Intermediate interview questions in DevOps & Cloud, page 8
How would you integrate automated security scanning for Terraform in CI/CD?
Run Checkov or TFLint in CI to block builds; catch open security groups, missing encryption, secrets in code, and bad IAM.
Required vs preferred node affinity rules
Required is a mandatory filter, preferred is a weighted preference, and IgnoredDuringExecution means rules apply only at scheduling time.
Spreading replicas across availability zones
Use topologySpreadConstraints on topology.kubernetes.io/zone with a small maxSkew, choose DoNotSchedule or ScheduleAnyway, and confirm nodes carry zone labels.
Taints and tolerations versus node affinity
Taints repel pods from nodes (reserve hardware), affinity attracts pods to nodes, and you combine both so only tolerating pods land AND only those pods seek the node.
Rightsizing an underutilized VM fleet safely
Gather multi-week percentile metrics across CPU, memory, network and disk; pick smaller or right-family types; roll out gradually with monitoring.
How do you diagnose a progressively slower CI pipeline?
Profile stage durations and critical path, audit runner CPU/memory/disk, flag flaky or late-failing tests.
Diagnose database CPU saturation under load
Find the expensive queries via the database's stats, check for missing indexes and full scans, then fix with indexing, query rewrites, caching, or read replicas.
Lifecycle storage tiering for compliance logs
Hot tier for 7-day query window, lifecycle rules transitioning to infrequent-access then archive, expiration at one year.
Design an automated rollback process when deployment error rates spike
Gate on error-rate and latency thresholds; use blue-green deploys to limit blast radius; require human approval for stateful rollbacks.
Capacity planning for annual traffic spikes
Forecast peak from history, load-test to find per-unit capacity, use autoscaling with pre-warming and headroom, and protect with caching and graceful degradation.
Reducing cross-region data transfer costs
Identify cross-region, cross-AZ, and internet egress; co-locate chatty components; add VPC endpoints, CDN caching, and compression.
How would you use distributed tracing to debug a deployment latency issue?
This tests causal request-path analysis beyond aggregate metrics. A strong answer filters traces by the new version, finds the exact regressed span, and compares it to a pre-deployment baseline.
Little's Law for capacity planning
L equals lambda times W, concurrency equals arrival rate times time in system; rearrange to size threads or concurrency for a target throughput and latency.
How would you instrument CI/CD to measure a DORA metric accurately?
Tests mapping DORA definitions to pipeline events. A strong answer picks one metric, defines exact boundaries from merge to production, and correlates deployments with incidents.
Front-end performance budgets
A performance budget is an enforced limit on metrics like Core Web Vitals and bundle size, checked in CI to fail builds that regress.
Troubleshooting an RBAC forbidden error
Use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules.
Namespace-scoped RBAC for a ServiceAccount
Create a Role in production granting create on deployments (apps group) and services (core group), then a RoleBinding tying that Role to the ServiceAccount.
Write a frontend-to-backend NetworkPolicy
Set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest.
Reliability patterns for queue-based job processing?
Retries with backoff and jitter for transient faults, dead-letter queues plus a poison-message limit, idempotent handlers and visibility timeouts.
Root and NET_ADMIN under Pod Security Standards
Set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles