Top 30 DevOps & Cloud Interview Questions and Answers

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   A company provisions virtual servers in the cloud and manages the operating system, middleware, and application code themselves. Which service model is this?

   • aSoftware as a Service
   • bOn-premise virtualization
   • cInfrastructure as a Service
   • dPlatform as a Service
   Show the answer

   Answer: c · Infrastructure as a Service

   This is IaaS: the vendor manages the physical infrastructure and hypervisor, while the customer manages everything from the OS upward. Platform as a Service is a tempting distractor because candidates often mistakenly label managed virtual machines as PaaS, but true PaaS abstracts away the OS and runtime management entirely.

   Read the full bite: Explain the difference between IaaS, PaaS, and SaaS with examples

2. Question 2 of 30

   Which task best fits the SRE definition of toil rather than overhead or engineering project work?

   • aManually rerunning the same failed batch job every night by hand
   • bDesigning a new autoscaling system to handle future traffic
   • cAttending the weekly team planning meeting
   • dInterviewing candidates for an open SRE position
   Show the answer

   Answer: a · Manually rerunning the same failed batch job every night by hand

   Manually rerunning the same job nightly is manual, repetitive, automatable, and scales with the service, the hallmarks of toil. Designing a system is engineering; meetings and interviews are overhead.

   Read the full bite: What defines toil, with an example?

3. Question 3 of 30

   What is the core architectural difference that makes a container lighter than a virtual machine?

   • aContainers disable networking by default to save resources
   • bContainers run only interpreted languages, avoiding compilation overhead
   • cContainers share the host kernel instead of booting a full guest OS
   • dContainers compress their disk images while VMs do not
   Show the answer

   Answer: c · Containers share the host kernel instead of booting a full guest OS

   Containers share the host's kernel and isolate via namespaces and cgroups, avoiding a full guest OS; the compression claim is irrelevant since the weight savings come from not running a separate kernel.

   Read the full bite: What is a container vs a VM?

4. Question 4 of 30

   A team merges into a shared branch daily with automated builds and tests. What is the single most important goal of this Continuous Integration practice?

   • aAutomatically deploying every passing build to production
   • bCatching bugs immediately after they are introduced
   • cKeeping the integrated codebase in a workable state at all times
   • dAutomating builds and tests to reduce manual integration work
   Show the answer

   Answer: c · Keeping the integrated codebase in a workable state at all times

   The defining goal of CI is maintaining a workable integrated codebase, not deployment, which is the realm of CD. While automation and bug detection are part of the practice, they are mechanisms and secondary benefits rather than the core objective.

   Read the full bite: What is CI, and what is its single most important goal?

5. Question 5 of 30

   Why should an internal SLO target be set stricter than the externally promised SLA?

   • aBecause customers cannot see SLOs, so they can be arbitrary
   • bBecause SLAs are measured monthly while SLOs are measured yearly
   • cBecause SLIs require the SLO and SLA to be numerically identical
   • dTo create a safety margin that triggers internal action before the contract is breached
   Show the answer

   Answer: d · To create a safety margin that triggers internal action before the contract is breached

   A stricter SLO gives early warning so the team reacts before violating the SLA and owing penalties. The other options misstate measurement windows, visibility, and the SLI relationship.

   Read the full bite: SLI vs SLO vs SLA: how do they relate?

6. Question 6 of 30

   When moving from IaaS to SaaS, which responsibility shifts to the cloud provider?

   • aClassifying and protecting sensitive data
   • bSecuring employee endpoints and devices
   • cPatching the guest operating system
   • dEnforcing multi-factor authentication on user accounts
   Show the answer

   Answer: c · Patching the guest operating system

   In IaaS the customer manages the guest OS, but in SaaS the provider assumes that duty. Many beginners incorrectly think the provider also secures their data in SaaS, yet data classification and protection always remain the customer's responsibility.

   Read the full bite: How does shared responsibility shift between IaaS and SaaS?

7. Question 7 of 30

   When you run a container from an image, how does Docker handle the image layers and runtime file changes?

   • aIt keeps the image layers read-only and adds a writable layer on top for runtime changes.
   • bIt converts the image into a virtual disk that the container boots as an independent mini-VM.
   • cIt copies all image layers into the container so changes do not affect the original image.
   • dIt merges runtime changes back into the image layers so all containers see the updates.
   Show the answer

   Answer: a · It keeps the image layers read-only and adds a writable layer on top for runtime changes.

   A container mounts the image's read-only layers and adds a writable layer on top, allowing runtime changes without altering the original image. Option B is wrong because containers are isolated processes that share the host kernel, not mini-VMs that boot their own kernels.

   Read the full bite: How do Docker images and containers differ and relate?

8. Question 8 of 30

   A developer pushes to main, triggering a CI pipeline with build, test, and deploy stages. Which outcome best matches typical execution?

   • aThe GitLab server compiles and tests the code directly after each push, then deploys automatically without stage gating.
   • bA runner builds the project; then multiple runners execute test jobs in parallel; deployment proceeds only if every test job succeeds.
   • cThe build and test jobs run sequentially on a single runner, and the pipeline advances to deploy as long as the final job finishes.
   • dDeployment begins as soon as the first test job passes, because later stages do not need to wait for every job in the previous stage.
   Show the answer

   Answer: b · A runner builds the project; then multiple runners execute test jobs in parallel; deployment proceeds only if every test job succeeds.

   The card states that runners (not the Git server) execute jobs, that jobs within a stage run in parallel, and that a stage must succeed completely before the next stage begins. Option C is tempting because it correctly mentions sequencing but wrongly assumes everything runs sequentially on one machine and ignores the requirement that all jobs pass.

   Read the full bite: Describe the typical CI pipeline sequence from push to deploy

9. Question 9 of 30

   Which statement best captures the relationship between SRE and DevOps?

   • aSRE is a prescriptive implementation of the broader DevOps philosophy
   • bSRE and DevOps are identical with no meaningful distinction
   • cThey are competing philosophies and an organization must choose one
   • dDevOps is simply the name for an SRE team's CI/CD pipeline
   Show the answer

   Answer: a · SRE is a prescriptive implementation of the broader DevOps philosophy

   SRE provides concrete practices, SLOs, error budgets, blameless postmortems, that implement the abstract DevOps principles. They are complementary, not competing, and they operate at different levels of abstraction.

   Read the full bite: How do SRE and DevOps relate?

10. Question 10 of 30

    How does migrating from on-premises infrastructure to the cloud typically change a company's cost model?

    • aIt guarantees the company spends less money overall
    • bIt converts ongoing OpEx into a one-time CapEx purchase
    • cIt eliminates all costs after the initial setup
    • dIt shifts spending from upfront CapEx to ongoing, usage-based OpEx
    Show the answer

    Answer: d · It shifts spending from upfront CapEx to ongoing, usage-based OpEx

    Cloud replaces large upfront asset purchases with pay-as-you-go operational spend that scales with usage. It does not eliminate costs, runs in the opposite direction of OpEx-to-CapEx, and is a different model, not a guaranteed saving.

    Read the full bite: CapEx vs OpEx in cloud migration

11. Question 11 of 30

    A container needs its own eth0 and routing table while its init process appears as PID 1. Which clone flags are required to create it?

    • aCLONE_NEWPID and CLONE_NEWNS
    • bCLONE_NEWNS and CLONE_NEWCGROUP
    • cCLONE_NEWNET and CLONE_NEWPID
    • dCLONE_NEWUSER and CLONE_NEWIPC
    Show the answer

    Answer: c · CLONE_NEWNET and CLONE_NEWPID

    CLONE_NEWNET creates a new Network namespace for isolated interfaces and routing tables, while CLONE_NEWPID creates a new PID namespace so the container's init becomes PID 1. Option A is tempting because it includes the correct PID flag, but CLONE_NEWNS isolates mount points rather than network devices.

    Read the full bite: Name three Linux namespaces and explain what each one isolates.

12. Question 12 of 30

    A company automatically deploys its internal tools to production but requires manual sign-off for its customer-facing payment service. What does this mixed strategy best demonstrate?

    • aContinuous Delivery is simply Continuous Deployment with unnecessary manual overhead that should eventually be removed.
    • bThe payment service lacks the automated testing maturity required for Continuous Deployment.
    • cThe payment service would use Continuous Deployment if it adopted feature flags for all new changes.
    • dDifferent applications may require different pipeline models based on business risk and compliance needs.
    Show the answer

    Answer: d · Different applications may require different pipeline models based on business risk and compliance needs.

    The card stresses that the choice between Continuous Delivery and Continuous Deployment is driven by business context, regulatory requirements, and blast radius, and that organizations often run a mixed model. Option A reflects the common misconception that Delivery is just an inferior version of Deployment, while the correct answer captures the intentional, risk-based pipeline design described in the card.

    Read the full bite: Continuous Delivery vs Continuous Deployment: key differences and choosing between them

13. Question 13 of 30

    Which approach aligns with the 'build once, deploy many' principle when handling environment-specific database URLs?

    • aEmbed the database URL directly in the application binary during compilation for each target environment
    • bMaintain separate Git branches per environment and build from the branch matching the target deployment
    • cRebuild the image for each environment, passing the database URL as a build argument to the Dockerfile
    • dBuild the container image once, then provide the database URL via environment variables at deployment time
    Show the answer

    Answer: d · Build the container image once, then provide the database URL via environment variables at deployment time

    The correct answer preserves artifact immutability by externalizing configuration and deploying the same binary everywhere. Option C is tempting because build arguments appear to parameterize deployments cleanly, but they force per-environment rebuilds that can introduce unverified dependency changes.

    Read the full bite: What is a build artifact and why build once deploy many crucial?

14. Question 14 of 30

    For a team with limited cloud expertise migrating an existing on-premises monolith, why is IaaS often the better initial choice over PaaS?

    • aIaaS enables a lower-risk lift-and-shift without forcing an immediate app rewrite
    • bIaaS requires no operational management at all
    • cPaaS gives more low-level control over the OS
    • dPaaS cannot run monolithic applications under any circumstances
    Show the answer

    Answer: a · IaaS enables a lower-risk lift-and-shift without forcing an immediate app rewrite

    IaaS lets the monolith move largely unchanged, reducing risk while skills are thin, with modernization to PaaS later. IaaS still has real ops overhead, PaaS offers less low-level control, and PaaS can run monoliths but usually needs refactoring.

    Read the full bite: IaaS vs PaaS for first cloud migration

15. Question 15 of 30

    Which component ultimately enforces CPU and memory limits after the container runtime writes the cgroup configuration at startup?

    • aThe Docker daemon, which monitors cgroup metrics and applies throttling to processes that exceed their limits
    • bThe container runtime, which remains active during execution to pause or kill offending processes
    • cLinux namespaces, which restrict both resource visibility and consumption for the container
    • dThe Linux kernel scheduler and memory manager, using the configured cgroup values
    Show the answer

    Answer: d · The Linux kernel scheduler and memory manager, using the configured cgroup values

    The Linux kernel scheduler and memory manager enforce cgroup limits continuously using values written by the runtime at startup. It is a common misconception that the Docker daemon actively monitors and throttles containers, but the daemon only configures limits while the kernel handles enforcement.

    Read the full bite: How do containers enforce CPU and memory limits via cgroups?

16. Question 16 of 30

    When defining the first SLIs for a user-facing service, what should they primarily measure?

    • aWhatever metric is easiest to collect from the host
    • bAspects of the service as experienced by users, such as request success and latency
    • cThe number of deploys the team ships each week
    • dInternal server resource use like CPU and memory utilization
    Show the answer

    Answer: b · Aspects of the service as experienced by users, such as request success and latency

    Good SLIs reflect user-visible behavior, since the goal is to measure user happiness. CPU and deploy counts are internal signals that can look fine while users suffer.

    Read the full bite: How do you set SLOs for a service from scratch?

17. Question 17 of 30

    Once runc has started the container process, which statement accurately describes its subsequent behavior?

    • aIt continues running as a child process of containerd to enforce the OCI runtime spec.
    • bIt exits and becomes stateless, leaving containerd to handle stop, delete, and event monitoring.
    • cIt remains resident as a daemon to monitor the container's cgroups and namespaces.
    • dIt converts into the per-container shim that forwards stdio and exit codes to containerd.
    Show the answer

    Answer: b · It exits and becomes stateless, leaving containerd to handle stop, delete, and event monitoring.

    runc is a short-lived CLI tool that exits after starting the isolated process, while containerd retains lifecycle ownership. The belief that runc stays resident as a daemon is a common misconception; it is stateless and does not monitor cgroups or namespaces after launch.

    Read the full bite: Describe the relationship between containerd and runc in starting a container.

18. Question 18 of 30

    An error budget is fully spent early in the quarter. What is the most appropriate first response?

    • aIdentify which individuals caused incidents and hold them accountable
    • bPermanently ban all releases for the rest of the year
    • cIgnore it, since revenue features should always take priority
    • dInvoke the pre-agreed error budget policy and analyze what consumed the budget
    Show the answer

    Answer: d · Invoke the pre-agreed error budget policy and analyze what consumed the budget

    The budget is a pre-agreed signal that triggers a policy and a data-driven analysis of the burn. Blaming individuals, a permanent ban, or ignoring it all defeat the budget's purpose as an objective tradeoff tool.

    Read the full bite: Error budget exhausted early: what now?

19. Question 19 of 30

    Which scenario best describes a genuine shift-left practice rather than a common misconception?

    • aHiring additional QA staff to write more regression tests executed the day before release
    • bIntegrating static analysis into pull request builds so vulnerabilities are caught before merge
    • cRunning the existing end-to-end suite on faster hardware to cut execution time from hours to minutes
    • dRequiring developers to manually perform user acceptance testing before they commit code
    Show the answer

    Answer: b · Integrating static analysis into pull request builds so vulnerabilities are caught before merge

    Integrating static analysis into pull request builds moves security feedback to the coding phase, which is the essence of shift left. Hiring more QA staff to test before release only increases test volume at the same late stage, confusing more testing with earlier feedback.

    Read the full bite: What does shift left mean in CI/CD, and give two concrete examples?

20. Question 20 of 30

    Which scenario specifically demonstrates elasticity rather than just scalability?

    • aA bigger virtual machine is provisioned to handle more load
    • bAn auto-scaling group automatically adds instances during a traffic spike and removes them when it subsides
    • cThe application is rewritten to support a larger database
    • dAn engineer manually adds servers before an expected busy season
    Show the answer

    Answer: b · An auto-scaling group automatically adds instances during a traffic spike and removes them when it subsides

    Elasticity is the automatic, two-way matching of capacity to demand, including scaling back down. Manual additions, code rewrites, and one-time vertical upgrades show scalability but not the automatic contraction that defines elasticity.

    Read the full bite: Scalability vs elasticity in the cloud

21. Question 21 of 30

    What is the best way to prioritize which toil to automate first?

    • aAutomate whichever task the on-call engineer finds most irritating
    • bAutomate the task that is technically easiest regardless of its impact
    • cRank by return on investment, weighing frequency and time saved against automation effort and risk
    • dCount how many scripts the team can write in a sprint
    Show the answer

    Answer: c · Rank by return on investment, weighing frequency and time saved against automation effort and risk

    Prioritizing by ROI, frequency times time saved versus effort and risk, maximizes recovered engineering time. Irritation, ease alone, or script count are poor proxies for actual impact.

    Read the full bite: How do you find and eliminate toil systematically?

22. Question 22 of 30

    What key characteristic separates Infrastructure as Code from traditional imperative server scripting?

    • aIaC executes configuration steps sequentially each time a deployment runs
    • bIaC files are written in JSON or YAML rather than Bash or PowerShell
    • cIaC requires manual approval through ticketing systems before any changes apply
    • dIaC defines the desired end state and achieves idempotence through automated reconciliation
    Show the answer

    Answer: d · IaC defines the desired end state and achieves idempotence through automated reconciliation

    True IaC is defined by its declarative, idempotent model that lets the platform reconcile to a desired state, not by the file format used. While IaC definitions are often written in JSON or YAML, simply using those formats without declarative idempotence is still just scripting.

    Read the full bite: What is Infrastructure as Code (IaC), and how does it support CI/CD?

23. Question 23 of 30

    In a hybrid cloud setup for a regulated business, which split of components is most appropriate?

    • aPut regulated customer data in the public cloud and keep the website on-premises
    • bKeep regulated data and legacy systems on-premises while running scalable customer-facing front ends in the public cloud
    • cMove everything to the public cloud and keep only backups on-premises
    • dRun all compute on-premises and use the public cloud only for storing sensitive records
    Show the answer

    Answer: b · Keep regulated data and legacy systems on-premises while running scalable customer-facing front ends in the public cloud

    Hybrid keeps sensitive, regulated, and hard-to-migrate systems in the controlled private environment while putting elastic, customer-facing workloads in the public cloud. The other options place regulated data in the cloud or misallocate the elastic and sensitive components.

    Read the full bite: When hybrid cloud beats public or private

24. Question 24 of 30

    Which statement correctly describes the relationship between OCI image layers and OverlayFS in container runtime?

    • aOCI stores images as monolithic blobs that OverlayFS splits into lowerdir and upperdir at runtime
    • bOCI specifies layer tarballs and manifests, while OverlayFS is the in-kernel driver that assembles them at runtime
    • cOverlayFS defines the image format and compression standard used by container registries
    • dOCI layers are unpacked and merged by OverlayFS in userland before the container starts
    Show the answer

    Answer: b · OCI specifies layer tarballs and manifests, while OverlayFS is the in-kernel driver that assembles them at runtime

    OCI governs the packaging and distribution of images as tarballs and manifests, while OverlayFS is solely a Linux kernel filesystem driver that mounts those layers at runtime. Distractor B is a common misconception that conflates the runtime driver with the image specification itself.

    Read the full bite: Explain layered filesystems like OverlayFS and their efficiency vs monolithic models

25. Question 25 of 30

    A platform team notices their pipeline is consistently green, but lead time for changes has grown from hours to days. Which diagnostic approach best aligns with value stream thinking?

    • aAudit production telemetry for elevated error rates that might be slowing releases
    • bInvestigate test flakiness causing repeated pipeline executions and hidden delays
    • cAdd more pre-merge quality gates to catch issues earlier and reduce rework
    • dDecompose lead time into queue, active pipeline, and post-pipeline release intervals
    Show the answer

    Answer: d · Decompose lead time into queue, active pipeline, and post-pipeline release intervals

    Decomposing lead time reveals whether waste hides in pre-merge queues, slow green stages, or post-merge deployment friction. Investigating test flakiness is tempting but misguided because a green pipeline rules out build failures as the cause.

    Read the full bite: Pipeline is green but lead time grows. Three areas to investigate?

26. Question 26 of 30

    Why does an image built with Docker run correctly on a Kubernetes node that uses containerd and runc instead of the Docker daemon?

    • aAll tools embed a copy of the Docker daemon internally
    • bThe image is converted to a VM disk image before running
    • cThey all conform to OCI image and runtime specifications
    • dKubernetes silently re-builds the image with its own format on pull
    Show the answer

    Answer: c · They all conform to OCI image and runtime specifications

    Interoperability comes from shared OCI image and runtime specs, so any compliant tool can consume the same artifact; there is no rebuild or embedded Docker daemon involved.

    Read the full bite: What is the OCI and why do its specs matter?

27. Question 27 of 30

    What is the most realistic downside a team accepts when prioritizing strict portability across two cloud providers?

    • aThey forgo the deepest managed services and slow feature velocity
    • bHigher single-provider discounts disappear, but features ship faster
    • cKubernetes can no longer be used as the runtime layer
    • dNetwork latency between regions becomes the dominant cost
    Show the answer

    Answer: a · They forgo the deepest managed services and slow feature velocity

    Portability forces a lowest-common-denominator design, sacrificing best-of-breed managed services and adding overhead that slows delivery. Faster shipping is the opposite of what multi-cloud abstraction produces.

    Read the full bite: Designing for portability across two clouds

28. Question 28 of 30

    Why is blamelessness essential to a postmortem's effectiveness at improving reliability?

    • aIt lets the team avoid documenting any action items
    • bIt speeds up writing the report by skipping the root-cause section
    • cIt creates psychological safety so engineers disclose full, honest details needed to fix systemic causes
    • dIt guarantees the same incident can never technically recur
    Show the answer

    Answer: c · It creates psychological safety so engineers disclose full, honest details needed to fix systemic causes

    Blamelessness removes fear of punishment so people share complete information, and you can only fix what you fully understand. It does not skip root cause or action items, nor magically prevent recurrence by itself.

    Read the full bite: What makes a blameless postmortem effective?

29. Question 29 of 30

    Which scenario best illustrates a fundamental CI/CD difference between monoliths and microservices regarding blast radius and artifact indivisibility?

    • aA microservice team deploys a signed container side-by-side with the previous version, while a monolith rollback requires reverting the entire application
    • bA monolith pipeline rebuilds only the changed module while microservices require full system rebuilds for consistency
    • cA monolith uses per-service quality gates, while microservices rely on a single shared pipeline to reduce coordination overhead
    • dBoth architectures use federated short-lived credentials to prevent secret leakage across deployment stages
    Show the answer

    Answer: a · A microservice team deploys a signed container side-by-side with the previous version, while a monolith rollback requires reverting the entire application

    This captures the core idea that monoliths produce a single indivisible artifact requiring full rollback, while microservices support independent side-by-side deployments with signed images. Option C reverses these architectures and promotes the shared-pipeline anti-pattern the card explicitly warns destroys team autonomy.

    Read the full bite: How does your CI/CD strategy differ between monoliths and microservices?

30. Question 30 of 30

    When bursting compute into the public cloud from on-prem, which factor most often becomes the real bottleneck?

    • aThe version of the hypervisor running on-prem
    • bThe number of available cloud instance types
    • cThe cloud provider's per-account VM quota
    • dData gravity and the latency or cost of reaching on-prem data
    Show the answer

    Answer: d · Data gravity and the latency or cost of reaching on-prem data

    Compute scales quickly, but the data the workload needs usually lives on-prem, so latency and egress dominate. Instance variety and quotas are minor and easily addressed by comparison.

    Read the full bite: Hybrid cloud bursting from a VMware footprint