Interview questions in DevOps & Cloud, page 8
IAM Role vs IAM User
A user is a fixed identity with long-lived credentials for a person; a role is assumable with temporary credentials for workloads or cross-account access.
Node, Pod, and Container relationship
A Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management.
What is Pipeline as Code and its benefits over GUI configuration?
Tests whether you treat delivery pipelines as versioned code. Strong answers define PaC as pipeline definitions in source control, citing branch automation, peer review, audit trails, and single source of truth.
Histograms versus summaries for latency
Histograms store bucket counts and stay aggregatable with query-time approximate quantiles; summaries precompute quantiles per instance that cannot be averaged.
Security Groups vs NACLs
A security group is stateful and attached to instances or NICs; a NACL is stateless and applied at the subnet.
Core control plane components
Api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager.
Declarative vs scripted pipeline syntax: when to choose each?
This tests Jenkins Pipeline trade-off judgment. Contrast Declarative's opinionated blocks and guardrails with Scripted's raw Groovy flexibility; prefer Declarative for new projects unless complex flow control is needed.
Granting a VM scoped storage access without static keys
Attach a least-privilege role or managed identity to the VM so it gets auto-rotating temporary credentials scoped to the bucket.
Minimal objects to expose a stateless app
A Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress.
How should you manage sensitive data in a committed pipeline file?
Tests that committed pipeline YAML must never store secrets. Answer: fetch at runtime via native secrets manager integrations; if needed, use masked, hidden, protected CI/CD variables; use typed CI/CD inputs for parameters.
Core components of Prometheus
Server scrapes targets found via service discovery, stores samples in a local time-series database, with Alertmanager and exporters as helpers.
Service-managed vs customer-managed vs BYOK keys
Service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance.
What happens after kubectl apply
Apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back.
How would you reuse pipeline steps across projects using PaC principles?
Tests DRY abstractions and coupling in CI/CD. Good answer: versioned reusable templates or libraries with parameterized inputs, consumed by composition. Red flag: raw copy-paste or one global pipeline forcing lockstep deployments.
High cardinality in time-series databases
Each combination is a separate series consuming memory and index; manage by avoiding unbounded labels and bucketing values.
Automating a no-public-IP governance rule
Use organization-level policy guardrails (SCP, Azure Policy, Org Policy) to deny public IP attachment before creation, applied across all accounts.
etcd as the cluster source of truth
Etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum.
How would you implement conditional logic in a pipeline?
Use if conditions with contexts like github.ref, separate trigger filters from runtime conditions, and add env rules.
Prometheus histogram versus summary
Histograms expose bucket counts and let you compute aggregatable quantiles at query time; summaries compute fixed quantiles per instance that cannot be combined.
Shared responsibility model across service tiers
Provider secures the cloud infrastructure; you secure what you put in it; the line shifts with abstraction. For OS patching, you patch IaaS VMs but the provider patches a managed database OS.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles