Top 30 Intermediate DevOps & Cloud Interview Questions and Answers
30 intermediate multiple-choice DevOps & Cloud interview questions, past the definitions: how the pieces fit together, what breaks in practice, and the trade-off behind a choice. They come from 30 bites in the DevOps & Cloud library, the middle slice of the 538 DevOps & Cloud interview questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
Infrastructure, containers, CI/CD, and cloud
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
A container needs its own eth0 and routing table while its init process appears as PID 1. Which clone flags are required to create it?
Show the answer
Answer: c · CLONE_NEWNET and CLONE_NEWPID
CLONE_NEWNET creates a new Network namespace for isolated interfaces and routing tables, while CLONE_NEWPID creates a new PID namespace so the container's init becomes PID 1. Option A is tempting because it includes the correct PID flag, but CLONE_NEWNS isolates mount points rather than network devices.
Read the full bite: Name three Linux namespaces and explain what each one isolates.
Question 2 of 30
A company automatically deploys its internal tools to production but requires manual sign-off for its customer-facing payment service. What does this mixed strategy best demonstrate?
Show the answer
Answer: d · Different applications may require different pipeline models based on business risk and compliance needs.
The card stresses that the choice between Continuous Delivery and Continuous Deployment is driven by business context, regulatory requirements, and blast radius, and that organizations often run a mixed model. Option A reflects the common misconception that Delivery is just an inferior version of Deployment, while the correct answer captures the intentional, risk-based pipeline design described in the card.
Question 3 of 30
Which approach aligns with the 'build once, deploy many' principle when handling environment-specific database URLs?
Show the answer
Answer: d · Build the container image once, then provide the database URL via environment variables at deployment time
The correct answer preserves artifact immutability by externalizing configuration and deploying the same binary everywhere. Option C is tempting because build arguments appear to parameterize deployments cleanly, but they force per-environment rebuilds that can introduce unverified dependency changes.
Read the full bite: What is a build artifact and why build once deploy many crucial?
Question 4 of 30
For a team with limited cloud expertise migrating an existing on-premises monolith, why is IaaS often the better initial choice over PaaS?
Show the answer
Answer: a · IaaS enables a lower-risk lift-and-shift without forcing an immediate app rewrite
IaaS lets the monolith move largely unchanged, reducing risk while skills are thin, with modernization to PaaS later. IaaS still has real ops overhead, PaaS offers less low-level control, and PaaS can run monoliths but usually needs refactoring.
Question 5 of 30
Which component ultimately enforces CPU and memory limits after the container runtime writes the cgroup configuration at startup?
Show the answer
Answer: d · The Linux kernel scheduler and memory manager, using the configured cgroup values
The Linux kernel scheduler and memory manager enforce cgroup limits continuously using values written by the runtime at startup. It is a common misconception that the Docker daemon actively monitors and throttles containers, but the daemon only configures limits while the kernel handles enforcement.
Read the full bite: How do containers enforce CPU and memory limits via cgroups?
Question 6 of 30
When defining the first SLIs for a user-facing service, what should they primarily measure?
Show the answer
Answer: b · Aspects of the service as experienced by users, such as request success and latency
Good SLIs reflect user-visible behavior, since the goal is to measure user happiness. CPU and deploy counts are internal signals that can look fine while users suffer.
Read the full bite: How do you set SLOs for a service from scratch?
Question 7 of 30
Once runc has started the container process, which statement accurately describes its subsequent behavior?
Show the answer
Answer: b · It exits and becomes stateless, leaving containerd to handle stop, delete, and event monitoring.
runc is a short-lived CLI tool that exits after starting the isolated process, while containerd retains lifecycle ownership. The belief that runc stays resident as a daemon is a common misconception; it is stateless and does not monitor cgroups or namespaces after launch.
Read the full bite: Describe the relationship between containerd and runc in starting a container.
Question 8 of 30
An error budget is fully spent early in the quarter. What is the most appropriate first response?
Show the answer
Answer: d · Invoke the pre-agreed error budget policy and analyze what consumed the budget
The budget is a pre-agreed signal that triggers a policy and a data-driven analysis of the burn. Blaming individuals, a permanent ban, or ignoring it all defeat the budget's purpose as an objective tradeoff tool.
Question 9 of 30
Which scenario best describes a genuine shift-left practice rather than a common misconception?
Show the answer
Answer: b · Integrating static analysis into pull request builds so vulnerabilities are caught before merge
Integrating static analysis into pull request builds moves security feedback to the coding phase, which is the essence of shift left. Hiring more QA staff to test before release only increases test volume at the same late stage, confusing more testing with earlier feedback.
Read the full bite: What does shift left mean in CI/CD, and give two concrete examples?
Question 10 of 30
Which scenario specifically demonstrates elasticity rather than just scalability?
Show the answer
Answer: b · An auto-scaling group automatically adds instances during a traffic spike and removes them when it subsides
Elasticity is the automatic, two-way matching of capacity to demand, including scaling back down. Manual additions, code rewrites, and one-time vertical upgrades show scalability but not the automatic contraction that defines elasticity.
Question 11 of 30
What is the best way to prioritize which toil to automate first?
Show the answer
Answer: c · Rank by return on investment, weighing frequency and time saved against automation effort and risk
Prioritizing by ROI, frequency times time saved versus effort and risk, maximizes recovered engineering time. Irritation, ease alone, or script count are poor proxies for actual impact.
Read the full bite: How do you find and eliminate toil systematically?
Question 12 of 30
What key characteristic separates Infrastructure as Code from traditional imperative server scripting?
Show the answer
Answer: d · IaC defines the desired end state and achieves idempotence through automated reconciliation
True IaC is defined by its declarative, idempotent model that lets the platform reconcile to a desired state, not by the file format used. While IaC definitions are often written in JSON or YAML, simply using those formats without declarative idempotence is still just scripting.
Read the full bite: What is Infrastructure as Code (IaC), and how does it support CI/CD?
Question 13 of 30
In a hybrid cloud setup for a regulated business, which split of components is most appropriate?
Show the answer
Answer: b · Keep regulated data and legacy systems on-premises while running scalable customer-facing front ends in the public cloud
Hybrid keeps sensitive, regulated, and hard-to-migrate systems in the controlled private environment while putting elastic, customer-facing workloads in the public cloud. The other options place regulated data in the cloud or misallocate the elastic and sensitive components.
Read the full bite: When hybrid cloud beats public or private
Question 14 of 30
Which statement correctly describes the relationship between OCI image layers and OverlayFS in container runtime?
Show the answer
Answer: b · OCI specifies layer tarballs and manifests, while OverlayFS is the in-kernel driver that assembles them at runtime
OCI governs the packaging and distribution of images as tarballs and manifests, while OverlayFS is solely a Linux kernel filesystem driver that mounts those layers at runtime. Distractor B is a common misconception that conflates the runtime driver with the image specification itself.
Question 15 of 30
Why is blamelessness essential to a postmortem's effectiveness at improving reliability?
Show the answer
Answer: c · It creates psychological safety so engineers disclose full, honest details needed to fix systemic causes
Blamelessness removes fear of punishment so people share complete information, and you can only fix what you fully understand. It does not skip root cause or action items, nor magically prevent recurrence by itself.
Read the full bite: What makes a blameless postmortem effective?
Question 16 of 30
Before adding an auto-scaling group, what change to the single-VM web app is most essential for scaling to work correctly?
Show the answer
Answer: c · Making the application stateless so any instance can serve any request
Horizontal scaling assumes interchangeable instances, so session state must be externalized. A bigger instance is vertical scaling, and the database engine or disk encryption do not enable horizontal elasticity.
Question 17 of 30
A nightly batch job is fully interruptible and checkpoints its progress. Which pricing model fits best and why?
Show the answer
Answer: b · Spot, because the job tolerates interruption and benefits from the deepest discount
Spot offers the largest discount precisely for interruptible, fault-tolerant work like a checkpointed batch job. Reserved suits steady always-on baselines, and On-Demand needlessly pays full price for tolerant work.
Question 18 of 30
Why does copying all source before npm install slow down rebuilds after a code change?
Show the answer
Answer: a · The COPY of changed source invalidates the install layer and everything after it
Cache invalidation cascades from the first changed instruction, so copying edited source before install busts the install layer; npm install does respect the cache when its inputs are unchanged.
Read the full bite: Optimize Dockerfile layer caching for npm install
Question 19 of 30
In scaled Trunk-Based Development, what is the intended purpose of short-lived branches?
Show the answer
Answer: d · To perform code review and validation before merging to trunk within hours
Scaled Trunk-Based Development uses short-lived branches solely for review and CI validation before same-day integration to trunk, not for artifact publication or long-term isolation. Keeping branches for multiple days violates the core principle of integrating at least every 24 hours and reintroduces merge risk.
Read the full bite: Describe Trunk-Based Development principles and CI/CD benefits
Question 20 of 30
How does Trunk-Based Development allow a team to continuously deploy an unfinished multi-week feature without exposing it to end users?
Show the answer
Answer: d · Wrap the new code paths in a feature flag that defaults to off in production, allowing the same binary to deploy continuously while keeping the feature hidden.
Feature flags that default to off let teams integrate to main daily and deploy continuously while hiding incomplete behavior from users. The long-lived branch approach in option B contradicts Trunk-Based Development and reintroduces painful merge conflicts.
Read the full bite: How do feature flags enable unfinished work in Trunk-Based Development?
Question 21 of 30
When is alerting on p99 latency rather than p95 most justified?
Show the answer
Answer: c · When requests fan out to many backends so the slow tail dominates user-perceived latency
High fan-out makes a backend's tail the common case for users, so p99 matters most there. p99 is not universally better, the median describes typical experience, and a healthy average can still hide a bad tail.
Read the full bite: Why use latency percentiles over the average?
Question 22 of 30
Why is storing user uploads on an auto-scaled instance's local disk a poor design choice?
Show the answer
Answer: d · The data is lost when the instance is terminated or replaced during scaling
Auto-scaled instances are ephemeral, so any durable data on local disk vanishes on replacement. Local disks can store binaries and are often fast; the fatal issue is impermanence, not speed or file type.
Read the full bite: Managing state across ephemeral instances
Question 23 of 30
What is the primary benefit of copying only the compiled binary into a minimal final stage of a multi-stage build?
Show the answer
Answer: d · It produces a smaller image with no toolchain or source, reducing attack surface
Discarding the compiler and source yields a small, hardened production image; multi-stage builds do not remove the kernel dependency, add encryption, or make a binary architecture-independent.
Read the full bite: Multi-stage builds for compiled languages
Question 24 of 30
Why is docker exec -it preferred over docker attach when opening a shell to debug a running container?
Show the answer
Answer: d · exec starts a new process, leaving PID 1 untouched, while attach can kill it on Ctrl-C
exec spawns a separate process so the main process is unaffected, whereas attach connects to PID 1's stdio and Ctrl-C can terminate it; attach is not deprecated and exec does run inside the container.
Read the full bite: Debug a running container with the Docker CLI
Question 25 of 30
Why is structured logging considered foundational for observability at large scale?
Show the answer
Answer: a · Its consistent named fields enable reliable querying, aggregation, and correlation across services
Structured logs put data in named fields, so you can query, aggregate, and join on trace IDs reliably at volume, which free text cannot. It does not replace metrics or traces, and it favors machine-parseability over raw readability.
Read the full bite: Structured vs unstructured logging: why it matters
Question 26 of 30
What is the most security-relevant capability the instance metadata service provides to an application?
Show the answer
Answer: a · It vends temporary, rotating credentials for the instance's attached role
The service delivers short-lived, auto-rotated role credentials so apps avoid hardcoded keys. It is link-local rather than internet-reachable, does not serve external config, and does not handle disk encryption.
Question 27 of 30
When integrating a 50-commit stale branch that others may have pulled, which strategy best preserves shared history while validating pipeline stability?
Show the answer
Answer: c · Merge main into the feature branch locally, resolve conflicts, run full tests, and open a draft PR before merging
Merging main into the feature branch preserves commit hashes and shared history, while a draft PR exercises the full CI pipeline without spamming reviewers or triggering merge queues prematurely. Rebasing and force-pushing is dangerous because it rewrites public history and breaks every collaborator's local environment.
Read the full bite: How do you safely merge a 50-commit stale branch with conflicts?
Question 28 of 30
Across three microservices handling one request, what value is identical on every span, and what value distinguishes each operation within that request?
Show the answer
Answer: a · Trace ID is shared; span ID distinguishes each operation
The trace ID is generated once and carried by every span to group them, while each operation gets its own span ID. Sharing span IDs or minting new trace IDs per hop would break correlation entirely.
Question 29 of 30
How does docker image prune (without -a) differ from docker image prune -a?
Show the answer
Answer: d · prune removes only dangling images; -a also removes unused tagged images
Plain prune targets only untagged dangling images, while -a additionally removes any tagged image not referenced by a container; -a is not merely a prompt flag and neither command removes containers.
Read the full bite: What is a dangling image and how to prune it
Question 30 of 30
Why is black-box monitoring usually the faster first step for a legacy app with no internal instrumentation?
Show the answer
Answer: d · It requires no application code changes and shows user-facing symptoms immediately
Black-box probes the system externally, so it needs no instrumentation and quickly reveals whether users are served. It cannot localize root cause or replace white-box signals, which is why those are added later.
Read the full bite: Black-box vs white-box monitoring for legacy apps
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.