Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About TCS hiring for DevOps roles
Tata Consultancy Services is a Tata Group company and one of the largest IT services and consulting firms in the world. It delivers application development, testing, cloud, data and analytics services to clients in banking, retail, manufacturing and other industries. In India it hires freshers and experienced staff for software testing, data engineering, BI reporting and analytics roles across its delivery centres.
For DevOps roles, this TCS practice set focuses most on Infrastructure as Code (Terraform and Ansible) (7), CI/CD Pipelines (6), Git and Version Control (5), AWS Cloud for DevOps (4). It has 14 easy, 16 medium questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Mumbai, India
Main India offices
Mumbai, Chennai, Pune, Bengaluru, Hyderabad
TCS DevOps interview process
TCS NQT online assessment (aptitude + coding)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for TCSStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between a security group and a network ACL?
A security group acts as a firewall for instances or network interfaces. It is stateful, so return traffic is allowed automatically, and it supports only allow rules. A network ACL works at the subnet level, is stateless, so inbound and outbound rules must both allow traffic, supports allow and deny rules, and evaluates rules in number order. Security groups are the main control.
02
What are the S3 storage classes and lifecycle policies?
S3 Standard is for frequently accessed data. Standard-IA and One Zone-IA are cheaper for infrequent access but charge retrieval fees. Intelligent-Tiering moves objects automatically based on access. Glacier Instant, Flexible Retrieval and Deep Archive are for archives with slower, cheaper access. Lifecycle rules move objects between classes after a set age and delete old versions or logs automatically.
git stash saves your uncommitted changes and cleans the working directory, so you can switch branches for an urgent fix. git stash list shows saved entries, git stash pop reapplies the latest and removes it, and git stash apply keeps it. Use git stash -u to include untracked files. It is a short-term tool; for longer work, commit on a branch.
04
How do you write an Ansible inventory and run ad-hoc commands?
Infrastructure as Code means defining servers, networks, databases and other resources in version-controlled files instead of clicking in a console. Benefits are repeatable environments, code review for infrastructure changes, history and rollback through Git, fewer manual mistakes, faster provisioning and easy disaster recovery. Common tools are Terraform and OpenTofu for provisioning and Ansible for configuration management.
06
What is the difference between count and for_each in Terraform?
count creates N copies indexed by number, such as aws_instance.web[0]. Removing an item in the middle shifts indexes and can destroy and recreate resources unexpectedly. for_each iterates over a map or set of strings and keys each instance by name, such as aws_s3_bucket.b["logs"], so adding or removing one item affects only that item. Prefer for_each for named collections.
07
What is the difference between declarative and scripted Jenkins pipelines?
Both are written in a Jenkinsfile using Groovy. Declarative pipelines use a fixed structure with pipeline, agent, stages, steps and post blocks, which is easy to read, validate and maintain. Scripted pipelines start with node and allow full Groovy logic, giving more flexibility but more room for messy code. Most teams use declarative and drop into a script block only when needed.
08
How do you create an EKS cluster with eksctl and connect kubectl to it?
The control plane has the kube-apiserver, the front door for all requests; etcd, the key-value store holding cluster state; the scheduler, which places pods on nodes; and the controller manager, which runs reconciliation loops. Each worker node runs the kubelet, which starts and monitors pods; kube-proxy, which handles service networking; and a container runtime such as containerd.
A role is a standard folder structure that packages tasks, handlers, templates, files, variables and defaults for one purpose, for example a nginx or postgres role. Playbooks then just list roles for host groups, keeping them short and reusable across projects. Roles can be shared through Ansible Galaxy or collections, and tested with Molecule.
11
How do you handle pressure when a release is blocked close to a deadline?
Situation: a security scan blocked our release one day before a client demo. Task: ship without ignoring the risk. Action: I checked the finding, confirmed it was a real vulnerable library, upgraded it, ran the full test suite and kept the product manager updated every few hours. Result: we released on time, and I added weekly dependency scans to avoid last-minute surprises.
12
How do you configure Prometheus to scrape a target?
# prometheus.yml
global:
scrape_interval: 15s
scrape_configs:
- job_name: node
static_configs:
- targets: ['10.0.1.10:9100', '10.0.1.11:9100']
- job_name: api
metrics_path: /metrics
static_configs:
- targets: ['api.internal:8080']
# validate and reload
promtool check config prometheus.yml
curl -X POST http://localhost:9090/-/reload
Port 9100 is the node exporter default. In Kubernetes, use service discovery or ServiceMonitors instead.
13
How do you use stored credentials inside a Jenkins pipeline?
pipeline {
agent any
environment {
SONAR_TOKEN = credentials('sonar-token')
}
stages {
stage('Push') {
steps {
withCredentials([usernamePassword(credentialsId: 'docker-hub',
usernameVariable: 'USER', passwordVariable: 'PASS')]) {
sh 'echo $PASS | docker login -u $USER --password-stdin'
}
}
}
}
}
Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.
14
How do you configure an S3 remote backend with locking?
terraform {
backend "s3" {
bucket = "acme-terraform-state"
key = "prod/network/terraform.tfstate"
region = "ap-south-1"
encrypt = true
use_lockfile = true
}
}
Then run terraform init (add -migrate-state if moving local state). Enable versioning on the bucket. Older setups use dynamodb_table = "tf-locks" instead of use_lockfile for locking.
15
Explain stdin, stdout, stderr and what 2>&1 means.
Every process gets three file descriptors: 0 is stdin, 1 is stdout and 2 is stderr. > redirects stdout to a file, 2> redirects errors, and 2>&1 sends stderr to wherever stdout currently points. So command > out.log 2>&1 captures both normal output and errors in one file. Order matters: 2>&1 placed before > out.log would still print errors to the terminal.
16
How do you assume an IAM role in another account using the AWS CLI?
# ~/.aws/config
[profile prod-admin]
role_arn = arn:aws:iam::123456789012:role/DevOpsAdmin
source_profile = default
region = ap-south-1
aws s3 ls --profile prod-admin
# manual way
aws sts assume-role \
--role-arn arn:aws:iam::123456789012:role/DevOpsAdmin \
--role-session-name ravi-session
The role's trust policy must allow your account. Temporary credentials expire, usually after an hour.
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm install my-redis bitnami/redis -n cache --create-namespace
helm upgrade my-redis bitnami/redis -f values-prod.yaml
helm list -A
helm rollback my-redis 1
helm uninstall my-redis -n cache
helm template ./mychart -f values.yaml # render locally
Helm is the package manager for Kubernetes. A chart is a set of templated manifests, and values files customise it per environment.
18
What is the difference between a Pod, a ReplicaSet and a Deployment?
A Pod is the smallest deployable unit: one or more containers sharing network and storage. A ReplicaSet keeps a specified number of identical pods running. A Deployment manages ReplicaSets and adds rolling updates and rollbacks by creating a new ReplicaSet for each version. In practice you create Deployments and rarely touch ReplicaSets or bare pods directly.
19
Write a multi-stage Dockerfile for a Java Spring Boot application.
FROM maven:3.9-eclipse-temurin-21 AS build
WORKDIR /src
COPY pom.xml .
RUN mvn -B dependency:go-offline
COPY src ./src
RUN mvn -B package -DskipTests
FROM eclipse-temurin:21-jre-alpine
WORKDIR /app
COPY --from=build /src/target/*.jar app.jar
RUN adduser -D appuser
USER appuser
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]
The final image has only the JRE and the JAR, not Maven or source.
20
Which kubectl commands do you use most for debugging?
I keep each pull request focused on one change and small enough to review in about fifteen minutes. Commits have clear messages saying what and why. The description explains the problem, the approach, how I tested it and any risk or rollback step. I run linters and tests locally first, and I reply to every review comment, even if just to say done.
22
Write an Ansible playbook to install and start nginx.
git log --oneline --graph --decorate --all
# last 10 commits by one author
git log --oneline -10 --author="Ravi"
# commits touching one file, with diffs
git log -p -- src/app.py
# who changed each line
git blame src/app.py
--graph draws branch and merge lines, and --decorate shows branch and tag names next to commits.
set -e exits the script when any command fails, set -u treats unset variables as errors, and set -o pipefail makes a pipeline fail if any command in it fails, not just the last. Together they stop a script from silently continuing after an error, which matters in CI and deployment scripts. Commands that may fail on purpose need explicit handling such as || true.
All three move the current branch pointer to another commit. --soft keeps your changes staged, useful for recombining commits. --mixed, the default, keeps changes in the working directory but unstaged. --hard discards changes in both staging and working directory, so uncommitted work is lost. Lost commits can usually still be found with git reflog for a while.
name: CI
on:
pull_request:
branches: [main]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
- run: npm ci
- run: npm test
Add this as .github/workflows/ci.yml and make the job a required status check in branch protection.
28
Explain Ansible architecture: inventory, modules and playbooks.
Ansible runs from a control node and connects to managed hosts over SSH, or WinRM for Windows, with no agent needed. The inventory lists hosts and groups. Modules are units of work like apt, copy or service. Playbooks are YAML files containing plays that map host groups to ordered tasks. Variables, templates with Jinja2 and roles organise larger automation.
29
How do you create a new branch, push it and set the upstream?
git switch -c feature/payment-retry
# make changes
git add .
git commit -m "Add retry for failed payments"
git push -u origin feature/payment-retry
After -u (set upstream), plain git push and git pull work on this branch without naming the remote. Then open a pull request against main.
30
What is an artefact repository and why is it used?
An artefact repository such as Nexus, JFrog Artifactory or a container registry stores versioned build outputs like JAR files, npm packages and Docker images. The pipeline builds once and promotes the same artefact through dev, staging and production, so what you tested is exactly what you deploy. It also caches public dependencies, speeds up builds and keeps release history for rollbacks.
Tips to crack the TCS DevOps interview
Practise TCS NQT style numerical, verbal and reasoning sections along with two basic coding problems under strict time limits.
Be ready to explain your final-year project, SQL basics and core concepts like OOP, DBMS and software testing life cycle.
Read about TCS service lines such as BFSI and its iON and Ignio platforms to answer why you want to join.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; TCS interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the TCS DevOps interview?
Candidates usually go through 4 stages: TCS NQT online assessment (aptitude + coding); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the TCS DevOps interview?
This practice set leans on Infrastructure as Code (Terraform and Ansible) (7), CI/CD Pipelines (6), Git and Version Control (5), AWS Cloud for DevOps (4). Revise those first, then practise explaining one or two of your own projects end to end, because most TCS interviewers ask you to walk through real work.
Are these the exact questions asked at TCS?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like TCS's. They are not a leaked or verified list of past questions.
Where does TCS hire DevOps professionals in India?
TCS has large teams in Mumbai, Chennai, Pune, Bengaluru, Hyderabad. Openings and locations change often, so check the TCS careers page and filter by city and experience.