40 questions with answers for candidates with Freshers — 25 easy, 15 medium.
What interviewers expect: freshers
Fresher interviews test fundamentals more than tool depth. Expect Linux commands, file permissions, processes, basic networking, Git operations, a simple bash script, Dockerfile basics and the idea of CI/CD. Interviewers ask you to explain your projects in detail, so be ready to show a pipeline or Docker deployment you built and explain every step and choice.
This set is weighted towards Git and Version Control (8), CI/CD Pipelines (7), Linux and Shell Scripting (7), Kubernetes (6).
Linux commands and troubleshooting Git workflows Bash scripting Docker basics and one CI/CD project
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Never store secrets in code or the Jenkinsfile. Use the CI tool's encrypted credentials store, such as Jenkins credentials or GitHub Actions secrets, or fetch them at runtime from HashiCorp Vault or AWS Secrets Manager. Prefer short-lived credentials, for example OIDC federation from GitHub Actions to AWS instead of long-lived keys. Mask secrets in logs and give each pipeline only the permissions it needs.
02
You get an alert that the company website is down. What are your first steps?
Acknowledge the alert so others know you are on it. Check whether it is really down from outside with curl or an uptime checker, and whether it is all users or one region. Look at recent deployments or changes, then load balancer health, application logs and the database. If a recent change caused it, roll back first. Inform the team and escalate if you cannot fix it quickly.
03
How do you view the commit history in a compact graph form?
git log --oneline --graph --decorate --all
# last 10 commits by one author
git log --oneline -10 --author="Ravi"
# commits touching one file, with diffs
git log -p -- src/app.py
# who changed each line
git blame src/app.py
--graph draws branch and merge lines, and --decorate shows branch and tag names next to commits.
The control plane has the kube-apiserver, the front door for all requests; etcd, the key-value store holding cluster state; the scheduler, which places pods on nodes; and the controller manager, which runs reconciliation loops. Each worker node runs the kubelet, which starts and monitors pods; kube-proxy, which handles service networking; and a container runtime such as containerd.
05
Write a Docker Compose file for a web app with a PostgreSQL database.
Situation: our team manually cleaned old build artefacts on shared servers every week, which took two hours and sometimes deleted the wrong files. Task: I offered to automate it. Action: I wrote a bash script with dry-run mode, logging and a retention rule, tested it on staging and scheduled it with cron. Result: zero manual effort and no more full-disk alerts for six months.
07
What is the difference between CMD and ENTRYPOINT?
ENTRYPOINT defines the main executable that always runs, while CMD provides default arguments or a default command that can be overridden from docker run. For example, ENTRYPOINT ["python", "app.py"] with CMD ["--port", "8000"] lets users change only the port. Use the exec (JSON array) form so the process runs as PID 1 and receives signals properly.
AWS is responsible for security of the cloud: physical data centres, hardware, the network and the hypervisor. The customer is responsible for security in the cloud: IAM, data encryption, OS patching on EC2, security groups and application code. The split shifts with the service; for managed services like RDS or Lambda, AWS handles more of the underlying patching.
09
How do you undo the last commit but keep the changes?
git reset --soft HEAD~1 # undo commit, keep changes staged
git reset HEAD~1 # undo commit, keep changes unstaged
# only fix the message or add a missed file
git add missed-file.txt
git commit --amend
Use these only on commits not yet pushed. For a pushed commit on a shared branch, use git revert instead.
10
How much downtime does a 99.9 percent availability SLO allow?
Allowed downtime = (1 - SLO) x period
99.9 percent over 30 days:
0.001 x 30 x 24 x 60 = 43.2 minutes per month
99.9 percent over a year = about 8.76 hours
99.95 percent per month = about 21.6 minutes
99.99 percent per month = about 4.3 minutes
Each extra nine cuts the budget tenfold and usually needs much more redundancy and automation, so pick an SLO that matches real user needs.
11
Write an Ansible playbook to install and start nginx.
Git keeps unreferenced commits for a while. Run git reflog to see recent HEAD positions and find the last commit of that branch, or check the hash printed when you deleted it. Then recreate the branch with git branch feature-x <hash>. Reflog is local only, so this works on the same machine, and entries expire after about 90 days by default.
13
Describe how you handled an on-call incident late at night.
Situation: at 2 AM I got an alert that checkout error rates crossed 10 percent. Task: restore service as on-call engineer. Action: I checked dashboards, saw a node pool had scaled down and pods were pending, scaled it manually, and posted updates in the incident channel. Result: errors cleared in 20 minutes, and next day I fixed the autoscaler settings and wrote the post-mortem.
14
A production deployment failed halfway. What do you do?
Assess impact quickly using monitoring and error rates. If users are affected, roll back to the last good version, which should be a single pipeline action redeploying the previous artefact. Communicate status to stakeholders. Then check pipeline logs and application logs to find the cause, fix it in a branch and redeploy. Afterwards, hold a blameless review and add a check to catch it earlier.
15
Write a script that alerts when any disk partition is above 80 percent used.
#!/bin/bash
THRESHOLD=80
df -hP | awk 'NR>1 {gsub("%","",$5); print $5, $6}' | while read -r used mount; do
if [ "$used" -ge "$THRESHOLD" ]; then
echo "WARNING: $mount is ${used}% full on $(hostname)"
fi
done
df -P keeps each entry on one line, awk strips the percent sign, and the loop compares each value with the threshold.
16
How do you find files larger than 100 MB and older than 7 days under /var/log?
find /var/log -type f -size +100M -mtime +7 -exec ls -lh {} +
# compress them instead of just listing
find /var/log -type f -size +100M -mtime +7 -exec gzip {} +
-size +100M matches files above 100 MB, -mtime +7 means modified more than 7 days ago, and -exec with + passes many files to one command call, which is faster than running it once per file.
17
What is a webhook and how does it trigger a build?
A webhook is an HTTP callback: when an event happens in the Git server, such as a push or pull request, it sends a POST request with event details to a configured URL. Jenkins or another CI tool receives it and starts the matching pipeline immediately. This is better than polling the repository every few minutes, which wastes resources and delays feedback.
su switches to another user, usually root, and needs that user's password, giving a full shell as them. sudo runs a single command with elevated rights using your own password, and is controlled by rules in /etc/sudoers. sudo is preferred in teams because each action is logged against the real user and access can be limited to specific commands.
19
What are AWS Regions, Availability Zones and edge locations?
A Region is a geographic area such as ap-south-1 in Mumbai or ap-south-2 in Hyderabad, fully independent from others. Each Region has multiple Availability Zones, which are separate data centres with independent power and networking, linked by low-latency connections. Edge locations are smaller sites used by CloudFront and Route 53 to cache content and answer DNS close to users.
20
Which kubectl commands do you use most for debugging?
S3 Standard is for frequently accessed data. Standard-IA and One Zone-IA are cheaper for infrequent access but charge retrieval fees. Intelligent-Tiering moves objects automatically based on access. Glacier Instant, Flexible Retrieval and Deep Archive are for archives with slower, cheaper access. Lifecycle rules move objects between classes after a set age and delete old versions or logs automatically.
22
Write a declarative Jenkinsfile with build, test and deploy stages.
Infrastructure as Code means defining servers, networks, databases and other resources in version-controlled files instead of clicking in a console. Benefits are repeatable environments, code review for infrastructure changes, history and rollback through Git, fewer manual mistakes, faster provisioning and easy disaster recovery. Common tools are Terraform and OpenTofu for provisioning and Ansible for configuration management.
24
What is .gitignore and how do you stop tracking a file that is already committed?
A .gitignore file lists patterns such as node_modules/, *.log or .env that Git should not track. It only affects untracked files, so a file already committed keeps being tracked. To stop tracking it, run git rm --cached <file>, add it to .gitignore and commit. If it held a secret, the old commits still contain it and the secret must be rotated.
25
How do you schedule a cron job to run every day at 2:30 AM?
crontab -e
# min hour day month weekday command
30 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1
crontab -l # list jobs
Use absolute paths because cron runs with a minimal PATH and environment. Redirect output to a log, otherwise errors are mailed or lost. On systemd hosts, timers are an alternative with better logging.
26
How do you create a new branch, push it and set the upstream?
git switch -c feature/payment-retry
# make changes
git add .
git commit -m "Add retry for failed payments"
git push -u origin feature/payment-retry
After -u (set upstream), plain git push and git pull work on this branch without naming the remote. Then open a pull request against main.
27
The build works on your laptop but fails on the CI server. How do you debug it?
The environments differ. Compare tool versions such as JDK, Node or Python, environment variables, and dependency versions, especially if there is no lock file. Check for files present locally but not committed, and for hard-coded paths. Reproduce by running the build inside the same Docker image the CI agent uses. Long term, build inside containers so local and CI match.
set -e exits the script when any command fails, set -u treats unset variables as errors, and set -o pipefail makes a pipeline fail if any command in it fails, not just the last. Together they stop a script from silently continuing after an error, which matters in CI and deployment scripts. Commands that may fail on purpose need explicit handling such as || true.
All three move the current branch pointer to another commit. --soft keeps your changes staged, useful for recombining commits. --mixed, the default, keeps changes in the working directory but unstaged. --hard discards changes in both staging and working directory, so uncommitted work is lost. Lost commits can usually still be found with git reflog for a while.
git tag -a v1.2.0 -m "Release 1.2.0"
git push origin v1.2.0
# push all tags
git push origin --tags
# list and inspect
git tag -l "v1.*"
git show v1.2.0
Annotated tags (-a) store author, date and message and are preferred for releases. Many CI pipelines trigger production builds on tags matching v*.
31
What is the difference between a Pod, a ReplicaSet and a Deployment?
A Pod is the smallest deployable unit: one or more containers sharing network and storage. A ReplicaSet keeps a specified number of identical pods running. A Deployment manages ReplicaSets and adds rolling updates and rollbacks by creating a new ReplicaSet for each version. In practice you create Deployments and rarely touch ReplicaSets or bare pods directly.
Docker Compose defines and runs multi-container applications from a YAML file, usually compose.yaml. You describe services, networks, volumes, environment variables and dependencies, then start everything with docker compose up. It is ideal for local development and testing, for example an API, database and cache together. For production orchestration across many hosts, teams use Kubernetes instead.
33
What is the difference between a security group and a network ACL?
A security group acts as a firewall for instances or network interfaces. It is stateful, so return traffic is allowed automatically, and it supports only allow rules. A network ACL works at the subnet level, is stateless, so inbound and outbound rules must both allow traffic, supports allow and deny rules, and evaluates rules in number order. Security groups are the main control.
34
Pods are running but the service is not reachable. How do you debug it?
Run kubectl get endpoints <svc>; if empty, the service selector does not match the pod labels or pods are not ready. Check that the service targetPort matches the container port. Test from a debug pod with curl svc-name.namespace:port to separate DNS from app issues. Then check network policies blocking traffic and, for external access, the ingress rules and load balancer health checks.
35
What is the difference between a container and a virtual machine?
A virtual machine runs a full guest operating system on a hypervisor, so it is heavier, takes minutes to boot and uses gigabytes. A container shares the host kernel and isolates only the application and its dependencies using namespaces and cgroups, so it starts in seconds and uses far less memory. VMs give stronger isolation; containers give density and portability.
The kubelet cannot pull the image. Check the image name and tag for typos and confirm the tag exists in the registry. For private registries, verify an imagePullSecret is set and has valid credentials, or that node IAM roles allow pulling from ECR. Also check network access from nodes to the registry and registry rate limits. kubectl describe pod shows the exact error.
37
What is an artefact repository and why is it used?
An artefact repository such as Nexus, JFrog Artifactory or a container registry stores versioned build outputs like JAR files, npm packages and Docker images. The pipeline builds once and promotes the same artefact through dev, staging and production, so what you tested is exactly what you deploy. It also caches public dependencies, speeds up builds and keeps release history for rollbacks.
git cherry-pick <hash> applies the changes of one specific commit onto your current branch as a new commit. It is useful to bring a hotfix from main into a release branch without merging everything else. Overusing it creates duplicate commits with different hashes and can cause confusing conflicts later, so prefer merging when you need a whole set of changes.
39
What is the difference between a hard link and a soft link?
A hard link is another directory entry pointing to the same inode, so the data survives until every hard link is deleted; it cannot cross file systems or point to directories. A soft (symbolic) link is a small file that stores a path to the target; it can cross file systems and point to directories, but it breaks if the target is moved or deleted.
40
What is the difference between continuous integration, continuous delivery and continuous deployment?
Continuous integration means developers merge small changes often and every merge is automatically built and tested. Continuous delivery goes further: every passing build is packaged and ready to release, but a human approves the production push. Continuous deployment removes that manual step, so every change that passes all checks goes to production automatically. Each stage needs more test confidence than the last.
Frequently asked questions
What is asked in DevOps interviews for Freshers?
Fresher interviews test fundamentals more than tool depth. Expect Linux commands, file permissions, processes, basic networking, Git operations, a simple bash script, Dockerfile basics and the idea of CI/CD. Interviewers ask you to explain your projects in detail, so be ready to show a pipeline or Docker deployment you built and explain every step and choice.
How many questions should I practise before a DevOps interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for Freshers?
Focus first on Linux commands and troubleshooting, Git workflows, Bash scripting, Docker basics and one CI/CD project.