Interview questions in DevOps & Cloud, page 7
Essential tags for a request latency metric
Add method, route template, status code, and maybe service or region; they enable slicing while staying low-cardinality.
DNS routing policies for active-passive failover
A failover policy with health checks routes to primary and flips to secondary on failure; keep TTL low; pair with health checks not just policy.
Debugging ImagePullBackOff on a private registry
ImagePullSecrets reference a dockerconfigjson Secret on the pod or service account, kubelet uses it to authenticate, and you inspect events to isolate auth versus name versus network errors.
Explain proxy repositories in artifact managers and the problems they solve
Tests caching and supply-chain resilience in builds. Strong answers cover: local caching of upstream artifacts, shielding CI from external outages, and policy enforcement at the edge.
OpenTelemetry API, SDK, and Collector
API defines vendor-neutral instrumentation, SDK implements and exports it, Collector receives, processes, and routes telemetry to backends.
CDN caching for static and dynamic content
Cache static assets with long TTLs and versioned filenames; bypass or short-cache dynamic per-user responses; invalidate via fingerprinted URLs not purges.
Three techniques to shrink a Docker image
Multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.
Promote an artifact from staging to release without rebuilding it
Tests immutable artifact discipline. Answer: promote by copying the binary or retagging the image digest, never recompiling, because rebuilds introduce dependency drift and untested bits.
Trace context and propagation across services
Trace context bundles trace ID, span ID, and flags; propagated via headers like W3C traceparent so each service extracts and continues the trace.
Site-to-Site VPN vs dedicated interconnect
VPN is quick, cheap, encrypted over public internet with variable latency; Direct Connect or ExpressRoute is a private dedicated link with consistent low latency, high bandwidth, longer lead time and…
Manifest lists and multi-arch images
A manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.
Integrate artifact signing and vulnerability scanning into CI/CD
Build SBOMs, sign with ephemeral keys, scan registries, and enforce policy before deploy.
Redesigning a high-cardinality request metric
Cardinality is unique label combinations; user_id and raw path are unbounded; redesign by dropping user_id and templating the path.
Stable egress IPs for multi-region outbound traffic
Route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist.
Vulnerability scanning as a deploy gate
Scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.
How can artifact management and CI identify affected services and block deployments?
Tests supply chain forensics and CI gating. Strong answers hit: SBOMs mapping transitive blast radius; artifact metadata tracing deployed versions; scan gates and quarantine policies blocking promotion.
Accelerating uncacheable dynamic traffic globally
Terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region.
Reducing cross-region image pull costs
A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.
How do you manage multi-arch container images under a single tag?
This tests image distribution and registry semantics. A strong answer covers manifest lists pointing to per-arch digests, Buildx as the builder driver, and the registry serving correct layer blobs.
When to add custom OpenTelemetry instrumentation
Wrap domain logic in custom spans, attach business attributes like tenant or plan, answer revenue and per-customer questions.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles