Process questions:
- "What happens when you run a command?" (fork, exec, wait)
- "How do you find a process using high CPU?" (top, ps aux)
- "What's the difference between kill and kill -9?" (SIGTERM vs SIGKILL)
Memory questions:
- "Explain virtual memory" (address space abstraction, paging)
- "What triggers the OOM killer?" (memory exhaustion, scoring algorithm)
Filesystem questions:
- "Disk is full but no large files. Why?" (deleted files held open, check lsof)
- "Explain /proc" (virtual filesystem, kernel/process info)
General approach: Explain concepts, mention commands, describe your investigation approach.