc/fstab
Run journalctl -xb to see the exact mount failure reason
Run blkid to list all block devices and their UUIDs

# Common cause — UUID mismatch in /etc/fstab:
blkid /dev/sdb1 # Get actual UUID
vi /etc/fstab # Update UUID to match blkid output
mount -a # Test all mounts
exit # Continue boot
# If SAN device missing — allow boot without /data:
# Add 'nofail' option to /etc/fstab entry temporarily:
/dev/mapper/data  /data  xfs  defaults,nofail  0 0
# Filesystem corruption — run fsck (filesystem unmounted):
fsck -y /dev/sdb1

Know the 'nofail' mount option — it lets the system boot even if a non-critical disk is missing. Critical for banking systems where you need to restore service quickly.

03Commands How do you reinstall GRUB and rebuild initramfs? ▾

Answer

Boot from Rescue ISO → Chroot

# At ISO boot: Troubleshooting → Rescue → Option 1 (Continue)
chroot /mnt/sysimage # Enter the installed system

Reinstall GRUB2

# BIOS system (check: ls /sys/firmware/efi — if dir missing, it's BIOS):
grub2-install /dev/sda
grub2-mkconfig -o /boot/grub2/grub.cfg
# UEFI system:
grub2-install --target=x86_64-efi --efi-directory=/boot/efi
grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Rebuild initramfs

dracut -f /boot/initramfs-$(uname -r).img $(uname -r)
ls -lh /boot/ # Verify files exist
exit && reboot

04Critical Explain the steps to troubleshoot kernel panic errors. ▾

Answer

Step 1 — Capture with kdump

systemctl status kdump # Verify kdump is enabled
ls /var/crash/ # vmcore dump files after crash

Step 2 — Check panic message from previous boot

journalctl -b -1 | grep -i 'kernel panic\|oops\|Call Trace'
grep -i 'kernel panic\|BUG\|oops' /var/log/messages

Step 3 — Analyze vmcore with crash utility

yum install crash kernel-debuginfo-$(uname -r) -y
crash /usr/lib/debug/lib/modules/$(uname -r)/vmlinux /var/crash/*/vmcore
# Inside crash utility:
bt # Backtrace — shows kernel stack at panic
log # Kernel message buffer
ps # Processes at crash time
vm # Virtual memory info

Common Causes & Fixes

Panic Type	Visible In	Fix
NULL pointer dereference	bt output — driver module	Update or blacklist driver
Hardware memory error	mcelog, EDAC dmesg	Replace faulty DIMM
OOM (Out of Memory)	oom-kill in /var/log/messages	Tune vm.overcommit, add RAM
SAN I/O error	HBA errors in dmesg	Fix multipath, check SAN

# Collect full diagnostic bundle for vendor support:
sosreport

01CommandsHow do you extend LV and filesystem size?▾

Answer

# Step 1 — Check VG free space:
vgs # Check VFree column
vgdisplay vg_data # Detailed VG info
# Step 2 — Extend LV + Resize filesystem (one command):
lvextend -L +20G -r /dev/vg_data/lv_app
# -r flag: auto-resizes ext4 OR xfs filesystem after extend
# Manual 2-step method:
lvextend -L +20G /dev/vg_data/lv_app
xfs_growfs /mountpoint # XFS — uses mountpoint
resize2fs /dev/vg_data/lv_app # ext4 — uses device
# If VG has no space — add new disk first:
pvcreate /dev/sdc
vgextend vg_data /dev/sdc
lvextend -l +100%FREE -r /dev/vg_data/lv_app
# VMware VM — expand disk without downtime:
# 1. Expand virtual disk in vCenter (VM Settings → Hard disk)
echo 1 > /sys/class/scsi_disk/0:0:0:0/device/rescan
partprobe /dev/sdb
pvcreate /dev/sdb
vgextend vg_data /dev/sdb
lvextend -l +100%FREE -r /dev/vg_data/lv_app
# Verify:
df -h /mountpoint
lvdisplay /dev/vg_data/lv_app

The -r flag (lvextend -r) is the shortcut that extends LV and resizes filesystem in one step — mention this in the interview.

02CriticalLVM Volumes not showing when we run vgs — what could be the reason and how do you fix it?▾

Answer

VG is inactive — most common reason after disk replacement, SAN path loss, or system migration
PV device is not visible — underlying disk/LUN not accessible to the OS
VG metadata corrupted — LVM metadata on the PV is missing or corrupt
LVM filter in /etc/lvm/lvm.conf excludes the device
Disk not scanned yet — new disk added but LVM hasn't discovered it

# Check PVs including inactive:
pvs -a
pvdisplay
# Check block devices visible to OS:
lsblk
ls /dev/sd*
# Rescan for PVs:
pvscan
# List all VGs including inactive:
vgs -a
vgdisplay --partial
# FIX — Activate VG:
vgchange -ay vg_data # Activate specific VG
vgchange -ay # Activate ALL VGs
# If VG moved from another system:
vgimport vg_data
vgchange -ay vg_data
# Restore from LVM metadata backup:
vgcfgrestore -f /etc/lvm/backup/vg_data vg_data

vgchange -ay is the first command to try whenever LVs are missing. Never use --partial flag in production without understanding the implications — it can activate a VG with missing PVs and potentially cause data corruption.

03CriticalFilesystem shows space free but no new files can be created. Why?▾

Answer — Inode Exhaustion

When df -h shows available space but you get "No space left on device", the cause is inode exhaustion — the inode table is full.

