Advanced interview questions in DevOps & Cloud
What is the OCI and why do its specs matter?
OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.
Designing for portability across two clouds
Abstract via containers, Terraform, and open standards; avoid proprietary managed services.
Pipeline is green but lead time grows. Three areas to investigate?
This tests distinguishing pipeline health from delivery flow efficiency. A strong answer targets pre-merge wait states, slow green pipeline stages, and post-merge deployment friction, using time-in-stage metrics.
Risky launch with a near-empty error budget?
Contain blast radius via canary and feature flags, use progressive rollout tied to budget burn, negotiate explicit risk acceptance, add fast rollback.
Trace a container process's syscalls from the host
Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.
Hybrid cloud bursting from a VMware footprint
Evaluate VMware Cloud on AWS, Azure Arc, Outposts; address connectivity, identity, and data gravity.
How does your CI/CD strategy differ between monoliths and microservices?
Contrast monolith unified builds with microservice independent deploys, side-by-side versions, and service gates.
SRE vs traditional ops on a recurring alert?
Traditional ops repeatedly handles the alert manually and scales by adding people; SRE treats it as a bug, automates or eliminates the root cause, and scales sublinearly.
Explain blue-green deployment, its prerequisites, and how it reduces deployment risk.
Tests operational maturity for zero-downtime cutover. Great answers: parallel environments, load balancer switching, backward-compatible schemas, externalized state, and instant rollback vs partial in-place failure.
Error budget policy across dependent microservices?
Set per-service SLOs but anchor on user-facing journey SLOs, budget for dependency error via the multiplication of availabilities, attribute downstream-caused failures correctly, and use…
Optimizing low-latency VM-to-VM networking
Cluster placement groups, enhanced networking and SR-IOV, larger instances for more bandwidth.
How do you fully remove leaked credentials from Git history?
This tests Git history rewriting and incident response. Rotate the secret first, then use git-filter-repo to purge the file, force-push main, and require all teammates to re-clone before resuming. A red flag is recommending git revert or skipping rotation.
Run a container as a non-root user
Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.
Cost-effective fault-tolerant batch processing
Spot fleets across types, a durable work queue, idempotent checkpointed tasks, retries.
Compare git submodules and git subtree for CI/CD
Tests dependency integration trade-offs in CI. Submodules need recursive clones and pinned commits, complicating checkout; subtree inlines code, simplifying clone but bloating history. Red flag: omitting submodule detached HEAD pain or calling subtree free.
What is high-cardinality data in Prometheus?
Cardinality is the count of unique label combinations; each is a separate series; explosion blows up memory and query cost.
Pass build-time secrets securely with BuildKit
Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.
Head-based vs tail-based trace sampling
Head-based decides at trace start cheaply but blindly; tail-based waits for the full trace to keep errors and slow requests.
Distroless images: benefits and trade-offs
Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.
Symptom-based vs cause-based alerting
Symptom alerts fire on user-visible impact, cause alerts on internal conditions; page on symptoms to cut noise and catch unforeseen failures.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles