Intermediate interview questions in DevOps & Cloud, page 11
How would you implement zero-downtime secrets rotation?
Inventory secrets and app caching; baseline monitoring; dual-phase rotation with overlapping secrets; verify before revoking old.
How do you keep one build artifact immutable across environments?
This tests separation of build and run stages. A strong answer packages one artifact with zero embedded config, then injects env vars or mounted secrets at deploy time via the platform. Red flags include per-stage rebuilds or config baked into the image.
Calculating downtime for a 99.9% SLO
0.1% of 30 days is roughly 43 minutes of allowed downtime; healthy budget enables faster shipping while depletion slows or freezes deploys.
Balance agility and compliance in regulated cloud
PaaS for speed where allowed, IaaS where control is required, enforced by encryption, IAM least privilege, network isolation, policy-as-code guardrails, and continuous audit logging.
How would you add E2E tests to CI and what challenges arise?
This tests CI/CD pipeline design. Cover Dockerized environments, parallel runs, flaky-test retries, and selective execution such as critical tests per commit and full suites nightly. Red flag: running all tests on every commit without isolation or retries.
Writing high-quality postmortem action items
Good action items are specific, assigned to an owner, prioritized, tracked to completion, and ideally prevent recurrence rather than just detect faster.
When to choose bare metal over a VM
Bare metal suits latency-sensitive or high-throughput workloads needing no hypervisor overhead, single-tenant isolation for compliance, or direct hardware and licensing access.
How do you speed up slow integration tests without compromising quality?
Tests your ability to optimize CI/CD pipelines while preserving coverage. A strong answer covers parallel execution, Test Impact Analysis, ephemeral containers, and test data as code. Red flag: proposing to delete tests or disable integration stage entirely.
Rolling update vs blue-green deployment
Rolling replaces instances gradually with minimal extra capacity but mixes versions; blue-green runs two full environments for instant switch and rollback at double the cost.
Configure a Kubernetes Horizontal Pod Autoscaler
HPA adjusts replica count toward a target CPU metric, needs the metrics server and pod resource requests, and scales a deployment between min and max.
The reconciliation loop in an Operator
Reconcile compares desired spec to observed state and converges them, idempotently; triggered by resource changes, watched dependents, and periodic resync.
How do you implement security policies as code across CI pipelines?
This tests operationalizing Policy as Code for security scanners at scale. Strong answers cover centralized version-controlled rules consumed by CI pipelines with automated gates and exception workflows. Red flag: teams maintaining independent scanner configs.
Designing shallow vs deep health checks
Shallow checks confirm the process is alive; deep checks verify dependencies; use shallow for liveness/load-balancer routing and deep sparingly to avoid…
Strangler Fig with serverless and an event bus
API Gateway acts as the routing facade, new features run as Lambda functions, an event bus decouples and fans out to new services, and traffic shifts feature by feature until the monolith…
Finalizers for clean external cleanup
A finalizer is a key blocking deletion; deletion sets deletionTimestamp, the operator does cleanup then removes the finalizer so the object is purged.
How do you add a basic post-deployment health check in CI/CD?
Tests deployment validation beyond exit-code success. Outline: add a post-deploy stage that probes an HTTP endpoint, checks status code and latency, validates critical dependencies, and triggers rollback on failure.
First-SRE 90-day plan at a startup
Listen and measure first, pick one high-impact service, define SLIs/SLOs and basic alerting, then show reduced toil or incidents to leadership.
Optimize cost of a big-data analytics platform
Storage tiering and lifecycle plus compression and partitioning; compute via spot instances, right-sizing, and efficient file formats; query and pipeline optimization to scan less data.
Adding a required field to a live CRD
Don't make it required immediately; add it optional with a default, introduce a new version with conversion, migrate existing objects, then tighten.
Explain .gitignore and its impact on faster, reliable, secure CI builds
Exclude build artifacts to shrink clones and stabilize cache keys; block secrets from runners.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles