Interview questions in DevOps & Cloud, page 17
Enforce a cloud resource compliance policy
Prevent at creation with org policies or admission checks, detect violations via continuous config scanning, and auto-remediate by stripping the IP or alerting owners.
What is SAST and which CI/CD stage integrates it best?
Define SAST as source-code scanning; run it in the test stage on every commit; note early detection is cheapest.
Diagnose a degraded canary release
Check statistical significance versus baseline, confirm apples-to-apples comparison, isolate the cause via traces and logs, then weigh the regression against SLO budget.
Requests vs limits for CPU and memory?
Requests guide scheduling and reservation, limits cap usage; exceeding a CPU limit throttles the container, while exceeding a memory limit triggers an OOMKill since memory is incompressible.
Diagnose 100% CPU on a managed database
Correlate the spike with deploys and traffic, find top queries via the engine's views, inspect plans for missing indexes, then tune before scaling.
Committed an API key to Git. Describe two automated CI/CD prevention methods.
This tests layered secret protection in Git workflows. A strong answer names pre-commit scanning and server-side push protection or pipeline scanning. Mention rotating that key. A weak answer only suggests manual review without automated gates.
Design automated canary analysis scoring
Track the golden-signal SLIs, compare canary to baseline statistically, weight and combine into a score with promote/rollback thresholds.
How do you pin a Pod to nodes with a given label?
The simplest tool is nodeSelector, a key-value map in the Pod spec requiring matching node labels; node affinity is the richer alternative for complex rules.
Strategy for large multi-team IaC projects
Versioned reusable modules, state split per environment and component, promotion of identical code via variables, and externalized secrets.
How do you investigate and resolve a critical transitive dependency vulnerability?
It tests transitive CVE triage. A strong answer reproduces the finding, traces the dependency path, upgrades the direct dependency if possible, and considers build-tool overrides otherwise. Red flag: ignoring it as transitive or blind upgrades without tests.
Client-side vs server-side feature flags
Client-side is fast and offline-capable but exposes flag logic and risks stale or leaked values; server-side keeps logic secret and consistent but adds latency.
How do you stop new Pods scheduling on a node?
Kubectl cordon marks the node unschedulable so no new Pods land, while existing Pods keep running; drain is the follow-up that also evicts them.
Monitoring with SLOs and error budgets
Define SLIs from the user's view, set SLO targets, derive an error budget, and alert on burn rate rather than raw thresholds.
Compare SAST and DAST. Why use both, and their limits?
Tests whether you understand complementary security testing layers in CI/CD. A strong answer contrasts static source analysis without execution against dynamic runtime attack simulation and explains that relying on only one leaves applications vulnerable.
Auto-rollback on failed blue-green cutover
Shift traffic gradually behind a smart router, use deep health checks plus real SLI monitoring, and auto-revert to blue on breach while blue stays warm.
What are the three Pod QoS classes?
Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…
Design automated cloud cost optimization
Target idle resources, oversized instances, orphaned storage, and commitment gaps; act via rightsizing and cleanup; safeguard with tagging, scoping, and approvals.
How would you integrate automated security scanning for Terraform in CI/CD?
Run Checkov or TFLint in CI to block builds; catch open security groups, missing encryption, secrets in code, and bad IAM.
Canary a shared downstream microservice
Route a slice of traffic to the canary via mesh rules, propagate context, and use distributed tracing to measure impact on upstream callers across the full path.
Required vs preferred node affinity rules
Required is a mandatory filter, preferred is a weighted preference, and IgnoredDuringExecution means rules apply only at scheduling time.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles