Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Razorpay hiring for DevOps roles
Razorpay is an Indian fintech company providing payment gateway, payment links, payroll, business banking through RazorpayX and other tools for businesses. Its engineering and analytics teams work on payment success rates, risk, reconciliation and merchant products. It hires for software engineers, SDETs, data analysts and data scientists.
For DevOps roles, this Razorpay practice set focuses most on Docker and Containers (6), CI/CD Pipelines (5), Kubernetes (4), AWS Cloud for DevOps (4). It has 2 easy, 24 medium, 4 hard questions, so you can start easy and work up to the harder ones.
Company type
Fintech
Headquarters
Bengaluru, India
Main India offices
Bengaluru, Mumbai
Razorpay DevOps interview process
Online assessment or assignment
Machine coding or technical round
Design or problem solving round
Hiring manager round
Culture fit round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for RazorpayStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between declarative and scripted Jenkins pipelines?
Both are written in a Jenkinsfile using Groovy. Declarative pipelines use a fixed structure with pipeline, agent, stages, steps and post blocks, which is easy to read, validate and maintain. Scripted pipelines start with node and allow full Groovy logic, giving more flexibility but more room for messy code. Most teams use declarative and drop into a script block only when needed.
02
What is load average in Linux and how do you read it?
Load average is the average number of processes running or waiting for CPU (and uninterruptible I/O) over 1, 5 and 15 minutes, shown by uptime or top. Compare it with the number of CPU cores: a load of 4 on a 4-core machine means full use, while 12 means work is queuing. A high load with low CPU use often points to disk or network I/O waits.
03
Pods are running but the service is not reachable. How do you debug it?
Run kubectl get endpoints <svc>; if empty, the service selector does not match the pod labels or pods are not ready. Check that the service targetPort matches the container port. Test from a debug pod with curl svc-name.namespace:port to separate DNS from app issues. Then check network policies blocking traffic and, for external access, the ingress rules and load balancer health checks.
04
Your Docker image is 1.5 GB. How do you reduce its size?
Switch to a slimmer base image such as a slim or distroless variant. Use a multi-stage build so compilers and build caches stay out of the final image. Combine package installs and clean caches in the same RUN layer. Add a .dockerignore to exclude .git, node_modules and test data. Then inspect remaining layers with docker history or the dive tool.
05
Logging costs are rising fast because of huge log volume. What do you do?
Find the top log sources by volume. Lower verbose debug logging in production, drop health check and noisy access logs, and sample high-volume info logs. Use structured logs to avoid duplicated fields. Set retention tiers: a few days hot, then archive to S3. Turn repeated log lines into metrics where only counts matter, which is far cheaper to store and query.
06
How do you create an EKS cluster with eksctl and connect kubectl to it?
# shell steps in any CI tool
IMAGE=registry.example.com/shop/api
TAG=$(git rev-parse --short HEAD)
echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin
docker build -t $IMAGE:$TAG .
docker push $IMAGE:$TAG
Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.
A DaemonSet makes sure one copy of a pod runs on every node, or on a selected group of nodes. When a node joins the cluster, the pod is added automatically. It is used for node-level agents such as log collectors like Fluent Bit, monitoring agents like the Prometheus node exporter, and CNI or storage plugins.
09
What is the difference between an Ingress and a Service?
A Service exposes a set of pods at layer 4. An Ingress is a layer 7 HTTP routing resource that maps hostnames and paths to services, for example api.example.com to the api service and /admin to another. It needs an ingress controller such as NGINX or a cloud controller to work. One Ingress with one load balancer can serve many services, and it handles TLS termination.
10
How do you create a Secret and use it as an environment variable in a pod?
HEAD normally points to a branch name. In detached HEAD, it points directly to a commit, for example after git checkout <hash> or checking out a tag. You can look around and even commit, but new commits belong to no branch and can be lost when you switch away. To keep them, create a branch with git switch -c new-branch.
A counter only increases, such as total requests, and you use rate() on it. A gauge goes up and down, such as memory in use or queue length. A histogram counts observations into configurable buckets, such as request duration, and lets you compute percentiles with histogram_quantile across instances. A summary computes quantiles on the client side but cannot be aggregated across instances.
13
Someone made an S3 bucket with customer files public. What do you do?
Immediately block public access on the bucket and remove the public policy or ACLs. Check S3 server access logs or CloudTrail data events to see whether objects were downloaded, and involve security if customer data was exposed. Then enable Block Public Access at the account level, use AWS Config rules to detect public buckets, and require bucket changes through reviewed IaC.
14
The host disk is filling up because of Docker. How do you clean up and prevent it?
Check usage with docker system df. Remove stopped containers, dangling images and unused networks with docker system prune, and old build cache with docker builder prune; be careful with the volumes flag. Container logs are a common culprit, so configure log rotation with max-size and max-file in daemon.json. In CI agents, schedule regular pruning jobs.
15
How do Docker image layers and build caching work?
Each Dockerfile instruction like RUN, COPY or ADD creates a layer. Docker caches layers and reuses them if the instruction and its inputs have not changed; once one layer changes, all later layers rebuild. So copy dependency files and install dependencies first, then copy source code. That way code changes do not reinstall all packages, and builds become much faster.
16
You need one pipeline that deploys to dev, staging and production with approval before production. How do you design it?
Build and test once, publish a versioned artefact, then promote it through environments. Dev deploys automatically on merge, staging deploys after dev smoke tests, and production waits for a manual approval from authorised people using a Jenkins input step or GitHub environment protection rules. Keep environment-specific settings in config files or parameters, not separate pipelines, and record who approved each release.
17
Write a Docker Compose file for a web app with a PostgreSQL database.
FROM node:20-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
USER node
EXPOSE 3000
CMD ["node", "server.js"]
Dependencies are copied and installed before source code so the layer is cached. npm ci gives reproducible installs, USER node avoids running as root, and exec form CMD lets the app receive signals.
19
Your container takes 10 seconds to stop and does not shut down gracefully. Why?
docker stop sends SIGTERM to PID 1 and waits 10 seconds before SIGKILL. If the Dockerfile uses shell form like CMD node app.js, PID 1 is a shell that does not forward signals, so the app never gets SIGTERM. Use exec form CMD ["node", "app.js"], use exec in entrypoint scripts, or add an init such as tini with --init, and handle SIGTERM in code.
systemctl status nginx
sudo systemctl start nginx
sudo systemctl restart nginx
sudo systemctl enable nginx # start at boot
sudo systemctl disable nginx
journalctl -u nginx -f # follow service logs
sudo systemctl daemon-reload # after editing a unit file
Unit files live in /etc/systemd/system. enable creates the symlink for the boot target, while start only runs it now.
21
What is the difference between declarative and imperative IaC, and between Terraform and Ansible?
Declarative tools describe the end state and the tool works out the steps; imperative tools describe the steps. Terraform is declarative, keeps a state file and is best at provisioning cloud resources. Ansible is procedural with mostly idempotent modules, agentless over SSH, and best at configuring servers and deploying software. Many teams use Terraform to create VMs and Ansible to configure them.
22
The application cannot connect to an RDS database. What do you check?
Confirm the endpoint, port, username and password. Check that the RDS security group allows inbound traffic on the database port from the application's security group, and that both are in reachable subnets of the same VPC or peered networks. Test with nc -zv endpoint 5432 from the app host. Also check the instance status, max connections and SSL requirements.
23
Your repository has become huge because of binary files and clones are very slow. How do you fix it?
Short term, CI can use shallow clones with --depth 1 and partial clone filters. For future binaries, move them to Git LFS or an artefact store such as S3 or Nexus. To shrink existing history, use git filter-repo to remove the large files, coordinate a force push and ask everyone to re-clone. Add size checks in pre-receive hooks to prevent recurrence.
24
The Jenkins controller is slow and builds keep queueing. What do you do?
Make sure no builds run on the controller by setting its executors to zero. Add agents, ideally dynamic ones on Kubernetes or EC2 that scale with the queue. Check controller heap, disk and plugin count, and remove unused plugins. Discard old builds and artefacts with retention rules. For very large setups, split teams across multiple controllers or move suitable jobs to another CI tool.
25
What are Ansible handlers and how do you use them?
Handlers are tasks that run only when notified by another task that reported a change, and they run once at the end of the play even if notified many times.
tasks:
- name: Update app config
ansible.builtin.copy:
src: app.conf
dest: /etc/app/app.conf
notify: Restart app
handlers:
- name: Restart app
ansible.builtin.service:
name: app
state: restarted
This avoids restarting services when nothing changed.
26
An Ansible playbook run against 100 servers failed on 7 of them. What do you do?
Check the output and the retry file or failed host list to see the error on those hosts, for example unreachable SSH, a missing package repo or full disk. Fix the cause, then rerun only those hosts with --limit. Because tasks are idempotent, rerunning on successful hosts is also safe. For rolling changes, use serial and max_fail_percentage to stop early on failures.
27
Write a script that alerts when any disk partition is above 80 percent used.
#!/bin/bash
THRESHOLD=80
df -hP | awk 'NR>1 {gsub("%","",$5); print $5, $6}' | while read -r used mount; do
if [ "$used" -ge "$THRESHOLD" ]; then
echo "WARNING: $mount is ${used}% full on $(hostname)"
fi
done
df -P keeps each entry on one line, awk strips the percent sign, and the loop compares each value with the threshold.
28
You deleted a local branch that had unmerged commits. How do you recover it?
Git keeps unreferenced commits for a while. Run git reflog to see recent HEAD positions and find the last commit of that branch, or check the hash printed when you deleted it. Then recreate the branch with git branch feature-x <hash>. Reflog is local only, so this works on the same machine, and entries expire after about 90 days by default.
29
An EC2 instance in a private subnet cannot download packages from the internet. Why?
A private subnet has no direct route to the Internet Gateway. Check that its route table sends 0.0.0.0/0 to a NAT Gateway placed in a public subnet, that the NAT Gateway has an Elastic IP, and that the security group and NACL allow outbound traffic and return ports. For AWS services like S3, a VPC endpoint avoids NAT data charges.
30
Builds fail randomly because of flaky tests. How do you handle it?
First identify flaky tests by tracking which tests fail and pass on the same commit. Quarantine them into a separate non-blocking job so the main pipeline stays trustworthy, and raise tickets with owners. Common causes are timing assumptions, shared test data, order dependence and external services. Blind automatic retries hide real bugs, so use them only briefly while fixing the root cause.
Tips to crack the Razorpay DevOps interview
Learn how a payment gateway works end to end, including authorisation, settlement, refunds and chargebacks.
Practise API testing with tools like Postman and understand webhooks if you are applying for QA roles.
Read Razorpay's engineering blog to understand its scale challenges and use them in design discussions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Razorpay interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Razorpay DevOps interview?
Candidates usually go through 5 stages: Online assessment or assignment; Machine coding or technical round; Design or problem solving round; Hiring manager round; Culture fit round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Razorpay DevOps interview?
This practice set leans on Docker and Containers (6), CI/CD Pipelines (5), Kubernetes (4), AWS Cloud for DevOps (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Razorpay interviewers ask you to walk through real work.
Are these the exact questions asked at Razorpay?
No. These are curated practice questions that match the skills and difficulty usually tested in fintech interviews like Razorpay's. They are not a leaked or verified list of past questions.
Where does Razorpay hire DevOps professionals in India?
Razorpay has large teams in Bengaluru, Mumbai. Openings and locations change often, so check the Razorpay careers page and filter by city and experience.