Easy DevOps Interview Questions

Show answer

A process is a running program with its own address space, file descriptors and PID. A thread is a unit of execution inside a process that shares the same memory and open files with other threads. Creating threads is cheaper and they communicate easily, but a bug in one thread can crash the whole process, while separate processes are isolated from each other.

Explain Linux file permissions and what chmod 755 means.

Show answer

Every file has read (4), write (2) and execute (1) bits for three classes: owner, group and others. chmod 755 gives the owner 7 (read, write, execute) and gives group and others 5 (read, execute). It is typical for scripts and directories that everyone may run or enter but only the owner may change. Use ls -l to see permissions.

What is the difference between a hard link and a soft link?

Show answer

A hard link is another directory entry pointing to the same inode, so the data survives until every hard link is deleted; it cannot cross file systems or point to directories. A soft (symbolic) link is a small file that stores a path to the target; it can cross file systems and point to directories, but it breaks if the target is moved or deleted.

How do you manage a service with systemd?

Show answer

systemctl status nginx sudo systemctl start nginx sudo systemctl restart nginx sudo systemctl enable nginx # start at boot sudo systemctl disable nginx journalctl -u nginx -f # follow service logs sudo systemctl daemon-reload # after editing a unit file Unit files live in /etc/systemd/system. enable creates the symlink for the boot target, while start only runs it now.

What is the difference between kill, kill -15 and kill -9?

Show answer

kill sends SIGTERM (15) by default, which asks the process to stop so it can close files, finish requests and clean up. kill -9 sends SIGKILL, which the kernel enforces immediately; the process cannot catch it, so data may be lost and temp files left behind. Always try SIGTERM first and use SIGKILL only when the process does not respond.

Explain stdin, stdout, stderr and what 2>&1 means.

Show answer

Every process gets three file descriptors: 0 is stdin, 1 is stdout and 2 is stderr. > redirects stdout to a file, 2> redirects errors, and 2>&1 sends stderr to wherever stdout currently points. So command > out.log 2>&1 captures both normal output and errors in one file. Order matters: 2>&1 placed before > out.log would still print errors to the terminal.

How do you schedule a cron job to run every day at 2:30 AM?

Show answer

crontab -e # min hour day month weekday command 30 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1 crontab -l # list jobs Use absolute paths because cron runs with a minimal PATH and environment. Redirect output to a log, otherwise errors are mailed or lost. On systemd hosts, timers are an alternative with better logging.

Your app fails to start with 'address already in use' on port 8080. What do you do?

Show answer

Find what is holding the port with ss -ltnp | grep 8080 or lsof -i :8080. If it is an old instance of the same app that did not shut down, stop it gracefully or fix the service manager so only one runs. If it is another service, change one app's port through configuration rather than hard coding. Then restart and confirm with curl localhost:8080.

What is the difference between sudo and su?

Show answer

su switches to another user, usually root, and needs that user's password, giving a full shell as them. sudo runs a single command with elevated rights using your own password, and is controlled by rules in /etc/sudoers. sudo is preferred in teams because each action is logged against the real user and access can be limited to specific commands.

Why do you want to build a career in DevOps?

Show answer

I enjoy both writing code and understanding how systems run in production, and DevOps sits between the two. In my projects I set up a CI pipeline and Docker deployment and liked seeing a change go from commit to live in minutes. I want to keep learning cloud, Kubernetes and automation, and help teams release faster with fewer failures.

What is Git and how is it different from GitHub?

Show answer

Git is a distributed version control system that tracks changes to files; every clone has the full history and works offline. GitHub is a hosting service built around Git that adds remote repositories, pull requests, code review, issues and Actions for CI. Alternatives such as GitLab and Bitbucket offer similar features. You can use Git without GitHub, but not the other way round.

What is the difference between git fetch and git pull?

Show answer

git fetch downloads new commits and branches from the remote into remote-tracking branches like origin/main without touching your working files. git pull is fetch followed by merge (or rebase if configured) into your current branch. Fetch is safer when you want to inspect incoming changes first with git log main..origin/main before integrating them.

What is git stash and when do you use it?

Show answer

git stash saves your uncommitted changes and cleans the working directory, so you can switch branches for an urgent fix. git stash list shows saved entries, git stash pop reapplies the latest and removes it, and git stash apply keeps it. Use git stash -u to include untracked files. It is a short-term tool; for longer work, commit on a branch.

What does git cherry-pick do?

Show answer

git cherry-pick <hash> applies the changes of one specific commit onto your current branch as a new commit. It is useful to bring a hotfix from main into a release branch without merging everything else. Overusing it creates duplicate commits with different hashes and can cause confusing conflicts later, so prefer merging when you need a whole set of changes.

What is .gitignore and how do you stop tracking a file that is already committed?

Show answer

A .gitignore file lists patterns such as node_modules/, *.log or .env that Git should not track. It only affects untracked files, so a file already committed keeps being tracked. To stop tracking it, run git rm --cached <file>, add it to .gitignore and commit. If it held a secret, the old commits still contain it and the secret must be rotated.

How do you undo the last commit but keep the changes?

Show answer

git reset --soft HEAD~1 # undo commit, keep changes staged git reset HEAD~1 # undo commit, keep changes unstaged # only fix the message or add a missed file git add missed-file.txt git commit --amend Use these only on commits not yet pushed. For a pushed commit on a shared branch, use git revert instead.

How do you create a new branch, push it and set the upstream?

Show answer

git switch -c feature/payment-retry # make changes git add . git commit -m "Add retry for failed payments" git push -u origin feature/payment-retry After -u (set upstream), plain git push and git pull work on this branch without naming the remote. Then open a pull request against main.

How do you view the commit history in a compact graph form?

Show answer

git log --oneline --graph --decorate --all # last 10 commits by one author git log --oneline -10 --author="Ravi" # commits touching one file, with diffs git log -p -- src/app.py # who changed each line git blame src/app.py --graph draws branch and merge lines, and --decorate shows branch and tag names next to commits.

How do you create a release tag and push it?

Show answer

git tag -a v1.2.0 -m "Release 1.2.0" git push origin v1.2.0 # push all tags git push origin --tags # list and inspect git tag -l "v1.*" git show v1.2.0 Annotated tags (-a) store author, date and message and are preferred for releases. Many CI pipelines trigger production builds on tags matching v*.

How do you make your commits and pull requests easy for teammates to review?

Show answer

I keep each pull request focused on one change and small enough to review in about fifteen minutes. Commits have clear messages saying what and why. The description explains the problem, the approach, how I tested it and any risk or rollback step. I run linters and tests locally first, and I reply to every review comment, even if just to say done.

What is the difference between continuous integration, continuous delivery and continuous deployment?

Show answer

Continuous integration means developers merge small changes often and every merge is automatically built and tested. Continuous delivery goes further: every passing build is packaged and ready to release, but a human approves the production push. Continuous deployment removes that manual step, so every change that passes all checks goes to production automatically. Each stage needs more test confidence than the last.

What are the typical stages of a CI/CD pipeline?

Show answer

A common pipeline is checkout, build or compile, unit tests, static analysis and security scans, packaging into an artefact or container image, pushing to a registry, deploying to a test or staging environment, running integration or smoke tests, an approval gate, and production deployment with monitoring. Fast checks run first so developers get feedback within minutes and slow tests run later.

What is an artefact repository and why is it used?

Show answer

An artefact repository such as Nexus, JFrog Artifactory or a container registry stores versioned build outputs like JAR files, npm packages and Docker images. The pipeline builds once and promotes the same artefact through dev, staging and production, so what you tested is exactly what you deploy. It also caches public dependencies, speeds up builds and keeps release history for rollbacks.

What is a webhook and how does it trigger a build?

Show answer

A webhook is an HTTP callback: when an event happens in the Git server, such as a push or pull request, it sends a POST request with event details to a configured URL. Jenkins or another CI tool receives it and starts the matching pipeline immediately. This is better than polling the repository every few minutes, which wastes resources and delays feedback.

The build works on your laptop but fails on the CI server. How do you debug it?

Show answer

The environments differ. Compare tool versions such as JDK, Node or Python, environment variables, and dependency versions, especially if there is no lock file. Check for files present locally but not committed, and for hard-coded paths. Reproduce by running the build inside the same Docker image the CI agent uses. Long term, build inside containers so local and CI match.

What is the difference between a container and a virtual machine?

Show answer

A virtual machine runs a full guest operating system on a hypervisor, so it is heavier, takes minutes to boot and uses gigabytes. A container shares the host kernel and isolates only the application and its dependencies using namespaces and cgroups, so it starts in seconds and uses far less memory. VMs give stronger isolation; containers give density and portability.

What is the difference between a Docker image and a container?

Show answer

An image is a read-only template made of layers, containing the application, libraries and configuration, built from a Dockerfile. A container is a running instance of an image with a thin writable layer on top. You can start many containers from one image. Changes made inside a container are lost when it is removed unless they are stored in volumes.

What is the difference between COPY and ADD in a Dockerfile?

Show answer

COPY copies local files and directories into the image and does nothing else. ADD can also download from a URL and automatically extracts local tar archives. Because that extra behaviour can be surprising, best practice is to use COPY by default and ADD only when you specifically want tar extraction. For downloads, use curl in a RUN step so you can verify checksums.

What is Docker Compose?

Show answer

Docker Compose defines and runs multi-container applications from a YAML file, usually compose.yaml. You describe services, networks, volumes, environment variables and dependencies, then start everything with docker compose up. It is ideal for local development and testing, for example an API, database and cache together. For production orchestration across many hosts, teams use Kubernetes instead.

A container exits immediately after it starts. How do you debug it?

Show answer

Run docker ps -a to see the exit code and docker logs <id> for output. Exit code 0 usually means the main process finished, for example a script that ran once or a service started in background mode, so the container has nothing to keep it alive. Non-zero codes point to errors such as missing config. Start an interactive shell with docker run -it --entrypoint sh to inspect.

Database data disappeared after the container was recreated. Why, and how do you fix it?

Show answer

Data written inside the container's writable layer is deleted when the container is removed. The database must store its data directory in a named volume or bind mount, for example -v pgdata:/var/lib/postgresql/data. Then containers can be upgraded or recreated without losing data. Also take regular backups, because volumes protect against container removal, not against disk failure.

Which Docker commands do you use to debug a running container?

Show answer

docker ps # running containers docker logs -f --tail 100 api # follow logs docker exec -it api sh # shell inside docker inspect api # config, IP, mounts, env docker stats # live CPU and memory docker top api # processes inside docker cp api:/app/log.txt . # copy a file out docker events # daemon events Use sh for alpine images, where bash may not exist.

How do you keep yourself updated with new DevOps tools and practices?

Show answer

I follow official release notes for tools I use, such as Kubernetes and Terraform, and read a few engineering blogs and CNCF updates weekly. I learn by doing, so I try new tools in a small home lab or free cloud tier before suggesting them. I also prepare for certifications to structure my learning, and share short notes with my team.

What is Kubernetes and why do companies use it?

Show answer

Kubernetes is an open-source container orchestration platform. You declare the desired state, such as five replicas of an API, and it schedules containers across nodes, restarts failed ones, scales them, balances traffic and rolls out updates. Companies use it to run many microservices reliably on shared infrastructure, on any cloud or on-premises, through managed services like EKS, AKS and GKE.

What is the difference between a Pod, a ReplicaSet and a Deployment?

Show answer

A Pod is the smallest deployable unit: one or more containers sharing network and storage. A ReplicaSet keeps a specified number of identical pods running. A Deployment manages ReplicaSets and adds rolling updates and rollbacks by creating a new ReplicaSet for each version. In practice you create Deployments and rarely touch ReplicaSets or bare pods directly.

What is the difference between a ConfigMap and a Secret?

Show answer

Both inject configuration into pods as environment variables or mounted files, keeping config out of images. ConfigMaps hold non-sensitive data like URLs and feature flags. Secrets hold sensitive values like passwords and tokens; they are only base64 encoded by default, so you should enable encryption at rest, restrict access with RBAC, or use an external secrets manager.

What is a DaemonSet and when is it used?

Show answer

A DaemonSet makes sure one copy of a pod runs on every node, or on a selected group of nodes. When a node joins the cluster, the pod is added automatically. It is used for node-level agents such as log collectors like Fluent Bit, monitoring agents like the Prometheus node exporter, and CNI or storage plugins.

A pod shows ImagePullBackOff. What do you check?

Show answer

The kubelet cannot pull the image. Check the image name and tag for typos and confirm the tag exists in the registry. For private registries, verify an imagePullSecret is set and has valid credentials, or that node IAM roles allow pulling from ECR. Also check network access from nodes to the registry and registry rate limits. kubectl describe pod shows the exact error.

Which kubectl commands do you use most for debugging?

Show answer

kubectl get pods -n shop -o wide kubectl describe pod api-7d9f -n shop kubectl logs api-7d9f -n shop -c api --previous kubectl logs -l app=api -f --tail=50 kubectl exec -it api-7d9f -- sh kubectl get events -n shop --sort-by=.lastTimestamp kubectl top pods -n shop kubectl port-forward svc/api 8080:80 kubectl get endpoints api describe and events usually explain scheduling and startup problems; logs explain application problems.

What is Infrastructure as Code and what are its benefits?

Show answer

Infrastructure as Code means defining servers, networks, databases and other resources in version-controlled files instead of clicking in a console. Benefits are repeatable environments, code review for infrastructure changes, history and rollback through Git, fewer manual mistakes, faster provisioning and easy disaster recovery. Common tools are Terraform and OpenTofu for provisioning and Ansible for configuration management.

Explain the basic Terraform workflow.

Show answer

terraform init downloads providers and modules and configures the backend. terraform fmt and validate check style and syntax. terraform plan shows what will be created, changed or destroyed without making changes. terraform apply executes the plan after confirmation. terraform destroy removes all managed resources. In CI, save the plan with -out and apply that exact plan after review.

Explain Ansible architecture: inventory, modules and playbooks.

Show answer

Ansible runs from a control node and connects to managed hosts over SSH, or WinRM for Windows, with no agent needed. The inventory lists hosts and groups. Modules are units of work like apt, copy or service. Playbooks are YAML files containing plays that map host groups to ordered tasks. Variables, templates with Jinja2 and roles organise larger automation.

How do you define variables and outputs in Terraform?

Show answer

# variables.tf variable "instance_type" { type = string default = "t3.micro" description = "EC2 size" } # outputs.tf output "public_ip" { value = aws_instance.web.public_ip } # use them terraform apply -var="instance_type=t3.small" terraform apply -var-file=prod.tfvars terraform output public_ip Outputs also pass values between modules.

Write an Ansible playbook to install and start nginx.

Show answer

- name: Configure web servers hosts: web become: true tasks: - name: Install nginx ansible.builtin.apt: name: nginx state: present update_cache: true - name: Deploy site config ansible.builtin.template: src: site.conf.j2 dest: /etc/nginx/conf.d/site.conf notify: Reload nginx - name: Ensure nginx is running ansible.builtin.service: name: nginx state: started enabled: true handlers: - name: Reload nginx ansible.builtin.service: name: nginx state: reloaded

How do you write an Ansible inventory and run ad-hoc commands?

Show answer

# inventory.ini [web] web1 ansible_host=10.0.1.10 web2 ansible_host=10.0.1.11 [db] db1 ansible_host=10.0.2.20 [all:vars] ansible_user=ubuntu # ad-hoc commands ansible all -i inventory.ini -m ping ansible web -i inventory.ini -a "uptime" ansible web -i inventory.ini -m apt -a "name=htop state=present" --become Ad-hoc commands suit quick one-off checks; repeatable work belongs in playbooks.

What are AWS Regions, Availability Zones and edge locations?

Show answer

A Region is a geographic area such as ap-south-1 in Mumbai or ap-south-2 in Hyderabad, fully independent from others. Each Region has multiple Availability Zones, which are separate data centres with independent power and networking, linked by low-latency connections. Edge locations are smaller sites used by CloudFront and Route 53 to cache content and answer DNS close to users.

Explain IAM users, groups, roles and policies.

Show answer

An IAM user is an identity for a person or app with long-term credentials. Groups collect users so permissions are managed together. Policies are JSON documents that allow or deny actions on resources. Roles are identities with temporary credentials that are assumed by services, such as EC2 or Lambda, or by users from other accounts. Prefer roles over access keys wherever possible.

What are the S3 storage classes and lifecycle policies?

Show answer

S3 Standard is for frequently accessed data. Standard-IA and One Zone-IA are cheaper for infrequent access but charge retrieval fees. Intelligent-Tiering moves objects automatically based on access. Glacier Instant, Flexible Retrieval and Deep Archive are for archives with slower, cheaper access. Lifecycle rules move objects between classes after a set age and delete old versions or logs automatically.

What is the AWS shared responsibility model?

Show answer

AWS is responsible for security of the cloud: physical data centres, hardware, the network and the hypervisor. The customer is responsible for security in the cloud: IAM, data encryption, OS patching on EC2, security groups and application code. The split shifts with the service; for managed services like RDS or Lambda, AWS handles more of the underlying patching.

Which AWS CLI commands do you commonly use?

Show answer

aws configure aws sts get-caller-identity aws ec2 describe-instances \ --filters Name=instance-state-name,Values=running \ --query 'Reservations[].Instances[].[InstanceId,PrivateIpAddress]' --output table aws s3 cp build.zip s3://acme-artifacts/releases/ aws s3 sync ./site s3://acme-site --delete aws logs tail /aws/lambda/orders --follow get-caller-identity confirms which account and role you are using before you run anything risky.

Write an EC2 user data script that installs and starts a web server on boot.

Show answer

#!/bin/bash set -e dnf update -y dnf install -y nginx systemctl enable --now nginx TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token \ -H 'X-aws-ec2-metadata-token-ttl-seconds: 60') ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \ http://169.254.169.254/latest/meta-data/instance-id) echo "<h1>Served by $ID</h1>" > /usr/share/nginx/html/index.html User data runs once as root on first boot; logs are in /var/log/cloud-init-output.log. This uses IMDSv2.

Tell me about a time you had to learn a new cloud service quickly.

Show answer

Situation: in my internship, the team needed a scheduled job and asked me to use AWS Lambda, which I had never used. Task: deliver it in a week. Action: I went through the official docs and a hands-on tutorial, built a small proof of concept on day two, and asked a senior to review the IAM role. Result: the job went live on time and I documented the setup.

What is the difference between monitoring and observability?

Show answer

Monitoring tracks known metrics and alerts when they cross thresholds, answering whether something is wrong. Observability is the ability to understand any internal state from outside data, answering why, even for problems you did not predict. It rests on three pillars: metrics for trends, logs for detailed events and traces for following one request across services. Good systems need both.

What is the ELK or EFK stack?

Show answer

ELK is Elasticsearch, Logstash and Kibana: Logstash or Beats collect and parse logs, Elasticsearch stores and indexes them, and Kibana provides search and dashboards. EFK replaces Logstash with Fluentd or Fluent Bit, which is common in Kubernetes as a DaemonSet. Centralised logging lets you search across all servers and containers in one place instead of SSH-ing into each.

What is Site Reliability Engineering, and what is toil?

Show answer

SRE, which began at a large search company, applies software engineering to operations: teams own reliability through SLOs, error budgets, automation, incident management and capacity planning. Toil is manual, repetitive, automatable work that grows with scale and adds no lasting value, such as manually restarting services. SRE teams aim to keep toil below about half their time and automate the rest.

You get an alert that the company website is down. What are your first steps?

Show answer

Acknowledge the alert so others know you are on it. Check whether it is really down from outside with curl or an uptime checker, and whether it is all users or one region. Look at recent deployments or changes, then load balancer health, application logs and the database. If a recent change caused it, roll back first. Inform the team and escalate if you cannot fix it quickly.

How do you configure Prometheus to scrape a target?

Show answer

# prometheus.yml global: scrape_interval: 15s scrape_configs: - job_name: node static_configs: - targets: ['10.0.1.10:9100', '10.0.1.11:9100'] - job_name: api metrics_path: /metrics static_configs: - targets: ['api.internal:8080'] # validate and reload promtool check config prometheus.yml curl -X POST http://localhost:9090/-/reload Port 9100 is the node exporter default. In Kubernetes, use service discovery or ServiceMonitors instead.

How much downtime does a 99.9 percent availability SLO allow?

Show answer

Allowed downtime = (1 - SLO) x period 99.9 percent over 30 days: 0.001 x 30 x 24 x 60 = 43.2 minutes per month 99.9 percent over a year = about 8.76 hours 99.95 percent per month = about 21.6 minutes 99.99 percent per month = about 4.3 minutes Each extra nine cuts the budget tenfold and usually needs much more redundancy and automation, so pick an SLO that matches real user needs.

How do you quickly search logs for errors from the last hour on a server or in Kubernetes?

Show answer

# systemd service journalctl -u api --since "1 hour ago" -p err # plain log files grep -i "error" /var/log/app/app.log | tail -50 grep -c "timeout" /var/log/app/app.log # Kubernetes kubectl logs deploy/api --since=1h | grep -i error kubectl logs -l app=api --since=1h --prefix | grep 500 For many hosts, search the central logging tool instead, filtering by service, level and time.

How do you handle the stress of on-call duty?