More in CI/CD & Automation — page 4
How would you use distributed tracing to debug a deployment latency issue?
This tests causal request-path analysis beyond aggregate metrics. A strong answer filters traces by the new version, finds the exact regressed span, and compares it to a pre-deployment baseline.
Design an automated rollback process when deployment error rates spike
WHAT IT TESTS: judgment when automating rollbacks. ANSWER OUTLINE: gate on error-rate and latency thresholds; use blue-green deploys to limit blast radius; require human approval for stateful rollbacks. RED FLAG: instant full rollback from one noisy metric.
How do you diagnose a progressively slower CI pipeline?
WHAT IT TESTS: data-driven CI diagnosis across pipeline topology, runner resources, and test quality. ANSWER OUTLINE: profile stage durations and critical path, audit runner CPU/memory/disk, flag flaky or late-failing tests.
What are the four Golden Signals for service health monitoring?
Tests whether you can name the four essential metrics—latency, traffic, errors, saturation—and explain why each matters for detecting user-facing regressions after a release, rather than drowning in infrastructure noise.
How would you use a Kubernetes Admission Controller as CI/CD security gate?
Tests pre-deployment enforcement via admission webhooks. Strong answers: ValidatingAdmissionWebhooks blocking bad manifests, Pod Security Standards restricted profiles, and OPA/Gatekeeper for image signatures. Red flag: confusing with RBAC or runtime scanning.
How would you integrate automated security scanning for Terraform in CI/CD?
WHAT IT TESTS: Shift-left security and IaC misconfig detection in CI. ANSWER OUTLINE: Run Checkov or TFLint in CI to block builds; catch open security groups, missing encryption, secrets in code, and bad IAM.
Compare SAST and DAST. Why use both, and their limits?
Tests whether you understand complementary security testing layers in CI/CD. A strong answer contrasts static source analysis without execution against dynamic runtime attack simulation and explains that relying on only one leaves applications vulnerable.
How do you investigate and resolve a critical transitive dependency vulnerability?
It tests transitive CVE triage. A strong answer reproduces the finding, traces the dependency path, upgrades the direct dependency if possible, and considers build-tool overrides otherwise. Red flag: ignoring it as transitive or blind upgrades without tests.
Committed an API key to Git. Describe two automated CI/CD prevention methods.
This tests layered secret protection in Git workflows. A strong answer names pre-commit scanning and server-side push protection or pipeline scanning. Mention rotating that key. A weak answer only suggests manual review without automated gates.
How do you deploy a hotfix during a multi-stage canary release?
TESTS: if you decouple deploy from release with flags to patch without killing canary metrics. OUTLINE: dark-launch the fix to the canary cohort, preserve metrics, then jointly promote.
Blue/green deployment fails during switch-over with partial decommissioning; recovery and process changes?
Tests whether you can recover when a blue/green rollback path is compromised. Strong answers stop the bleed, revive blue if possible, and mandate keeping blue fully warm until green is stable. Red flag: "just roll back" ignoring partial decommissioning.
Canary vs shadow deployments: use cases and requirements
This tests whether you distinguish user-facing rollouts from invisible duplication. Canary routes some real users to new code to limit blast radius; shadow mirrors traffic to an isolated clone to test performance without user impact.
How can a service mesh facilitate canary or A/B testing?
Tests mesh-level traffic control decoupled from app releases. Strong answers name traffic shifting, request routing, ingress gateways, and telemetry-driven rollback. Red flag: citing mTLS alone and omitting observability automation.
How would you automate canary deployment and what metrics decide rollback?
This tests progressive delivery maturity. Strong answers cover traffic splitting (10% to 100%), automated 5-10 minute health gates, and rollback triggers like error rate and p99 latency.
What are the major challenges of blue/green deployments with relational databases?
Tests decoupling schema and code changes in stateful blue/green deployments. Strong answers cover the additive-then-deletive pattern, backward compatibility for both app versions, and shared DB risks. Red flag: split DBs with no rollback or sync plan.
What problem can a breaking API change cause during a rolling update?
Tests if you know rolling updates run mixed versions, so breaking API changes crash cross-traffic. Good answer: note old and new pods serve together, watch probes fail, and monitor 5xx spikes. Red flag: claiming Kubernetes isolates versions during rollout.
Explain canary releases and why choose them over rolling updates
This tests risk mitigation via user routing versus in-place replacement. A strong answer defines canary as exposing a subset to the new version first, contrasts rolling updates lacking user segmentation, and cites fast rollback.
Rolling vs blue/green deployments: differences and trade-offs
Tests risk-cost-downtime judgment. Contrast rolling's gradual swap with blue/green's parallel swap; rolling is cheaper but mixes versions, while blue/green doubles capacity for instant rollback. Red flag: saying blue/green cheaper or rolling double-capacity
Design a zero-downtime Kubernetes Deployment strategy for a stateless microservice
WHAT IT TESTS: K8s rolling updates and graceful pod termination. ANSWER: set RollingUpdate with maxSurge 1 and maxUnavailable 0; use readiness probes to gate traffic; set terminationGracePeriodSeconds and preStop to drain requests.
How do you diagnose and fix a Kubernetes OOMKilled application?
Tests cgroup enforcement versus scheduling. A strong answer verifies OOMKilled, compares limits to usage, then rightsizes requests to baseline and limits with headroom. Red flag: confusing requests with caps or blindly raising limits.