Skip to content
DevOps
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

DevOps Engineer Interview Questions & Answers

40 questions for DevOps Engineer interviews — 2 easy, 34 medium, 4 hard.

About the DevOps Engineer role

A DevOps engineer automates the full delivery path from commit to production. They build CI/CD pipelines, containerise applications, run Kubernetes clusters, provision cloud infrastructure with Terraform and set up monitoring and alerts. They work closely with developers to improve release speed and stability and take part in on-call rotations. Most openings ask for two to five years of experience with AWS or Azure and Kubernetes.

CI/CD design Kubernetes operations Terraform AWS services Prometheus and Grafana
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

Write a GitHub Actions workflow that runs tests on every pull request.

CI/CD PipelinesMedium
Save to ▾
Show answer
name: CI on: pull_request: branches: [main] jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 20 cache: npm - run: npm ci - run: npm test Add this as .github/workflows/ci.yml and make the job a required status check in branch protection.
02

You need one pipeline that deploys to dev, staging and production with approval before production. How do you design it?

CI/CD PipelinesMedium
Save to ▾
Show answer
Build and test once, publish a versioned artefact, then promote it through environments. Dev deploys automatically on merge, staging deploys after dev smoke tests, and production waits for a manual approval from authorised people using a Jenkins input step or GitHub environment protection rules. Keep environment-specific settings in config files or parameters, not separate pipelines, and record who approved each release.
03

A pod is stuck in Pending state. What could be the reasons?

KubernetesMedium
Save to ▾
Show answer
Pending means it has not been scheduled or its volumes are not ready. kubectl describe pod shows the scheduler's reason. Common causes are insufficient CPU or memory on nodes for the requests, node selectors, affinity or taints that no node satisfies, a PersistentVolumeClaim that cannot bind, or a resource quota being exceeded. Fix the spec or add nodes with the cluster autoscaler.
04

Tell me about a mistake you made in infrastructure work and what you learned.

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Situation: I applied a Terraform change that renamed a security group, which forced replacement and briefly cut access to a staging database. Task: fix it and prevent repeats. Action: I restored access quickly, explained it openly to my lead, and then added plan review in pull requests plus lifecycle create_before_destroy rules. Result: no similar outage since, and I now read every destroy line in a plan.
05

Write a production-ready Dockerfile for a Node.js application.

Docker and ContainersMedium
Save to ▾
Show answer
FROM node:20-alpine WORKDIR /app ENV NODE_ENV=production COPY package.json package-lock.json ./ RUN npm ci --omit=dev COPY . . USER node EXPOSE 3000 CMD ["node", "server.js"] Dependencies are copied and installed before source code so the layer is cached. npm ci gives reproducible installs, USER node avoids running as root, and exec form CMD lets the app receive signals.
06

Explain the Jenkins controller and agent architecture.

CI/CD PipelinesMedium
Save to ▾
Show answer
The Jenkins controller stores configuration, schedules jobs, serves the UI and keeps build history. Agents are separate machines or containers that actually execute build steps, connected over SSH or JNLP and selected by labels. Running builds on agents rather than the controller keeps the controller stable and secure, and lets you scale with dynamic agents on Kubernetes or cloud VMs that are created per build.
07

Your Docker image is 1.5 GB. How do you reduce its size?

Docker and ContainersMedium
Save to ▾
Show answer
Switch to a slimmer base image such as a slim or distroless variant. Use a multi-stage build so compilers and build caches stay out of the final image. Combine package installs and clean caches in the same RUN layer. Add a .dockerignore to exclude .git, node_modules and test data. Then inspect remaining layers with docker history or the dive tool.
08

How do you manage secrets in a CI/CD pipeline?

CI/CD PipelinesMedium
Save to ▾
Show answer
Never store secrets in code or the Jenkinsfile. Use the CI tool's encrypted credentials store, such as Jenkins credentials or GitHub Actions secrets, or fetch them at runtime from HashiCorp Vault or AWS Secrets Manager. Prefer short-lived credentials, for example OIDC federation from GitHub Actions to AWS instead of long-lived keys. Mask secrets in logs and give each pipeline only the permissions it needs.
09

How do you add a health check to a Docker image?

Docker and ContainersMedium
Save to ▾
Show answer
FROM nginx:1.27-alpine COPY site/ /usr/share/nginx/html/ HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \ CMD wget -qO- http://localhost/ || exit 1 # check status docker inspect --format '{{.State.Health.Status}}' web Docker marks the container healthy or unhealthy. Compose can wait on it with condition: service_healthy. Kubernetes ignores HEALTHCHECK and uses its own probes.
10

What is the difference between declarative and scripted Jenkins pipelines?

CI/CD PipelinesMedium
Save to ▾
Show answer
Both are written in a Jenkinsfile using Groovy. Declarative pipelines use a fixed structure with pipeline, agent, stages, steps and post blocks, which is easy to read, validate and maintain. Scripted pipelines start with node and allow full Groovy logic, giving more flexibility but more room for messy code. Most teams use declarative and drop into a script block only when needed.
11

Compare blue-green, canary and rolling deployments.

CI/CD PipelinesMedium
Save to ▾
Show answer
Blue-green runs two full environments and switches traffic from old to new at once; rollback is instant but costs double capacity. Rolling replaces instances in batches with no extra environment, but old and new versions run together for a while. Canary sends a small share of traffic, say 5 percent, to the new version and widens it as metrics stay healthy, limiting blast radius.
12

Two containers on the same host cannot talk to each other. What do you check?

Docker and ContainersMedium
Save to ▾
Show answer
Check that both are on the same user-defined network with docker network inspect; the default bridge does not resolve container names. Use the service or container name and the container's internal port, not localhost and not the published host port. Confirm the app listens on 0.0.0.0 rather than 127.0.0.1. Then test with curl or nc from inside one container.
13

Describe how you handled an on-call incident late at night.

KubernetesMedium
Save to ▾
Show answer
Situation: at 2 AM I got an alert that checkout error rates crossed 10 percent. Task: restore service as on-call engineer. Action: I checked dashboards, saw a node pool had scaled down and pods were pending, scaled it manually, and posted updates in the incident channel. Result: errors cleared in 20 minutes, and next day I fixed the autoscaler settings and wrote the post-mortem.
14

How do you limit CPU and memory for a container?

Docker and ContainersMedium
Save to ▾
Show answer
docker run -d --name api \ --memory=512m --memory-swap=512m \ --cpus=1.5 \ --restart=unless-stopped \ myapp:1.0 # change limits on a running container docker update --memory=1g --memory-swap=1g api If the process exceeds the memory limit it is OOM killed, so set application heap sizes below the limit. --cpus caps CPU time rather than reserving cores.
15

A pod is in CrashLoopBackOff. How do you troubleshoot it?

KubernetesMedium
Save to ▾
Show answer
The container starts and keeps crashing, and Kubernetes waits longer between restarts. Run kubectl describe pod to see events and exit codes, and kubectl logs <pod> --previous for the crashed container's output. Common causes are missing environment variables or secrets, bad config, failing database connections, a wrong command, an aggressive liveness probe, or exit code 137 meaning OOM kill.
16

Builds fail randomly because of flaky tests. How do you handle it?

CI/CD PipelinesMedium
Save to ▾
Show answer
First identify flaky tests by tracking which tests fail and pass on the same commit. Quarantine them into a separate non-blocking job so the main pipeline stays trustworthy, and raise tickets with owners. Common causes are timing assumptions, shared test data, order dependence and external services. Blind automatic retries hide real bugs, so use them only briefly while fixing the root cause.
17

What is the difference between a security group and a network ACL?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
A security group acts as a firewall for instances or network interfaces. It is stateful, so return traffic is allowed automatically, and it supports only allow rules. A network ACL works at the subnet level, is stateless, so inbound and outbound rules must both allow traffic, supports allow and deny rules, and evaluates rules in number order. Security groups are the main control.
18

How do you perform a rolling update and roll back a Deployment?

KubernetesMedium
Save to ▾
Show answer
# update the image kubectl set image deployment/api api=registry.example.com/api:1.5.0 kubectl rollout status deployment/api # history and rollback kubectl rollout history deployment/api kubectl rollout undo deployment/api kubectl rollout undo deployment/api --to-revision=3 # pause or restart kubectl rollout pause deployment/api kubectl rollout restart deployment/api In GitOps setups, you change the image tag in Git instead and let Argo CD apply it.
19

A production deployment failed halfway. What do you do?

CI/CD PipelinesMedium
Save to ▾
Show answer
Assess impact quickly using monitoring and error rates. If users are affected, roll back to the last good version, which should be a single pipeline action redeploying the previous artefact. Communicate status to stakeholders. Then check pipeline logs and application logs to find the cause, fix it in a branch and redeploy. Afterwards, hold a blameless review and add a check to catch it earlier.
20

How do you run a matrix build in GitHub Actions?

CI/CD PipelinesMedium
Save to ▾
Show answer
jobs: test: runs-on: ${{ matrix.os }} strategy: fail-fast: false matrix: os: [ubuntu-latest, windows-latest] python: ['3.11', '3.12'] steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 with: python-version: ${{ matrix.python }} - run: pip install -r requirements.txt - run: pytest This creates four parallel jobs; fail-fast false lets all finish so you see every failure.
21

What is a DaemonSet and when is it used?

KubernetesEasy
Save to ▾
Show answer
A DaemonSet makes sure one copy of a pod runs on every node, or on a selected group of nodes. When a node joins the cluster, the pod is added automatically. It is used for node-level agents such as log collectors like Fluent Bit, monitoring agents like the Prometheus node exporter, and CNI or storage plugins.
22

What does idempotency mean in Ansible?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Idempotency means running the same playbook many times gives the same result without unwanted changes. Modules check current state first: the apt module installs a package only if missing and reports ok instead of changed. The shell and command modules are not idempotent by default, so use creates, removes or changed_when conditions, or prefer a dedicated module.
23

How do containers work under the hood using namespaces and cgroups?

Docker and ContainersHard
Save to ▾
Show answer
Linux namespaces give each container its own isolated view of process IDs, network interfaces, mount points, hostname, users and IPC, so it believes it is alone on the machine. Control groups (cgroups) limit and account for CPU, memory and I/O usage. A container runtime such as containerd with runc sets these up, plus an overlay file system for image layers.
24

An Ansible playbook run against 100 servers failed on 7 of them. What do you do?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Check the output and the retry file or failed host list to see the error on those hosts, for example unreachable SSH, a missing package repo or full disk. Fix the cause, then rerun only those hosts with --limit. Because tasks are idempotent, rerunning on successful hosts is also safe. For rolling changes, use serial and max_fail_percentage to stop early on failures.
25

Tell me about a production deployment that went wrong and how you handled it.

CI/CD PipelinesHard
Save to ▾
Show answer
Situation: a release passed staging but caused payment timeouts in production because a new connection pool setting was wrong. Task: as release owner, I had to restore service. Action: I triggered the rollback job within ten minutes, updated stakeholders, then found the config difference between environments. Result: service recovered quickly and we added config validation and a canary stage to the pipeline.
26

What is the difference between an Ingress and a Service?

KubernetesMedium
Save to ▾
Show answer
A Service exposes a set of pods at layer 4. An Ingress is a layer 7 HTTP routing resource that maps hostnames and paths to services, for example api.example.com to the api service and /admin to another. It needs an ingress controller such as NGINX or a cloud controller to work. One Ingress with one load balancer can serve many services, and it handles TLS termination.
27

Write a multi-stage Dockerfile for a Java Spring Boot application.

Docker and ContainersMedium
Save to ▾
Show answer
FROM maven:3.9-eclipse-temurin-21 AS build WORKDIR /src COPY pom.xml . RUN mvn -B dependency:go-offline COPY src ./src RUN mvn -B package -DskipTests FROM eclipse-temurin:21-jre-alpine WORKDIR /app COPY --from=build /src/target/*.jar app.jar RUN adduser -D appuser USER appuser EXPOSE 8080 ENTRYPOINT ["java", "-jar", "app.jar"] The final image has only the JRE and the JAR, not Maven or source.
28

Pods are running but the service is not reachable. How do you debug it?

KubernetesMedium
Save to ▾
Show answer
Run kubectl get endpoints <svc>; if empty, the service selector does not match the pod labels or pods are not ready. Check that the service targetPort matches the container port. Test from a debug pod with curl svc-name.namespace:port to separate DNS from app issues. Then check network policies blocking traffic and, for external access, the ingress rules and load balancer health checks.
29

What are Ansible roles?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
A role is a standard folder structure that packages tasks, handlers, templates, files, variables and defaults for one purpose, for example a nginx or postgres role. Playbooks then just list roles for host groups, keeping them short and reusable across projects. Roles can be shared through Ansible Galaxy or collections, and tested with Molecule.
30

What are Ansible handlers and how do you use them?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Handlers are tasks that run only when notified by another task that reported a change, and they run once at the end of the play even if notified many times. tasks: - name: Update app config ansible.builtin.copy: src: app.conf dest: /etc/app/app.conf notify: Restart app handlers: - name: Restart app ansible.builtin.service: name: app state: restarted This avoids restarting services when nothing changed.
31

The kernel OOM killer keeps killing your application. How do you handle it?

Linux and Shell ScriptingHard
Save to ▾
Show answer
Confirm with dmesg or journalctl -k, which shows the OOM message and the killed process. Check whether memory grows over time (a leak) or spikes with load. Set correct heap limits, for example JVM -Xmx below container memory, add swap only as a buffer, and set memory limits so one service cannot starve others. Then profile the app and right-size the instance.
32

How do Docker image layers and build caching work?

Docker and ContainersMedium
Save to ▾
Show answer
Each Dockerfile instruction like RUN, COPY or ADD creates a layer. Docker caches layers and reuses them if the instruction and its inputs have not changed; once one layer changes, all later layers rebuild. So copy dependency files and install dependencies first, then copy source code. That way code changes do not reinstall all packages, and builds become much faster.
33

The host disk is filling up because of Docker. How do you clean up and prevent it?

Docker and ContainersMedium
Save to ▾
Show answer
Check usage with docker system df. Remove stopped containers, dangling images and unused networks with docker system prune, and old build cache with docker builder prune; be careful with the volumes flag. Container logs are a common culprit, so configure log rotation with max-size and max-file in daemon.json. In CI agents, schedule regular pruning jobs.
34

Explain Ansible architecture: inventory, modules and playbooks.

Infrastructure as Code (Terraform and Ansible)Easy
Save to ▾
Show answer
Ansible runs from a control node and connects to managed hosts over SSH, or WinRM for Windows, with no agent needed. The inventory lists hosts and groups. Modules are units of work like apt, copy or service. Playbooks are YAML files containing plays that map host groups to ordered tasks. Variables, templates with Jinja2 and roles organise larger automation.
35

What are the best practices for securing Docker images?

Docker and ContainersHard
Save to ▾
Show answer
Use small, trusted base images such as distroless or alpine and pin versions or digests. Run as a non-root user, use multi-stage builds, and never bake secrets into layers. Scan images with Trivy or similar in CI and rebuild regularly to pick up patches. At runtime, drop Linux capabilities, use read-only root file systems and sign images to verify their source.
36

How do you use stored credentials inside a Jenkins pipeline?

CI/CD PipelinesMedium
Save to ▾
Show answer
pipeline { agent any environment { SONAR_TOKEN = credentials('sonar-token') } stages { stage('Push') { steps { withCredentials([usernamePassword(credentialsId: 'docker-hub', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $PASS | docker login -u $USER --password-stdin' } } } } } Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.
37

How do you build and push a Docker image from a pipeline?

CI/CD PipelinesMedium
Save to ▾
Show answer
# shell steps in any CI tool IMAGE=registry.example.com/shop/api TAG=$(git rev-parse --short HEAD) echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin docker build -t $IMAGE:$TAG . docker push $IMAGE:$TAG Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.
38

Explain Docker network types.

Docker and ContainersMedium
Save to ▾
Show answer
bridge is the default: containers get private IPs on a virtual bridge and reach outside through NAT; user-defined bridges also provide DNS by container name. host shares the host's network stack directly, with no port mapping. none disables networking. overlay connects containers across multiple hosts in Swarm. macvlan gives a container its own MAC address on the physical network.
39

What is the difference between count and for_each in Terraform?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
count creates N copies indexed by number, such as aws_instance.web[0]. Removing an item in the middle shifts indexes and can destroy and recreate resources unexpectedly. for_each iterates over a map or set of strings and keys each instance by name, such as aws_s3_bucket.b["logs"], so adding or removing one item affects only that item. Prefer for_each for named collections.
40

How do you handle pressure when a release is blocked close to a deadline?

CI/CD PipelinesMedium
Save to ▾
Show answer
Situation: a security scan blocked our release one day before a client demo. Task: ship without ignoring the risk. Action: I checked the finding, confirmed it was a real vulnerable library, upgraded it, ran the full test suite and kept the product manager updated every few hours. Result: we released on time, and I added weekly dependency scans to avoid last-minute surprises.

Frequently asked questions

What does a DevOps Engineer do?

A DevOps engineer automates the full delivery path from commit to production. They build CI/CD pipelines, containerise applications, run Kubernetes clusters, provision cloud infrastructure with Terraform and set up monitoring and alerts. They work closely with developers to improve release speed and stability and take part in on-call rotations. Most openings ask for two to five years of experience with AWS or Azure and Kubernetes.

Which skills are tested in a DevOps Engineer interview?

Expect questions on CI/CD design, Kubernetes operations, Terraform, AWS services, Prometheus and Grafana. Most rounds also ask you to explain a project and solve one practical problem live.

How do I prepare for a DevOps Engineer interview?

Revise CI/CD Pipelines, Docker and Containers, Kubernetes, Infrastructure as Code (Terraform and Ansible) first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.

Topic sheets for this role

CI/CD Pipelines questionsDocker and Containers questionsKubernetes questionsInfrastructure as Code (Terraform and Ansible) questions

Other roles

Junior DevOps EngineerBuild and Release EngineerCloud EngineerSite Reliability EngineerPlatform Engineer

More ways to practise

Company-wise DevOps questionsExperience-wise DevOps questionsRole-wise DevOps questionsCity-wise DevOps questionsMost asked DevOps questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsDevOps mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsDevOps topic sheets