Intermediate interview questions in DevOps & Cloud, page 4
Granting a VM scoped storage access without static keys
Attach a least-privilege role or managed identity to the VM so it gets auto-rotating temporary credentials scoped to the bucket.
Service-managed vs customer-managed vs BYOK keys
Service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance.
What happens after kubectl apply
Apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back.
How would you reuse pipeline steps across projects using PaC principles?
Tests DRY abstractions and coupling in CI/CD. Good answer: versioned reusable templates or libraries with parameterized inputs, consumed by composition. Red flag: raw copy-paste or one global pipeline forcing lockstep deployments.
High cardinality in time-series databases
Each combination is a separate series consuming memory and index; manage by avoiding unbounded labels and bucketing values.
Automating a no-public-IP governance rule
Use organization-level policy guardrails (SCP, Azure Policy, Org Policy) to deny public IP attachment before creation, applied across all accounts.
etcd as the cluster source of truth
Etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum.
How would you implement conditional logic in a pipeline?
Use if conditions with contexts like github.ref, separate trigger filters from runtime conditions, and add env rules.
Prometheus histogram versus summary
Histograms expose bucket counts and let you compute aggregatable quantiles at query time; summaries compute fixed quantiles per instance that cannot be combined.
Shared responsibility model across service tiers
Provider secures the cloud infrastructure; you secure what you put in it; the line shifts with abstraction. For OS patching, you patch IaaS VMs but the provider patches a managed database OS.
The Kubernetes reconciliation loop
A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.
How would you use PaC to introduce pipeline parallelism?
Tests splitting a sequential Jenkinsfile into independent Declarative parallel stages. Group tests and scans in a parallel block with stage-level agents, use matrix for cross-axis work, and version the Jenkinsfile.
Correlating logs, metrics, and traces
Propagate a trace and span ID through context, stamp it on logs and metric exemplars, then pivot metric to trace to logs.
Deployment versus StatefulSet
Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems.
Implement a manual approval gate for production deployment in pipeline-as-code
This tests embedding human governance in automated pipelines with auditability. A strong answer covers environment-scoped approvals, timeouts, RBAC, and immutable logs. Red flag: Ad-hoc manual deploys outside the pipeline or missing rollback plans.
Designing a cache health dashboard
Hit ratio, latency, memory and evictions, connections and saturation, with stat panels for current state and time-series for trends.
RDS Multi-AZ versus Read Replicas
Multi-AZ is a synchronous standby for failover, replicas are async for read scaling, combine both when needed.
How a Deployment rolling update works
New image creates a new ReplicaSet; Deployment scales it up while scaling the old one down per maxSurge/maxUnavailable; old ReplicaSet is retained at zero for rollback.
Fixing a noisy non-actionable alert
Review the data to see if it is ever actionable, then tune threshold or duration, re-target at user-facing symptoms, or delete it.
Strong versus eventual consistency in NoSQL
Strong reads see the latest write at higher latency and cost, eventual reads may be stale but are cheaper and faster, match the choice to stakes.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles