A platform engineer builds an internal developer platform so product teams can ship without worrying about infrastructure. They create golden paths: reusable Terraform modules, Helm charts, standard pipelines, GitOps with Argo CD, self-service environments and guardrails for security and cost. The role is senior and needs broad DevOps experience, strong Kubernetes skills and the ability to treat developers as customers of the platform.
Internal developer platforms GitOps with Argo CD Kubernetes multi-tenancy Reusable IaC modules Policy as code
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you use stored credentials inside a Jenkins pipeline?
pipeline {
agent any
environment {
SONAR_TOKEN = credentials('sonar-token')
}
stages {
stage('Push') {
steps {
withCredentials([usernamePassword(credentialsId: 'docker-hub',
usernameVariable: 'USER', passwordVariable: 'PASS')]) {
sh 'echo $PASS | docker login -u $USER --password-stdin'
}
}
}
}
}
Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.
02
How do you build and push a Docker image from a pipeline?
# shell steps in any CI tool
IMAGE=registry.example.com/shop/api
TAG=$(git rev-parse --short HEAD)
echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin
docker build -t $IMAGE:$TAG .
docker push $IMAGE:$TAG
Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.
03
What are Ansible handlers and how do you use them?
Handlers are tasks that run only when notified by another task that reported a change, and they run once at the end of the play even if notified many times.
tasks:
- name: Update app config
ansible.builtin.copy:
src: app.conf
dest: /etc/app/app.conf
notify: Restart app
handlers:
- name: Restart app
ansible.builtin.service:
name: app
state: restarted
This avoids restarting services when nothing changed.
04
You need one pipeline that deploys to dev, staging and production with approval before production. How do you design it?
Build and test once, publish a versioned artefact, then promote it through environments. Dev deploys automatically on merge, staging deploys after dev smoke tests, and production waits for a manual approval from authorised people using a Jenkins input step or GitHub environment protection rules. Keep environment-specific settings in config files or parameters, not separate pipelines, and record who approved each release.
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm install my-redis bitnami/redis -n cache --create-namespace
helm upgrade my-redis bitnami/redis -f values-prod.yaml
helm list -A
helm rollback my-redis 1
helm uninstall my-redis -n cache
helm template ./mychart -f values.yaml # render locally
Helm is the package manager for Kubernetes. A chart is a set of templated manifests, and values files customise it per environment.
06
What is remote state and state locking in Terraform?
Remote state stores the state file in a shared backend such as an S3 bucket, Azure Storage or Terraform Cloud, so the whole team and CI use the same state. Locking prevents two runs from changing state at the same time, avoiding corruption; on S3 it uses a lock file or a DynamoDB table. Enable versioning and encryption on the backend for recovery and security.
07
What are resource requests and limits, and what are QoS classes?
Requests are what the scheduler reserves for a container when placing it on a node; limits are the maximum it may use. Exceeding a CPU limit causes throttling, while exceeding a memory limit gets the container OOM killed. Pods are Guaranteed when requests equal limits, Burstable when requests are lower, and BestEffort with none; BestEffort pods are evicted first under node pressure.
08
A developer accidentally pushed an AWS access key to a public repository. What do you do?
Treat the key as compromised immediately: deactivate and rotate it in IAM, then check CloudTrail for misuse. Removing it from history comes second, using git filter-repo or BFG and a force push, and asking everyone to re-clone. Then prevent repeats with secret scanning in CI, pre-commit hooks like gitleaks and storing secrets in a vault or secrets manager instead of code.
09
Pods are running but the service is not reachable. How do you debug it?
Run kubectl get endpoints <svc>; if empty, the service selector does not match the pod labels or pods are not ready. Check that the service targetPort matches the container port. Test from a debug pod with curl svc-name.namespace:port to separate DNS from app issues. Then check network policies blocking traffic and, for external access, the ingress rules and load balancer health checks.
10
How do you handle secrets in Terraform and Ansible?
Do not hard-code secrets in .tf files or playbooks. In Terraform, read them from AWS Secrets Manager or Vault data sources, mark variables sensitive, and protect state because it may still hold values. In Ansible, encrypt secret variable files with ansible-vault and supply the vault password from CI secrets, or look up values from Vault at runtime. Rotate anything exposed in Git.
11
Tell me about a production deployment that went wrong and how you handled it.
Situation: a release passed staging but caused payment timeouts in production because a new connection pool setting was wrong. Task: as release owner, I had to restore service. Action: I triggered the rollback job within ten minutes, updated stakeholders, then found the config difference between environments. Result: service recovered quickly and we added config validation and a canary stage to the pipeline.
Run kubectl describe node to see conditions such as MemoryPressure, DiskPressure or a kubelet that stopped posting status. SSH in and check systemctl status kubelet, the container runtime, journalctl -u kubelet, disk space and network to the API server. Pods on the node are evicted after a timeout. Cordon and drain it, fix or replace the node, and in cloud setups let the node group recreate it.
13
How do you work with developers who resist new DevOps processes?
Situation: a team saw our new pipeline checks as slowing them down. Task: get adoption without forcing it. Action: I sat with them to understand the pain, found that the scans added twelve minutes, moved slow scans to run in parallel and made results clearer. Result: pipeline time went below the old one, the team adopted it and later suggested further improvements.
14
What is DevSecOps and which security checks belong in a pipeline?
DevSecOps moves security earlier into the delivery process instead of a final audit. A pipeline typically adds secret scanning, static code analysis (SAST) with tools like SonarQube, dependency scanning (SCA) for vulnerable libraries, container image scanning with Trivy, infrastructure-as-code checks with Checkov, and sometimes dynamic testing (DAST) on staging. Critical findings fail the build, while lower ones create tickets.
15
Someone made an S3 bucket with customer files public. What do you do?
Immediately block public access on the bucket and remove the public policy or ACLs. Check S3 server access logs or CloudTrail data events to see whether objects were downloaded, and involve security if customer data was exposed. Then enable Block Public Access at the account level, use AWS Config rules to detect public buckets, and require bucket changes through reviewed IaC.
16
Compare blue-green, canary and rolling deployments.
Blue-green runs two full environments and switches traffic from old to new at once; rollback is instant but costs double capacity. Rolling replaces instances in batches with no extra environment, but old and new versions run together for a while. Canary sends a small share of traffic, say 5 percent, to the new version and widens it as metrics stay healthy, limiting blast radius.
17
How do you configure an S3 remote backend with locking?
terraform {
backend "s3" {
bucket = "acme-terraform-state"
key = "prod/network/terraform.tfstate"
region = "ap-south-1"
encrypt = true
use_lockfile = true
}
}
Then run terraform init (add -migrate-state if moving local state). Enable versioning on the bucket. Older setups use dynamodb_table = "tf-locks" instead of use_lockfile for locking.
18
What is configuration drift and how do you detect it with Terraform?
Drift is when real infrastructure differs from code, usually because someone changed it manually in the console. terraform plan, or plan -refresh-only, shows differences between state and reality. Teams run scheduled plans in CI and alert on any diff. Prevent drift by restricting console write access, applying only through pipelines, and either reverting manual changes or codifying them.
19
During rolling updates some user requests fail. How do you get true zero-downtime deployments?
Add a proper readiness probe so new pods get traffic only when ready. Set maxUnavailable to 0 and maxSurge to 1 or more. Handle SIGTERM gracefully and add a short preStop sleep so endpoints update before the old pod stops accepting connections, with terminationGracePeriodSeconds long enough to drain requests. Add a PodDisruptionBudget for node maintenance too.
GitOps uses a Git repository as the single source of truth for the desired state of infrastructure and applications. An agent running in the cluster, such as Argo CD or Flux, continuously compares the live state with Git and pulls changes to reconcile drift. Deployments become pull requests, giving review, audit history and easy rollback by reverting a commit. CI builds images; GitOps handles deployment.
Never store secrets in code or the Jenkinsfile. Use the CI tool's encrypted credentials store, such as Jenkins credentials or GitHub Actions secrets, or fetch them at runtime from HashiCorp Vault or AWS Secrets Manager. Prefer short-lived credentials, for example OIDC federation from GitHub Actions to AWS instead of long-lived keys. Mask secrets in logs and give each pipeline only the permissions it needs.
22
How do you design a highly available web application on AWS?
Spread every tier across at least two Availability Zones. Put an ALB in front of an Auto Scaling group of stateless instances or containers. Use RDS Multi-AZ or Aurora for the database and ElastiCache for sessions. Serve static content from S3 through CloudFront and use Route 53 health checks. Remove single points of failure and test failover regularly.
23
The monthly AWS bill suddenly doubled. How do you investigate and fix it?
Open Cost Explorer and group by service, account and tag to find the spike, then drill into usage type. Common causes are forgotten instances, unattached EBS volumes, NAT Gateway data transfer, oversized RDS, or logs retained forever. Fix the source, then set AWS Budgets alerts, enforce tagging, right-size using Compute Optimizer, and use Savings Plans or Spot for steady or batch workloads.
The HPA periodically reads metrics from the metrics server or a custom metrics adapter and changes the replica count of a Deployment or StatefulSet to keep a target, for example 70 percent average CPU. It calculates desired replicas from current usage divided by the target, within min and max bounds, with stabilisation windows to avoid flapping. CPU-based HPA needs resource requests set.
25
What is the difference between an Ingress and a Service?
A Service exposes a set of pods at layer 4. An Ingress is a layer 7 HTTP routing resource that maps hostnames and paths to services, for example api.example.com to the api service and /admin to another. It needs an ingress controller such as NGINX or a cloud controller to work. One Ingress with one load balancer can serve many services, and it handles TLS termination.
26
The Jenkins controller is slow and builds keep queueing. What do you do?
Make sure no builds run on the controller by setting its executors to zero. Add agents, ideally dynamic ones on Kubernetes or EC2 that scale with the queue. Check controller heap, disk and plugin count, and remove unused plugins. Discard old builds and artefacts with retention rules. For very large setups, split teams across multiple controllers or move suitable jobs to another CI tool.
27
You need to bring existing manually created cloud resources under Terraform. How?
Write the resource blocks in code, then import the real resources into state. Since Terraform 1.5 you can declare import blocks with the resource ID and run plan; terraform plan -generate-config-out can even draft the configuration. Older versions use the terraform import CLI command. Run plan until it shows no changes, which proves code matches reality.
28
A pod is in CrashLoopBackOff. How do you troubleshoot it?
The container starts and keeps crashing, and Kubernetes waits longer between restarts. Run kubectl describe pod to see events and exit codes, and kubectl logs <pod> --previous for the crashed container's output. Common causes are missing environment variables or secrets, bad config, failing database connections, a wrong command, an aggressive liveness probe, or exit code 137 meaning OOM kill.
A role is a standard folder structure that packages tasks, handlers, templates, files, variables and defaults for one purpose, for example a nginx or postgres role. Playbooks then just list roles for host groups, keeping them short and reusable across projects. Roles can be shared through Ansible Galaxy or collections, and tested with Molecule.
30
Explain the Kubernetes Service types ClusterIP, NodePort and LoadBalancer.
A Service gives pods a stable IP and DNS name and load balances across them using label selectors. ClusterIP, the default, is reachable only inside the cluster. NodePort also opens a port, 30000 to 32767, on every node. LoadBalancer additionally asks the cloud provider to create an external load balancer pointing to the service. Each type builds on the previous one.
31
Your CI pipeline takes 40 minutes. How would you speed it up?
Measure first: find which stages take longest. Then cache dependencies and Docker layers, run independent stages and test suites in parallel, split tests across agents, and run only affected modules in a monorepo. Move slow end-to-end tests to a later stage or nightly run while keeping fast unit tests on every commit. Use bigger or autoscaled agents if they are the bottleneck.
32
Two engineers ran terraform apply at the same time. What could go wrong and how do you prevent it?
Without locking, both runs read the same state and write conflicting updates, which can corrupt state or create duplicate resources. Use a remote backend with state locking so the second run waits or fails. Better still, run apply only from a CI pipeline on merge to main, so changes are serialised and reviewed. If a lock is stuck after a crash, use terraform force-unlock carefully.
33
Someone deleted a resource manually that Terraform manages, and the state is now out of sync. What do you do?
Run terraform plan; Terraform refreshes and sees the resource is missing, so it plans to recreate it, which is often right. If the resource should no longer exist, remove it from code, or use terraform state rm. If state itself is corrupted, restore a previous version from the versioned S3 bucket. Then find out why manual changes happened and tighten access.
34
Tell me about a time you migrated an application to Kubernetes.
Situation: our monolith and five services ran on hand-managed VMs with frequent config drift. Task: I led the move to a managed Kubernetes cluster. Action: I containerised each service, wrote Helm charts, added probes and resource limits, set up Argo CD, and migrated one low-risk service first with a rollback plan. Result: deployments went from weekly to daily and VM costs dropped about 30 percent.
RBAC controls who can do what on which resources. A Role defines allowed verbs like get, list or create on resources within a namespace; a ClusterRole does so cluster-wide. RoleBindings and ClusterRoleBindings attach those roles to users, groups or service accounts. Follow least privilege: give each application its own service account with only the permissions it needs.
36
An e-commerce site expects 10 times normal traffic during a festive sale. How do you prepare?
Load test beforehand to find bottlenecks. Pre-scale Auto Scaling groups or Kubernetes nodes with scheduled scaling, since reactive scaling may be too slow. Cache aggressively with CloudFront and Redis, add read replicas, and check service quotas. Use queues to absorb spikes in order processing, set up dashboards and alerts, freeze risky deployments, and keep an on-call war room ready.
37
Write an IAM policy that gives read-only access to one S3 bucket.
The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.
39
How would you convince a team that manages servers by hand to adopt Infrastructure as Code?
I would start with their pain, such as slow environment setup or outages from manual changes, rather than the tool. Then I would codify one small, visible piece, for example a new staging environment, and show it rebuilt in minutes with a reviewed pull request. I would pair with team members, write simple docs and expand gradually, measuring time saved and incidents avoided.
40
How would you plan disaster recovery for a complete AWS region failure?
Start from business RTO and RPO. Options range from backup and restore, which is cheapest and slowest, to pilot light, warm standby and multi-region active-active. Replicate data with S3 cross-region replication, Aurora Global Database or DynamoDB global tables, keep infrastructure in Terraform so it can be rebuilt, use Route 53 failover routing and rehearse failover drills.
Frequently asked questions
What does a Platform Engineer do?
A platform engineer builds an internal developer platform so product teams can ship without worrying about infrastructure. They create golden paths: reusable Terraform modules, Helm charts, standard pipelines, GitOps with Argo CD, self-service environments and guardrails for security and cost. The role is senior and needs broad DevOps experience, strong Kubernetes skills and the ability to treat developers as customers of the platform.
Which skills are tested in a Platform Engineer interview?
Expect questions on Internal developer platforms, GitOps with Argo CD, Kubernetes multi-tenancy, Reusable IaC modules, Policy as code. Most rounds also ask you to explain a project and solve one practical problem live.
How do I prepare for a Platform Engineer interview?
Revise Kubernetes, Infrastructure as Code (Terraform and Ansible), CI/CD Pipelines, AWS Cloud for DevOps first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.