Intermediate everything in DevOps & Cloud, page 16
IAST: Inside-Out Runtime Security Scanning
IAST is an inside-out security scanner: an agent in your running app watches data flow to catch vulnerabilities with few false positives. It runs during functional tests, giving precise line-of-code findings. If your tests skip a route, IAST stays blind to it.
Container Image Security Scanning
A container image is a frozen filesystem; scanning unpacks layers to flag known CVEs before deployment. Run it in CI/CD after every build and continuously in production registries. Scanning only at build time misses new CVEs in running images.
Dynamic Secrets: Temporary On-Demand Credentials
Dynamic secrets are temporary credentials minted on demand, not static passwords living in config files. A CI job requests a 15-minute database lease instead of a long-lived env var.
Vault: Centralized Secrets with Dynamic Leasing
Vault is a secrets firewall: it centralizes credentials and issues short-lived leases instead of static keys. Use it when apps need DB passwords not hardcoded. The footgun is using Vault without audit logs, leaving secrets unmonitored.
Terraform Modules: Reusable Infrastructure Blueprints
A Terraform module is a reusable container for related resources, letting you stamp out infrastructure from one blueprint instead of copying HCL. Teams share VPC patterns or tagging standards with them.
GitLab CI/CD: Pipeline as Code
Your .gitlab-ci.yml file turns your repo into an assembly line. Pushes trigger build and test jobs across runners. One missing rules clause can spawn jobs on every branch and explode compute costs.
Dependency Resolution: The Build's Constraint Solver
Dependency resolution finds compatible package versions across transitive requirements. It runs whenever npm, Maven, or pip installs in CI. The footgun is trusting ranges without a lock file; tomorrow's resolve can silently install different code.
End-to-End Testing: Simulate Real User Paths
End-to-end testing exercises the full stack through user flows, catching integration fractures unit tests miss. Run it in staging before releases to verify behavior. The trap is using it for fast feedback; it is slow, brittle, so never abandon unit tests.
Git Tags: Immutable Milestones for Release History
A Git tag is a permanent bookmark on a commit, usually marking releases like v2.0. Annotated tags store author, date, and GPG signatures to anchor deploy pipelines.
Load Balancing Algorithms: How to Pick a Server
Load balancing algorithms are the rules a client uses to pick one server from a pool of identical backends. They're used by web proxies routing user traffic and by microservices calling each other.
Post-Incident Review: Learning from Failure, Blamelessly
A Post-Incident Review (PIR) is a blameless process to learn from an outage, not to assign blame. Use it after a production incident to identify systemic flaws and create action items to prevent repeats.
Escalation Policy: When to Stop Shipping and Start Fixing
An escalation policy is a pre-agreed plan for when to divert engineers from feature work to fix reliability. When a service's error budget burns too fast, the policy's thresholds trigger specific actions. The footgun is thinking a quick rollback is enough.
Time-Series Compression: Storing More with Less
Time-series compression stores data more efficiently by saving the *difference* between consecutive points, not the full values. It's key for managing terabyte-scale monitoring and IoT data, often saving over 90% on storage.
Service Maps: A Live Blueprint of Your Architecture
A service map is a live blueprint of your distributed system, generated from telemetry data. It visualizes service dependencies and health, letting you instantly see an incident's blast radius instead of hunting through Slack for tribal knowledge.
Capacity Planning: Don't Run Out of Room
Capacity planning matches your system's resources to user demand, crucial for handling traffic spikes or budgeting cloud spend. The main footgun is planning for theoretical 'design capacity' instead of realistic 'effective capacity' which accounts for…
Shared Ownership Model: Bridging the Dev/Ops Divide
The shared ownership model ends the tug-of-war between developers wanting to ship and operations teams wanting stability. Both teams share responsibility for service quality, using SLOs as a common language.
SRE Team Topologies: Organizing for Fast Flow
Team Topologies structure teams to speed up value delivery by organizing around the software itself. This model helps scale product organizations, adopt cloud-native architectures, or build a platform engineering function.
Chaos Mesh: Orchestrated Failure for Resilient Systems
Chaos Mesh is a disaster-as-a-service for Kubernetes. It lets you inject failures like network latency or pod kills to test system resilience. Use it to find weaknesses before they impact users, but be warned: its job is to break things, so scope experiments…
Resource Exhaustion: Starving a System to Death
A resource exhaustion attack is a denial-of-service tactic that starves a system by consuming all of a finite resource like CPU or database connections. It exploits missing rate limits or quotas.
Latency Injection: Testing How Your System Handles Slowdown
Latency injection intentionally slows down parts of your system to test its resilience. Use it to validate timeout configurations and circuit breakers before a real network lag causes a cascading failure. The footgun is injecting unrealistic delays.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles