Intermediate interview questions in DevOps & Cloud, page 7
What are the major challenges of blue/green deployments with relational databases?
Tests decoupling schema and code changes in stateful blue/green deployments. Strong answers cover the additive-then-deletive pattern, backward compatibility for both app versions, and shared DB risks. Red flag: split DBs with no rollback or sync plan.
Idempotency in infrastructure provisioning scripts
Idempotency means repeated runs converge to one end state; achieve it via desired-state reconciliation or idempotency keys with read-before-write.
What is a StorageClass and dynamic provisioning?
A StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes.
How would you automate canary deployment and what metrics decide rollback?
This tests progressive delivery maturity. Strong answers cover traffic splitting (10% to 100%), automated 5-10 minute health gates, and rollback triggers like error rate and p99 latency.
Systematically reduce noisy alert toil
Inventory alerts, measure frequency, actionability, and time cost, then prioritize by volume times effort.
What do PersistentVolume accessModes mean?
RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX.
How can a service mesh facilitate canary or A/B testing?
Tests mesh-level traffic control decoupled from app releases. Strong answers name traffic shifting, request routing, ingress gateways, and telemetry-driven rollback. Red flag: citing mTLS alone and omitting observability automation.
Design automated microservice provisioning workflow
Template scaffolding plus a pipeline that creates repo, CI/CD, and infra as code, with idempotent steps and rollback.
How does a StatefulSet give stable identity and storage?
Ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule.
Centralized logging across microservices
Ship structured logs from every service into a central searchable store, then propagate a correlation ID through all hops to trace one request.
State drift in Terraform
Drift is when live infrastructure diverges from recorded state, usually via manual console changes; detect with plan or refresh, remediate by re-applying or importing.
Blue-green deploys with schema migrations
The shared database means both versions hit one schema, so breaking changes must be split into backward-compatible steps via expand-and-contract.
Enforce a cloud resource compliance policy
Prevent at creation with org policies or admission checks, detect violations via continuous config scanning, and auto-remediate by stripping the IP or alerting owners.
Diagnose a degraded canary release
Check statistical significance versus baseline, confirm apples-to-apples comparison, isolate the cause via traces and logs, then weigh the regression against SLO budget.
Diagnose 100% CPU on a managed database
Correlate the spike with deploys and traffic, find top queries via the engine's views, inspect plans for missing indexes, then tune before scaling.
Design automated canary analysis scoring
Track the golden-signal SLIs, compare canary to baseline statistically, weight and combine into a score with promote/rollback thresholds.
How do you investigate and resolve a critical transitive dependency vulnerability?
It tests transitive CVE triage. A strong answer reproduces the finding, traces the dependency path, upgrades the direct dependency if possible, and considers build-tool overrides otherwise. Red flag: ignoring it as transitive or blind upgrades without tests.
Client-side vs server-side feature flags
Client-side is fast and offline-capable but exposes flag logic and risks stale or leaked values; server-side keeps logic secret and consistent but adds latency.
Compare SAST and DAST. Why use both, and their limits?
Tests whether you understand complementary security testing layers in CI/CD. A strong answer contrasts static source analysis without execution against dynamic runtime attack simulation and explains that relying on only one leaves applications vulnerable.
What are the three Pod QoS classes?
Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles