DevOps Engineer Interview Questions and Answers

Questions and model answers

9 questions you are likely to hear.

1. 1

   Design a CI/CD pipeline for a microservice. What stages would you include?

   Why they ask: This tests end-to-end understanding of safe, automated delivery.

   Sample answer: On each pull request, the pipeline runs linting, unit tests, static analysis with a tool like SonarQube and a dependency vulnerability scan. On merge to main, it builds a Docker image tagged with the commit SHA, scans it with Trivy, and pushes it to the registry. It deploys to a dev environment automatically, runs integration and smoke tests, then promotes the same image to staging and production, with an approval gate for production. Deployment uses a rolling or canary strategy with automatic rollback on failed health checks. I built a similar pipeline in GitHub Actions and Argo CD that took release lead time from days to under an hour.

2. 2

   A pod is in CrashLoopBackOff. How do you troubleshoot it?

   Why they ask: This is a standard hands-on Kubernetes question.

   Sample answer: I start with kubectl describe pod to see events, exit codes and probe failures, then kubectl logs, including --previous for the last crashed container. Exit code 137 often means it was OOM-killed, so I check memory limits. Exit code 1 usually means an application error, such as a missing environment variable or failed database connection. I also check whether liveness probes are too aggressive, killing the app before it starts. In one case a Java service kept restarting because the liveness probe started before Spring Boot finished booting; adding a startup probe fixed it.

3. 3

   How do you manage Terraform state in a team?

   Why they ask: State management is a common source of outages and conflicts.

   Sample answer: I keep state in a remote backend such as an S3 bucket with DynamoDB locking or Azure Storage with blob leases, never on laptops. The bucket is encrypted, versioned and access-restricted. I split state by environment and by component, so a change to networking does not risk the database. All changes go through pull requests with terraform plan output posted for review, and apply runs from the pipeline, not locally. I also run periodic drift detection. In a previous team, moving to this setup ended the state conflicts that had been breaking applies every few weeks.

4. 4

   What is the difference between blue-green and canary deployments?

   Why they ask: Interviewers check understanding of release risk management.

   Sample answer: In blue-green, I run two identical environments; the new version goes to the idle one, gets tested, and traffic switches over all at once, with instant rollback by switching back. It needs double capacity during the release. In canary, I send a small percentage of traffic, say 5 percent, to the new version, monitor error rates and latency, and increase gradually. Canary catches issues with real traffic while limiting impact. I have used Argo Rollouts for canary releases with automated analysis against Prometheus metrics, which rolled back a bad release automatically before most users were affected.

5. 5

   How do you write a secure and efficient Dockerfile?

   Why they ask: Image quality affects security, build speed and runtime cost.

   Sample answer: I use multi-stage builds so build tools stay out of the final image, and a small base image such as distroless or Alpine where compatible. I order instructions so dependency installation is cached before copying source code. I run the app as a non-root user, pin base image versions, avoid secrets in layers and use a .dockerignore file. I add a health check where the platform uses it. For a Node.js service, these changes cut the image from about 1.2 GB to roughly 150 MB, which sped up deployments and reduced vulnerability scan findings significantly.

6. 6

   How do you design monitoring and alerting for a service?

   Why they ask: This tests reliability thinking, not just tool knowledge.

   Sample answer: I start with what users experience, using the four golden signals: latency, traffic, errors and saturation. I define SLOs, for example 99.9 percent of requests under 300 milliseconds, and alert on burn rate against the error budget rather than on every CPU spike. Metrics go to Prometheus with Grafana dashboards, logs to Loki or ELK, and traces through OpenTelemetry. Every alert must be actionable and link to a runbook. In one team, cleaning up noisy alerts reduced pages by about two thirds, and on-call engineers started trusting the remaining alerts again.

7. 7

   How do you manage secrets in pipelines and Kubernetes?

   Why they ask: Secret leaks are among the most common serious DevOps mistakes.

   Sample answer: I never store secrets in Git or in plain pipeline variables. In pipelines I use the platform's secret store or OIDC federation, so GitHub Actions can assume a cloud role without long-lived keys. In Kubernetes, I use External Secrets Operator or the Secrets Store CSI driver to sync from AWS Secrets Manager, Azure Key Vault or HashiCorp Vault, and I restrict access with RBAC. Secret scanning runs on every commit. After a developer accidentally committed an API key, I rotated it immediately and added pre-commit secret scanning for the whole team.

8. 8

   A server's disk is full and the application is failing. What do you do?

   Why they ask: This checks Linux troubleshooting under pressure.

   Sample answer: First I confirm with df -h which filesystem is full, then use du with sort to find the largest directories, usually logs, temp files or old artifacts. If a deleted file is still held open by a process, lsof shows it, and restarting that process frees the space. For immediate relief I compress or remove old logs safely, then fix the root cause, such as missing log rotation or a debug log level left on. I add disk usage alerts at around 80 percent. In one incident, a misconfigured logrotate on an Nginx server was the cause, and fixing it prevented repeats.

9. 9

   Tell me about a production incident you handled.

   Why they ask: Interviewers want to see calm leadership, technical skill and learning culture.

   Sample answer: After a routine release, our checkout API error rate jumped to around 20 percent. I was on call, so I declared an incident, started a war-room channel and rolled back within ten minutes, which restored service. Investigation showed the new version used a database connection pool setting that exhausted connections under peak load, which staging never reached. In the blameless postmortem, we added a load test stage to the pipeline and alerts on connection pool usage. We also adopted canary releases for that service, so later issues affected only a small share of traffic.

Keep going.

• AWS Cloud Engineer Interview Questions and Answers
• Azure Cloud Engineer Interview Questions and Answers
• DevOps job support
• Kubernetes Job Support Online for Platform Engineers
• Auto Apply to DevOps Jobs with AI
• AI Copilot for Technical Interviews