System Administrator interview questionsTechnical Interview round

Purpose

Makes the page the material and the candidate its new owner, so the hour goes on what they read in it rather than on what they could recite.

Purpose

Reads identity and access as coverage, not as a setting. The separator is whether the candidate follows each password to where it is checked — the policy's exclusions, the address it trusts, the systems that never ask the cloud — and finds the routes that join up.

Signals to score

• Connects the full-tunnel VPN to the trusted address: home workers sign in from 203.0.113.10 and are never asked for a second factor
• Counts the guest Wi-Fi, its password at reception, as another way onto the trusted address
• Says the VPN itself takes a password alone, because it checks the domain over RADIUS, out of the cloud policy's sight
• Joins them up: one phished password opens the VPN, and the VPN then exempts every cloud sign-in that follows
• Reads the 71% as the share of last month's sign-ins that were never asked for a second factor
• Says the 23 unregistered accounts belong to whoever first signs in with the password — the new starters' emailed ones above all
• Puts the CEO's account near the top: exempt, shared with her assistant, nothing registered, and a global administrator
• Notices that the floor exemption follows the accounts rather than the terminals, so a password forty people know works from anywhere
• Treats the finance director's March exemption as temporary in name only, on an account that can open payroll
• Leaves `breakglass01`'s exclusion alone, and ranks the 27 text-message users below every account with no second factor

Follow-up questions

• A colleague is working from home on the VPN. What happens when she signs in to her mail?
• What does the VPN ask for, and what checks the answer?
• Nine new starters already have accounts. Who will register their second factor?
• `breakglass01` is excluded from the policy too. Is that a hole?
• Twenty-seven people get their codes by text message. Where does that sit on your list?

Purpose

Reads privileged access: whether the candidate finds control where it actually sits, and takes it away without creating a lockout. Counting role members finds seven accounts; following credentials also finds `SYNC01`, the provider's agent, the synced exemption group and the laptops IT signs in to.

Signals to score

• Names `admin-it` as the worst single account: shared, synced, exempt from the MFA policy, in both top roles
• Says the CEO's shared password makes her assistant a global administrator in practice
• Says IT's everyday accounts expose Domain Admin twice over: in inboxes that receive phishing, and typed at users' desks on laptops whose users are local administrators
• Treats `SYNC01` as sensitive as a domain controller, because password hash synchronisation needs an account that can read every password hash
• Sees the provider's agent on every server and its shift-shared login as a way into the domain the company neither controls nor audits
• Says a synced administrator can be taken over from the domain — its password reset on-premises, then used from the trusted address — and moves cloud roles to cloud-only accounts
• Notices `MFA-Exempt` is synced, so whoever can edit it in the domain decides who skips the company's MFA policy
• Gives the IT staff separate admin accounts with no mailbox, keeps domain admin rights off users' laptops, and fixes those with Windows LAPS or a workstation-only account
• Moves the CEO and the provider off the top roles, with the provider's technicians named and given access only when needed
• Proves both sealed accounts work before removing anyone, and adds a second cloud one

Follow-up questions

• Which of these accounts reads email?
• `SYNC01` is on no administrator list. Why might it matter more than some accounts that are?
• The provider says their technicians need Domain Admin to support us. What do you offer instead?
• The CEO wants to keep global administrator, just in case. What do you tell her?
• You have removed four global administrators. How do you know we can still get in on Saturday night?

Purpose

Reads identity and access as a change to how two hundred people sign in. The separator is whether each exemption is replaced by something that serves the reason it was granted — shared terminals, an assistant, a traveller — and whether the effect is measured before it is enforced.

Signals to score

• Runs the new policy in report-only mode first and reads the sign-in log for who it would have stopped, and from where
• Has the 23 unregistered people register first, in person or with a one-time pass, so no first prompt is answered by someone else
• Creates new starters' accounts disabled until their start date, with a short-lived first-day pass instead of a password emailed to a manager
• Gives the assistant delegated access to the CEO's mail and calendar, so the CEO gets her own password and her own second factor
• Allows the floor accounts only from the floor terminals and into the floor's apps, or moves the floor to security keys or badges — never phones
• Ends the finance director's exemption with a method that needs no signal — the authenticator app's offline codes or a security key
• Adds a second factor to the VPN itself, through the cloud identity service or a RADIUS-based check
• Stops the office address exempting anyone, and says what that changes for VPN users and the guest Wi-Fi
• Keeps `breakglass01` outside the policy, and rolls back by returning the policy to report-only, not by restoring exemptions
• Defines Wednesday's check: old exemptions now signing in with a second factor, the first floor shift in, the service desk's calls counted

Follow-up questions

• What does a week in report-only mode tell you that the page does not?
• Phones are banned on the floor. How does a floor worker sign in on Wednesday?
• The CEO says her assistant has always used her login and it works. What do you offer instead?
• Six people have only ever signed in from the office. What happens to them on Tuesday?
• It is 06:10 on Wednesday and the first shift cannot sign in. What do you do?

Purpose

Reads device management: whether the candidate knows what each state a device can be in proves — joined, enrolled, compliant — and where a "company laptops only" rule leaks. The separator is the Macs, which pass a check that checks nothing.

Signals to score

• Separates a laptop that is joined or enrolled from one that is compliant, and asks for compliant for payroll
• Finds the nine unencrypted laptops and the three silent for 45 days, and deals with them before switching anything on
• Reads the no-policy setting as making all 20 Macs compliant with nothing on them checked, and assigns a policy before relying on it
• Says enrolment from a web page proves someone enrolled a Mac, not that the company owns it, and ties enrolment to company purchases
• Notices the floor terminals pass a device rule while forty people share them, and keeps shared devices out of payroll
• Removes everyday local administrator rights, because compliant is only the last report and a local administrator can switch off what it checks in between
• Keeps payroll off personal phones, and protects mail and files there with app-level controls and selective wipe rather than enrolment
• Checks whether any contractor can reach payroll today, and gives contractors no route to it
• Turns the rule on for finance in report-only mode first, and checks finance's own laptops before the deadline
• Says what happens to a lost laptop: recovery key held centrally, remote wipe, device disabled in the directory

Follow-up questions

• If the rule were domain-joined laptops only, which machines would get in?
• The Macs all show as compliant. What was checked?
• Everyone is a local administrator of their own laptop. Does that matter for this rule?
• The finance director reads payroll reports on her phone on the train. What happens to her next month?
• A finance laptop is left in a taxi tonight. What happens, and what does it cost us?