Top 30 Easy DevOps & Cloud Interview Questions and Answers for Freshers
30 easy multiple-choice DevOps & Cloud interview questions, the ones an interviewer opens with: definitions, everyday syntax, and the quick checks that you have really used it. They come from 30 bites in the DevOps & Cloud library, the gentlest slice of the 538 DevOps & Cloud interview questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
Infrastructure, containers, CI/CD, and cloud
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
A company provisions virtual servers in the cloud and manages the operating system, middleware, and application code themselves. Which service model is this?
Show the answer
Answer: c · Infrastructure as a Service
This is IaaS: the vendor manages the physical infrastructure and hypervisor, while the customer manages everything from the OS upward. Platform as a Service is a tempting distractor because candidates often mistakenly label managed virtual machines as PaaS, but true PaaS abstracts away the OS and runtime management entirely.
Read the full bite: Explain the difference between IaaS, PaaS, and SaaS with examples
Question 2 of 30
Which task best fits the SRE definition of toil rather than overhead or engineering project work?
Show the answer
Answer: a · Manually rerunning the same failed batch job every night by hand
Manually rerunning the same job nightly is manual, repetitive, automatable, and scales with the service, the hallmarks of toil. Designing a system is engineering; meetings and interviews are overhead.
Question 3 of 30
What is the core architectural difference that makes a container lighter than a virtual machine?
Show the answer
Answer: c · Containers share the host kernel instead of booting a full guest OS
Containers share the host's kernel and isolate via namespaces and cgroups, avoiding a full guest OS; the compression claim is irrelevant since the weight savings come from not running a separate kernel.
Question 4 of 30
A team merges into a shared branch daily with automated builds and tests. What is the single most important goal of this Continuous Integration practice?
Show the answer
Answer: c · Keeping the integrated codebase in a workable state at all times
The defining goal of CI is maintaining a workable integrated codebase, not deployment, which is the realm of CD. While automation and bug detection are part of the practice, they are mechanisms and secondary benefits rather than the core objective.
Read the full bite: What is CI, and what is its single most important goal?
Question 5 of 30
Why should an internal SLO target be set stricter than the externally promised SLA?
Show the answer
Answer: d · To create a safety margin that triggers internal action before the contract is breached
A stricter SLO gives early warning so the team reacts before violating the SLA and owing penalties. The other options misstate measurement windows, visibility, and the SLI relationship.
Question 6 of 30
When moving from IaaS to SaaS, which responsibility shifts to the cloud provider?
Show the answer
Answer: c · Patching the guest operating system
In IaaS the customer manages the guest OS, but in SaaS the provider assumes that duty. Many beginners incorrectly think the provider also secures their data in SaaS, yet data classification and protection always remain the customer's responsibility.
Read the full bite: How does shared responsibility shift between IaaS and SaaS?
Question 7 of 30
When you run a container from an image, how does Docker handle the image layers and runtime file changes?
Show the answer
Answer: a · It keeps the image layers read-only and adds a writable layer on top for runtime changes.
A container mounts the image's read-only layers and adds a writable layer on top, allowing runtime changes without altering the original image. Option B is wrong because containers are isolated processes that share the host kernel, not mini-VMs that boot their own kernels.
Read the full bite: How do Docker images and containers differ and relate?
Question 8 of 30
A developer pushes to main, triggering a CI pipeline with build, test, and deploy stages. Which outcome best matches typical execution?
Show the answer
Answer: b · A runner builds the project; then multiple runners execute test jobs in parallel; deployment proceeds only if every test job succeeds.
The card states that runners (not the Git server) execute jobs, that jobs within a stage run in parallel, and that a stage must succeed completely before the next stage begins. Option C is tempting because it correctly mentions sequencing but wrongly assumes everything runs sequentially on one machine and ignores the requirement that all jobs pass.
Read the full bite: Describe the typical CI pipeline sequence from push to deploy
Question 9 of 30
Which statement best captures the relationship between SRE and DevOps?
Show the answer
Answer: a · SRE is a prescriptive implementation of the broader DevOps philosophy
SRE provides concrete practices, SLOs, error budgets, blameless postmortems, that implement the abstract DevOps principles. They are complementary, not competing, and they operate at different levels of abstraction.
Question 10 of 30
How does migrating from on-premises infrastructure to the cloud typically change a company's cost model?
Show the answer
Answer: d · It shifts spending from upfront CapEx to ongoing, usage-based OpEx
Cloud replaces large upfront asset purchases with pay-as-you-go operational spend that scales with usage. It does not eliminate costs, runs in the opposite direction of OpEx-to-CapEx, and is a different model, not a guaranteed saving.
Question 11 of 30
Which configuration choice most directly controls what network traffic is allowed to reach a newly launched VM?
Show the answer
Answer: c · The security group rules attached to the instance
Security groups act as a virtual firewall defining permitted inbound and outbound traffic. The image, instance type, and storage size define software and capacity, not network access control.
Read the full bite: Launching a virtual machine in the cloud
Question 12 of 30
In docker run -d -p 8080:80 my-app:1.0, what does the 8080:80 specify?
Show the answer
Answer: b · Host port 8080 forwards to container port 80
The -p flag uses host:container ordering, so host 8080 maps to container 80; reversing this is the classic mistake and the other options misread the syntax entirely.
Read the full bite: Build, tag, and run a container with port mapping
Question 13 of 30
How does rebasing a feature branch onto main before a PR typically affect CI behavior compared to merging main into that branch?
Show the answer
Answer: b · Rebase generates new commit SHAs, causing CI to treat rebased commits as new pushes and queue multiple builds.
Rebase replays commits onto the target branch, which creates fresh SHAs that CI systems treat as brand-new pushes, burning compute minutes and orphaning prior build results, whereas merge preserves the original SHAs and triggers a single integration build. Option C is tempting because many beginners believe rebase is inherently cleaner or safer, but it actually requires force-push and breaks the one-to-one link between a commit and its CI result.
Read the full bite: Difference between git merge and git rebase before a pull request
Question 14 of 30
Why does a machine image enable fast, reliable auto-scaling more than manually configuring each new instance?
Show the answer
Answer: a · Images let every launched instance be identical and ready without setup steps
An image is a frozen template, so each instance launches identical and pre-provisioned, which is what makes scaling fast and deterministic. Images do not compress memory, bypass networking, or scale CPU on their own.
Read the full bite: What a machine image is and why it matters
Question 15 of 30
Which scenario is the legitimate reason to choose ADD over COPY in a Dockerfile?
Show the answer
Answer: a · Auto-extracting a local tar archive into the destination
ADD's distinguishing legitimate feature is auto-extracting local tar archives; plain file copies are exactly what COPY is for, and both support ownership flags so that is not a differentiator.
Question 16 of 30
In a distributed web service, which telemetry type is best for pinpointing which downstream service is adding latency to a single slow request?
Show the answer
Answer: d · Distributed traces, because they follow one request's spans across services
Traces follow a single request across services and attribute time to each span, localizing the slow hop. Metrics show aggregate trends and logs give per-event detail, but neither maps one request's cross-service path like a trace.
Read the full bite: Explain the three pillars of observability
Question 17 of 30
Why should a team not rely solely on a pre-push hook to guarantee that all tests pass before merging?
Show the answer
Answer: a · It is local-only, not cloned with the repository, can be skipped with --no-verify, and does not run for web or API commits.
Pre-push hooks reside in .git/hooks and are not copied on clone, can be bypassed with --no-verify, and do not run for web or API commits, so they cannot replace server-side enforcement. Option B is a tempting misconception: --no-verify skips pre-push hooks as well as commit hooks.
Read the full bite: Describe using a pre-push Git hook for checks and its CI limitations.
Question 18 of 30
If a Dockerfile has ENTRYPOINT ["ping"] and CMD ["localhost"], what happens when you run the container with the argument example.com?
Show the answer
Answer: d · It pings example.com, since the arg overrides CMD but appends to ENTRYPOINT
Run-time arguments replace CMD but are appended to ENTRYPOINT, so ping example.com runs; the arg does not replace the ENTRYPOINT executable nor cause a conflict.
Question 19 of 30
Which set correctly lists the Four Golden Signals for monitoring a user-facing system?
Show the answer
Answer: b · Latency, traffic, errors, and saturation
The Four Golden Signals are latency, traffic, errors, and saturation, focused on user experience and capacity. CPU and memory are resource metrics; logs and traces are observability pillars, not the golden signals.
Question 20 of 30
Which storage type is the appropriate backing for a relational database that needs low-latency random reads and writes?
Show the answer
Answer: b · Block storage, because it provides a raw low-latency volume to a single instance
Databases need fast in-place random I/O on a volume attached to one host, which is exactly what block storage provides. Object storage reads and writes whole objects over HTTP and is unsuitable for transactional workloads.
Question 21 of 30
When is a build tool like Maven or Gradle necessary instead of invoking a compiler directly?
Show the answer
Answer: a · When you need an orchestration layer that resolves dependencies, runs tests, and packages deployable artifacts
A compiler only translates source into runnable code, whereas a build tool is an orchestration layer that handles dependency resolution, testing, and artifact packaging. Option D reflects the common misconception that a build tool is merely a wrapper around the compiler, while Option C wrongly reduces it to a package manager.
Read the full bite: How do build tools differ from compilers or interpreters?
Question 22 of 30
How can you serve images from object storage through a CDN while keeping the bucket itself private?
Show the answer
Answer: a · Grant the CDN read access via origin access control and deny all other bucket access
Origin access control lets only the CDN read the bucket while it stays private to everyone else. A public bucket defeats the goal, copying defeats the origin model, and signed URLs are time-limited, not permanent.
Read the full bite: Serving user images securely from object storage
Question 23 of 30
Why is docker compose logs -f web preferred over docker logs web to follow a Compose service's output?
Show the answer
Answer: c · compose logs resolves the service name and aggregates its containers, even when scaled
Compose logs takes the service name from the YAML and aggregates all its containers (including scaled replicas), whereas docker logs needs a specific container name or ID; docker logs does support -f.
Read the full bite: Start Compose services detached and view one service's logs
Question 24 of 30
You mount a named volume at the Postgres data directory, then run docker compose down. Why does the data survive?
Show the answer
Answer: a · Named volumes are managed independently of containers, so removing containers leaves them intact
Named volumes have a lifetime separate from containers, so down (which removes containers) leaves the volume and its data; there is no snapshot, and down does remove containers unless you add -v which would also delete the volume.
Read the full bite: Persist PostgreSQL data across compose down
Question 25 of 30
Why is an SLA typically set looser than the internal SLO for the same service?
Show the answer
Answer: d · To provide internal headroom so an SLO miss does not immediately breach a customer contract
Keeping the SLA below the SLO gives the team a safety buffer, so missing the internal goal does not instantly trigger contractual penalties. The SLI is the raw metric, the SLO the internal target, and the SLA the external promise.
Question 26 of 30
A team's error budget for the quarter is fully consumed. According to error budget policy, what should typically happen next?
Show the answer
Answer: b · Risky feature launches pause and effort shifts toward reliability until the budget recovers
An exhausted budget triggers the policy to slow risky changes and prioritize reliability work until it recovers, giving the budget real teeth. Lowering the SLO to dodge the breach defeats the purpose, and the budget resets each window rather than halting forever.
Question 27 of 30
In a Compose project, why does the web app use db (the service name) rather than localhost to reach the database?
Show the answer
Answer: d · From inside the web container, localhost is the web container itself; db resolves via Docker DNS to the database
Each container's localhost refers to itself, so the web container must use the database's service name, which Docker's embedded DNS resolves to the right container; the localhost-blocking and protocol claims are false.
Read the full bite: How Compose services reach each other by name
Question 28 of 30
For an auth API availability SLI, why should legitimate 401 responses for wrong passwords be excluded from the failure count?
Show the answer
Answer: a · Because they represent the system working correctly, not an outage, so counting them penalizes correct behavior
A 401 for a wrong password is the auth system doing its job, so treating it as downtime would distort the SLI and punish correct behavior. Server-side 5xx and timeouts are the real availability failures to count.
Read the full bite: Proposing availability and latency SLIs for an auth API
Question 29 of 30
What is the key difference between a quality gate and running tests in a CI pipeline?
Show the answer
Answer: b · A quality gate enforces metric thresholds that block merges or deployments when failed.
A quality gate is a policy layer that enforces metric thresholds to block pipeline progression or merges, whereas merely running tests or linting only generates data without enforcing release readiness. The tempting distractor confuses executing checks with the policy decision that acts on their results.
Read the full bite: What is a CI/CD quality gate? Give a simple example.
Question 30 of 30
Why are unit tests placed in the build stage and integration tests in a later CI stage?
Show the answer
Answer: b · Unit tests are fast and isolated, while integration tests require real infrastructure and are slower
Unit tests are fast and isolated with mocks, making them ideal for the build stage, while integration tests verify real wiring and need provisioned infrastructure, so they run later. Distractor B swaps the two definitions, which is a common misconception when candidates only memorize names without understanding the speed and isolation differences.
Read the full bite: Difference between unit and integration tests and CI pipeline placement
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.