Advanced interview questions in DevOps & Cloud, page 2
How would you integrate artifact signing into CI/CD and secure the keys?
Tests supply chain architecture and secrets management. A strong answer: remote HSM or KMS signing isolated from build runners, signature verification at deploy gates, and key rotation with audit logging.
Maximizing object-store throughput for small files
Spread keys across prefixes for partition parallelism, batch small files, parallelize and use multipart uploads.
Object store vs NFS consistency models
S3 gives strong read-after-write per object with no partial updates; NFS offers close-to-open with shared mutable files.
Block storage availability across AZ failure
Block volumes are AZ-bound, so use snapshots, synchronous replication, or app-level replication, trading cost for lower RTO/RPO.
Setting SLOs across a dependency chain
Serial dependencies multiply, so each backend needs a tighter SLO than the target; mitigate with redundancy, caching, and graceful degradation.
Structuring Compose files across environments
A base compose.yaml plus override files, the default override auto-merge, and explicit -f flags or extends per environment.
Launching a risky feature with no error budget left
Bring burn history, what consumed the budget, blast radius, and rollback safety; offer mitigations like flags and canaries.
Optimizing Dockerfile layer caching
Order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.
Smoke test fails after canary deployment. Design the automated rollback.
Tests self-healing pipeline design: freeze canary traffic, auto-redeploy the last good release, verify rollback health, and keep failed pods for forensics. Red flag: requiring manual approval or in-place fixes instead of an atomic rollout swap.
Fixing watermelon SLOs that hide unhappy users
Green-outside, red-inside SLOs come from server-side measurement, coarse aggregation, wrong events, and lax thresholds; fix by measuring at the client and using meaningful SLIs.
Docker Compose profiles for optional services
Profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.
How would you diagnose, report, and mitigate E2E flakiness at scale?
Tests metric-driven pipeline hygiene versus retry band-aids. Strong answers baseline flakiness rates, identify offenders via CI history, quarantine chronic flakes from presubmit, and fix root causes like concurrency.
Site-to-Site VPN vs dedicated interconnect
VPN is quick, cheap, encrypted over public internet with variable latency; Direct Connect or ExpressRoute is a private dedicated link with consistent low latency, high bandwidth, longer lead time and…
Integrate artifact signing and vulnerability scanning into CI/CD
Build SBOMs, sign with ephemeral keys, scan registries, and enforce policy before deploy.
Stable egress IPs for multi-region outbound traffic
Route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist.
Vulnerability scanning as a deploy gate
Scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.
How can artifact management and CI identify affected services and block deployments?
Tests supply chain forensics and CI gating. Strong answers hit: SBOMs mapping transitive blast radius; artifact metadata tracing deployed versions; scan gates and quarantine policies blocking promotion.
Accelerating uncacheable dynamic traffic globally
Terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region.
Reducing cross-region image pull costs
A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.
How do you manage multi-arch container images under a single tag?
This tests image distribution and registry semantics. A strong answer covers manifest lists pointing to per-arch digests, Buildx as the builder driver, and the registry serving correct layer blobs.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles