Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Thoughtworks hiring for DevOps roles
Thoughtworks is a global technology consultancy known for agile software delivery, continuous delivery and its Technology Radar publication. It works on custom software, data platforms and digital transformation for enterprise clients. In India it hires for developers, quality analysts, data engineers and data scientists. Teams usually work closely with client engineers.
For DevOps roles, this Thoughtworks practice set focuses most on Kubernetes (6), AWS Cloud for DevOps (5), Monitoring, Logging and SRE (4), Linux and Shell Scripting (4). It has 2 easy, 25 medium, 3 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
Chicago, Illinois, USA
Main India offices
Pune, Bengaluru, Chennai, Gurugram, Hyderabad
Thoughtworks DevOps interview process
Online coding assessment
Code pairing round
Technical interview
Cultural fit or social change round
Leadership round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for ThoughtworksStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What are the four golden signals, and the RED and USE methods?
The four golden signals are latency, traffic, errors and saturation. RED, for request-driven services, tracks rate, errors and duration. USE, for resources such as CPU, disks and network, tracks utilisation, saturation and errors. RED tells you whether users are hurting; USE helps find which resource is the bottleneck. Together they give a solid starting set of dashboards and alerts.
02
A production deployment failed halfway. What do you do?
Assess impact quickly using monitoring and error rates. If users are affected, roll back to the last good version, which should be a single pipeline action redeploying the previous artefact. Communicate status to stakeholders. Then check pipeline logs and application logs to find the cause, fix it in a branch and redeploy. Afterwards, hold a blameless review and add a check to catch it earlier.
Never store secrets in code or the Jenkinsfile. Use the CI tool's encrypted credentials store, such as Jenkins credentials or GitHub Actions secrets, or fetch them at runtime from HashiCorp Vault or AWS Secrets Manager. Prefer short-lived credentials, for example OIDC federation from GitHub Actions to AWS instead of long-lived keys. Mask secrets in logs and give each pipeline only the permissions it needs.
04
Tell me about a blameless post-mortem you were part of.
Situation: a certificate expired and our API was down for 40 minutes. Task: I wrote the post-mortem. Action: I built a timeline from logs and chat, and we focused on why the system allowed it rather than who forgot: renewal was manual and nothing alerted. Result: we automated renewal with cert-manager, added expiry alerts 21 days ahead, and tracked actions to closure.
05
What is the difference between CMD and ENTRYPOINT?
ENTRYPOINT defines the main executable that always runs, while CMD provides default arguments or a default command that can be overridden from docker run. For example, ENTRYPOINT ["python", "app.py"] with CMD ["--port", "8000"] lets users change only the port. Use the exec (JSON array) form so the process runs as PID 1 and receives signals properly.
06
What is load average in Linux and how do you read it?
Load average is the average number of processes running or waiting for CPU (and uninterruptible I/O) over 1, 5 and 15 minutes, shown by uptime or top. Compare it with the number of CPU cores: a load of 4 on a 4-core machine means full use, while 12 means work is queuing. A high load with low CPU use often points to disk or network I/O waits.
07
The application cannot connect to an RDS database. What do you check?
Confirm the endpoint, port, username and password. Check that the RDS security group allows inbound traffic on the database port from the application's security group, and that both are in reachable subnets of the same VPC or peered networks. Test with nc -zv endpoint 5432 from the app host. Also check the instance status, max connections and SSL requirements.
08
A production server is very slow. How do you troubleshoot high CPU usage?
Start with uptime and top or htop to see load and which processes use CPU. Check whether it is user, system or iowait time, and use pidstat or ps -eo pid,pcpu,cmd --sort=-pcpu for detail. For a Java process, take thread dumps; for others, use perf or strace. Correlate with recent deployments, cron jobs or traffic spikes before deciding to scale, roll back or fix code.
09
How do you communicate with stakeholders during an outage?
I post a short first update quickly saying what is affected, that we are working on it and when the next update will come. Then I update at a fixed interval, such as every 20 minutes, in plain language without guessing at causes. I keep technical detail in the engineering channel. After resolution, I send a summary with impact, cause and next steps.
10
You suspect a memory leak in a production service. How do you confirm and handle it?
Look at memory graphs over days: a leak shows steady growth that drops only on restart, often with OOM kills. Correlate the start with a deployment. Take heap dumps or profiles, for example jmap for Java or pprof for Go, and compare them over time. As a short-term fix, set memory limits and schedule restarts or roll back, then fix the code and add a memory alert.
11
How do you prioritise when several teams ask you for infrastructure work at the same time?
I list the requests with their business impact and deadline, and check which are blocking production or a release. Production issues and security fixes come first. For the rest I agree priority with my lead and the requesting teams openly, give realistic timelines and share progress. Where requests repeat, I build self-service templates so teams are not waiting on me.
12
How do an Application Load Balancer and an Auto Scaling group work together?
The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.
13
The host disk is filling up because of Docker. How do you clean up and prevent it?
Check usage with docker system df. Remove stopped containers, dangling images and unused networks with docker system prune, and old build cache with docker builder prune; be careful with the volumes flag. Container logs are a common culprit, so configure log rotation with max-size and max-file in daemon.json. In CI agents, schedule regular pruning jobs.
14
How do you use stored credentials inside a Jenkins pipeline?
pipeline {
agent any
environment {
SONAR_TOKEN = credentials('sonar-token')
}
stages {
stage('Push') {
steps {
withCredentials([usernamePassword(credentialsId: 'docker-hub',
usernameVariable: 'USER', passwordVariable: 'PASS')]) {
sh 'echo $PASS | docker login -u $USER --password-stdin'
}
}
}
}
}
Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.
15
How do you count unique client IP addresses in an nginx access log?
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10
# total number of unique IPs
awk '{print $1}' access.log | sort -u | wc -l
The first field in the default log format is the client IP. uniq -c only collapses adjacent lines, so sort must run before it; the final sort -rn shows the busiest IPs first.
16
A pod is stuck in Pending state. What could be the reasons?
Pending means it has not been scheduled or its volumes are not ready. kubectl describe pod shows the scheduler's reason. Common causes are insufficient CPU or memory on nodes for the requests, node selectors, affinity or taints that no node satisfies, a PersistentVolumeClaim that cannot bind, or a resource quota being exceeded. Fix the spec or add nodes with the cluster autoscaler.
17
Tell me about a time you introduced a new tool or practice to your team.
Situation: new developers took two days to set up our app locally because of different OS versions and manual database installs. Task: I wanted to make onboarding easy. Action: I created a Docker Compose setup with the app, database and seed data, wrote a short README and demoed it. Result: setup dropped to under an hour and the team adopted it for CI.
18
What is the difference between git fetch and git pull?
git fetch downloads new commits and branches from the remote into remote-tracking branches like origin/main without touching your working files. git pull is fetch followed by merge (or rebase if configured) into your current branch. Fetch is safer when you want to inspect incoming changes first with git log main..origin/main before integrating them.
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm install my-redis bitnami/redis -n cache --create-namespace
helm upgrade my-redis bitnami/redis -f values-prod.yaml
helm list -A
helm rollback my-redis 1
helm uninstall my-redis -n cache
helm template ./mychart -f values.yaml # render locally
Helm is the package manager for Kubernetes. A chart is a set of templated manifests, and values files customise it per environment.
20
Write a bash script that checks whether a service is running and restarts it if not.
#!/bin/bash
set -u
SERVICE="nginx"
if ! systemctl is-active --quiet "$SERVICE"; then
echo "$(date) $SERVICE down, restarting" >> /var/log/svc-check.log
systemctl restart "$SERVICE"
if ! systemctl is-active --quiet "$SERVICE"; then
echo "$SERVICE failed to start" | mail -s "ALERT" ops@example.com
fi
fi
Run it from cron every few minutes; a real setup would rely on systemd Restart= plus monitoring.
The HPA periodically reads metrics from the metrics server or a custom metrics adapter and changes the replica count of a Deployment or StatefulSet to keep a target, for example 70 percent average CPU. It calculates desired replicas from current usage divided by the target, within min and max bounds, with stabilisation windows to avoid flapping. CPU-based HPA needs resource requests set.
22
A pod is in CrashLoopBackOff. How do you troubleshoot it?
The container starts and keeps crashing, and Kubernetes waits longer between restarts. Run kubectl describe pod to see events and exit codes, and kubectl logs <pod> --previous for the crashed container's output. Common causes are missing environment variables or secrets, bad config, failing database connections, a wrong command, an aggressive liveness probe, or exit code 137 meaning OOM kill.
23
Write an IAM policy that gives read-only access to one S3 bucket.
Both inject configuration into pods as environment variables or mounted files, keeping config out of images. ConfigMaps hold non-sensitive data like URLs and feature flags. Secrets hold sensitive values like passwords and tokens; they are only base64 encoded by default, so you should enable encryption at rest, restrict access with RBAC, or use an external secrets manager.
25
How would you plan disaster recovery for a complete AWS region failure?
Start from business RTO and RPO. Options range from backup and restore, which is cheapest and slowest, to pilot light, warm standby and multi-region active-active. Replicate data with S3 cross-region replication, Aurora Global Database or DynamoDB global tables, keep infrastructure in Terraform so it can be rebuilt, use Route 53 failover routing and rehearse failover drills.
A module is a reusable folder of Terraform files with input variables and outputs, for example a vpc module or an eks-cluster module. The root module calls child modules with different values for each environment. Modules reduce duplication and enforce standards across teams. They can come from local paths, Git or the Terraform Registry and should be pinned to versions.
Idempotency means running the same playbook many times gives the same result without unwanted changes. Modules check current state first: the apt module installs a package only if missing and reports ok instead of changed. The shell and command modules are not idempotent by default, so use creates, removes or changed_when conditions, or prefer a dedicated module.
28
You pushed a broken commit to the shared main branch and the build is failing. What do you do?
First restore a green main quickly: run git revert <hash> and push, which adds an undo commit without rewriting history that others have pulled. Tell the team in the channel. Then fix the issue on a branch with a proper pull request and tests. Avoid git reset with force push on main; branch protection rules should block it anyway.
29
What is configuration drift and how do you detect it with Terraform?
Drift is when real infrastructure differs from code, usually because someone changed it manually in the console. terraform plan, or plan -refresh-only, shows differences between state and reality. Teams run scheduled plans in CI and alert on any diff. Prevent drift by restricting console write access, applying only through pipelines, and either reverting manual changes or codifying them.
30
What is the difference between an Ingress and a Service?
A Service exposes a set of pods at layer 4. An Ingress is a layer 7 HTTP routing resource that maps hostnames and paths to services, for example api.example.com to the api service and /admin to another. It needs an ingress controller such as NGINX or a cloud controller to work. One Ingress with one load balancer can serve many services, and it handles TLS termination.
Tips to crack the Thoughtworks DevOps interview
Practise pair programming with test-driven development, since Thoughtworks interviews often include coding together with an interviewer.
Read the latest Thoughtworks Technology Radar and form opinions on a few tools or techniques it lists.
Prepare to discuss social and economic justice values, which Thoughtworks openly includes in its culture discussions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Thoughtworks interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Thoughtworks DevOps interview?
Candidates usually go through 5 stages: Online coding assessment; Code pairing round; Technical interview; Cultural fit or social change round; Leadership round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Thoughtworks DevOps interview?
This practice set leans on Kubernetes (6), AWS Cloud for DevOps (5), Monitoring, Logging and SRE (4), Linux and Shell Scripting (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Thoughtworks interviewers ask you to walk through real work.
Are these the exact questions asked at Thoughtworks?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like Thoughtworks's. They are not a leaked or verified list of past questions.
Where does Thoughtworks hire DevOps professionals in India?
Thoughtworks has large teams in Pune, Bengaluru, Chennai, Gurugram, Hyderabad. Openings and locations change often, so check the Thoughtworks careers page and filter by city and experience.