75 DevOps & Cloud Essentials interview questions with detailed answers, sorted from basic to advanced. Free to practice, with progress saved automatically.
A curated shortlist for DevOps and cloud roles that cuts across several tools rather than one platform. Topics include Kubernetes and Pods, Docker images versus containers, CI/CD pipelines, Linux process management, IAM, observability, Terraform and Infrastructure as Code, blue-green and canary deployments, plus cloud networking and scaling.
Both reduce release risk and avoid downtime: - Blue-green: run two parallel environments — "blue" (live) and "green" (new). After testing, switch all traffic to green at once; on failure, switch back instantly. Rollback is very fast, but it doubles infrastructure and still flips 100%…
- Image: a read-only package with code, runtime, libraries and config — the blueprint to run an app. An image is a stack of layers. - Container: a running instance of an image, adding a writable layer on top. Many containers can start from the…
A Dockerfile is a text file describing each step to build an image. Docker reads the instructions in order, creating layers. - FROM: the base image. - WORKDIR: working directory inside the image. - COPY / ADD: copy files from the build context into the…
An image is a stack of immutable layers. Each RUN, COPY and ADD creates a layer holding filesystem changes; ENV, CMD, EXPOSE and similar only write metadata into the image and add no files. On rebuild, Docker reuses the cache for a layer if its…
A multi-stage build uses several FROM stages in one Dockerfile: an early stage to build (compiler, dev dependencies), and a final stage that only COPY --from the needed artifact into a slim base image. - Result: the final image excludes the toolchain, source and dev…
A container filesystem is ephemeral — deleting the container loses data written inside. To persist data and share it between containers, use a mount. - Volume: managed by Docker (stored in Docker's own area). The recommended way for app data (DB, uploads). Portable, easy to…
- bridge (default): a virtual private network on one host. Containers on the same user-defined bridge reach each other by container name (built-in DNS). External access is via NAT. - host: drops network isolation; the container uses the host network stack directly (faster, but shares…
Compose defines and runs multi-container apps from one YAML file (compose.yaml). Instead of many docker run commands, you declare the whole stack and run docker compose up. - Each service = a container (web, api, db, redis...), declaring image, ports, env, volumes, dependson. - Compose…
- Small base image: use alpine, -slim, or distroless instead of a full-OS image. - Multi-stage build: copy only runtime artifacts, drop the toolchain/dev deps. - Combine RUN steps and clean caches in the same layer (apt-get ... && rm -rf /var/lib/apt/lists/) — since each…
A Pod is the smallest deployable unit in Kubernetes — not a bare container. A pod wraps one or more containers that share: - Network: one IP and port space; containers in the pod talk over localhost. - Storage: shared volumes. Containers in a pod…
- ReplicaSet: guarantees a specified number of replicas of a pod are running. A dead pod is recreated. But a ReplicaSet does not handle version updates. - Deployment: a higher-level controller that owns ReplicaSets and adds rollout/rollback. On an image change, the Deployment creates a…
Pod IPs change when pods are recreated. A Service provides a stable address (virtual IP + DNS) and load-balances to the set of pods matching a label selector. Types: - ClusterIP (default): internal IP, reachable within the cluster only. - NodePort: opens a fixed port…
Ingress manages external HTTP/HTTPS access into the cluster at layer 7 (L7), routing by host and path. - One Ingress can route many hostnames/paths to different Services through a single entry point — instead of one LoadBalancer per Service (costly on IPs/money). - Supports TLS…
Both decouple config from the image so one image runs across environments. They are injected into pods as env vars or mounted files. - ConfigMap: non-sensitive configuration in plaintext (URLs, feature flags, hostnames). - Secret: sensitive data (passwords, API keys, tokens, certificates). Stored base64-encoded and…
A namespace logically partitions a cluster into isolated spaces — like multiple "folders" sharing one physical cluster. - Separate environments/teams: dev, staging, prod, or per team. - Avoid name clashes: the same resource name (e.g. Service api) can coexist in different namespaces. - Attach limits:…
The HPA automatically scales the replica count of a Deployment/StatefulSet based on observed load. - It reads metrics (default CPU/memory via metrics-server; or custom/external metrics like requests/second). - Compares against a target threshold (e.g. keep CPU ~60%). Above → add pods; below → remove pods,…
Both are health checks the kubelet runs periodically on a container, but they react differently on failure: - Liveness probe: "is the container alive?" On failure the kubelet restarts the container (for hangs/deadlocks). - Readiness probe: "is the container ready for traffic?" On failure the…
A rolling update (the default strategy) replaces old pods with new ones incrementally, with no downtime. - Controlled by maxUnavailable (how many pods may be missing) and maxSurge (how many extra pods may exist temporarily). - The Deployment creates a new ReplicaSet, ramping up new…
A pipeline is a chain of automated steps taking code from commit to a running environment — replacing manual process. Typical stages: 1. Source: triggered on push/merge (Git webhook). 2. Fast checks: lint, type check, unit tests; cheap steps run first and stop on failure.…
- Continuous Integration (CI): developers merge frequently into a shared branch; each merge auto builds + tests to catch conflicts/bugs early. Focus is code quality at integration. - Continuous Delivery (CD): extends CI so every passing build is always release-ready, but the push to production…
An artifact is the immutable output of a build, ready to deploy or test further — e.g. a Docker image, a .jar/.war, a binary, an npm package, or a dist folder. - Build once, deploy many: build once into an artifact, then use that same…
EC2 (Elastic Compute Cloud) provides on-demand virtual servers (instances) — an IaaS model: you manage the OS and software, AWS manages the hardware. - Instance type: chosen by CPU/RAM/GPU for the workload (t/m general, c compute, r memory...). - AMI: a template image to launch…
S3 (Simple Storage Service) is object storage — files are stored as objects in buckets, accessed via an HTTP API/URL, not a filesystem or block device. - An object = data + metadata + key (unique name in the bucket). There are no real folders,…
IAM governs who can do what on AWS. - Policy: a JSON document declaring permissions (Effect allow/deny, Action, Resource, Condition). It is just a "list of permissions"; on its own it belongs to no one — it is attached to a user/group/role. - Role: an…
A VPC (Virtual Private Cloud) is your private virtual network in AWS, logically isolated, where you place resources (EC2, RDS...) and control networking. Key components: - Subnet: divides the VPC IP range per AZ. Public subnet (route to the internet) vs private subnet (no direct…
Both are AWS ELB load balancers but operate at different layers: - ALB (Application Load Balancer) — layer 7 (HTTP/HTTPS). Routes by path, host, header; supports TLS termination, WebSocket, gRPC (end-to-end HTTP/2), redirects, targets of instance/IP/Lambda. Fits web apps, microservices, APIs. - NLB (Network Load…
Auto Scaling adds/removes EC2 instances with load, keeping performance without paying for idle capacity. - Auto Scaling Group (ASG): a managed set of instances with min / desired / max. - Launch template: the blueprint for new instances (AMI, type, security group). - Scaling policy:…
RDS (Relational Database Service) is a managed relational database — supporting PostgreSQL, MySQL, MariaDB, Oracle, SQL Server (and Aurora). AWS handles the heavy operations: automated backups, patching, upgrades, monitoring. You focus on schema and queries. Benefits over self-managing on EC2: - Multi-AZ: a synchronous standby…
Lambda is Function as a Service (FaaS): you upload function code and AWS runs it on events, managing servers and scaling for you. - Event-driven: triggered by API Gateway (HTTP), S3 (new file), SQS/SNS, EventBridge (cron), DynamoDB streams... - Automatic scaling: each request/event can run…
CloudFront is AWS's CDN — a globally distributed network of edge locations that caches content near users to cut latency and origin load. - A request goes to the nearest edge; if cached it is served immediately (cache hit), otherwise it is fetched from the…
- Region: a geographic area (e.g. us-east-1, ap-southeast-1 Singapore). Regions are fully isolated from each other; choose by latency to users, price, and data residency/compliance. - Availability Zone (AZ): one or more discrete data centers within a region, with independent power/networking but connected by low-latency…
- High Availability (HA): the system minimizes downtime and recovers quickly from failures — but may have a brief interruption during failover. Measured in "nines" (99.9%, 99.99%). Achieved by removing single points of failure, multi-AZ, health checks + auto failover, load balancing. - Fault Tolerance…
A process is a running program with its own PID, memory space, and a parent (PPID). The first process is init/systemd (PID 1), and every other process descends from it. - States: running, sleeping, stopped, zombie (finished but the parent has not reaped its exit…
A signal is an asynchronous notification sent to a process to prompt a reaction — a simple OS IPC mechanism. Send with kill -SIGNAL <PID. Common ones: - SIGTERM (15) — the default of kill: asks for a graceful termination. The process can catch it…
Each file has permissions for 3 classes: owner (u), group (g), others (o); each with 3 bits r (read=4), w (write=2), x (execute=1). - The ls -l string -rwxr-xr-x → owner rwx, group r-x, others r-x. - Octal: sum each class. 755 = owner 7…
systemd is the init system and service manager on most modern Linux — the PID 1 process that starts at boot and manages background services (daemons) throughout the system lifecycle. - Unit: the managed unit; the common type is .service (a service), plus .socket, .timer,…
Cron is the scheduler for periodic tasks on Unix/Linux (log rotation, backups, reports, timed scripts). The crond daemon reads the crontab schedule table and runs commands at the right time. Syntax is 5 fields + a command: Examples: - 0 2 → 2 AM every…
Both are transport-layer protocols, but they trade off reliability vs speed differently. - TCP — connection-oriented, reliable: a 3-way handshake, guaranteed, in-order delivery, with error checking, retransmission, flow control and congestion control. Higher overhead and latency. Use when data loss is unacceptable: HTTP/HTTPS, email, SSH,…
HTTPS is HTTP over TLS — it adds an encryption layer to the connection while keeping HTTP semantics (methods, status, headers) unchanged. HTTPS provides three things plain HTTP lacks: - Confidentiality: data is encrypted, so eavesdroppers cannot read it. - Integrity: detects if data is…
DNS (Domain Name System) is the internet's "phone book": it translates memorable domain names (example.com) into the IP addresses machines use to connect. When you visit a name that is not cached yet, resolution goes like this: 1. The browser, then the operating system, checks…
A load balancer distributes requests across multiple backend servers so none is overloaded — improving throughput, availability and scalability. It also runs health checks, stopping traffic to unhealthy servers. Two layers: - L4 (transport): routes by IP + port, without inspecting request content. Very fast,…
Both are intermediaries, but they sit on opposite sides and serve different parties. - Forward proxy: sits in front of clients, sending requests outward on behalf of the client. The target server sees only the proxy, not the client. Used for: client anonymity, corporate access…
A firewall controls network traffic by a rule set (allow/deny based on IP, port, protocol, direction) — a boundary between trusted and untrusted zones. On AWS there are two virtual-firewall layers, often compared: - Security Group (instance level): stateful — if inbound traffic is allowed,…
The 12-factor app is a set of 12 design principles for SaaS apps to make them easy to deploy, scale horizontally and stay portable across environments (especially on cloud/containers). Often-asked principles: - Codebase: one codebase in version control, many deploys. - Dependencies: explicitly declared and…
IaC means managing infrastructure through versioned config files instead of clicking in a console — infrastructure is described as code, reviewed via Git, and reproduced consistently. Benefits: reproducibility (recreate identical environments), versioning + review, fewer manual errors (config drift), automation, and living documentation. Terraform (HashiCorp)…
Three related but not synonymous concepts: - Logging: records discrete events (timestamped log lines) — useful to look up "what happened" when debugging. - Monitoring: collects known metrics over time and alerts on thresholds — answers predefined questions ("is CPU high?", "what is the error…
A secret is sensitive data used to access resources: passwords, API keys, DB credentials, tokens, encryption keys, certificates. Secrets management is how you store, distribute, rotate and control access to them safely. Why not hardcode into code/repos: - Committing to Git is a permanent exposure…
DevOps is a set of cultural philosophies, practices and tools that helps an organization ship software faster and more reliably, by removing the wall between Development and Operations instead of keeping them siloed. - It is not a job title or a single tool —…
They differ in the level of virtualization: - VM: virtualizes the hardware via a hypervisor. Each VM runs a full OS (its own guest kernel) → several GB, slow to boot (minutes), but strong isolation. - Container: virtualizes the operating system. Containers share the host…
Running a few containers on one machine, Docker is enough. But with many containers across many hosts in production, a lot of work must happen automatically — that is why you need an orchestrator. Kubernetes handles: - Scheduling: place containers on suitable nodes (enough CPU/RAM).…
Both declare resources (CPU/memory) for a container but play different roles: - requests: the guaranteed minimum. The scheduler uses this to place the pod on a node with enough room. It is also the basis for HPA utilization %. - limits: the hard ceiling a…
Helm is the package manager for Kubernetes — like apt/npm but for K8s resources. Its packaging unit is a chart: a set of templated manifests plus a values.yaml file. Helm solves: - YAML repetition: a real app needs many manifests (Deployment, Service, Ingress, ConfigMap...). A…
These are workload controllers beyond Deployment, for different run patterns: - Job: runs to completion then stops — for one-off tasks: DB migrations, batch processing. When a Pod fails the Job creates a new Pod to retry, up to backoffLimit times (default 6, with a…
Two ways to add capacity as load grows: - Vertical scaling (scale up): add resources to one machine — more CPU, RAM, or a bigger instance. Simple, no architecture change, but there is a hardware ceiling, it usually needs downtime to upgrade, and that machine…
- Stateless: each request carries enough information to be processed; the app holds no state in process memory between requests. When it needs data, it reads from a backing service (DB, Redis, object storage). Because all instances are identical, it is easy to scale out,…
Prometheus is a monitoring system with a time-series database that collects data via a pull model: the server scrapes each target's /metrics endpoint on an interval (unlike a push model where apps send data out). Targets are found via service discovery (K8s, files, DNS). -…
Two opposing branching models in how they integrate: - Trunk-based development: everyone commits to one main branch (trunk/main) with small, frequent merges; feature branches are very short-lived (under a day) then merged immediately. Unfinished features are hidden behind feature flags rather than kept in long…
Ansible is an automation / configuration management tool — it configures machines, installs software and deploys apps declaratively. Key traits: - Agentless: no agent on the target, just SSH + Python — connect, push modules, execute, disconnect. - YAML playbooks: describe the desired state in…
CIDR (Classless Inter-Domain Routing) notates a network address range as IP/prefix, where the prefix is the number of leading bits for the network part, the rest being host bits. - 10.0.0.0/16 → the first 16 bits are the network, the other 16 bits are host…
Goal: every commit flows through automated stages; only a vetted artifact reaches production. Stages in order 1. Lint / format: catch style issues early, run the fastest checks first. 2. Test: unit + integration tests; stop on failure (fail fast). 3. Build: produce a single…
nginx sits in front of the application, accepting external requests and forwarding (proxypass) them to the app on an internal port. - server block = virtual host: nginx picks the block whose listen + servername match the request Host header — so one machine serves…
The standard diagnostic flow: 1. kubectl get pods: check the status and restart count. 2. kubectl describe pod <name: read the Events section at the bottom plus Last State / Exit Code — most causes surface here. 3. kubectl logs <pod: logs of the current…
The diagnostic toolkit: - docker ps -a: see the status and exit code of stopped containers. - docker logs <container (-f to follow, --tail 100): stdout/stderr of the main process — the first place to look for a crash cause. - docker inspect <container: check…
The classic cross-layer question. The chain of steps: 1. DNS: the browser checks caches (browser → OS → resolver). On a miss, the resolver queries recursively: root → TLD (.com) → authoritative nameserver → gets the IP, cached per TTL. 2. TCP: the three-way handshake…
Let's Encrypt is a free, automated CA issuing DV (domain validation) certificates via the ACME protocol. The principle: prove control of the domain by machine, no paperwork. Issuance flow 1. certbot (an ACME client) generates a key pair and requests a certificate for the domain…
A cluster has two layers: the control plane (the decision-making brain) and the worker nodes (where workloads run). Control plane: - kube-apiserver — the single gateway to the cluster; every action (kubectl, controllers, kubelet) goes through this REST API. - etcd — a consistent key-value…