# Diagnose:
df -i # Show INODE usage — look for 100% in IUse%
df -ih # Human-readable
# Find directory consuming most inodes (most files):
find / -xdev -printf '%h\n' | sort | uniq -c | sort -rn | head -20
# Common culprits:
# /var/spool/mail  /tmp  /var/spool/exim/input  app temp dirs
# Fix — delete unnecessary small files:
rm -rf /var/spool/exim/input/*
find /tmp -mtime +7 -delete
# Check inode settings:
tune2fs -l /dev/sda1 | grep -i inode # ext4
xfs_info /mountpoint # XFS

Can filesystem space increase also increase inode count?

Filesystem	Can Extend Add Inodes?	Reason
ext4	NO	Inode count fixed at mkfs time — cannot change after creation
XFS	YES (effectively)	XFS allocates inodes dynamically from free space

# Create ext4 with higher inode density (at mkfs time only):
mkfs.ext4 -i 8192 /dev/sdb1 # 1 inode per 8KB (default is 16KB)
mkfs.ext4 -N 10000000 /dev/sdb1 # Set explicit inode count

This is a classic trick question — df -h looks fine but you cannot create files. Always check df -i when you see "No space left on device".

04CommandsExplain about multipathing (DM-Multipath) on Linux.▾

Answer

DM-Multipath provides multiple I/O paths between a server and SAN storage for redundancy and load balancing. If one path fails, I/O switches to alternate path — transparent to the application.

# Check multipath status:
multipath -ll # Show all devices with path status
multipathd -k # Interactive console
# Sample output interpretation:
mpatha (3600508b...) dm-0 HP,LOGICAL VOLUME
|-+- policy='round-robin 0' prio=1 status=active
| |- 2:0:0:1 sdb 8:16 active ready running   ← active path
| |- 3:0:0:1 sdc 8:32 active ready running   ← active path
`-+- policy='round-robin 0' prio=0 status=enabled
  |- 2:0:1:1 sdd 8:48 active ready running   ← standby path
# Troubleshoot failed/ghost paths:
multipath -ll | grep -i 'fail\|ghost'
dmesg | grep -i 'multipathd\|scsi\|hba'
# Flush and rediscover:
multipath -F && multipath

Policy	Behavior	Use Case
failover	One active path, rest standby	Simple redundancy
round-robin	Distribute I/O across all paths	Load balancing
multibus	All paths in one group, all active	Max throughput

05CriticalHow do you repair a filesystem?▾

Answer

CRITICAL RULE: NEVER run fsck or xfs_repair on a MOUNTED filesystem. Always unmount first or do it from rescue mode for root filesystem.

ext4 — fsck

umount /dev/sdb1 # Unmount first!
fsck -n /dev/sdb1 # Dry run — check only
fsck -y /dev/sdb1 # Auto-repair all errors
e2fsck -fy /dev/sdb1 # Force check + auto-repair

XFS — xfs_repair

umount /dev/sdb1
xfs_repair /dev/sdb1 # Repair XFS
xfs_repair -n /dev/sdb1 # Dry run
# If 'dirty log' error:
xfs_repair -L /dev/sdb1 # Force clear log (LAST RESORT)

Root filesystem (cannot unmount)

# Boot from rescue ISO → chroot → run fsck
chroot /mnt/sysimage
fsck -y /dev/sda2

Check disk health before repair

smartctl -a /dev/sda # Check SMART data for reallocated sectors
dmesg | grep -i 'I/O error\|EXT4-fs error\|XFS'

06Scenario/var filesystem hits 100% at 3 AM causing application failures. How do you recover?▾

Answer

# Immediate — identify top space consumers:
df -h # Confirm /var is full
du -sh /var/* | sort -rh | head -20 # Find biggest directories
du -sh /var/log/* | sort -rh | head -10
# Common culprits in banking environments:
# /var/crash — core dumps (delete if not needed)
rm -rf /var/crash/*
# /var/log — oversized application logs
find /var/log -name "*.log" -size +100M -mtime +3
gzip /var/log/app/app.log.2024*
# Quick space via audit logs (only after security approval):
service auditd stop
truncate -s 0 /var/log/audit/audit.log
service auditd start
# Extend LV if VG has space:
lvextend -L +10G -r /dev/vg_sys/lv_var

After recovery: implement 80% disk alert in monitoring tool
Configure proper logrotate for offending application
Document RCA and submit post-incident report

01ConceptWhat is your approach to server hardening as per bank security policy?▾

Answer

Area	Action	Commands/Files
SSH	Disable root login, key-auth only, SSHv2, idle timeout	/etc/ssh/sshd_config
SELinux	Set to Enforcing mode	setenforce 1, /etc/selinux/config
Firewall	Default deny, allow only required ports	firewall-cmd --add-service
PAM	Password complexity, account lockout, aging	/etc/security/limits.conf
Audit	auditd for privileged commands, file integrity	/etc/audit/rules.d/
Kernel	sysctl hardening, disable IP forwarding, SYN cookies	/etc/sysctl.conf
Packages	Remove unused packages and services	yum remove, systemctl disable
USB	Disable USB storage module	blacklist usb-storage in modprobe

# Key sshd_config settings:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Protocol 2
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers admin1 admin2
# Kernel hardening (/etc/sysctl.conf):
net.ipv4.ip_forward = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_redirects = 0
kernel.dmesg_restrict = 1
# Validate compliance after hardening:
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Mention OpenSCAP/CIS benchmarks and running a compliance scan post-hardening — shows process maturity beyond just making changes.

02ConceptHow can you provide permission to a user to run a command as root?▾

Answer

# ALWAYS use visudo — never edit /etc/sudoers directly
visudo
# Allow user 'john' to run systemctl (with password):
john    ALL=(ALL)    /bin/systemctl
# Allow without password prompt:
john    ALL=(ALL)    NOPASSWD: /bin/systemctl restart httpd
# Allow group 'dba':
%dba    ALL=(ALL)    ALL
# Preferred — drop-in file in /etc/sudoers.d/:
visudo -f /etc/sudoers.d/john
chmod 440 /etc/sudoers.d/john
# Test the rule:
sudo -l -U john # What can john run?
# View sudo audit trail:
grep sudo /var/log/secure
ausearch -m USER_CMD -sv yes

Use specific command paths — never give ALL without strong justification
Avoid NOPASSWD for destructive commands (rm, dd, chmod, shutdown)
All sudo usage is logged in /var/log/secure and auditd automatically
Review sudo rules quarterly as part of access review process

03ConceptExplain PAM (Pluggable Authentication Modules) and how you use it.▾

Answer

PAM is a framework that decouples authentication from applications. Configuration files are in /etc/pam.d/ — one per service (sshd, login, sudo).

# Key PAM modules used in banking:
# Password complexity — /etc/security/pwquality.conf:
minlen = 12
dcredit = -1     # At least 1 digit
ucredit = -1     # At least 1 uppercase
ocredit = -1     # At least 1 special char
lcredit = -1     # At least 1 lowercase
# Account lockout (/etc/pam.d/sshd — pam_faillock):
auth required pam_faillock.so preauth deny=5 unlock_time=900
auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900
# Password history — prevent reuse of last 12:
password sufficient pam_unix.so remember=12
# Unlock a locked account:
faillock --user john --reset
# Check failed attempts:
faillock --user john

Always keep a root session open while testing PAM changes — a misconfiguration can lock ALL users out of the system.

04ConceptExplain about ulimit — what is it and how is it configured?▾

Answer

ulimit controls resource limits for processes — preventing a single user/process from consuming all system resources.

ulimit -a # View all current limits for session
ulimit -n 65536 # Open file descriptors (nofile)
ulimit -u 16384 # Max processes (nproc)
ulimit -c unlimited # Core dump size
# Permanent — /etc/security/limits.conf:
oracle   soft   nofile   65536
oracle   hard   nofile   65536
oracle   soft   nproc    16384
oracle   hard   nproc    16384
oracle   soft   stack    10240
# For systemd services — in unit file [Service] section:
LimitNOFILE=65536
LimitNPROC=16384
# Check limits for a running process:
cat /proc/<PID>/limits

Limit	Flag	Common Value	What It Controls
nofile	-n	65536	Open file descriptors (critical for Oracle, Tomcat)
nproc	-u	16384	Max processes (low value causes fork: retry error)
core	-c	unlimited	Core dump size for debugging
stack	-s	10240	Stack size in KB

05ScenarioA service account is logging into production via SSH password — violating key-auth policy. What do you do?▾

Answer

First — gather evidence: grep the logs, document scope before taking any action
Report to Information Security team IMMEDIATELY — this is a policy violation security incident
After IS team authorization — enforce key-auth only for this account
Coordinate with app team to implement proper key-based auth
Scan all other servers for the same issue

# Gather evidence:
grep <service_account> /var/log/secure | grep 'Accepted password'
last <service_account> # Login history
ausearch -m USER_AUTH -sv yes | grep <account>
# Enforce key-auth only for specific account:
# Add to /etc/ssh/sshd_config:
Match User svc_account
    PasswordAuthentication no
systemctl reload sshd
# Scan all servers for password-auth logins:
for srv in $(cat /etc/server_list.txt); do
  ssh $srv "grep 'Accepted password' /var/log/secure | grep svc_account"
done

Report to IS team FIRST — never take remediation action before authorization in a banking environment. Evidence preservation is as important as the fix.

01ConceptHow do you troubleshoot server slowness issues?▾

Answer — Layered Approach: CPU → Memory → Disk → Network

Step 1 — CPU

uptime # Load avg vs CPU count
top # or htop # Real-time CPU per process
mpstat -P ALL 1 3 # Per-CPU stats
ps -eo pid,ppid,%cpu,%mem,cmd --sort=-%cpu | head -15

Step 2 — Memory

free -h # Available RAM and swap
vmstat 1 5 # si/so = swap in/out (bad if > 0)
grep -i 'oom\|kill' /var/log/messages # OOM kills
ps -eo pid,%mem,cmd --sort=-%mem | head -10

Step 3 — Disk I/O

iostat -xz 1 3 # %iowait >20% = bottleneck, await >20ms = high
iotop -o # Per-process I/O (top for disk)

Step 4 — Network

ss -s # Socket summary
netstat -s | grep -E 'retransmit|error'
sar -n DEV 1 3 # Network throughput
ethtool eth0 # NIC speed/duplex

Step 5 — Recent Changes & Logs

rpm -qa --last | head -20 # Recent package changes
journalctl -p err -n 50
dmesg | tail -30
last reboot

Always check if the slowness correlates with a recent change — patch, config change, or new cron job. 80% of slowness issues have a change-related root cause.

02CriticalHow do you fix Disk I/O bottleneck issues?▾

Answer

# Confirm I/O bottleneck:
iostat -xz 1 5
# Key metrics:
# %iowait > 20%  = CPU waiting for I/O
# await (ms) > 20ms on SSD = high latency
# %util > 80%    = disk near saturation
# Identify process causing high I/O:
iotop -o
pidstat -d 1 5
lsof -p <PID> # Files the process has open
# OS-level tuning:
# Set I/O scheduler:
cat /sys/block/sda/queue/scheduler
echo 'mq-deadline' > /sys/block/sda/queue/scheduler # Good for DB workloads
echo 'none' > /sys/block/nvme0n1/queue/scheduler # NVMe SSDs
# Increase read-ahead for sequential I/O:
blockdev --setra 4096 /dev/sda
# Tune dirty page writeback:
sysctl vm.dirty_ratio=15
sysctl vm.dirty_background_ratio=5

Cause	Symptom	Fix
Runaway log writes	High w/s on app partition	Log rotation, reduce verbosity
Backup running	Sequential read spikes	Reschedule to off-peak hours
Memory too low / swapping	si/so in vmstat > 0	Increase RAM or swap
VMware noisy neighbor	Latency, not throughput	vMotion VM to less-loaded host
SAN path degraded	Intermittent high await	Check multipath -ll, escalate

03ConceptHow do you improve server performance?▾

Answer

# Apply tuned performance profile:
tuned-adm list
tuned-adm profile throughput-performance # Best for servers
tuned-adm profile latency-performance # Low latency workloads
tuned-adm active # Check current profile
# CPU — reduce swapping tendency:
sysctl vm.swappiness=10 # Default 60, lower = less swapping
sysctl vm.vfs_cache_pressure=50 # Retain VFS cache longer
# HugePages for Oracle/Java (reduces TLB misses):
echo 1000 > /proc/sys/vm/nr_hugepages
# Disable services not needed:
systemctl disable bluetooth cups avahi-daemon --now
# Network tuning:
sysctl net.core.rmem_max=16777216
sysctl net.core.wmem_max=16777216
sysctl net.ipv4.tcp_fin_timeout=15
# Filesystem mount performance options:
# Add noatime,nodiratime to /etc/fstab for non-OS partitions

Always measure before and after tuning — use sar to collect baseline data for comparison. Performance changes without measurement data are just guesses.

04ConceptWhat kernel parameters do you tune for an Oracle Database server?▾

Answer

# /etc/sysctl.conf — Oracle Database tuning:
kernel.shmmax = 68719476736     # Max SHM segment (≥ SGA size)
kernel.shmall = 16777216        # Total SHM pages
kernel.sem = 250 32000 100 128  # Semaphores for Oracle processes
fs.file-max = 6815744           # Max open file descriptors
net.core.rmem_max = 4194304     # Network buffer
net.core.wmem_max = 1048576
vm.swappiness = 10              # Minimize swapping for DB
vm.nr_hugepages = 1000          # Pre-allocated HugePages for SGA
kernel.panic_on_oops = 1        # Reboot on kernel oops
# Apply permanently:
sysctl -p
# Oracle pre-install RPM automates most of this:
yum install oracle-database-preinstall-19c

01CriticalA server is unable to resolve domain names. How would you fix it?▾

Answer — Layered DNS Troubleshooting

# Step 1 — Confirm the problem:
nslookup google.com
dig google.com
host google.com
# Step 2 — Check DNS config:
cat /etc/resolv.conf
# Should contain:
nameserver 192.168.1.1
nameserver 8.8.8.8
search company.local
# Step 3 — Test DNS server reachability:
ping 192.168.1.1
dig @192.168.1.1 google.com # Query specific DNS server
nc -zv 192.168.1.1 53 # Test port 53 connectivity
# Step 4 — Check resolution order:
cat /etc/nsswitch.conf | grep hosts
# Should be: hosts: files dns
# Step 5 — Check /etc/hosts for conflicts:
cat /etc/hosts
# Step 6 — Check NetworkManager / systemd-resolved:
systemctl status NetworkManager
resolvectl status
# Fix — Set DNS permanently via nmcli:
nmcli con mod 'eth0' ipv4.dns '192.168.1.1 8.8.8.8'
nmcli con up 'eth0'

02ConceptExplain NIC Bonding/Teaming modes and which mode do you use in banking production?▾

Answer

Mode	Name	Redundancy	Load Balance	Switch Config
Mode 0	Round Robin	No	Yes	Required
Mode 1	Active-Backup	Yes	No	None needed
Mode 2	XOR	Yes	Yes	Required
Mode 4	802.3ad / LACP	Yes	Yes	LACP required
Mode 5	Adaptive TLB	Yes	Tx only	None needed
Mode 6	Adaptive LB	Yes	Yes	None needed

Banking production: Mode 4 (LACP/802.3ad) for app servers needing throughput + redundancy. Mode 1 (Active-Backup) for management interfaces or where switch LACP config is not possible.

# Check bond status:
cat /proc/net/bonding/bond0 # Active interface, mode, link status
ip addr show bond0

03ConceptIs it possible to add multiple IP addresses to one single NIC card?▾

Answer

Yes — called IP aliasing or secondary IPs. A single NIC can have multiple IP addresses, all sharing the same MAC address and physical link.

# Method 1 — Temporary (lost on reboot):
ip addr add 192.168.1.101/24 dev eth0
ip addr add 192.168.1.102/24 dev eth0
ip addr show eth0 # Verify all IPs
# Method 2 — Permanent via NetworkManager:
nmcli con mod 'eth0' +ipv4.addresses 192.168.1.101/24
nmcli con mod 'eth0' +ipv4.addresses 192.168.1.102/24
nmcli con up 'eth0'
# Method 3 — Legacy ifcfg alias (RHEL 6/7):
# Create /etc/sysconfig/network-scripts/ifcfg-eth0:1
DEVICE=eth0:1
IPADDR=192.168.1.101
NETMASK=255.255.255.0
ONBOOT=yes

01ConceptDo you have shell scripting knowledge? What is a for loop?▾

Answer

# Basic for loop syntax:
for variable in list; do
    commands
done
# Example 1 — Check disk on multiple servers:
#!/bin/bash
SERVERS="server01 server02 server03"
for SERVER in $SERVERS; do
    echo "=== $SERVER ==="
    ssh -o ConnectTimeout=5 $SERVER 'df -h | grep -vE "tmpfs|devtmpfs"'
    [ $? -ne 0 ] && echo "WARNING: Cannot reach $SERVER"
done
# Example 2 — C-style counter loop:
for ((i=1; i<=10; i++)); do
    echo "Iteration $i"
done
# Example 3 — Loop over files (compress old logs):
for FILE in /var/log/app/*.log; do
    [ -f "$FILE" ] && gzip "$FILE" && echo "Compressed: $FILE"
done
# Example 4 — Loop from file (server list):
while IFS= read -r SERVER; do
    ssh $SERVER 'uptime'
done < /etc/server_list.txt

02CommandsHow do you use awk, sed, and grep for log analysis?▾

Answer

# grep — pattern matching:
grep -i error /var/log/messages | grep -v kernel
grep -c 'Failed password' /var/log/secure # Count occurrences
grep -A 5 'FATAL' /app/logs/app.log # 5 lines after match
grep -n 'ORA-' /var/log/oracle.log # With line numbers
# awk — field-based parsing:
# Extract source IPs from SSH brute force — sort by frequency:
awk '/Failed password/ {print $11}' /var/log/secure | sort | uniq -c | sort -rn
# Sum a numeric column:
awk '{sum += $5} END {print "Total:", sum}' /var/log/transfer.log
# Print specific time range:
awk '$3 >= "08:00:00" && $3 <= "09:00:00"' /var/log/messages
# sed — in-place text manipulation:
# Extract time window from log:
sed -n '/Oct 1 08:00/,/Oct 1 09:00/p' /var/log/messages
# Replace config value:
sed -i 's/PermitRootLogin yes/PermitRootLogin no/g' /etc/ssh/sshd_config
# Combined — unique Oracle errors with timestamps:
grep 'ORA-' /app/logs/app.log | awk '{print $1, $2, $NF}' | sort -u

03ConceptShell scripting vs Ansible — when do you use each?▾

Answer

Criteria	Shell Script	Ansible
Style	Procedural	Declarative (desired state)
Idempotency	Must code manually	Built-in — safe to run twice
Scale	1–few servers	Hundreds of servers in parallel
Agent	None needed	None (agentless via SSH)
Use case	Monitoring, log mgmt, ad-hoc tasks	Config deployment, patch orchestration
Availability	Always available	Requires Ansible installed

My practice: Shell scripts for monitoring, log management, and single-server tasks. Ansible playbooks for configuration deployment (NTP, SSH hardening, sudoers), rolling patch cycles, and compliance enforcement across the entire server fleet.

01Error"Too many open files" error▾

Cause & Fix

Cause: Process exceeded its 'nofile' ulimit — max open file descriptors limit reached.

lsof -p <PID> | wc -l # Count open files for PID
cat /proc/<PID>/limits # Current limits for the process
ulimit -n # Current session limit
# Fix — /etc/security/limits.conf:
appuser  soft  nofile  65536
appuser  hard  nofile  65536
# For systemd service:
LimitNOFILE=65536 # In [Service] section of unit file
systemctl daemon-reload && systemctl restart <service>

02Error"bash: fork: retry: Resource temporarily unavailable"▾

Cause & Fix

Cause: nproc ulimit reached — max number of processes for the user is exhausted. Often caused by a process creating too many threads or a fork bomb.

ulimit -u # Current nproc limit
ps -u <username> | wc -l # Count user's processes
ps -eo pid,ppid,user,cmd | grep <user> | head -20
# Fix — /etc/security/limits.conf:
username  soft  nproc  16384
username  hard  nproc  16384
# Kill runaway processes consuming slots:
pkill -u <username> <processname>

03Error"No space left on device" — related to inodes▾

Cause & Fix

Cause: Inode table is full — millions of small files (sessions, temp files, mail spools) have exhausted the inode count even though disk space is available.

df -i # Check IUse% — if 100%, inode exhaustion
find / -xdev -printf '%h\n' | sort | uniq -c | sort -rn | head -20
# Fix:
rm -rf /var/spool/exim/input/*
find /tmp -mtime +1 -type f -delete
find /var/log -name "*.log" -mtime +30 -delete

04Error"Cannot allocate memory"▾

Cause & Fix

Cause: System is out of physical RAM and swap, OOM killer is active, or virtual address space is exhausted.

free -h # Available RAM and swap
vmstat 1 3 # Check si/so columns
dmesg | grep -i 'oom\|kill' # OOM killer activity
ps -eo pid,%mem,cmd --sort=-%mem | head -10
# Quick fix — add temporary swap:
dd if=/dev/zero of=/swapfile bs=1G count=4
mkswap /swapfile && chmod 600 /swapfile
swapon /swapfile
# Kill top memory consumer (after app team approval):
kill -9 <PID>

05Error"device is busy" when unmounting filesystem▾

Cause & Fix

Cause: Files or processes are still using the filesystem — open file handles, processes with working directory inside the mount.

fuser -mv /mountpoint # Show all processes using the mount
lsof /mountpoint # Open files on the filesystem
# Fix — close application cleanly, then unmount:
fuser -km /mountpoint # Kill processes (use with care!)
umount /mountpoint
# Lazy unmount — detaches when all handles close:
umount -l /mountpoint

06Error"LVM Volume not found / inactive"▾

Cause & Fix

pvs -a # Check PVs including inactive
lsblk # Check block device availability
pvscan # Rescan for PVs
# Activate VG:
vgchange -ay vg_data
vgchange -ay # All VGs
# If moved from another system:
vgimport vg_data && vgchange -ay vg_data

01ConceptHow do you take a VM snapshot and what are the rules?▾

Answer

# PowerCLI — Create snapshot:
New-Snapshot -VM 'server01' -Name 'Pre-Patch-2025-10-15' -Quiesce -Memory:$false
# Revert (rollback):
Set-VM -VM 'server01' -Snapshot (Get-Snapshot -VM 'server01' -Name 'Pre-Patch-2025-10-15')
# Delete snapshot (after validating stability):
Remove-Snapshot -Snapshot (Get-Snapshot -VM 'server01' -Name 'Pre-Patch') -Confirm:$false
# List all snapshots:
Get-Snapshot -VM 'server01'
# Consolidate snapshots (if needed):
# vCenter: Right-click VM → Snapshots → Consolidate

Maximum snapshot age in production: 48 hours. Stale snapshots grow indefinitely (redirect-on-write) and can fill datastores. Never run production VMs in snapshot state long-term.

Quiesce option: Freezes guest filesystem I/O before snapshot for consistency — requires VMware Tools to be installed and running.

02ConceptWhat if VM snapshot fails?▾

Answer

Cause	Fix
Datastore out of space	Free datastore space, or extend; check Storage → Datastores → Monitor
VMware Tools not installed/old	Install/update open-vm-tools inside guest OS
Snapshot consolidation needed	Right-click VM → Snapshots → Consolidate
Too many existing snapshots	Delete old snapshots first (max recommended: 3-4)
Backup running (disk locked)	Wait for NetBackup/Veeam backup to complete
Guest OS quiesce failure	Check /var/log/vmware-vmsvc.log inside guest

# Check VMware Tools inside guest:
systemctl status vmtoolsd
vmware-toolbox-cmd -v
# Update VMware Tools:
yum update open-vm-tools -y

03ConceptWhat is vMotion? Explain the types.▾

Answer

vMotion is VMware's live migration technology — moves a running VM from one ESXi host/datastore to another with zero downtime (typically < 1 second interruption).

Type	Moves	Requirement
vMotion	CPU + Memory (compute)	Shared storage between hosts
Storage vMotion	VM disk files	VM stays on same host
Enhanced vMotion	Compute + Storage	No shared storage needed

# Requirements:
# - Shared storage (SAN/NFS) accessible by both hosts
# - Dedicated VMkernel port with vMotion enabled (10GbE recommended)
# - Compatible CPU families or EVC mode on cluster
# - vCenter required (cannot do vMotion from ESXi directly)
# PowerCLI — Migrate VM:
Move-VM -VM 'server01' -Destination (Get-VMHost 'esxi02')

Banking use case: use vMotion to evacuate all VMs from an ESXi host before patching it. DRS automates vMotion for load balancing across the cluster.

04ConceptCan you explain about VM templates?▾

Answer

A VM template is a master golden image for deploying new VMs consistently. It is a non-runnable copy of a configured VM.

Item	Template	Snapshot	Clone
Purpose	New VM deployments	Rollback point	Copy for testing
Runnable?	No	Yes (parent VM)	Yes
Uses	Gold image for fleet	Pre-change safety net	Dev/test copies

# Convert VM to template:
# vCenter: Right-click VM → Template → Convert to Template
# PowerCLI — Deploy from template:
New-VM -Name 'newserver01' -Template 'RHEL8-Gold-Template' -VMHost 'esxi01' -Datastore 'DS01'
# Update template (quarterly):
# 1. Convert template back to VM
# 2. Power on → apply patches → harden → power off
# 3. Convert back to template
# 4. Document template version in naming convention

05ConceptExplain about VMware Tools — why is it important?▾

Answer

Function	Why It Matters
Time synchronization	Critical for Kerberos, Oracle RAC, banking timestamps
Quiesced snapshots	Consistent backup — requires VMware Tools
Graceful shutdown/restart	vCenter can cleanly shut down VM (not force power off)
Memory balloon driver	Hypervisor reclaims unused guest memory under pressure
VMXNET3 NIC driver	Paravirtual — much faster than emulated e1000
PVSCSI driver	High I/O performance for Oracle/SQL Server
Guest metrics	vCenter shows OS-level CPU/memory/disk inside guest

# Install (preferred — open-vm-tools, in standard repos):
yum install open-vm-tools -y
systemctl enable vmtoolsd --now
# Verify:
systemctl status vmtoolsd
vmware-toolbox-cmd -v

06ScenarioVMware vCenter shows 90% CPU Ready on a VM. The application team says it's slow. Diagnose and resolve.▾

Answer

CPU Ready means the vCPU is ready to run but the physical CPU is not available — the hypervisor host is overcommitted.

# In esxtop (on ESXi host) — press 'v' for VM view:
# %RDY > 5% = concerning, > 20% = severe
# %CSTP = co-stop for multi-vCPU VMs
# At OS level — CPU Ready shows as steal time:
top # st% column (steal time) in CPU stats
# PowerCLI — check CPU Ready stats:
Get-Stat -Entity $vm -Stat cpu.ready.summation -Start (Get-Date).AddHours(-4)

Check if the ESXi host cluster is overcommitted (too many vCPUs vs physical cores)
Coordinate with VMware team to vMotion the VM to a less-loaded host immediately
Consider reducing vCPU count — fewer vCPUs = less co-scheduling pressure (counterintuitive but effective)
Escalate for capacity addition if entire cluster is consistently overloaded
Document correlation between CPU Ready % and application response time for capacity report

01ConceptWhat are the key administrative tasks you perform on Solaris 10 and 11?▾

Answer

Task	Solaris 10	Solaris 11
Patching	patchadd, patchrm	pkg update
Package install	pkgadd	pkg install
Service management	svcadm, svcs	svcadm, svcs (same)
Zones	zoneadm, zonecfg	zoneadm, zonecfg
Network	ifconfig, ndd	ipadm, dladm
ZFS	zfs, zpool	zfs, zpool (same)
Deployment	JumpStart	AI (Automated Installer)

# SMF — Service Management Facility:
svcs -a # All services status
svcs -xv svc:/network/ssh:default # Detailed service info
svcadm enable svc:/network/ssh:default
svcadm restart svc:/network/ssh:default
svcadm disable svc:/network/ssh:default
# Zones management:
zoneadm list -cv # List all zones with status
zoneadm -z zone01 boot # Boot a zone
zlogin zone01 # Login to zone console
zoneadm -z zone01 halt # Halt a zone
# Network (Solaris 11):
ipadm show-addr # Show IP addresses
dladm show-link # Show network links

02ConceptExplain ZFS on Solaris — key features and how you use them.▾

Answer

Feature	Benefit	Command
Copy-on-Write	Crash consistency, instant recovery	Built-in
Snapshots	Instant, space-efficient backups	zfs snapshot pool/ds@snap
Clones	Writable copy of snapshot	zfs clone pool/ds@snap pool/new
Compression	2-4x storage savings for logs	zfs set compression=lz4
Quotas	Capacity management per dataset	zfs set quota=100G
RAIDZ	Native disk redundancy	zpool create -o ashift=12 raidz2

# ZFS pool and dataset management:
zpool status # Pool health
zpool iostat -v 1 # I/O per disk
zfs list # List all datasets with space
zfs list -t snapshot # List snapshots
# Create and manage snapshots:
zfs snapshot data/app@pre-deploy-2024-10-15
zfs rollback data/app@pre-deploy-2024-10-15 # Instant rollback!
zfs destroy data/app@pre-deploy-2024-10-15 # Remove snapshot
# Set compression and quotas:
zfs set compression=lz4 data/logs
zfs set quota=200G data/app
zfs set reservation=50G data/app
# Scrub (verify data integrity):
zpool scrub data
zpool status data # Check scrub results

ZFS snapshot + rollback is one of the most powerful features for OS admins — instant deployment rollback without backup restore time. Mention real-world use: rolling back a failed application deployment in seconds.

03ScenarioA Solaris zone is consuming excessive CPU/memory, impacting other zones. How do you resolve?▾

Answer

# Identify which zone is consuming resources:
prstat -Z # Zone-level resource summary
zonestat 1 # Per-zone resource statistics
# Identify which process inside the zone:
prstat -z zone01 1
# Apply immediate CPU cap (from global zone):
prctl -n zone.cpu-cap -v 200 -i zone zone01 # Limit to 200% (2 CPUs)
# Permanent — configure resource controls via zonecfg:
zonecfg -z zone01
  set cpu-shares=10
  add capped-cpu
  set ncpus=2
  end
  add capped-memory
  set physical=4g
  set swap=8g
  end
  commit
zoneadm -z zone01 apply # Apply without zone reboot

01ConceptExplain AIX's LVM architecture and how it differs from Linux LVM.▾

Answer

Concept	Linux LVM	AIX LVM
Allocation unit	Physical Extents (PE) — 4MB default, fixed	Physical Partitions (PP) — 4–128MB, configurable per VG
VG types	Standard only	Original (32 PVs), Big (128), Scalable (1024)
Mirroring	Via RAID or dm-mirror	Native — mklvcopy
Metadata	/etc/lvm/	ODM (Object Data Manager)
Filesystem	ext4, XFS	JFS2 (preferred)

# AIX LVM commands:
lsvg # List Volume Groups
lsvg -l rootvg # List LVs in VG
lspv # List Physical Volumes (hdisks)
extendvg rootvg hdisk1 # Add disk to VG
mklv -t jfs2 datavg 100 # Create LV (100 PPs)
chfs -a size=+1G /data # Extend filesystem
# AIX LVM mirroring:
mklvcopy lv_data 2 # Create mirror copy
syncvg datavg # Sync mirror after disk replacement
# Check ODM consistency:
lsvgdb rootvg
# AIX performance monitoring:
topas # AIX equivalent of top
nmon # Comprehensive performance tool
errpt -a | head -50 # Hardware/software error report

02ConceptWhat is NIM (Network Installation Management) and how have you used it?▾

Answer

NIM is AIX's network-based infrastructure management system for OS installation, cloning, and updates across LPAR environments.

# NIM resources:
# LPP_SOURCE — installation media
# SPOT       — Shared Product Object Tree (network boot image)
# MKSYSB     — system backup images for cloning
# Check NIM master status:
lsnim -l # List all NIM objects
lsnim -t lpp_source # List available installation sources
# Update client via NIM:
nim -o update -a lpp_source=lpp_7200_03 -a fixes=all lpar01
# Zero-downtime patching with alt_disk_install:
alt_disk_install -b bosboot -d hdisk1 # Install new AIX on alternate disk
# System runs on original disk while patching alternate disk
# Rollback: simply boot from original disk if new disk fails
# Create system backup (MKSYSB):
mksysb -i /dev/rmt0 # Backup to tape
mksysb /tmp/server01.mksysb # Backup to file

alt_disk_install is AIX's unique zero-downtime upgrade feature — the system continues running on the original disk while the new TL/SP is installed on an alternate disk. Instant rollback by simply booting from the original.

01ConceptHow do you handle a Major Incident (P1) involving multiple teams?▾

Answer

Join the P1 bridge call immediately and declare technical lead for the OS layer
Perform initial triage within first 15 minutes: server health, network, service status, recent changes
Maintain a live incident timeline — document every action with timestamps
Coordinate with App, DBA, Network, and Storage teams — prevent siloed working
Apply 5-Why methodology to drill to root cause while simultaneously restoring service
Update the incident manager every 15–30 minutes with status
After resolution: draft RCA document and present PIR within 48 hours

Priority	Response Time	Resolution Target	Update Frequency
P1 — Critical	15 minutes	4 hours	Every 15–30 min
P2 — High	30 minutes	8 hours	Every 1 hour
P3 — Medium	4 hours	24 hours	Daily
P4 — Low	Next business day	72 hours	On request

02ScenarioA developer asks you to open a firewall port on production urgently with no change ticket. What do you do?▾

Answer

Empathize with the urgency but firmly explain that production changes require a change ticket — this is compliance, not bureaucracy
Guide the developer/manager to raise an Emergency Change Request (ECR) immediately — can be approved in 30–60 minutes
While ticket is being raised, collect technical details: source IP, destination IP, port, protocol, business justification — ready to implement the moment approval arrives
Do NOT make the change without an approved ticket — this exposes the bank to audit risk and potential security breach
Once approved: implement, document in the ticket, update firewall rule inventory, and schedule post-implementation review

This is a test of your process discipline under pressure. The answer is ALWAYS: raise the ECR first, then implement. Your job security and the bank's compliance depend on it.

03ConceptAre you using any monitoring tools? What alerts do you usually get?▾

Answer

Tools Used:

IBM Tivoli Monitoring (ITM) / Netcool — enterprise monitoring in banking
Nagios / Icinga — threshold-based service and resource alerting
Zabbix — agent-based monitoring with dashboards
HP Operations Manager (HPOM) — event correlation
vCenter performance alerts — VMware-specific metrics
Custom shell scripts + cron + mailx — lightweight targeted monitoring

Common Alerts & Actions:

Alert	Threshold	My Action
CPU High	>85% sustained 5min	Identify top process, escalate to app team
Memory High	>90%	Check for leak, add swap temporarily
Disk Warning	>80%	du -sh, clean or extend LV
Disk Critical	>90%	Immediate cleanup, alert app team
Filesystem Full	100%	Emergency cleanup, P1 ticket
Inode Exhaustion	>90% IUse	Find small file consumer, clean up
Service Down	Immediate	systemctl restart, RCA if recurring
Backup Failed	Next morning	Retry, fix root cause, document
SSH Brute Force	>10 fails/min	Check secure log, block source IP

04ConceptHow has your ITIL certification influenced the way you work?▾

Answer

Incident Management: I prioritize tickets by impact × urgency matrix, not by who shouts loudest. SLA adherence is tracked and reported weekly.
Change Management: All production changes go through RFC → CAB → Implementation → PIR. No exceptions — this protects both the bank and me personally.
Problem Management: When I see the same incident recurring, I raise a Problem ticket to find and eliminate the root cause. Example: I noticed 80% of disk-full tickets on a cluster came from unmanaged log growth — implemented systematic log rotation that eliminated the recurring incidents entirely.
Continual Service Improvement (CSI): I track SLA trends monthly and identify improvement opportunities. Automation initiatives I've implemented have reduced manual ticket handling by 40%.
Knowledge Management: Every resolved incident gets documented in the knowledge base with RCA and resolution steps — reduces time-to-resolve for repeat issues.

Connect ITIL principles to real examples — "I applied ITIL problem management when..." shows genuine application, not just passing the exam.

Performance

top / htop # CPU/memory
vmstat 1 5 # System overview
iostat -xz 1 3 # Disk I/O
iotop -o # Per-process I/O
sar -A # Historical stats
mpstat -P ALL 1 # Per-CPU
pidstat -d 1 # Per-process I/O
free -h # Memory
uptime # Load average

Storage / LVM

pvs / pvcreate # Physical volumes
vgs / vgextend # Volume groups
lvs / lvextend -r # Logical volumes
vgchange -ay # Activate VGs
xfs_growfs /mnt # Grow XFS
resize2fs /dev/lv # Grow ext4
df -h / df -i # Space / inodes
multipath -ll # Multipath status
fsck -y / xfs_repair # Repair FS

Security

sestatus / getenforce # SELinux
ausearch -m avc # SELinux denials
audit2why / audit2allow
grep sudo /var/log/secure
faillock --user john # Failed logins
faillock --user j --reset
chage -l username # Password aging
visudo # Edit sudoers
sudo -l -U john # John's sudo rights

Networking

ip addr / ip route # IP configuration
ss -tuln # Listening ports
netstat -s # Network stats
dig / nslookup / host # DNS
tcpdump -i eth0 port 80
firewall-cmd --list-all
nmcli con mod eth0 ...
cat /proc/net/bonding/bond0
ethtool eth0 # NIC status

Boot / Kernel

uname -r # Kernel version
grub2-install /dev/sda
grub2-mkconfig -o ... # Regenerate GRUB
dracut -f $(uname -r) # Rebuild initramfs
journalctl -b -1 # Previous boot log
journalctl -p err -n 50
sysctl -a / sysctl -p
dmesg | tail -50
systemctl status kdump

User Admin

useradd / usermod / userdel
groupadd / gpasswd
passwd / chage # Password mgmt
who / w / last # Logged-in users
id username # User info
cat /proc/<PID>/limits # Process limits
lsof -u username # User's open files
ulimit -a # Session limits

Solaris

svcs -a / svcadm # SMF services
zoneadm list -cv # Zone status
zlogin / zonecfg
zfs list / zpool status
zfs snapshot ds@snap
zfs rollback ds@snap
prstat -Z # Per-zone stats
pkg update # S11 patching
patchadd # S10 patching

AIX

lsvg / lspv / lslv # LVM info
extendvg / mklv # Extend storage
chfs -a size=+1G /data
topas / nmon # Performance
errpt -a # Error report
oslevel -s # TL/SP level
smitty update_all # Apply updates
alt_disk_install # Zero-downtime patch
lsnim -l # NIM objects