DevOps Interview Questions in Noida

Show answer

A volume is storage managed by Docker under its own directory, created with docker volume create and referenced by name; it is portable and is the recommended way to persist data such as databases. A bind mount maps a specific host path into the container, which is handy for local development hot reload but depends on host directory layout and permissions.

What is the difference between continuous integration, continuous delivery and continuous deployment?

CI/CD PipelinesEasy

Show answer

Continuous integration means developers merge small changes often and every merge is automatically built and tested. Continuous delivery goes further: every passing build is packaged and ready to release, but a human approves the production push. Continuous deployment removes that manual step, so every change that passes all checks goes to production automatically. Each stage needs more test confidence than the last.

What is DevSecOps and which security checks belong in a pipeline?

CI/CD PipelinesHard

Show answer

DevSecOps moves security earlier into the delivery process instead of a final audit. A pipeline typically adds secret scanning, static code analysis (SAST) with tools like SonarQube, dependency scanning (SCA) for vulnerable libraries, container image scanning with Trivy, infrastructure-as-code checks with Checkov, and sometimes dynamic testing (DAST) on staging. Critical findings fail the build, while lower ones create tickets.

What is the difference between git revert and git reset?

Show answer

git revert creates a new commit that undoes the changes of an earlier commit, leaving history intact, so it is safe on shared branches like main. git reset moves the branch pointer backwards and removes commits from the branch history, which is fine locally but forces others to deal with rewritten history if already pushed. Use revert for anything already public.

Your service has used its entire error budget halfway through the quarter. What happens next?

Monitoring, Logging and SREHard

Show answer

Following the agreed error budget policy, the team pauses risky feature launches and focuses on reliability work: fixing the top causes of failures from post-mortems, adding tests, improving rollbacks and canaries. Product and engineering leads review the plan together. Once the budget recovers in the rolling window, normal releases resume. If the SLO is unrealistic, revisit it with data.

Tell me about a time you migrated an application to Kubernetes.

KubernetesHard

Show answer

Situation: our monolith and five services ran on hand-managed VMs with frequent config drift. Task: I led the move to a managed Kubernetes cluster. Action: I containerised each service, wrote Helm charts, added probes and resource limits, set up Argo CD, and migrated one low-risk service first with a rollback plan. Result: deployments went from weekly to daily and VM costs dropped about 30 percent.

Tell me about a time you reduced cloud costs.

Show answer

Situation: our dev and test AWS accounts cost almost as much as production. Task: my manager asked me to cut waste without slowing teams. Action: I tagged resources by owner, found idle instances and old snapshots, scheduled non-production instances to stop at night with a Lambda, and moved CI agents to Spot. Result: non-production spend fell about 40 percent within two months.

How do you quickly search logs for errors from the last hour on a server or in Kubernetes?

Monitoring, Logging and SREEasy

Show answer

# systemd service journalctl -u api --since "1 hour ago" -p err # plain log files grep -i "error" /var/log/app/app.log | tail -50 grep -c "timeout" /var/log/app/app.log # Kubernetes kubectl logs deploy/api --since=1h | grep -i error kubectl logs -l app=api --since=1h --prefix | grep 500 For many hosts, search the central logging tool instead, filtering by service, level and time.

An EC2 instance in a private subnet cannot download packages from the internet. Why?

Show answer

A private subnet has no direct route to the Internet Gateway. Check that its route table sends 0.0.0.0/0 to a NAT Gateway placed in a public subnet, that the NAT Gateway has an Elastic IP, and that the security group and NACL allow outbound traffic and return ports. For AWS services like S3, a VPC endpoint avoids NAT data charges.

What is the difference between git merge and git rebase?

Infrastructure as Code (Terraform and Ansible)Easy

Show answer

Merge joins two branches with a merge commit and keeps the true history, including when work happened in parallel. Rebase replays your commits on top of the target branch, giving a clean linear history but new commit hashes. Rebase local feature branches to stay current, but never rebase commits others have already pulled, because it rewrites shared history.

Explain the Jenkins controller and agent architecture.

CI/CD PipelinesMedium

Show answer

The Jenkins controller stores configuration, schedules jobs, serves the UI and keeps build history. Agents are separate machines or containers that actually execute build steps, connected over SSH or JNLP and selected by labels. Running builds on agents rather than the controller keeps the controller stable and secure, and lets you scale with dynamic agents on Kubernetes or cloud VMs that are created per build.

What is the difference between an Ingress and a Service?

KubernetesMedium

Show answer

A Service exposes a set of pods at layer 4. An Ingress is a layer 7 HTTP routing resource that maps hostnames and paths to services, for example api.example.com to the api service and /admin to another. It needs an ingress controller such as NGINX or a cloud controller to work. One Ingress with one load balancer can serve many services, and it handles TLS termination.

Explain the basic Terraform workflow.

Show answer

terraform init downloads providers and modules and configures the backend. terraform fmt and validate check style and syntax. terraform plan shows what will be created, changed or destroyed without making changes. terraform apply executes the plan after confirmation. terraform destroy removes all managed resources. In CI, save the plan with -out and apply that exact plan after review.

What are the four golden signals, and the RED and USE methods?

Show answer

The four golden signals are latency, traffic, errors and saturation. RED, for request-driven services, tracks rate, errors and duration. USE, for resources such as CPU, disks and network, tracks utilisation, saturation and errors. RED tells you whether users are hurting; USE helps find which resource is the bottleneck. Together they give a solid starting set of dashboards and alerts.

What is the difference between a security group and a network ACL?

Show answer

A security group acts as a firewall for instances or network interfaces. It is stateful, so return traffic is allowed automatically, and it supports only allow rules. A network ACL works at the subnet level, is stateless, so inbound and outbound rules must both allow traffic, supports allow and deny rules, and evaluates rules in number order. Security groups are the main control.

Tell me about a blameless post-mortem you were part of.

Show answer

Situation: a certificate expired and our API was down for 40 minutes. Task: I wrote the post-mortem. Action: I built a timeline from logs and chat, and we focused on why the system allowed it rather than who forgot: renewal was manual and nothing alerted. Result: we automated renewal with cert-manager, added expiry alerts 21 days ahead, and tracked actions to closure.

How do you build and push a Docker image from a pipeline?

CI/CD PipelinesMedium

Show answer

# shell steps in any CI tool IMAGE=registry.example.com/shop/api TAG=$(git rev-parse --short HEAD) echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin docker build -t $IMAGE:$TAG . docker push $IMAGE:$TAG Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.

Explain Docker network types.

Show answer

bridge is the default: containers get private IPs on a virtual bridge and reach outside through NAT; user-defined bridges also provide DNS by container name. host shares the host's network stack directly, with no port mapping. none disables networking. overlay connects containers across multiple hosts in Swarm. macvlan gives a container its own MAC address on the physical network.

You need one pipeline that deploys to dev, staging and production with approval before production. How do you design it?

CI/CD PipelinesMedium

Show answer

Build and test once, publish a versioned artefact, then promote it through environments. Dev deploys automatically on merge, staging deploys after dev smoke tests, and production waits for a manual approval from authorised people using a Jenkins input step or GitHub environment protection rules. Keep environment-specific settings in config files or parameters, not separate pipelines, and record who approved each release.

How do you perform a rolling update and roll back a Deployment?

KubernetesMedium

Show answer

# update the image kubectl set image deployment/api api=registry.example.com/api:1.5.0 kubectl rollout status deployment/api # history and rollback kubectl rollout history deployment/api kubectl rollout undo deployment/api kubectl rollout undo deployment/api --to-revision=3 # pause or restart kubectl rollout pause deployment/api kubectl rollout restart deployment/api In GitOps setups, you change the image tag in Git instead and let Argo CD apply it.

What is the difference between count and for_each in Terraform?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

count creates N copies indexed by number, such as aws_instance.web[0]. Removing an item in the middle shifts indexes and can destroy and recreate resources unexpectedly. for_each iterates over a map or set of strings and keys each instance by name, such as aws_s3_bucket.b["logs"], so adding or removing one item affects only that item. Prefer for_each for named collections.

How do you limit CPU and memory for a container?

Show answer

docker run -d --name api \ --memory=512m --memory-swap=512m \ --cpus=1.5 \ --restart=unless-stopped \ myapp:1.0 # change limits on a running container docker update --memory=1g --memory-swap=1g api If the process exceeds the memory limit it is OOM killed, so set application heap sizes below the limit. --cpus caps CPU time rather than reserving cores.

Compare GitFlow and trunk-based development.

Git and Version ControlHard

Show answer

GitFlow uses long-lived develop and main branches plus feature, release and hotfix branches; it suits scheduled releases but causes big merges. Trunk-based development has everyone merge small changes into main at least daily, with short-lived branches and feature flags to hide unfinished work. It suits continuous delivery and is what high-performing DevOps teams usually prefer, but needs strong automated tests.

What are the Prometheus metric types?

Show answer

A counter only increases, such as total requests, and you use rate() on it. A gauge goes up and down, such as memory in use or queue length. A histogram counts observations into configurable buckets, such as request duration, and lets you compute percentiles with histogram_quantile across instances. A summary computes quantiles on the client side but cannot be aggregated across instances.

You deleted a local branch that had unmerged commits. How do you recover it?

Show answer

Git keeps unreferenced commits for a while. Run git reflog to see recent HEAD positions and find the last commit of that branch, or check the hash printed when you deleted it. Then recreate the branch with git branch feature-x <hash>. Reflog is local only, so this works on the same machine, and entries expire after about 90 days by default.

Someone made an S3 bucket with customer files public. What do you do?

Show answer

Immediately block public access on the bucket and remove the public policy or ACLs. Check S3 server access logs or CloudTrail data events to see whether objects were downloaded, and involve security if customer data was exposed. Then enable Block Public Access at the account level, use AWS Config rules to detect public buckets, and require bucket changes through reviewed IaC.

df shows the disk is 100 percent full but du does not find large files. What is happening?

Linux and Shell ScriptingHard

Show answer

Usually a large file was deleted while a process still holds it open, so the space is not released. Run lsof +L1 or lsof | grep deleted to find the process and file. Restarting or reloading that process frees the space; if you cannot restart, truncate the file through /proc/<pid>/fd/<n>. The fix is proper log rotation with copytruncate or a reopen signal.

What are the S3 storage classes and lifecycle policies?

AWS Cloud for DevOpsEasy

Show answer

S3 Standard is for frequently accessed data. Standard-IA and One Zone-IA are cheaper for infrequent access but charge retrieval fees. Intelligent-Tiering moves objects automatically based on access. Glacier Instant, Flexible Retrieval and Deep Archive are for archives with slower, cheaper access. Lifecycle rules move objects between classes after a set age and delete old versions or logs automatically.

What does idempotency mean in Ansible?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Idempotency means running the same playbook many times gives the same result without unwanted changes. Modules check current state first: the apt module installs a package only if missing and reports ok instead of changed. The shell and command modules are not idempotent by default, so use creates, removes or changed_when conditions, or prefer a dedicated module.

What is Helm and what are its basic commands?

KubernetesMedium

Show answer

helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update helm install my-redis bitnami/redis -n cache --create-namespace helm upgrade my-redis bitnami/redis -f values-prod.yaml helm list -A helm rollback my-redis 1 helm uninstall my-redis -n cache helm template ./mychart -f values.yaml # render locally Helm is the package manager for Kubernetes. A chart is a set of templated manifests, and values files customise it per environment.

Write a Prometheus alerting rule for a high error rate.

Show answer

groups: - name: api-alerts rules: - alert: HighErrorRate expr: | sum(rate(http_requests_total{job="api",status=~"5.."}[5m])) / sum(rate(http_requests_total{job="api"}[5m])) > 0.05 for: 10m labels: severity: page annotations: summary: "API error rate above 5 percent" runbook: "https://wiki.example.com/runbooks/api-errors" for: 10m ignores short spikes; Alertmanager routes by the severity label.

You pushed a broken commit to the shared main branch and the build is failing. What do you do?

Show answer

First restore a green main quickly: run git revert <hash> and push, which adds an undo commit without rewriting history that others have pulled. Tell the team in the channel. Then fix the issue on a branch with a proper pull request and tests. Avoid git reset with force push on main; branch protection rules should block it anyway.

The host disk is filling up because of Docker. How do you clean up and prevent it?