Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About IBM hiring for DevOps roles
IBM is a global technology company offering hybrid cloud, AI through watsonx, software such as Red Hat, infrastructure and IBM Consulting services. Its India Software Labs and IBM Consulting teams form one of its largest workforces outside the US. It hires in India for software developers, test engineers, data engineers, data scientists and consultants.
For DevOps roles, this IBM practice set focuses most on Kubernetes (7), AWS Cloud for DevOps (5), Linux and Shell Scripting (5), Monitoring, Logging and SRE (3). It has 12 easy, 18 medium questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Armonk, New York, USA
Main India offices
Bengaluru, Pune, Hyderabad, Kolkata, Gurugram
IBM DevOps interview process
Online assessment (cognitive games + coding)
English language test
Technical interview
Managerial or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for IBMStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How much downtime does a 99.9 percent availability SLO allow?
Allowed downtime = (1 - SLO) x period
99.9 percent over 30 days:
0.001 x 30 x 24 x 60 = 43.2 minutes per month
99.9 percent over a year = about 8.76 hours
99.95 percent per month = about 21.6 minutes
99.99 percent per month = about 4.3 minutes
Each extra nine cuts the budget tenfold and usually needs much more redundancy and automation, so pick an SLO that matches real user needs.
A process is a running program with its own address space, file descriptors and PID. A thread is a unit of execution inside a process that shares the same memory and open files with other threads. Creating threads is cheaper and they communicate easily, but a bug in one thread can crash the whole process, while separate processes are isolated from each other.
A DaemonSet makes sure one copy of a pod runs on every node, or on a selected group of nodes. When a node joins the cluster, the pod is added automatically. It is used for node-level agents such as log collectors like Fluent Bit, monitoring agents like the Prometheus node exporter, and CNI or storage plugins.
05
Write a Docker Compose file for a web app with a PostgreSQL database.
# shell steps in any CI tool
IMAGE=registry.example.com/shop/api
TAG=$(git rev-parse --short HEAD)
echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin
docker build -t $IMAGE:$TAG .
docker push $IMAGE:$TAG
Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.
07
Explain Ansible architecture: inventory, modules and playbooks.
Ansible runs from a control node and connects to managed hosts over SSH, or WinRM for Windows, with no agent needed. The inventory lists hosts and groups. Modules are units of work like apt, copy or service. Playbooks are YAML files containing plays that map host groups to ordered tasks. Variables, templates with Jinja2 and roles organise larger automation.
08
How do an Application Load Balancer and an Auto Scaling group work together?
The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.
Never store secrets in code or the Jenkinsfile. Use the CI tool's encrypted credentials store, such as Jenkins credentials or GitHub Actions secrets, or fetch them at runtime from HashiCorp Vault or AWS Secrets Manager. Prefer short-lived credentials, for example OIDC federation from GitHub Actions to AWS instead of long-lived keys. Mask secrets in logs and give each pipeline only the permissions it needs.
10
What is the difference between a Docker image and a container?
An image is a read-only template made of layers, containing the application, libraries and configuration, built from a Dockerfile. A container is a running instance of an image with a thin writable layer on top. You can start many containers from one image. Changes made inside a container are lost when it is removed unless they are stored in volumes.
11
What is the difference between monitoring and observability?
Monitoring tracks known metrics and alerts when they cross thresholds, answering whether something is wrong. Observability is the ability to understand any internal state from outside data, answering why, even for problems you did not predict. It rests on three pillars: metrics for trends, logs for detailed events and traces for following one request across services. Good systems need both.
12
How do you perform a rolling update and roll back a Deployment?
# update the image
kubectl set image deployment/api api=registry.example.com/api:1.5.0
kubectl rollout status deployment/api
# history and rollback
kubectl rollout history deployment/api
kubectl rollout undo deployment/api
kubectl rollout undo deployment/api --to-revision=3
# pause or restart
kubectl rollout pause deployment/api
kubectl rollout restart deployment/api
In GitOps setups, you change the image tag in Git instead and let Argo CD apply it.
13
How do you create an EKS cluster with eksctl and connect kubectl to it?
crontab -e
# min hour day month weekday command
30 2 * * * /opt/scripts/backup.sh >> /var/log/backup.log 2>&1
crontab -l # list jobs
Use absolute paths because cron runs with a minimal PATH and environment. Redirect output to a log, otherwise errors are mailed or lost. On systemd hosts, timers are an alternative with better logging.
Lambda runs functions without servers, billed per request and duration, ideal for event-driven tasks with short runtimes up to 15 minutes. ECS is AWS's simpler container orchestrator, good when you want containers without Kubernetes complexity, often with Fargate. EKS is managed Kubernetes, chosen for portability, a rich ecosystem and existing Kubernetes skills, but it needs more operational knowledge.
A liveness probe checks whether the container is healthy; if it fails, the kubelet restarts it. A readiness probe checks whether it can serve traffic; if it fails, the pod is removed from service endpoints but not restarted. A startup probe gives slow-starting apps time to boot and holds off the other probes until it succeeds. Wrong liveness probes can cause restart loops.
17
What is the difference between continuous integration, continuous delivery and continuous deployment?
Continuous integration means developers merge small changes often and every merge is automatically built and tested. Continuous delivery goes further: every passing build is packaged and ready to release, but a human approves the production push. Continuous deployment removes that manual step, so every change that passes all checks goes to production automatically. Each stage needs more test confidence than the last.
18
What is the difference between an Ingress and a Service?
A Service exposes a set of pods at layer 4. An Ingress is a layer 7 HTTP routing resource that maps hostnames and paths to services, for example api.example.com to the api service and /admin to another. It needs an ingress controller such as NGINX or a cloud controller to work. One Ingress with one load balancer can serve many services, and it handles TLS termination.
Idempotency means running the same playbook many times gives the same result without unwanted changes. Modules check current state first: the apt module installs a package only if missing and reports ok instead of changed. The shell and command modules are not idempotent by default, so use creates, removes or changed_when conditions, or prefer a dedicated module.
An inode is a data structure that stores a file's metadata: owner, permissions, size, timestamps, link count and pointers to data blocks, but not the file name. Names live in directory entries that map to inode numbers. A file system has a fixed number of inodes, so millions of tiny files can exhaust them while disk space is still free; check with df -i.
21
A production server is very slow. How do you troubleshoot high CPU usage?
Start with uptime and top or htop to see load and which processes use CPU. Check whether it is user, system or iowait time, and use pidstat or ps -eo pid,pcpu,cmd --sort=-pcpu for detail. For a Java process, take thread dumps; for others, use perf or strace. Correlate with recent deployments, cron jobs or traffic spikes before deciding to scale, roll back or fix code.
22
Explain the Kubernetes Service types ClusterIP, NodePort and LoadBalancer.
A Service gives pods a stable IP and DNS name and load balances across them using label selectors. ClusterIP, the default, is reachable only inside the cluster. NodePort also opens a port, 30000 to 32767, on every node. LoadBalancer additionally asks the cloud provider to create an external load balancer pointing to the service. Each type builds on the previous one.
23
Explain Linux file permissions and what chmod 755 means.
Every file has read (4), write (2) and execute (1) bits for three classes: owner, group and others. chmod 755 gives the owner 7 (read, write, execute) and gives group and others 5 (read, execute). It is typical for scripts and directories that everyone may run or enter but only the owner may change. Use ls -l to see permissions.
24
A pod is stuck in Pending state. What could be the reasons?
Pending means it has not been scheduled or its volumes are not ready. kubectl describe pod shows the scheduler's reason. Common causes are insufficient CPU or memory on nodes for the requests, node selectors, affinity or taints that no node satisfies, a PersistentVolumeClaim that cannot bind, or a resource quota being exceeded. Fix the spec or add nodes with the cluster autoscaler.
All three move the current branch pointer to another commit. --soft keeps your changes staged, useful for recombining commits. --mixed, the default, keeps changes in the working directory but unstaged. --hard discards changes in both staging and working directory, so uncommitted work is lost. Lost commits can usually still be found with git reflog for a while.
The HPA periodically reads metrics from the metrics server or a custom metrics adapter and changes the replica count of a Deployment or StatefulSet to keep a target, for example 70 percent average CPU. It calculates desired replicas from current usage divided by the target, within min and max bounds, with stabilisation windows to avoid flapping. CPU-based HPA needs resource requests set.
Docker Compose defines and runs multi-container applications from a YAML file, usually compose.yaml. You describe services, networks, volumes, environment variables and dependencies, then start everything with docker compose up. It is ideal for local development and testing, for example an API, database and cache together. For production orchestration across many hosts, teams use Kubernetes instead.
28
An application on EC2 needs to read files from S3. How do you give it access securely?
Create an IAM role with a policy allowing only the needed actions, such as s3:GetObject on that bucket, attach it to the instance through an instance profile, and let the AWS SDK pick up temporary credentials automatically. Never put access keys in code or config files. Optionally add a bucket policy and a VPC endpoint so traffic stays inside AWS.
29
You get an alert that the company website is down. What are your first steps?
Acknowledge the alert so others know you are on it. Check whether it is really down from outside with curl or an uptime checker, and whether it is all users or one region. Look at recent deployments or changes, then load balancer health, application logs and the database. If a recent change caused it, roll back first. Inform the team and escalate if you cannot fix it quickly.
30
What is the difference between git revert and git reset?
git revert creates a new commit that undoes the changes of an earlier commit, leaving history intact, so it is safe on shared branches like main. git reset moves the branch pointer backwards and removes commits from the branch history, which is fine locally but forces others to deal with rewritten history if already pushed. Use revert for anything already public.
Tips to crack the IBM DevOps interview
Practise IBM's game-based cognitive assessments, which test pattern recognition, memory and numerical reasoning quickly.
Learn basics of hybrid cloud, Red Hat OpenShift and watsonx, which IBM promotes as core strategic areas.
Revise SQL, Python or Java fundamentals and be ready to explain one project in depth.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; IBM interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the IBM DevOps interview?
Candidates usually go through 4 stages: Online assessment (cognitive games + coding); English language test; Technical interview; Managerial or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the IBM DevOps interview?
This practice set leans on Kubernetes (7), AWS Cloud for DevOps (5), Linux and Shell Scripting (5), Monitoring, Logging and SRE (3). Revise those first, then practise explaining one or two of your own projects end to end, because most IBM interviewers ask you to walk through real work.
Are these the exact questions asked at IBM?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like IBM's. They are not a leaked or verified list of past questions.
Where does IBM hire DevOps professionals in India?
IBM has large teams in Bengaluru, Pune, Hyderabad, Kolkata, Gurugram. Openings and locations change often, so check the IBM careers page and filter by city and experience.