Intermediate interview questions in DevOps & Cloud, page 13
Migrating a stateful monolith to the cloud
Assess and inventory, pick a migration pattern like rehost or replatform, handle data migration and cutover, mitigate downtime and data-loss risk.
Canary release with Istio traffic splitting
DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy.
Design short-lived dynamic database credentials and their security benefits
This tests automated least-privilege credential lifecycle design. A strong answer covers a secrets broker with database plugins, short TTL leases tied to workload identity, and automatic revocation. Red flag: manual rotation or long-lived CI variables.
Capacity planning for distributed stateful systems
Account for replication and cross-region network, IOPS and disk throughput, connection limits, partition/shard balance, and N+1 region failover headroom; validate with load and chaos…
How a service mesh enables automatic mTLS
The control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel.
What strategies reduce DAST scan time while maintaining security coverage?
It tests balancing security depth with CI velocity through DAST tuning. A strong answer covers incremental scans, parallel workers, scoped targets, and shift-left complements.
Capacity planning for a distributed cache
Track hit ratio, memory and eviction rate, throughput/latency, and connections; correlate with growth to forecast when to add capacity before the hit ratio or evictions…
Retries and circuit breaking in a mesh
Configure bounded retries with timeouts for transient errors, and a circuit breaker via outlier detection plus connection-pool limits to shed load from a failing dependency.
Design a workflow for managing security scanner vulnerabilities
This tests scaling security without developer noise fatigue. A strong answer covers centralized ingestion, severity SLAs with exploitability, auto-triage rules, and CI gates on critical findings only. A red flag is forcing manual review of all scanner output.
Federating reliability ownership to product teams
Build a self-service reliability platform (golden paths, paved roads), train teams and embed SLO/on-call practices, and govern with standards plus error budget…
Design a golden path CI/CD pipeline for a Go API
Propose build, test, SAST, containerize, deploy stages with hooks or config overlays for flexibility.
Guardrails for GitOps sync outages
Pre-merge schema validation, dry-run, policy gates and review; post-merge progressive sync, health checks with automated rollback, and pruning controls.
Istio Gateway vs Kubernetes Ingress
Ingress is a simple built-in L7 entry abstraction; an Istio Gateway configures only ports and hosts at the edge while VirtualServices do routing, unlocking mesh features.
What makes a process a container to the kernel
Namespaces isolate and cgroups limit, but also capabilities, seccomp filters, mount/pivot_root for the rootfs, and SELinux/AppArmor labels.
Container registries: public vs private
A registry stores and serves versioned image layers by digest; public registries are open and rate-limited, private ones add access control, scanning, signing and network isolation.
Impact of losing etcd quorum
Without quorum etcd goes read-only-ish and the API server cannot persist writes, so scheduling and changes stall, but kubelets keep running existing pods.
Scaling on queue length with the HPA
Expose queue length through an external metrics adapter behind the metrics API, point the HPA at that external metric with a target per pod; KEDA packages this.
Docker layers and build cache efficiency
Each instruction makes a content-addressed read-only layer stacked by a union FS; shared layers are pushed/pulled once, and ordering the Dockerfile so volatile steps come last maximizes cache reuse.
Image signing with Cosign vs trusting a digest
A digest proves content has not changed but not who produced it; Cosign cryptographically signs the digest so a verified key proves provenance, and policies enforce it at admission.
How mounted ConfigMap updates propagate to pods
Kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles