Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About PhonePe hiring for DevOps roles
PhonePe is an Indian digital payments and financial services company, majority-owned by Walmart, known for UPI payments, insurance and investment distribution, and the Pincode commerce app. Its engineering teams build high-scale payments systems. It hires for software engineers, SDETs, data analysts, data engineers and data scientists.
For DevOps roles, this PhonePe practice set focuses most on Kubernetes (6), Infrastructure as Code (Terraform and Ansible) (5), AWS Cloud for DevOps (4), Git and Version Control (4). It has 3 easy, 21 medium, 6 hard questions, so you can start easy and work up to the harder ones.
Company type
Fintech
Headquarters
Bengaluru, India
Main India offices
Bengaluru, Pune
PhonePe DevOps interview process
Online coding assessment
Machine coding round
DSA or problem solving round
Design or hiring manager round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for PhonePeStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you build and push a Docker image from a pipeline?
# shell steps in any CI tool
IMAGE=registry.example.com/shop/api
TAG=$(git rev-parse --short HEAD)
echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin
docker build -t $IMAGE:$TAG .
docker push $IMAGE:$TAG
Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.
FROM nginx:1.27-alpine
COPY site/ /usr/share/nginx/html/
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
CMD wget -qO- http://localhost/ || exit 1
# check status
docker inspect --format '{{.State.Health.Status}}' web
Docker marks the container healthy or unhealthy. Compose can wait on it with condition: service_healthy. Kubernetes ignores HEALTHCHECK and uses its own probes.
03
The application cannot connect to an RDS database. What do you check?
Confirm the endpoint, port, username and password. Check that the RDS security group allows inbound traffic on the database port from the application's security group, and that both are in reachable subnets of the same VPC or peered networks. Test with nc -zv endpoint 5432 from the app host. Also check the instance status, max connections and SSL requirements.
Run kubectl describe node to see conditions such as MemoryPressure, DiskPressure or a kubelet that stopped posting status. SSH in and check systemctl status kubelet, the container runtime, journalctl -u kubelet, disk space and network to the API server. Pods on the node are evicted after a timeout. Cordon and drain it, fix or replace the node, and in cloud setups let the node group recreate it.
A module is a reusable folder of Terraform files with input variables and outputs, for example a vpc module or an eks-cluster module. The root module calls child modules with different values for each environment. Modules reduce duplication and enforce standards across teams. They can come from local paths, Git or the Terraform Registry and should be pinned to versions.
06
How do an Application Load Balancer and an Auto Scaling group work together?
The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.
07
Write a production-ready Dockerfile for a Node.js application.
FROM node:20-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
USER node
EXPOSE 3000
CMD ["node", "server.js"]
Dependencies are copied and installed before source code so the layer is cached. npm ci gives reproducible installs, USER node avoids running as root, and exec form CMD lets the app receive signals.
08
What are Ansible handlers and how do you use them?
Handlers are tasks that run only when notified by another task that reported a change, and they run once at the end of the play even if notified many times.
tasks:
- name: Update app config
ansible.builtin.copy:
src: app.conf
dest: /etc/app/app.conf
notify: Restart app
handlers:
- name: Restart app
ansible.builtin.service:
name: app
state: restarted
This avoids restarting services when nothing changed.
The HPA periodically reads metrics from the metrics server or a custom metrics adapter and changes the replica count of a Deployment or StatefulSet to keep a target, for example 70 percent average CPU. It calculates desired replicas from current usage divided by the target, within min and max bounds, with stabilisation windows to avoid flapping. CPU-based HPA needs resource requests set.
10
How would you plan disaster recovery for a complete AWS region failure?
Start from business RTO and RPO. Options range from backup and restore, which is cheapest and slowest, to pilot light, warm standby and multi-region active-active. Replicate data with S3 cross-region replication, Aurora Global Database or DynamoDB global tables, keep infrastructure in Terraform so it can be rebuilt, use Route 53 failover routing and rehearse failover drills.
11
Compare blue-green, canary and rolling deployments.
Blue-green runs two full environments and switches traffic from old to new at once; rollback is instant but costs double capacity. Rolling replaces instances in batches with no extra environment, but old and new versions run together for a while. Canary sends a small share of traffic, say 5 percent, to the new version and widens it as metrics stay healthy, limiting blast radius.
Kubernetes is an open-source container orchestration platform. You declare the desired state, such as five replicas of an API, and it schedules containers across nodes, restarts failed ones, scales them, balances traffic and rolls out updates. Companies use it to run many microservices reliably on shared infrastructure, on any cloud or on-premises, through managed services like EKS, AKS and GKE.
13
You pushed a broken commit to the shared main branch and the build is failing. What do you do?
First restore a green main quickly: run git revert <hash> and push, which adds an undo commit without rewriting history that others have pulled. Tell the team in the channel. Then fix the issue on a branch with a proper pull request and tests. Avoid git reset with force push on main; branch protection rules should block it anyway.
14
What is the difference between count and for_each in Terraform?
count creates N copies indexed by number, such as aws_instance.web[0]. Removing an item in the middle shifts indexes and can destroy and recreate resources unexpectedly. for_each iterates over a map or set of strings and keys each instance by name, such as aws_s3_bucket.b["logs"], so adding or removing one item affects only that item. Prefer for_each for named collections.
15
Tell me about a time you disagreed with a code review comment.
Situation: a reviewer asked me to replace a simple retry loop in our deploy script with a heavy external library. Task: I felt it added risk. Action: I explained my reasoning, shared a small benchmark and failure tests, and asked what concern they had; it was about backoff. Result: I added exponential backoff to my version, they approved, and we documented the pattern.
A liveness probe checks whether the container is healthy; if it fails, the kubelet restarts it. A readiness probe checks whether it can serve traffic; if it fails, the pod is removed from service endpoints but not restarted. A startup probe gives slow-starting apps time to boot and holds off the other probes until it succeeds. Wrong liveness probes can cause restart loops.
17
Tell me about a blameless post-mortem you were part of.
Situation: a certificate expired and our API was down for 40 minutes. Task: I wrote the post-mortem. Action: I built a timeline from logs and chat, and we focused on why the system allowed it rather than who forgot: renewal was manual and nothing alerted. Result: we automated renewal with cert-manager, added expiry alerts 21 days ahead, and tracked actions to closure.
18
Someone made an S3 bucket with customer files public. What do you do?
Immediately block public access on the bucket and remove the public policy or ACLs. Check S3 server access logs or CloudTrail data events to see whether objects were downloaded, and involve security if customer data was exposed. Then enable Block Public Access at the account level, use AWS Config rules to detect public buckets, and require bucket changes through reviewed IaC.
19
How do you use stored credentials inside a Jenkins pipeline?
pipeline {
agent any
environment {
SONAR_TOKEN = credentials('sonar-token')
}
stages {
stage('Push') {
steps {
withCredentials([usernamePassword(credentialsId: 'docker-hub',
usernameVariable: 'USER', passwordVariable: 'PASS')]) {
sh 'echo $PASS | docker login -u $USER --password-stdin'
}
}
}
}
}
Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.
docker run -d --name api \
--memory=512m --memory-swap=512m \
--cpus=1.5 \
--restart=unless-stopped \
myapp:1.0
# change limits on a running container
docker update --memory=1g --memory-swap=1g api
If the process exceeds the memory limit it is OOM killed, so set application heap sizes below the limit. --cpus caps CPU time rather than reserving cores.
21
You need to bring existing manually created cloud resources under Terraform. How?
Write the resource blocks in code, then import the real resources into state. Since Terraform 1.5 you can declare import blocks with the resource ID and run plan; terraform plan -generate-config-out can even draft the configuration. Older versions use the terraform import CLI command. Run plan until it shows no changes, which proves code matches reality.
22
How do you manage dev, staging and production environments with Terraform?
Keep shared logic in versioned modules and create a separate root configuration per environment, each with its own backend state and tfvars, for example envs/dev and envs/prod. This isolates state so a mistake in dev cannot touch prod. Workspaces are an option for near-identical environments but share backend config. Promote module versions from dev to prod through pull requests.
All three move the current branch pointer to another commit. --soft keeps your changes staged, useful for recombining commits. --mixed, the default, keeps changes in the working directory but unstaged. --hard discards changes in both staging and working directory, so uncommitted work is lost. Lost commits can usually still be found with git reflog for a while.
24
The on-call team gets dozens of alerts every night and is burning out. How do you fix it?
Collect alert data for a few weeks: which fired, how often, and whether anyone acted. Delete or downgrade non-actionable alerts, tune thresholds and add for durations, and group duplicates in Alertmanager. Fix the recurring root causes behind the top alerts and automate common fixes. Move to SLO-based alerts and make sure rotations are fair with follow-up time after bad nights.
25
You suspect a memory leak in a production service. How do you confirm and handle it?
Look at memory graphs over days: a leak shows steady growth that drops only on restart, often with OOM kills. Correlate the start with a deployment. Take heap dumps or profiles, for example jmap for Java or pprof for Go, and compare them over time. As a short-term fix, set memory limits and schedule restarts or roll back, then fix the code and add a memory alert.
26
How do you perform a rolling update and roll back a Deployment?
# update the image
kubectl set image deployment/api api=registry.example.com/api:1.5.0
kubectl rollout status deployment/api
# history and rollback
kubectl rollout history deployment/api
kubectl rollout undo deployment/api
kubectl rollout undo deployment/api --to-revision=3
# pause or restart
kubectl rollout pause deployment/api
kubectl rollout restart deployment/api
In GitOps setups, you change the image tag in Git instead and let Argo CD apply it.
27
What is the difference between git fetch and git pull?
git fetch downloads new commits and branches from the remote into remote-tracking branches like origin/main without touching your working files. git pull is fetch followed by merge (or rebase if configured) into your current branch. Fetch is safer when you want to inspect incoming changes first with git log main..origin/main before integrating them.
28
Tell me about a time you migrated an application to Kubernetes.
Situation: our monolith and five services ran on hand-managed VMs with frequent config drift. Task: I led the move to a managed Kubernetes cluster. Action: I containerised each service, wrote Helm charts, added probes and resource limits, set up Argo CD, and migrated one low-risk service first with a rollback plan. Result: deployments went from weekly to daily and VM costs dropped about 30 percent.
29
Logging costs are rising fast because of huge log volume. What do you do?
Find the top log sources by volume. Lower verbose debug logging in production, drop health check and noisy access logs, and sample high-volume info logs. Use structured logs to avoid duplicated fields. Set retention tiers: a few days hot, then archive to S3. Turn repeated log lines into metrics where only counts matter, which is far cheaper to store and query.
30
Explain stdin, stdout, stderr and what 2>&1 means.
Every process gets three file descriptors: 0 is stdin, 1 is stdout and 2 is stderr. > redirects stdout to a file, 2> redirects errors, and 2>&1 sends stderr to wherever stdout currently points. So command > out.log 2>&1 captures both normal output and errors in one file. Order matters: 2>&1 placed before > out.log would still print errors to the terminal.
Tips to crack the PhonePe DevOps interview
Practise machine coding problems and focus on clean, extensible object-oriented design within the time limit.
Understand how UPI transactions work at scale, including idempotency, retries and reconciliation.
For analyst roles, prepare cases on transaction success rates, merchant adoption and fraud detection metrics.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; PhonePe interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the PhonePe DevOps interview?
Candidates usually go through 5 stages: Online coding assessment; Machine coding round; DSA or problem solving round; Design or hiring manager round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the PhonePe DevOps interview?
This practice set leans on Kubernetes (6), Infrastructure as Code (Terraform and Ansible) (5), AWS Cloud for DevOps (4), Git and Version Control (4). Revise those first, then practise explaining one or two of your own projects end to end, because most PhonePe interviewers ask you to walk through real work.
Are these the exact questions asked at PhonePe?
No. These are curated practice questions that match the skills and difficulty usually tested in fintech interviews like PhonePe's. They are not a leaked or verified list of past questions.
Where does PhonePe hire DevOps professionals in India?
PhonePe has large teams in Bengaluru, Pune. Openings and locations change often, so check the PhonePe careers page and filter by city and experience.