Advanced interview questions in DevOps & Cloud, page 4
Catching rare intermittent failures
Add high-cardinality traces and structured logs with exemplars, use tail-based sampling to keep failing traces, and alert on SLO burn rather than coarse averages.
Spreading Pods one-per-node for availability
Use required podAntiAffinity with topologyKey kubernetes.io/hostname matching the Deployment's own pod labels, so the scheduler refuses to co-locate two Pods on a node.
Compare Terraform and Ansible: when to use each and both together
This tests whether you distinguish provisioning from config management. Strong answers define Terraform for immutable infra and Ansible for mutable state, contrast day 0 versus day 1-2 work, and cover Terraform for VMs and Ansible for setup.
Alert silencing versus alert inhibition
Silencing mutes by matcher for a window, inhibition suppresses lower alerts when a higher one fires, dependency-aware.
Offload long-running tasks from web requests
Enqueue the job to a queue, return immediately, process with separate workers, report status out of band.
Cold starts in serverless environments
A cold start is the delay to provision a fresh instance and initialize the runtime; mitigate with provisioned concurrency and by shrinking init work.
Technical investments to reduce MTTR
Cut detection, diagnosis, and recovery time via observability, runbooks/automation, fast rollback, and resilient architecture.
Migrating a stateful monolith to PaaS
Externalize state to backing services, make processes stateless and disposable, read config from the environment per Twelve-Factor.
kube-proxy and iptables vs IPVS modes
Kube-proxy watches Services/endpoints and programs node rules so ClusterIP traffic is DNAT'd to a backend Pod; iptables uses sequential rule chains, IPVS uses a hash table with real…
Prevent developer access to production secrets while preserving debuggability
Use dynamic short-lived credentials, break-glass with dual-control audit, and structured telemetry or synthetic transactions for debugging.
Architecting a single source of truth for incidents
One curated view overlaying golden metrics, deploy/change events, and active alerts on a shared timeline, fed by standardized telemetry.
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies.
How do you securely manage and inject Helm secrets in CI/CD?
Tests secret lifecycle trade-offs in GitOps. Strong answers compare SOPS-encrypted values in Git, direct Vault injection for dynamic secrets, and External Secrets Operator to decouple secrets from charts.
Designing a safe chaos engineering exercise
Form a hypothesis, define steady state and blast radius, inject failure, observe response, with abort and rollback safeguards.
Ingress resource vs Ingress controller
The Ingress resource is declarative routing rules; the controller is the running proxy (NGINX, etc.) that reads them and serves traffic.
Grant an EKS pod IAM access to S3
IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials.
Isolate tenants in a shared Kubernetes cluster
Namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace.
How do you inject secrets from an external store at runtime?
Use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.
Debug intermittent pod-to-pod connectivity
Scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU.
Compare Kubernetes Secrets versus environment variables for Pod credentials
Tests Kubernetes credential threat model across etcd and Git. Plain env vars leak into manifests and process lists; Secrets enable RBAC but are base64 by default and visible to nodes and authorized readers. Red flag: claiming Secrets are encrypted by default.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles