Medium DevOps Interview Questions

Show answer

An inode is a data structure that stores a file's metadata: owner, permissions, size, timestamps, link count and pointers to data blocks, but not the file name. Names live in directory entries that map to inode numbers. A file system has a fixed number of inodes, so millions of tiny files can exhaust them while disk space is still free; check with df -i.

What is load average in Linux and how do you read it?

Show answer

Load average is the average number of processes running or waiting for CPU (and uninterruptible I/O) over 1, 5 and 15 minutes, shown by uptime or top. Compare it with the number of CPU cores: a load of 4 on a 4-core machine means full use, while 12 means work is queuing. A high load with low CPU use often points to disk or network I/O waits.

What are zombie and orphan processes?

Show answer

A zombie is a process that has exited but whose parent has not yet read its exit status with wait(), so it still holds a PID entry and shows state Z. An orphan is a running process whose parent died; it is adopted by PID 1, which reaps it later. Many zombies indicate a buggy parent; fixing or restarting the parent clears them.

What does set -euo pipefail do in a bash script?

Show answer

set -e exits the script when any command fails, set -u treats unset variables as errors, and set -o pipefail makes a pipeline fail if any command in it fails, not just the last. Together they stop a script from silently continuing after an error, which matters in CI and deployment scripts. Commands that may fail on purpose need explicit handling such as || true.

How do you find files larger than 100 MB and older than 7 days under /var/log?

Show answer

find /var/log -type f -size +100M -mtime +7 -exec ls -lh {} + # compress them instead of just listing find /var/log -type f -size +100M -mtime +7 -exec gzip {} + -size +100M matches files above 100 MB, -mtime +7 means modified more than 7 days ago, and -exec with + passes many files to one command call, which is faster than running it once per file.

Write a bash script that checks whether a service is running and restarts it if not.

Show answer

#!/bin/bash set -u SERVICE="nginx" if ! systemctl is-active --quiet "$SERVICE"; then echo "$(date) $SERVICE down, restarting" >> /var/log/svc-check.log systemctl restart "$SERVICE" if ! systemctl is-active --quiet "$SERVICE"; then echo "$SERVICE failed to start" | mail -s "ALERT" ops@example.com fi fi Run it from cron every few minutes; a real setup would rely on systemd Restart= plus monitoring.

How do you count unique client IP addresses in an nginx access log?

Show answer

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10 # total number of unique IPs awk '{print $1}' access.log | sort -u | wc -l The first field in the default log format is the client IP. uniq -c only collapses adjacent lines, so sort must run before it; the final sort -rn shows the busiest IPs first.

Write a script that alerts when any disk partition is above 80 percent used.

Show answer

#!/bin/bash THRESHOLD=80 df -hP | awk 'NR>1 {gsub("%","",$5); print $5, $6}' | while read -r used mount; do if [ "$used" -ge "$THRESHOLD" ]; then echo "WARNING: $mount is ${used}% full on $(hostname)" fi done df -P keeps each entry on one line, awk strips the percent sign, and the loop compares each value with the threshold.

A production server is very slow. How do you troubleshoot high CPU usage?

Show answer

Start with uptime and top or htop to see load and which processes use CPU. Check whether it is user, system or iowait time, and use pidstat or ps -eo pid,pcpu,cmd --sort=-pcpu for detail. For a Java process, take thread dumps; for others, use perf or strace. Correlate with recent deployments, cron jobs or traffic spikes before deciding to scale, roll back or fix code.

You suddenly cannot SSH into a Linux server. What do you check?

Show answer

Check reachability with ping and whether port 22 is open with nc -zv host 22. Then look at security groups, firewall rules and whether the sshd service is running, using the cloud console or serial access. Run ssh -vvv to see whether it fails at key exchange or authentication. Common causes are wrong key permissions, a full disk, a changed IP, or fail2ban blocking you.

Tell me about a time you automated a repetitive manual task.

Show answer

Situation: our team manually cleaned old build artefacts on shared servers every week, which took two hours and sometimes deleted the wrong files. Task: I offered to automate it. Action: I wrote a bash script with dry-run mode, logging and a retention rule, tested it on staging and scheduled it with cron. Result: zero manual effort and no more full-disk alerts for six months.

What is the difference between git merge and git rebase?

Show answer

Merge joins two branches with a merge commit and keeps the true history, including when work happened in parallel. Rebase replays your commits on top of the target branch, giving a clean linear history but new commit hashes. Rebase local feature branches to stay current, but never rebase commits others have already pulled, because it rewrites shared history.

What is a detached HEAD state in Git?

Show answer

HEAD normally points to a branch name. In detached HEAD, it points directly to a commit, for example after git checkout <hash> or checking out a tag. You can look around and even commit, but new commits belong to no branch and can be lost when you switch away. To keep them, create a branch with git switch -c new-branch.

Explain git reset --soft, --mixed and --hard.

Show answer

All three move the current branch pointer to another commit. --soft keeps your changes staged, useful for recombining commits. --mixed, the default, keeps changes in the working directory but unstaged. --hard discards changes in both staging and working directory, so uncommitted work is lost. Lost commits can usually still be found with git reflog for a while.

What is the difference between git revert and git reset?

Show answer

git revert creates a new commit that undoes the changes of an earlier commit, leaving history intact, so it is safe on shared branches like main. git reset moves the branch pointer backwards and removes commits from the branch history, which is fine locally but forces others to deal with rewritten history if already pushed. Use revert for anything already public.

What are Git hooks and how are they used in DevOps?

Show answer

Hooks are scripts Git runs at events such as pre-commit, commit-msg and pre-push on the client, or pre-receive on the server. Teams use them to run linters, format code, block secrets or enforce commit message formats before code leaves a laptop. Client hooks are not shared by default, so tools like pre-commit or Husky manage them, and CI repeats the checks.

How do you resolve a merge conflict?

Show answer

Git marks conflicting files and inserts markers showing both versions. Open each file, decide the correct final code, often combining both sides after talking to the other author, and remove the markers. Then git add the files and finish with git commit or git rebase --continue. Run tests before pushing, because a conflict resolved without errors can still break logic.

You deleted a local branch that had unmerged commits. How do you recover it?

Show answer

Git keeps unreferenced commits for a while. Run git reflog to see recent HEAD positions and find the last commit of that branch, or check the hash printed when you deleted it. Then recreate the branch with git branch feature-x <hash>. Reflog is local only, so this works on the same machine, and entries expire after about 90 days by default.

You pushed a broken commit to the shared main branch and the build is failing. What do you do?

Show answer

First restore a green main quickly: run git revert <hash> and push, which adds an undo commit without rewriting history that others have pulled. Tell the team in the channel. Then fix the issue on a branch with a proper pull request and tests. Avoid git reset with force push on main; branch protection rules should block it anyway.

How do you squash your last three commits into one?

Show answer

git rebase -i HEAD~3 # in the editor, keep the first line as pick # and change the other two to squash (or s) pick a1b2c3 Add login API squash d4e5f6 Fix typo squash 789abc Add tests # alternative without the editor git reset --soft HEAD~3 git commit -m "Add login API with tests" If the branch was already pushed, update it with git push --force-with-lease.

Tell me about a time you disagreed with a code review comment.

Show answer

Situation: a reviewer asked me to replace a simple retry loop in our deploy script with a heavy external library. Task: I felt it added risk. Action: I explained my reasoning, shared a small benchmark and failure tests, and asked what concern they had; it was about backoff. Result: I added exponential backoff to my version, they approved, and we documented the pattern.

Explain the Jenkins controller and agent architecture.

Show answer

The Jenkins controller stores configuration, schedules jobs, serves the UI and keeps build history. Agents are separate machines or containers that actually execute build steps, connected over SSH or JNLP and selected by labels. Running builds on agents rather than the controller keeps the controller stable and secure, and lets you scale with dynamic agents on Kubernetes or cloud VMs that are created per build.

What is the difference between declarative and scripted Jenkins pipelines?

Show answer

Both are written in a Jenkinsfile using Groovy. Declarative pipelines use a fixed structure with pipeline, agent, stages, steps and post blocks, which is easy to read, validate and maintain. Scripted pipelines start with node and allow full Groovy logic, giving more flexibility but more room for messy code. Most teams use declarative and drop into a script block only when needed.

Compare blue-green, canary and rolling deployments.

Show answer

Blue-green runs two full environments and switches traffic from old to new at once; rollback is instant but costs double capacity. Rolling replaces instances in batches with no extra environment, but old and new versions run together for a while. Canary sends a small share of traffic, say 5 percent, to the new version and widens it as metrics stay healthy, limiting blast radius.

How do you manage secrets in a CI/CD pipeline?

Show answer

Never store secrets in code or the Jenkinsfile. Use the CI tool's encrypted credentials store, such as Jenkins credentials or GitHub Actions secrets, or fetch them at runtime from HashiCorp Vault or AWS Secrets Manager. Prefer short-lived credentials, for example OIDC federation from GitHub Actions to AWS instead of long-lived keys. Mask secrets in logs and give each pipeline only the permissions it needs.

Builds fail randomly because of flaky tests. How do you handle it?

Show answer

First identify flaky tests by tracking which tests fail and pass on the same commit. Quarantine them into a separate non-blocking job so the main pipeline stays trustworthy, and raise tickets with owners. Common causes are timing assumptions, shared test data, order dependence and external services. Blind automatic retries hide real bugs, so use them only briefly while fixing the root cause.

A production deployment failed halfway. What do you do?

Show answer

Assess impact quickly using monitoring and error rates. If users are affected, roll back to the last good version, which should be a single pipeline action redeploying the previous artefact. Communicate status to stakeholders. Then check pipeline logs and application logs to find the cause, fix it in a branch and redeploy. Afterwards, hold a blameless review and add a check to catch it earlier.

You need one pipeline that deploys to dev, staging and production with approval before production. How do you design it?

Show answer

Build and test once, publish a versioned artefact, then promote it through environments. Dev deploys automatically on merge, staging deploys after dev smoke tests, and production waits for a manual approval from authorised people using a Jenkins input step or GitHub environment protection rules. Keep environment-specific settings in config files or parameters, not separate pipelines, and record who approved each release.

Write a declarative Jenkinsfile with build, test and deploy stages.

Show answer

pipeline { agent { label 'linux' } stages { stage('Build') { steps { sh 'mvn -B clean package -DskipTests' } } stage('Test') { steps { sh 'mvn -B test' } post { always { junit 'target/surefire-reports/*.xml' } } } stage('Deploy') { when { branch 'main' } steps { sh './deploy.sh staging' } } } post { failure { echo 'Build failed' } } }

Write a GitHub Actions workflow that runs tests on every pull request.

Show answer

name: CI on: pull_request: branches: [main] jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 20 cache: npm - run: npm ci - run: npm test Add this as .github/workflows/ci.yml and make the job a required status check in branch protection.

How do you run a matrix build in GitHub Actions?

Show answer

jobs: test: runs-on: ${{ matrix.os }} strategy: fail-fast: false matrix: os: [ubuntu-latest, windows-latest] python: ['3.11', '3.12'] steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 with: python-version: ${{ matrix.python }} - run: pip install -r requirements.txt - run: pytest This creates four parallel jobs; fail-fast false lets all finish so you see every failure.

How do you build and push a Docker image from a pipeline?

Show answer

# shell steps in any CI tool IMAGE=registry.example.com/shop/api TAG=$(git rev-parse --short HEAD) echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin docker build -t $IMAGE:$TAG . docker push $IMAGE:$TAG Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.

How do you use stored credentials inside a Jenkins pipeline?

Show answer

pipeline { agent any environment { SONAR_TOKEN = credentials('sonar-token') } stages { stage('Push') { steps { withCredentials([usernamePassword(credentialsId: 'docker-hub', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $PASS | docker login -u $USER --password-stdin' } } } } } Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.

How do you handle pressure when a release is blocked close to a deadline?

Show answer

Situation: a security scan blocked our release one day before a client demo. Task: ship without ignoring the risk. Action: I checked the finding, confirmed it was a real vulnerable library, upgraded it, ran the full test suite and kept the product manager updated every few hours. Result: we released on time, and I added weekly dependency scans to avoid last-minute surprises.

How do Docker image layers and build caching work?

Show answer

Each Dockerfile instruction like RUN, COPY or ADD creates a layer. Docker caches layers and reuses them if the instruction and its inputs have not changed; once one layer changes, all later layers rebuild. So copy dependency files and install dependencies first, then copy source code. That way code changes do not reinstall all packages, and builds become much faster.

What is the difference between CMD and ENTRYPOINT?

Show answer

ENTRYPOINT defines the main executable that always runs, while CMD provides default arguments or a default command that can be overridden from docker run. For example, ENTRYPOINT ["python", "app.py"] with CMD ["--port", "8000"] lets users change only the port. Use the exec (JSON array) form so the process runs as PID 1 and receives signals properly.

Explain Docker network types.

Show answer

bridge is the default: containers get private IPs on a virtual bridge and reach outside through NAT; user-defined bridges also provide DNS by container name. host shares the host's network stack directly, with no port mapping. none disables networking. overlay connects containers across multiple hosts in Swarm. macvlan gives a container its own MAC address on the physical network.

What is the difference between volumes and bind mounts?

Show answer

A volume is storage managed by Docker under its own directory, created with docker volume create and referenced by name; it is portable and is the recommended way to persist data such as databases. A bind mount maps a specific host path into the container, which is handy for local development hot reload but depends on host directory layout and permissions.

What is a multi-stage Docker build and why use it?

Show answer

A multi-stage build uses several FROM instructions in one Dockerfile. Early stages contain compilers and build tools to produce the artefact; the final stage starts from a small runtime image and copies only the built output with COPY --from. The result is a much smaller image with fewer vulnerabilities, because build tools, source code and caches never reach production.

Your Docker image is 1.5 GB. How do you reduce its size?

Show answer

Switch to a slimmer base image such as a slim or distroless variant. Use a multi-stage build so compilers and build caches stay out of the final image. Combine package installs and clean caches in the same RUN layer. Add a .dockerignore to exclude .git, node_modules and test data. Then inspect remaining layers with docker history or the dive tool.

Two containers on the same host cannot talk to each other. What do you check?

Show answer

Check that both are on the same user-defined network with docker network inspect; the default bridge does not resolve container names. Use the service or container name and the container's internal port, not localhost and not the published host port. Confirm the app listens on 0.0.0.0 rather than 127.0.0.1. Then test with curl or nc from inside one container.

The host disk is filling up because of Docker. How do you clean up and prevent it?

Show answer

Check usage with docker system df. Remove stopped containers, dangling images and unused networks with docker system prune, and old build cache with docker builder prune; be careful with the volumes flag. Container logs are a common culprit, so configure log rotation with max-size and max-file in daemon.json. In CI agents, schedule regular pruning jobs.

Write a production-ready Dockerfile for a Node.js application.

Show answer

FROM node:20-alpine WORKDIR /app ENV NODE_ENV=production COPY package.json package-lock.json ./ RUN npm ci --omit=dev COPY . . USER node EXPOSE 3000 CMD ["node", "server.js"] Dependencies are copied and installed before source code so the layer is cached. npm ci gives reproducible installs, USER node avoids running as root, and exec form CMD lets the app receive signals.

Write a multi-stage Dockerfile for a Java Spring Boot application.

Show answer

FROM maven:3.9-eclipse-temurin-21 AS build WORKDIR /src COPY pom.xml . RUN mvn -B dependency:go-offline COPY src ./src RUN mvn -B package -DskipTests FROM eclipse-temurin:21-jre-alpine WORKDIR /app COPY --from=build /src/target/*.jar app.jar RUN adduser -D appuser USER appuser EXPOSE 8080 ENTRYPOINT ["java", "-jar", "app.jar"] The final image has only the JRE and the JAR, not Maven or source.

Write a Docker Compose file for a web app with a PostgreSQL database.

Show answer

services: web: build: . ports: - "8000:8000" environment: DATABASE_URL: postgres://app:secret@db:5432/appdb depends_on: db: condition: service_healthy db: image: postgres:16 environment: POSTGRES_USER: app POSTGRES_PASSWORD: secret POSTGRES_DB: appdb volumes: - pgdata:/var/lib/postgresql/data healthcheck: test: ["CMD", "pg_isready", "-U", "app"] interval: 5s volumes: pgdata:

How do you limit CPU and memory for a container?

Show answer

docker run -d --name api \ --memory=512m --memory-swap=512m \ --cpus=1.5 \ --restart=unless-stopped \ myapp:1.0 # change limits on a running container docker update --memory=1g --memory-swap=1g api If the process exceeds the memory limit it is OOM killed, so set application heap sizes below the limit. --cpus caps CPU time rather than reserving cores.

How do you add a health check to a Docker image?

Show answer

FROM nginx:1.27-alpine COPY site/ /usr/share/nginx/html/ HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \ CMD wget -qO- http://localhost/ || exit 1 # check status docker inspect --format '{{.State.Health.Status}}' web Docker marks the container healthy or unhealthy. Compose can wait on it with condition: service_healthy. Kubernetes ignores HEALTHCHECK and uses its own probes.

Tell me about a time you introduced a new tool or practice to your team.

Show answer

Situation: new developers took two days to set up our app locally because of different OS versions and manual database installs. Task: I wanted to make onboarding easy. Action: I created a Docker Compose setup with the app, database and seed data, wrote a short README and demoed it. Result: setup dropped to under an hour and the team adopted it for CI.

Explain the Kubernetes architecture.

KubernetesMedium

Show answer

The control plane has the kube-apiserver, the front door for all requests; etcd, the key-value store holding cluster state; the scheduler, which places pods on nodes; and the controller manager, which runs reconciliation loops. Each worker node runs the kubelet, which starts and monitors pods; kube-proxy, which handles service networking; and a container runtime such as containerd.

Explain the Kubernetes Service types ClusterIP, NodePort and LoadBalancer.

KubernetesMedium

Show answer

A Service gives pods a stable IP and DNS name and load balances across them using label selectors. ClusterIP, the default, is reachable only inside the cluster. NodePort also opens a port, 30000 to 32767, on every node. LoadBalancer additionally asks the cloud provider to create an external load balancer pointing to the service. Each type builds on the previous one.

What is the difference between an Ingress and a Service?

KubernetesMedium

Show answer

A Service exposes a set of pods at layer 4. An Ingress is a layer 7 HTTP routing resource that maps hostnames and paths to services, for example api.example.com to the api service and /admin to another. It needs an ingress controller such as NGINX or a cloud controller to work. One Ingress with one load balancer can serve many services, and it handles TLS termination.

Explain liveness, readiness and startup probes.

KubernetesMedium

Show answer

A liveness probe checks whether the container is healthy; if it fails, the kubelet restarts it. A readiness probe checks whether it can serve traffic; if it fails, the pod is removed from service endpoints but not restarted. A startup probe gives slow-starting apps time to boot and holds off the other probes until it succeeds. Wrong liveness probes can cause restart loops.

When do you use a StatefulSet instead of a Deployment?

KubernetesMedium

Show answer

Use a StatefulSet for stateful workloads such as databases, Kafka or Elasticsearch that need stable identity. Pods get fixed names like db-0 and db-1, start and stop in order, and each gets its own PersistentVolumeClaim that follows it after rescheduling. A headless service gives each pod a stable DNS name. Deployments treat pods as interchangeable, which suits stateless apps.

How does the Horizontal Pod Autoscaler work?

KubernetesMedium

Show answer

The HPA periodically reads metrics from the metrics server or a custom metrics adapter and changes the replica count of a Deployment or StatefulSet to keep a target, for example 70 percent average CPU. It calculates desired replicas from current usage divided by the target, within min and max bounds, with stabilisation windows to avoid flapping. CPU-based HPA needs resource requests set.

A pod is in CrashLoopBackOff. How do you troubleshoot it?

KubernetesMedium

Show answer

The container starts and keeps crashing, and Kubernetes waits longer between restarts. Run kubectl describe pod to see events and exit codes, and kubectl logs <pod> --previous for the crashed container's output. Common causes are missing environment variables or secrets, bad config, failing database connections, a wrong command, an aggressive liveness probe, or exit code 137 meaning OOM kill.

A pod is stuck in Pending state. What could be the reasons?

KubernetesMedium

Show answer

Pending means it has not been scheduled or its volumes are not ready. kubectl describe pod shows the scheduler's reason. Common causes are insufficient CPU or memory on nodes for the requests, node selectors, affinity or taints that no node satisfies, a PersistentVolumeClaim that cannot bind, or a resource quota being exceeded. Fix the spec or add nodes with the cluster autoscaler.

Pods are running but the service is not reachable. How do you debug it?

KubernetesMedium

Show answer

Run kubectl get endpoints <svc>; if empty, the service selector does not match the pod labels or pods are not ready. Check that the service targetPort matches the container port. Test from a debug pod with curl svc-name.namespace:port to separate DNS from app issues. Then check network policies blocking traffic and, for external access, the ingress rules and load balancer health checks.

Write a Deployment manifest with 3 replicas, resource limits and a readiness probe.

KubernetesMedium

Show answer

apiVersion: apps/v1 kind: Deployment metadata: name: api spec: replicas: 3 selector: matchLabels: app: api template: metadata: labels: app: api spec: containers: - name: api image: registry.example.com/api:1.4.2 ports: - containerPort: 8080 resources: requests: {cpu: 250m, memory: 256Mi} limits: {cpu: 500m, memory: 512Mi} readinessProbe: httpGet: {path: /health, port: 8080} periodSeconds: 5

How do you perform a rolling update and roll back a Deployment?

KubernetesMedium

Show answer

# update the image kubectl set image deployment/api api=registry.example.com/api:1.5.0 kubectl rollout status deployment/api # history and rollback kubectl rollout history deployment/api kubectl rollout undo deployment/api kubectl rollout undo deployment/api --to-revision=3 # pause or restart kubectl rollout pause deployment/api kubectl rollout restart deployment/api In GitOps setups, you change the image tag in Git instead and let Argo CD apply it.

What is Helm and what are its basic commands?

KubernetesMedium

Show answer

helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update helm install my-redis bitnami/redis -n cache --create-namespace helm upgrade my-redis bitnami/redis -f values-prod.yaml helm list -A helm rollback my-redis 1 helm uninstall my-redis -n cache helm template ./mychart -f values.yaml # render locally Helm is the package manager for Kubernetes. A chart is a set of templated manifests, and values files customise it per environment.

How do you create a Secret and use it as an environment variable in a pod?

KubernetesMedium

Show answer

kubectl create secret generic db-creds \ --from-literal=DB_USER=app --from-literal=DB_PASS='S3cret!' -n shop # in the container spec env: - name: DB_PASS valueFrom: secretKeyRef: name: db-creds key: DB_PASS # or load all keys envFrom: - secretRef: name: db-creds Pods do not pick up changed env values until restarted; mounted secret files update automatically.

Describe how you handled an on-call incident late at night.

KubernetesMedium

Show answer

Situation: at 2 AM I got an alert that checkout error rates crossed 10 percent. Task: restore service as on-call engineer. Action: I checked dashboards, saw a node pool had scaled down and pods were pending, scaled it manually, and posted updates in the incident channel. Result: errors cleared in 20 minutes, and next day I fixed the autoscaler settings and wrote the post-mortem.

What is the difference between declarative and imperative IaC, and between Terraform and Ansible?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Declarative tools describe the end state and the tool works out the steps; imperative tools describe the steps. Terraform is declarative, keeps a state file and is best at provisioning cloud resources. Ansible is procedural with mostly idempotent modules, agentless over SSH, and best at configuring servers and deploying software. Many teams use Terraform to create VMs and Ansible to configure them.

What is the Terraform state file and why is it important?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

terraform.tfstate maps the resources in your code to real resources in the cloud, storing their IDs and attributes. Terraform compares code, state and reality to decide what to create, change or destroy. Without it Terraform would not know what it manages. It may contain secrets in plain text, so store it in a secure remote backend, never in Git.

What is remote state and state locking in Terraform?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Remote state stores the state file in a shared backend such as an S3 bucket, Azure Storage or Terraform Cloud, so the whole team and CI use the same state. Locking prevents two runs from changing state at the same time, avoiding corruption; on S3 it uses a lock file or a DynamoDB table. Enable versioning and encryption on the backend for recovery and security.

What are Terraform modules?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

A module is a reusable folder of Terraform files with input variables and outputs, for example a vpc module or an eks-cluster module. The root module calls child modules with different values for each environment. Modules reduce duplication and enforce standards across teams. They can come from local paths, Git or the Terraform Registry and should be pinned to versions.

What is the difference between count and for_each in Terraform?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

count creates N copies indexed by number, such as aws_instance.web[0]. Removing an item in the middle shifts indexes and can destroy and recreate resources unexpectedly. for_each iterates over a map or set of strings and keys each instance by name, such as aws_s3_bucket.b["logs"], so adding or removing one item affects only that item. Prefer for_each for named collections.

What does idempotency mean in Ansible?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Idempotency means running the same playbook many times gives the same result without unwanted changes. Modules check current state first: the apt module installs a package only if missing and reports ok instead of changed. The shell and command modules are not idempotent by default, so use creates, removes or changed_when conditions, or prefer a dedicated module.

What are Ansible roles?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

A role is a standard folder structure that packages tasks, handlers, templates, files, variables and defaults for one purpose, for example a nginx or postgres role. Playbooks then just list roles for host groups, keeping them short and reusable across projects. Roles can be shared through Ansible Galaxy or collections, and tested with Molecule.

You need to bring existing manually created cloud resources under Terraform. How?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Write the resource blocks in code, then import the real resources into state. Since Terraform 1.5 you can declare import blocks with the resource ID and run plan; terraform plan -generate-config-out can even draft the configuration. Older versions use the terraform import CLI command. Run plan until it shows no changes, which proves code matches reality.

An Ansible playbook run against 100 servers failed on 7 of them. What do you do?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Check the output and the retry file or failed host list to see the error on those hosts, for example unreachable SSH, a missing package repo or full disk. Fix the cause, then rerun only those hosts with --limit. Because tasks are idempotent, rerunning on successful hosts is also safe. For rolling changes, use serial and max_fail_percentage to stop early on failures.

Write Terraform code to create an AWS EC2 instance.

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

terraform { required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } } } provider "aws" { region = "ap-south-1" } resource "aws_instance" "web" { ami = var.ami_id instance_type = "t3.micro" subnet_id = var.subnet_id tags = { Name = "web-server" Env = "dev" } } Run terraform init, plan and apply. ap-south-1 is the Mumbai region.

How do you configure an S3 remote backend with locking?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

terraform { backend "s3" { bucket = "acme-terraform-state" key = "prod/network/terraform.tfstate" region = "ap-south-1" encrypt = true use_lockfile = true } } Then run terraform init (add -migrate-state if moving local state). Enable versioning on the bucket. Older setups use dynamodb_table = "tf-locks" instead of use_lockfile for locking.

What are Ansible handlers and how do you use them?

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Handlers are tasks that run only when notified by another task that reported a change, and they run once at the end of the play even if notified many times. tasks: - name: Update app config ansible.builtin.copy: src: app.conf dest: /etc/app/app.conf notify: Restart app handlers: - name: Restart app ansible.builtin.service: name: app state: restarted This avoids restarting services when nothing changed.

Tell me about a mistake you made in infrastructure work and what you learned.

Infrastructure as Code (Terraform and Ansible)Medium

Show answer

Situation: I applied a Terraform change that renamed a security group, which forced replacement and briefly cut access to a staging database. Task: fix it and prevent repeats. Action: I restored access quickly, explained it openly to my lead, and then added plan review in pull requests plus lifecycle create_before_destroy rules. Result: no similar outage since, and I now read every destroy line in a plan.

Explain the main components of an AWS VPC.

Show answer

A VPC is your private network with a CIDR range like 10.0.0.0/16. It is split into subnets in each Availability Zone. Public subnets have a route to an Internet Gateway; private subnets reach the internet only through a NAT Gateway in a public subnet. Route tables control traffic, security groups and NACLs filter it, and VPC endpoints give private access to services like S3.

What is the difference between a security group and a network ACL?

Show answer

A security group acts as a firewall for instances or network interfaces. It is stateful, so return traffic is allowed automatically, and it supports only allow rules. A network ACL works at the subnet level, is stateless, so inbound and outbound rules must both allow traffic, supports allow and deny rules, and evaluates rules in number order. Security groups are the main control.

How do an Application Load Balancer and an Auto Scaling group work together?

Show answer

The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.

When would you choose ECS, EKS or Lambda?

Show answer

Lambda runs functions without servers, billed per request and duration, ideal for event-driven tasks with short runtimes up to 15 minutes. ECS is AWS's simpler container orchestrator, good when you want containers without Kubernetes complexity, often with Fargate. EKS is managed Kubernetes, chosen for portability, a rich ecosystem and existing Kubernetes skills, but it needs more operational knowledge.

An EC2 instance in a private subnet cannot download packages from the internet. Why?

Show answer

A private subnet has no direct route to the Internet Gateway. Check that its route table sends 0.0.0.0/0 to a NAT Gateway placed in a public subnet, that the NAT Gateway has an Elastic IP, and that the security group and NACL allow outbound traffic and return ports. For AWS services like S3, a VPC endpoint avoids NAT data charges.

An application on EC2 needs to read files from S3. How do you give it access securely?

Show answer

Create an IAM role with a policy allowing only the needed actions, such as s3:GetObject on that bucket, attach it to the instance through an instance profile, and let the AWS SDK pick up temporary credentials automatically. Never put access keys in code or config files. Optionally add a bucket policy and a VPC endpoint so traffic stays inside AWS.

Someone made an S3 bucket with customer files public. What do you do?

Show answer

Immediately block public access on the bucket and remove the public policy or ACLs. Check S3 server access logs or CloudTrail data events to see whether objects were downloaded, and involve security if customer data was exposed. Then enable Block Public Access at the account level, use AWS Config rules to detect public buckets, and require bucket changes through reviewed IaC.

The application cannot connect to an RDS database. What do you check?

Show answer

Confirm the endpoint, port, username and password. Check that the RDS security group allows inbound traffic on the database port from the application's security group, and that both are in reachable subnets of the same VPC or peered networks. Test with nc -zv endpoint 5432 from the app host. Also check the instance status, max connections and SSL requirements.

Write an IAM policy that gives read-only access to one S3 bucket.

Show answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::acme-reports" }, { "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::acme-reports/*" } ] } ListBucket applies to the bucket ARN and GetObject to object ARNs, so both resources are needed.

How do you assume an IAM role in another account using the AWS CLI?

Show answer

# ~/.aws/config [profile prod-admin] role_arn = arn:aws:iam::123456789012:role/DevOpsAdmin source_profile = default region = ap-south-1 aws s3 ls --profile prod-admin # manual way aws sts assume-role \ --role-arn arn:aws:iam::123456789012:role/DevOpsAdmin \ --role-session-name ravi-session The role's trust policy must allow your account. Temporary credentials expire, usually after an hour.

How do you create an EKS cluster with eksctl and connect kubectl to it?

Show answer

eksctl create cluster \ --name shop-dev \ --region ap-south-1 \ --nodegroup-name workers \ --node-type t3.medium \ --nodes 2 --nodes-min 2 --nodes-max 5 \ --managed aws eks update-kubeconfig --name shop-dev --region ap-south-1 kubectl get nodes eksctl builds CloudFormation stacks for the VPC, control plane and node group. In production, teams usually manage EKS with Terraform modules instead.

Tell me about a time you reduced cloud costs.

Show answer

Situation: our dev and test AWS accounts cost almost as much as production. Task: my manager asked me to cut waste without slowing teams. Action: I tagged resources by owner, found idle instances and old snapshots, scheduled non-production instances to stop at night with a Lambda, and moved CI agents to Spot. Result: non-production spend fell about 40 percent within two months.

How do you prioritise when several teams ask you for infrastructure work at the same time?

Show answer

I list the requests with their business impact and deadline, and check which are blocking production or a release. Production issues and security fixes come first. For the rest I agree priority with my lead and the requesting teams openly, give realistic timelines and share progress. Where requests repeat, I build self-service templates so teams are not waiting on me.

What are the Prometheus metric types?

Show answer

A counter only increases, such as total requests, and you use rate() on it. A gauge goes up and down, such as memory in use or queue length. A histogram counts observations into configurable buckets, such as request duration, and lets you compute percentiles with histogram_quantile across instances. A summary computes quantiles on the client side but cannot be aggregated across instances.

What are the four golden signals, and the RED and USE methods?

Show answer

The four golden signals are latency, traffic, errors and saturation. RED, for request-driven services, tracks rate, errors and duration. USE, for resources such as CPU, disks and network, tracks utilisation, saturation and errors. RED tells you whether users are hurting; USE helps find which resource is the bottleneck. Together they give a solid starting set of dashboards and alerts.

The on-call team gets dozens of alerts every night and is burning out. How do you fix it?

Show answer

Collect alert data for a few weeks: which fired, how often, and whether anyone acted. Delete or downgrade non-actionable alerts, tune thresholds and add for durations, and group duplicates in Alertmanager. Fix the recurring root causes behind the top alerts and automate common fixes. Move to SLO-based alerts and make sure rotations are fair with follow-up time after bad nights.

Write PromQL queries for request rate, error rate and p95 latency.

Show answer

# requests per second per service over 5 minutes sum by (service) (rate(http_requests_total[5m])) # error ratio (5xx) sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m])) # p95 latency from a histogram histogram_quantile(0.95, sum by (le) (rate(http_request_duration_seconds_bucket[5m]))) rate() works on counters and handles resets; the le label holds histogram bucket bounds.

Write a Prometheus alerting rule for a high error rate.

Show answer

groups: - name: api-alerts rules: - alert: HighErrorRate expr: | sum(rate(http_requests_total{job="api",status=~"5.."}[5m])) / sum(rate(http_requests_total{job="api"}[5m])) > 0.05 for: 10m labels: severity: page annotations: summary: "API error rate above 5 percent" runbook: "https://wiki.example.com/runbooks/api-errors" for: 10m ignores short spikes; Alertmanager routes by the severity label.

Tell me about a blameless post-mortem you were part of.

Show answer

Situation: a certificate expired and our API was down for 40 minutes. Task: I wrote the post-mortem. Action: I built a timeline from logs and chat, and we focused on why the system allowed it rather than who forgot: renewal was manual and nothing alerted. Result: we automated renewal with cert-manager, added expiry alerts 21 days ahead, and tracked actions to closure.

How do you communicate with stakeholders during an outage?