Intermediate everything in CI/CD & Automation, page 4
Promote an artifact from staging to release without rebuilding it
Tests immutable artifact discipline. Answer: promote by copying the binary or retagging the image digest, never recompiling, because rebuilds introduce dependency drift and untested bits.
Explain proxy repositories in artifact managers and the problems they solve
Tests caching and supply-chain resilience in builds. Strong answers cover: local caching of upstream artifacts, shielding CI from external outages, and policy enforcement at the edge.
How do you version Docker images: Git SHA or SemVer?
Your grasp of immutable artifacts and traceability versus human-readable releases. Tag every build with Git SHA for immutability, then apply SemVer aliases only on promoted images. Treating floating tags like latest or v1 as safe production targets.
How would you integrate SAST into CI without alert fatigue?
This tests embedding security into workflow without killing velocity. Run SAST per commit, suppress false positives via rulesets, gate on high-severity findings first and block merges only after calibration. A red flag is zero-tolerance blocking on day one.
How would you block merges when PR coverage drops 2%?
Upload coverage to Codecov, set a project status threshold of 2, and require the check in branch protection.
How would you design a multi-arch build process and anticipate challenges?
Mention buildx or cross-compilation, split native and emulated builds, cache per-arch layers.
Compare ephemeral container agents versus persistent build agents
Ephemeral agents ensure clean state but add cold-start latency; persistent agents speed builds via caching yet risk config drift.
Explain dependency management and diamond conflicts in automated builds
Tests transitive dependency resolution and conflict strategies in build pipelines. Strong answers mention nearest-wins eviction, strict versioning, shading, or classloader isolation. Red flag: manual jar swaps or pinning without understanding ABI breakage.
Your build times increased significantly. How do you investigate and optimize?
Tests methodical CI/CD bottleneck analysis and build optimization tactics. Strong answers baseline the timeline, isolate the slowest stage with metrics, then apply parallelism, caching, or dependency pruning.
How do you safely merge a 50-commit stale branch with conflicts?
Assess relevance, merge main locally, validate via draft PR and tests, merge off-peak with rollback ready.
How do feature flags enable unfinished work in Trunk-Based Development?
Commit behind off flags; CI/CD deploys trunk continuously; flags gate exposure for gradual rollouts.
Describe Trunk-Based Development principles and CI/CD benefits
Tests if you view TBD as a CI/CD enabler versus GitFlow. Good answers name a single trunk, branches under 24 hours, pre-integrate builds, and feature flags, tying daily commits to releasable code and less merge hell. Red flag: endorsing long-lived branches.
What is a build artifact and why build once deploy many crucial?
Tests whether you see artifacts as immutable deployable units. A strong answer says one binary is promoted through all stages, config is externalized, and rebuilding per environment creates drift. Red flag: accepting per-environment rebuilds.
Platform Orchestrator: Infrastructure's Travel Agent
A platform orchestrator is infrastructure's travel agent: describe an app and it provisions compute, databases, and caches across clouds automatically. It shines once teams outgrow per-service Terraform. Adopt it too early and it becomes a bottleneck.
Backstage: The Developer Portal Framework
Backstage is a framework for building a developer portal, not a ready-made dashboard. It centralizes ownership, docs, and tooling when microservice sprawl hides context. The footgun is treating it as a product you deploy without upkeep; the catalog rots.
Security Champions: Embedded Team Defense
A security champions program embeds trained developers inside teams to catch risks early. It scales AppSec without hiring a specialist for every squad. The footgun is treating champions as free labor instead of investing in their training and time.
IAST: Inside-Out Runtime Security Scanning
IAST is an inside-out security scanner: an agent in your running app watches data flow to catch vulnerabilities with few false positives. It runs during functional tests, giving precise line-of-code findings. If your tests skip a route, IAST stays blind to it.
Container Image Security Scanning
A container image is a frozen filesystem; scanning unpacks layers to flag known CVEs before deployment. Run it in CI/CD after every build and continuously in production registries. Scanning only at build time misses new CVEs in running images.
Dynamic Secrets: Temporary On-Demand Credentials
Dynamic secrets are temporary credentials minted on demand, not static passwords living in config files. A CI job requests a 15-minute database lease instead of a long-lived env var.
Vault: Centralized Secrets with Dynamic Leasing
Vault is a secrets firewall: it centralizes credentials and issues short-lived leases instead of static keys. Use it when apps need DB passwords not hardcoded. The footgun is using Vault without audit logs, leaving secrets unmonitored.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles