40 questions with answers for candidates with 3 years of experience — 3 easy, 34 medium, 3 hard.
What interviewers expect: 3 years experience
Three-year candidates are expected to work independently on infrastructure end to end. Interviews include designing a CI/CD and Kubernetes setup from scratch, VPC and IAM design, autoscaling, GitOps, DevSecOps scanning and incident handling. You should explain trade-offs, not just commands, and describe improvements you led with measurable results such as faster builds or lower costs.
This set is weighted towards CI/CD Pipelines (8), AWS Cloud for DevOps (7), Linux and Shell Scripting (6), Kubernetes (6).
End-to-end pipeline design AWS networking and IAM GitOps and security scanning Incident response
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
You suddenly cannot SSH into a Linux server. What do you check?
Check reachability with ping and whether port 22 is open with nc -zv host 22. Then look at security groups, firewall rules and whether the sshd service is running, using the cloud console or serial access. Run ssh -vvv to see whether it fails at key exchange or authentication. Common causes are wrong key permissions, a full disk, a changed IP, or fail2ban blocking you.
02
Write an IAM policy that gives read-only access to one S3 bucket.
A Pod is the smallest deployable unit: one or more containers sharing network and storage. A ReplicaSet keeps a specified number of identical pods running. A Deployment manages ReplicaSets and adds rolling updates and rollbacks by creating a new ReplicaSet for each version. In practice you create Deployments and rarely touch ReplicaSets or bare pods directly.
05
How do you assume an IAM role in another account using the AWS CLI?
# ~/.aws/config
[profile prod-admin]
role_arn = arn:aws:iam::123456789012:role/DevOpsAdmin
source_profile = default
region = ap-south-1
aws s3 ls --profile prod-admin
# manual way
aws sts assume-role \
--role-arn arn:aws:iam::123456789012:role/DevOpsAdmin \
--role-session-name ravi-session
The role's trust policy must allow your account. Temporary credentials expire, usually after an hour.
06
How do you handle pressure when a release is blocked close to a deadline?
Situation: a security scan blocked our release one day before a client demo. Task: ship without ignoring the risk. Action: I checked the finding, confirmed it was a real vulnerable library, upgraded it, ran the full test suite and kept the product manager updated every few hours. Result: we released on time, and I added weekly dependency scans to avoid last-minute surprises.
07
Builds fail randomly because of flaky tests. How do you handle it?
First identify flaky tests by tracking which tests fail and pass on the same commit. Quarantine them into a separate non-blocking job so the main pipeline stays trustworthy, and raise tickets with owners. Common causes are timing assumptions, shared test data, order dependence and external services. Blind automatic retries hide real bugs, so use them only briefly while fixing the root cause.
08
An Ansible playbook run against 100 servers failed on 7 of them. What do you do?
Check the output and the retry file or failed host list to see the error on those hosts, for example unreachable SSH, a missing package repo or full disk. Fix the cause, then rerun only those hosts with --limit. Because tasks are idempotent, rerunning on successful hosts is also safe. For rolling changes, use serial and max_fail_percentage to stop early on failures.
09
Write PromQL queries for request rate, error rate and p95 latency.
# requests per second per service over 5 minutes
sum by (service) (rate(http_requests_total[5m]))
# error ratio (5xx)
sum(rate(http_requests_total{status=~"5.."}[5m]))
/ sum(rate(http_requests_total[5m]))
# p95 latency from a histogram
histogram_quantile(0.95,
sum by (le) (rate(http_request_duration_seconds_bucket[5m])))
rate() works on counters and handles resets; the le label holds histogram bucket bounds.
A liveness probe checks whether the container is healthy; if it fails, the kubelet restarts it. A readiness probe checks whether it can serve traffic; if it fails, the pod is removed from service endpoints but not restarted. A startup probe gives slow-starting apps time to boot and holds off the other probes until it succeeds. Wrong liveness probes can cause restart loops.
11
How do you create an EKS cluster with eksctl and connect kubectl to it?
Blue-green runs two full environments and switches traffic from old to new at once; rollback is instant but costs double capacity. Rolling replaces instances in batches with no extra environment, but old and new versions run together for a while. Canary sends a small share of traffic, say 5 percent, to the new version and widens it as metrics stay healthy, limiting blast radius.
13
How would you plan disaster recovery for a complete AWS region failure?
Start from business RTO and RPO. Options range from backup and restore, which is cheapest and slowest, to pilot light, warm standby and multi-region active-active. Replicate data with S3 cross-region replication, Aurora Global Database or DynamoDB global tables, keep infrastructure in Terraform so it can be rebuilt, use Route 53 failover routing and rehearse failover drills.
bridge is the default: containers get private IPs on a virtual bridge and reach outside through NAT; user-defined bridges also provide DNS by container name. host shares the host's network stack directly, with no port mapping. none disables networking. overlay connects containers across multiple hosts in Swarm. macvlan gives a container its own MAC address on the physical network.
15
How do Docker image layers and build caching work?
Each Dockerfile instruction like RUN, COPY or ADD creates a layer. Docker caches layers and reuses them if the instruction and its inputs have not changed; once one layer changes, all later layers rebuild. So copy dependency files and install dependencies first, then copy source code. That way code changes do not reinstall all packages, and builds become much faster.
Idempotency means running the same playbook many times gives the same result without unwanted changes. Modules check current state first: the apt module installs a package only if missing and reports ok instead of changed. The shell and command modules are not idempotent by default, so use creates, removes or changed_when conditions, or prefer a dedicated module.
A VPC is your private network with a CIDR range like 10.0.0.0/16. It is split into subnets in each Availability Zone. Public subnets have a route to an Internet Gateway; private subnets reach the internet only through a NAT Gateway in a public subnet. Route tables control traffic, security groups and NACLs filter it, and VPC endpoints give private access to services like S3.
18
You need to bring existing manually created cloud resources under Terraform. How?
Write the resource blocks in code, then import the real resources into state. Since Terraform 1.5 you can declare import blocks with the resource ID and run plan; terraform plan -generate-config-out can even draft the configuration. Older versions use the terraform import CLI command. Run plan until it shows no changes, which proves code matches reality.
19
Explain the Jenkins controller and agent architecture.
The Jenkins controller stores configuration, schedules jobs, serves the UI and keeps build history. Agents are separate machines or containers that actually execute build steps, connected over SSH or JNLP and selected by labels. Running builds on agents rather than the controller keeps the controller stable and secure, and lets you scale with dynamic agents on Kubernetes or cloud VMs that are created per build.
20
Write a multi-stage Dockerfile for a Java Spring Boot application.
FROM maven:3.9-eclipse-temurin-21 AS build
WORKDIR /src
COPY pom.xml .
RUN mvn -B dependency:go-offline
COPY src ./src
RUN mvn -B package -DskipTests
FROM eclipse-temurin:21-jre-alpine
WORKDIR /app
COPY --from=build /src/target/*.jar app.jar
RUN adduser -D appuser
USER appuser
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]
The final image has only the JRE and the JAR, not Maven or source.
21
How do you perform a rolling update and roll back a Deployment?
# update the image
kubectl set image deployment/api api=registry.example.com/api:1.5.0
kubectl rollout status deployment/api
# history and rollback
kubectl rollout history deployment/api
kubectl rollout undo deployment/api
kubectl rollout undo deployment/api --to-revision=3
# pause or restart
kubectl rollout pause deployment/api
kubectl rollout restart deployment/api
In GitOps setups, you change the image tag in Git instead and let Argo CD apply it.
22
How do an Application Load Balancer and an Auto Scaling group work together?
The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.
23
What is the difference between count and for_each in Terraform?
count creates N copies indexed by number, such as aws_instance.web[0]. Removing an item in the middle shifts indexes and can destroy and recreate resources unexpectedly. for_each iterates over a map or set of strings and keys each instance by name, such as aws_s3_bucket.b["logs"], so adding or removing one item affects only that item. Prefer for_each for named collections.
24
A pod is stuck in Pending state. What could be the reasons?
Pending means it has not been scheduled or its volumes are not ready. kubectl describe pod shows the scheduler's reason. Common causes are insufficient CPU or memory on nodes for the requests, node selectors, affinity or taints that no node satisfies, a PersistentVolumeClaim that cannot bind, or a resource quota being exceeded. Fix the spec or add nodes with the cluster autoscaler.
25
A production deployment failed halfway. What do you do?
Assess impact quickly using monitoring and error rates. If users are affected, roll back to the last good version, which should be a single pipeline action redeploying the previous artefact. Communicate status to stakeholders. Then check pipeline logs and application logs to find the cause, fix it in a branch and redeploy. Afterwards, hold a blameless review and add a check to catch it earlier.
26
What are Git hooks and how are they used in DevOps?
Hooks are scripts Git runs at events such as pre-commit, commit-msg and pre-push on the client, or pre-receive on the server. Teams use them to run linters, format code, block secrets or enforce commit message formats before code leaves a laptop. Client hooks are not shared by default, so tools like pre-commit or Husky manage them, and CI repeats the checks.
RBAC controls who can do what on which resources. A Role defines allowed verbs like get, list or create on resources within a namespace; a ClusterRole does so cluster-wide. RoleBindings and ClusterRoleBindings attach those roles to users, groups or service accounts. Follow least privilege: give each application its own service account with only the permissions it needs.
28
What is an artefact repository and why is it used?
An artefact repository such as Nexus, JFrog Artifactory or a container registry stores versioned build outputs like JAR files, npm packages and Docker images. The pipeline builds once and promotes the same artefact through dev, staging and production, so what you tested is exactly what you deploy. It also caches public dependencies, speeds up builds and keeps release history for rollbacks.
An SLI is a measured indicator, for example the share of requests served under 300 ms. An SLO is the internal target for it, such as 99.9 percent over 30 days. An SLA is the external contract with penalties, usually looser than the SLO. The error budget is the allowed unreliability, 0.1 percent here; while budget remains teams ship features, and when it runs out they focus on reliability.
30
You deleted a local branch that had unmerged commits. How do you recover it?
Git keeps unreferenced commits for a while. Run git reflog to see recent HEAD positions and find the last commit of that branch, or check the hash printed when you deleted it. Then recreate the branch with git branch feature-x <hash>. Reflog is local only, so this works on the same machine, and entries expire after about 90 days by default.
set -e exits the script when any command fails, set -u treats unset variables as errors, and set -o pipefail makes a pipeline fail if any command in it fails, not just the last. Together they stop a script from silently continuing after an error, which matters in CI and deployment scripts. Commands that may fail on purpose need explicit handling such as || true.
32
A production server is very slow. How do you troubleshoot high CPU usage?
Start with uptime and top or htop to see load and which processes use CPU. Check whether it is user, system or iowait time, and use pidstat or ps -eo pid,pcpu,cmd --sort=-pcpu for detail. For a Java process, take thread dumps; for others, use perf or strace. Correlate with recent deployments, cron jobs or traffic spikes before deciding to scale, roll back or fix code.
33
Write a Prometheus alerting rule for a high error rate.
Git marks conflicting files and inserts markers showing both versions. Open each file, decide the correct final code, often combining both sides after talking to the other author, and remove the markers. Then git add the files and finish with git commit or git rebase --continue. Run tests before pushing, because a conflict resolved without errors can still break logic.
35
Tell me about a time you automated a repetitive manual task.
Situation: our team manually cleaned old build artefacts on shared servers every week, which took two hours and sometimes deleted the wrong files. Task: I offered to automate it. Action: I wrote a bash script with dry-run mode, logging and a retention rule, tested it on staging and scheduled it with cron. Result: zero manual effort and no more full-disk alerts for six months.
36
Write a bash script that checks whether a service is running and restarts it if not.
#!/bin/bash
set -u
SERVICE="nginx"
if ! systemctl is-active --quiet "$SERVICE"; then
echo "$(date) $SERVICE down, restarting" >> /var/log/svc-check.log
systemctl restart "$SERVICE"
if ! systemctl is-active --quiet "$SERVICE"; then
echo "$SERVICE failed to start" | mail -s "ALERT" ops@example.com
fi
fi
Run it from cron every few minutes; a real setup would rely on systemd Restart= plus monitoring.
37
How do you use stored credentials inside a Jenkins pipeline?
pipeline {
agent any
environment {
SONAR_TOKEN = credentials('sonar-token')
}
stages {
stage('Push') {
steps {
withCredentials([usernamePassword(credentialsId: 'docker-hub',
usernameVariable: 'USER', passwordVariable: 'PASS')]) {
sh 'echo $PASS | docker login -u $USER --password-stdin'
}
}
}
}
}
Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.
38
How do you prioritise when several teams ask you for infrastructure work at the same time?
I list the requests with their business impact and deadline, and check which are blocking production or a release. Production issues and security fixes come first. For the rest I agree priority with my lead and the requesting teams openly, give realistic timelines and share progress. Where requests repeat, I build self-service templates so teams are not waiting on me.
Kubernetes is an open-source container orchestration platform. You declare the desired state, such as five replicas of an API, and it schedules containers across nodes, restarts failed ones, scales them, balances traffic and rolls out updates. Companies use it to run many microservices reliably on shared infrastructure, on any cloud or on-premises, through managed services like EKS, AKS and GKE.
A zombie is a process that has exited but whose parent has not yet read its exit status with wait(), so it still holds a PID entry and shows state Z. An orphan is a running process whose parent died; it is adopted by PID 1, which reaps it later. Many zombies indicate a buggy parent; fixing or restarting the parent clears them.
Frequently asked questions
What is asked in DevOps interviews for 3 years of experience?
Three-year candidates are expected to work independently on infrastructure end to end. Interviews include designing a CI/CD and Kubernetes setup from scratch, VPC and IAM design, autoscaling, GitOps, DevSecOps scanning and incident handling. You should explain trade-offs, not just commands, and describe improvements you led with measurable results such as faster builds or lower costs.
How many questions should I practise before a DevOps interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 3 years of experience?
Focus first on End-to-end pipeline design, AWS networking and IAM, GitOps and security scanning, Incident response.