I still find that the old "how do I safely and portably delete a file named 'dash-eff-arr' (-fr)?" to be a reasonably good predictor of how well someone will fare for more advanced questions. I routinely recommend it as a screening question.
People who flounder around with suggestions about globbing, quoting and escaping are, in my opinion, potentially dangerous at a root shell on a production system. Those who blithely suggest rm -- -fr are only marginally better. Those who demonstrate a real understanding of how the shell parses a command line ... about the difference between what the shell parsed and what a command (such as rm) received on its argument vector usually have a pretty good understanding of other systems administration material as well.
A much more interesting and involved question:
Given a tape backup, a boot/root or rescue disc of your choice, and
a system with a freshly replace, blank, hard drive ... how would you get
that system back into production? What other information do you need
before you can proceed?
(I will usually provide a specific tar command and a date as the label on the tape's case; and print out with the fdisk -l and df -k output; and I generally will permit them to change the tar to any similar cpio, afio, or even pax command; the details of the archiving utility are not the focus of my question).
This question is not suitable for screening ... the interviewer has to have a solid understanding of the answer and should be able to check off about ten steps in the process. I'm very forgiving of minor sequence issues, especially if the respondent catches them --- for example realizing they he or she would have had to run fdisk before that series of mkfs and mount commands.
I'd say this is, in spirit, the closest to a fizzbuzz scenario.
Another favorite:
You have just been given responsibility for a departmental server running Linux.
The former admin has been "hit by a bus" and no one knows the root password for
this system. How do you proceed?
This one is intended to be a dialog. At the core I want them to demonstrate an understanding of how to boot a system into single user mode and force a password change and how to boot from a rescue disc and accomplish the same task. (So I reveal, by turns, that the system is configured with sulogin and that there's a bootloader (GRUB or LILO) password to prevent an easy init=/bin/sh). That's the purely technical part of the desired answer.
However, I usually also care about the broader considerations that they should raise. Do they ask whether anyone has sudo access sufficient to the task? How do they anticipate arranging for the service disruption? Do they ask about the possibility that the former administrator was hostile or that the system may have been compromised? Do they volunteer some opinions or make suggestions about how passwords should be escrowed by management?
