Advanced everything in DevOps & Cloud, page 4
Designing a multi-account cloud chargeback model
Account-per-team or mandatory cost-allocation tags enforced by SCPs and tag policies, plus a pipeline over the cost and usage report grouped by tag/account.
Savings Plans vs Reserved Instances for mixed compute
Compute Savings Plans cover EC2, Fargate, and Lambda flexibly; EC2 Instance Plans and RIs trade flexibility for slightly deeper discounts.
Design automated cloud cost optimization
Target idle resources, oversized instances, orphaned storage, and commitment gaps; act via rightsizing and cleanup; safeguard with tagging, scoping, and approvals.
Monitoring with SLOs and error budgets
Define SLIs from the user's view, set SLO targets, derive an error budget, and alert on burn rate rather than raw thresholds.
Strategy for large multi-team IaC projects
Versioned reusable modules, state split per environment and component, promotion of identical code via variables, and externalized secrets.
High-throughput serverless stream processing
Partition by key for per-user ordering, use a sharded log with batched consumers for backpressure, and tune batch size and shards for cost.
Serverless functions with a relational database
Concurrent function instances each open connections and exhaust the database's bounded pool; fix with a connection proxy or pooler, init-phase reuse, or capped concurrency.
Debug intermittent pod-to-pod connectivity
Scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU.
Isolate tenants in a shared Kubernetes cluster
Namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace.
Grant an EKS pod IAM access to S3
IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials.
Migrating a stateful monolith to PaaS
Externalize state to backing services, make processes stateless and disposable, read config from the environment per Twelve-Factor.
Cold starts in serverless environments
A cold start is the delay to provision a fresh instance and initialize the runtime; mitigate with provisioned concurrency and by shrinking init work.
Offload long-running tasks from web requests
Enqueue the job to a queue, return immediately, process with separate workers, report status out of band.
CAP theorem and real database tradeoffs
During a partition you pick consistency or availability, CP systems reject requests, AP systems stay available but stale.
Design a global low-latency database
A distributed store with replicas near users, a tuned consistency level, accepting lag, conflicts, and cross-region cost.
Add a second access pattern to a key-value store
Add a global secondary index on EmailAddress, weighing extra storage, write amplification, and eventual consistency.
Architecting for HIPAA or PCI DSS compliance
Isolate sensitive data in restricted networks and accounts, encrypt at rest and in transit with managed keys, enforce least-privilege access, and keep immutable audit logs.
Centralized logging and threat detection across accounts
Organization-wide trails ship logs to a locked-down central security account, store in immutable append-only storage, and aggregate threat detection findings centrally with least-privilege…
Dynamic database credential rotation for microservices
A secrets manager issues short-lived per-service credentials, services authenticate by workload identity and fetch or refresh secrets without restart, leases expire and rotate automatically.
Accelerating uncacheable dynamic traffic globally
Terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles