Interview questions in DevOps & Cloud, page 18
Attribute cloud costs to teams
Tag resources with team and project metadata, activate them as cost-allocation tags, group the cost report by that tag, and enforce tagging with policy.
How would you use a Kubernetes Admission Controller as CI/CD security gate?
Tests pre-deployment enforcement via admission webhooks. Strong answers: ValidatingAdmissionWebhooks blocking bad manifests, Pod Security Standards restricted profiles, and OPA/Gatekeeper for image signatures. Red flag: confusing with RBAC or runtime scanning.
Golden signals for capacity planning
Monitor the four golden signals, latency, traffic, errors, and saturation, from day one, watching percentiles and saturation to forecast scaling.
Spreading replicas across availability zones
Use topologySpreadConstraints on topology.kubernetes.io/zone with a small maxSkew, choose DoNotSchedule or ScheduleAnyway, and confirm nodes carry zone labels.
On-Demand vs Reserved vs Spot pricing models
On-Demand is flexible but priciest, Reserved trades a 1-3 year commitment for discounts, Spot is cheapest but interruptible.
What are the four Golden Signals for service health monitoring?
Tests whether you can name the four essential metrics—latency, traffic, errors, saturation—and explain why each matters for detecting user-facing regressions after a release, rather than drowning in infrastructure noise.
Load vs stress vs soak testing
Load tests expected traffic, stress pushes past limits to find the breaking point, soak runs sustained load for hours to expose leaks.
Taints and tolerations versus node affinity
Taints repel pods from nodes (reserve hardware), affinity attracts pods to nodes, and you combine both so only tolerating pods land AND only those pods seek the node.
Rightsizing an underutilized VM fleet safely
Gather multi-week percentile metrics across CPU, memory, network and disk; pick smaller or right-family types; roll out gradually with monitoring.
How do you diagnose a progressively slower CI pipeline?
Profile stage durations and critical path, audit runner CPU/memory/disk, flag flaky or late-failing tests.
Diagnose database CPU saturation under load
Find the expensive queries via the database's stats, check for missing indexes and full scans, then fix with indexing, query rewrites, caching, or read replicas.
Pinning exclusive CPU cores to a pod
Set kubelet CPU Manager policy to static, make the pod Guaranteed QoS with integer CPU limits equal to requests, so it gets exclusive dedicated cores.
Lifecycle storage tiering for compliance logs
Hot tier for 7-day query window, lifecycle rules transitioning to infrequent-access then archive, expiration at one year.
Design an automated rollback process when deployment error rates spike
Gate on error-rate and latency thresholds; use blue-green deploys to limit blast radius; require human approval for stateful rollbacks.
Capacity planning for annual traffic spikes
Forecast peak from history, load-test to find per-unit capacity, use autoscaling with pre-warming and headroom, and protect with caching and graceful degradation.
tolerationSeconds and graceful eviction on NoExecute
TolerationSeconds is how long a tolerating pod may stay after the taint applies; once it elapses eviction starts, then terminationGracePeriodSeconds governs the SIGTERM-to-SIGKILL window.
Reducing cross-region data transfer costs
Identify cross-region, cross-AZ, and internet egress; co-locate chatty components; add VPC endpoints, CDN caching, and compression.
How would you use distributed tracing to debug a deployment latency issue?
This tests causal request-path analysis beyond aggregate metrics. A strong answer filters traces by the new version, finds the exact regressed span, and compares it to a pre-deployment baseline.
Little's Law for capacity planning
L equals lambda times W, concurrency equals arrival rate times time in system; rearrange to size threads or concurrency for a target throughput and latency.
Topology spread constraints versus pod anti-affinity
Spread constraints balance pod counts per domain bounded by maxSkew, anti-affinity is all-or-nothing co-location avoidance, and maxSkew caps the difference between fullest and emptiest…
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles