Intermediate interview questions in CI/CD & Automation, page 2
How do you manage secrets within IaC configurations?
This tests secret injection and the security-complexity tradeoff in IaC. A strong answer contrasts a cloud secret manager with encrypted files or env vars, covering rotation and blast radius. A red flag is plaintext secrets in Git or state files.
Explain Terraform state, why managing it is critical, and team best practices
Tests if you know state maps config to real resources and tracks metadata. Strong answers cover remote backends with locking and encryption, never Git. Red flag: local state or ignoring that state files contain secrets.
Design a CI/CD pipeline for ephemeral feature branch environments
This tests dynamic infrastructure lifecycle modeling in CI/CD. A strong answer covers branch-triggered provisioning, dynamic naming, automatic cleanup via stop jobs, and cost controls. Red flag: proposing manual teardown or static environments per branch.
Define configuration drift in IaC. How do you detect and remediate it?
This tests state divergence between declared and live infrastructure. A strong answer defines drift as deviation from the IaC source of truth, proposes automated scanning for detection, and recommends reconciliation or redeployment.
Describe secure secret injection into Kubernetes containers during CI/CD
Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.
How does your app authenticate with secrets management and solve secret zero?
This tests platform trust chains and the bootstrap credential problem. A strong answer names IAM, Kubernetes, or AppRole auth, explains platform attestation, and uses short-lived tokens.
Compare GitOps and Kustomize vs Ansible for environment configs
Tests declarative vs imperative trade-offs. Contrast GitOps drift detection with Ansible's imperative flexibility. Note Kustomize overlays for K8s vs Ansible's broader reach.
What are liveness and readiness probes, and what happens when each fails?
This tests whether you know the distinct kubelet actions for each probe failure. A strong answer: liveness failure restarts the container; readiness failure removes the Pod from Service endpoints and stops traffic.
Describe the difference between a Deployment and a StatefulSet
Tests stateful pod identity versus stateless scaling. Outline: contrast Deployments' interchangeable replicas with StatefulSets' stable hostnames, per-pod PVCs, and ordered rollout; give a database example.
How ensure Kubernetes pulls correct new image and why avoid :latest?
Tests immutable tagging and Kubernetes image pull behavior. Strong answers demand unique tags like git SHA, explicit deployment spec updates, and explain :latest's reproducibility failures across nodes.
Explain the concept of a sidecar container in Kubernetes
Tests Pod multi-container patterns. A strong answer defines sidecars as co-located helpers sharing network and storage, cites service mesh or log forwarding, and argues for reuse and separate lifecycles. Red flag: calling it another Pod or legacy workaround.
What are the major challenges of blue/green deployments with relational databases?
Tests decoupling schema and code changes in stateful blue/green deployments. Strong answers cover the additive-then-deletive pattern, backward compatibility for both app versions, and shared DB risks. Red flag: split DBs with no rollback or sync plan.
How would you automate canary deployment and what metrics decide rollback?
This tests progressive delivery maturity. Strong answers cover traffic splitting (10% to 100%), automated 5-10 minute health gates, and rollback triggers like error rate and p99 latency.
How can a service mesh facilitate canary or A/B testing?
Tests mesh-level traffic control decoupled from app releases. Strong answers name traffic shifting, request routing, ingress gateways, and telemetry-driven rollback. Red flag: citing mTLS alone and omitting observability automation.
How do you investigate and resolve a critical transitive dependency vulnerability?
It tests transitive CVE triage. A strong answer reproduces the finding, traces the dependency path, upgrades the direct dependency if possible, and considers build-tool overrides otherwise. Red flag: ignoring it as transitive or blind upgrades without tests.
Compare SAST and DAST. Why use both, and their limits?
Tests whether you understand complementary security testing layers in CI/CD. A strong answer contrasts static source analysis without execution against dynamic runtime attack simulation and explains that relying on only one leaves applications vulnerable.
How would you integrate automated security scanning for Terraform in CI/CD?
Run Checkov or TFLint in CI to block builds; catch open security groups, missing encryption, secrets in code, and bad IAM.
How do you diagnose a progressively slower CI pipeline?
Profile stage durations and critical path, audit runner CPU/memory/disk, flag flaky or late-failing tests.
Design an automated rollback process when deployment error rates spike
Gate on error-rate and latency thresholds; use blue-green deploys to limit blast radius; require human approval for stateful rollbacks.
How would you use distributed tracing to debug a deployment latency issue?
This tests causal request-path analysis beyond aggregate metrics. A strong answer filters traces by the new version, finds the exact regressed span, and compares it to a pre-deployment baseline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles