DevOps Interview Questions

Traditionally, developers wrote code and threw it over to a genuinely separate operations team to actually deploy and run, which often created friction, slow releases, and finger-pointing when something genuinely broke. DevOps solves this by having both sides share genuine ownership of an application's entire lifecycle, from writing code to actually running it reliably.

Continuous integration and delivery, automating genuinely repetitive manual work, fostering genuine collaboration between traditionally separate teams, and treating infrastructure itself as something that can be genuinely versioned and automated, rather than manually configured by hand each time.

Agile is genuinely a methodology for managing how software gets built, iterative development, frequent feedback. DevOps genuinely extends that same spirit of continuous improvement to how software actually gets deployed and operated, covering the genuine gap between finishing a feature and actually running it reliably in production.

A DevOps engineer typically builds and maintains the genuine tooling and infrastructure supporting a software team's entire delivery pipeline, CI/CD systems, infrastructure automation, monitoring, rather than working purely on the application's own feature code.

Cloud computing's genuine on-demand, API-driven infrastructure made many DevOps practices, like automatically provisioning a genuinely new environment or scaling resources dynamically, practically achievable in a way that was genuinely much harder with traditional, physical, manually-racked servers.

Git is a distributed version control system tracking genuine changes to code over time. It's essential to DevOps because a genuinely reliable, automated pipeline needs a genuine, trustworthy source of truth for exactly what code is actually being built and deployed at any given moment.

git commit genuinely saves a snapshot of changes to your own local repository. git push genuinely uploads those committed changes to a remote repository, like one hosted on GitHub, making them actually visible and available to the rest of the team.

A branch is a genuinely separate, independent line of development within the exact same repository, letting you actually work on a new feature or fix without affecting the genuinely main, stable codebase until that work is actually ready to be merged back in.

A merge conflict occurs when Git genuinely can't automatically combine changes from two different branches, because both branches genuinely modified the exact same lines of the exact same file in different ways, requiring a person to actually manually decide which version should genuinely win.

A merge genuinely combines two branches' histories together, creating a genuine merge commit recording that combination. A rebase genuinely replays one branch's commits on top of another, producing a genuinely cleaner, linear history, though at the cost of genuinely rewriting commit history, which requires care when a branch is already shared with others.

A tag marks a genuinely specific point in a repository's history with a permanent, memorable name, commonly used to genuinely mark a release version, like v1.2.0, making it easy to actually reference or return to that exact specific point later.

CI is the genuine practice of frequently merging code changes into a shared repository, with each merge automatically triggering a build and a test run, catching a genuine integration problem early rather than letting it accumulate silently over a genuinely longer period of separate, isolated development.

Continuous Delivery genuinely ensures code is always in a deployable state, with an actual human deciding when to genuinely trigger the release to production. Continuous Deployment goes one step further, automatically deploying every genuinely passing change straight to production with genuinely no manual approval step required at all.

A pipeline automates the genuine steps code goes through from being committed to actually running in production. Common stages include building the code, running automated tests, and deploying it to a genuinely specific environment, each stage genuinely needing to pass before the pipeline actually proceeds to the next one.

Jenkins, a genuinely widely used, highly configurable open-source tool. GitHub Actions and GitLab CI, genuinely built directly into their respective code hosting platforms. CircleCI, a genuinely popular cloud-based CI/CD service.

Without automated tests genuinely running on every single change, a CI/CD pipeline can only genuinely confirm code builds successfully, not that it actually still works correctly, which genuinely defeats much of the purpose of automating fast, frequent delivery in the first place.

A broken build means the genuinely automated build or test process failed for the genuinely latest committed change, which typically blocks that change from actually progressing further through the pipeline until the genuine underlying issue is fixed.

A container packages an application together with everything it genuinely needs to run, its dependencies, its runtime, its configuration, into one genuinely portable unit that runs consistently across different environments. It solves the genuine it works on my machine problem, ensuring an application behaves the exact same way everywhere it's actually deployed.

Docker is the genuinely most widely used tool for building, packaging, and running containers. It provides both the genuine tooling to create a container image and the genuine runtime to actually execute containers built from those images.

A virtual machine virtualizes an entire genuine computer, including its own full operating system kernel, making it genuinely heavier and slower to start. A container instead shares the genuine host machine's underlying operating system kernel, making containers significantly lighter and much faster to actually start up.

A Docker image is a genuinely static, read-only template containing an application and its dependencies. A container is an actual, genuinely running instance created from that image, and you can genuinely run several separate containers from the exact same single image at once.

A Dockerfile is a genuine text file containing step-by-step instructions for actually building a Docker image, specifying a base image to genuinely start from, files to copy in, and commands to actually run during the build process.

A container registry, like Docker Hub or a genuinely private equivalent, stores built container images so they can be genuinely pulled and run on any server or cluster that actually needs them, serving as the genuine distribution point between building an image and actually deploying it.

Most production servers and containers genuinely run Linux, and a genuinely large portion of DevOps automation, deployment scripts, CI/CD pipelines, container images, is genuinely built directly around Linux command-line tools and shell scripting.

ls lists the files and directories in the genuinely current location. ls -la genuinely shows a detailed, long-format listing including genuinely hidden files, ones whose name starts with a dot, which the plain ls command genuinely doesn't show by default.

cp genuinely copies a file, leaving the original in place. mv genuinely moves (or renames) a file, removing it from its genuinely original location entirely.

chmod changes a file's genuine permissions. The three digits genuinely represent permissions for the owner, the group, and everyone else respectively, each digit genuinely combining read (4), write (2), and execute (1) values, so 755 genuinely gives the owner full read-write-execute access and gives everyone else read and execute access only.

An absolute path genuinely starts from the root directory, /, and fully specifies a file's genuine, exact location regardless of your current directory. A relative path is genuinely interpreted relative to your current working directory, and points to a genuinely different actual location depending on where you currently are.

grep searches text for lines genuinely matching a specific pattern. grep 'error' logfile.txt genuinely prints every line in logfile.txt containing the actual word error, which is genuinely commonly used to quickly search through a large log file for a specific term.

IaC means genuinely defining infrastructure, servers, networks, configuration, through actual code rather than manual, click-through configuration. This lets infrastructure be genuinely version-controlled, reviewed, and reliably recreated the exact same way every single time it's actually applied.

Manually configuring servers by hand is genuinely slow, error-prone, and hard to reliably reproduce consistently across many servers. Configuration management tools genuinely automate applying a consistent, defined configuration across potentially many servers at once.

Ansible is a genuinely popular configuration management and automation tool, using simple, genuinely human-readable YAML files called playbooks to actually define the desired state of a server, and applying that configuration over SSH without genuinely requiring any special agent software installed on the target server.

A push-based tool, like Ansible, genuinely connects to target servers and pushes configuration out to them from a genuinely central control machine. A pull-based tool has each individual server genuinely periodically check in and pull its own configuration from a central source itself.

An idempotent operation produces the exact same genuine result no matter how many times it's actually run, which matters because a configuration management script often genuinely needs to be run repeatedly, and it should genuinely converge a server to the desired state without causing an unintended, unexpected side effect on a genuinely repeated run.

A build artifact is the genuinely compiled, packaged output of the build stage, like a container image or a compiled binary. Rebuilding separately for each environment risks a genuinely subtle difference sneaking in between what was actually tested in staging and what actually gets deployed to production, undermining confidence in the whole pipeline.

An artifact repository, like Nexus or Artifactory, stores build outputs of many kinds, compiled libraries, packages, binaries, beyond just container images specifically. A container registry is genuinely specialized just for container images. Many organizations use an artifact repository as the broader, general-purpose store, sometimes with a container registry running alongside it or built into the same platform.

Blue-green deployment runs two genuinely identical, complete environments, switching all traffic from the old (blue) to the new (green) version genuinely all at once. Canary deployment gradually routes a genuinely small percentage of traffic to the new version first, expanding it incrementally once confidence genuinely grows that it's actually working correctly.

A rolling deployment gradually replaces old instances with genuinely new ones, a few at a time, rather than switching everything genuinely all at once the way blue-green does. It genuinely requires less duplicate infrastructure than blue-green, but means both old and new versions genuinely run simultaneously during the actual rollout window.

Keep every genuinely previous build artifact readily available, and design the deployment process to be able to quickly genuinely redeploy a known-good previous version if a newly deployed change genuinely causes a problem, ideally triggered through the exact same automated pipeline rather than a genuinely manual, ad hoc process.

Each instruction in a Dockerfile genuinely creates a new, cached layer, and Docker reuses genuinely unchanged layers from a previous build rather than rebuilding them again. Ordering instructions so genuinely rarely-changing steps, like installing dependencies, come before genuinely frequently-changing steps, like copying application code, meaningfully speeds up repeated builds.

A multi-stage build uses genuinely multiple FROM statements in one Dockerfile, letting you use a genuinely larger image with build tools in an early stage, then copy only the actual, genuinely necessary compiled output into a much smaller, genuinely leaner final image, reducing the final image's size significantly.

Docker Compose lets you actually define and run a genuinely multi-container application, like a web server, a database, and a cache together, using one single YAML configuration file, rather than manually starting and connecting each individual container by hand with a genuinely long series of separate commands.

Docker Compose automatically creates a genuinely shared network for all the services defined within it, letting containers actually reach each other directly by their genuine service name, like connecting to a database container simply using db as its actual hostname.

A container's own filesystem is genuinely temporary by default, and any data written inside it is genuinely lost once that container is removed. A volume provides genuinely persistent storage that exists independently of any specific container's own lifecycle, letting data actually survive a container being recreated or replaced.

All three genuinely offer broadly similar core services, compute, storage, networking, managed databases, though each has its own genuinely specific naming, tooling, and areas of relative strength. The genuinely right choice for a given organization often comes down to existing expertise, genuinely specific service needs, or an existing genuine relationship with that particular provider.

Terraform is genuinely focused specifically on provisioning infrastructure itself, servers, networks, databases, across a cloud provider, described declaratively in genuine configuration files. Ansible is genuinely more focused on configuring software and settings on an already-existing server, though the two genuinely, commonly get used together in the exact same overall pipeline.

A declarative approach genuinely describes the desired end state, and Terraform figures out what actual changes are genuinely needed to reach it. An imperative approach would instead genuinely require specifying the exact step-by-step commands to actually perform, which Terraform's own declarative model deliberately avoids.

Terraform state is a genuine file tracking what infrastructure Terraform has actually created and its current configuration. Managing it correctly matters because Terraform genuinely relies on that state to actually determine what changes are needed on a subsequent run, and a genuinely lost or corrupted state file can cause Terraform to lose track of resources it's actually managing.

A local state file means only that one machine genuinely knows what infrastructure actually exists, and another team member running Terraform on their own machine would have no genuine visibility into that same state at all, risking conflicting changes. A shared remote backend, with locking, ensures everyone genuinely works from the exact same up-to-date state and prevents two people from applying a conflicting change at the exact same time.

Manual provisioning through a console is genuinely quick for a one-off task, but leaves genuinely no record of exactly what was configured, and it's genuinely hard to reliably reproduce that same configuration again later. IaC creates a genuinely version-controlled, reviewable, and repeatable record of infrastructure that can actually be recreated consistently.

As an application genuinely scales across many servers or containers, checking each individual machine's own local logs one by one genuinely becomes impractical. Centralized monitoring aggregates genuine metrics and logs from every source into one place, letting a team actually see the overall system's health at a glance.

A metric is a genuinely numeric measurement over time, like CPU usage or request count, well suited for genuinely tracking trends and triggering an alert. A log is a genuinely detailed, timestamped record of a specific event, better suited for actually investigating exactly what happened during a specific incident.

Centralized logging collects logs from every genuinely separate server or container into one searchable, unified location. The ELK stack genuinely provides this, collecting and processing logs (Logstash), storing and indexing them for genuinely fast search (Elasticsearch), and visualizing them through genuinely interactive dashboards (Kibana).

An alert notifies someone when a genuinely defined condition is met, indicating something needs actual attention. Alerting on a symptom catches genuinely any underlying cause producing that same observable effect, while alerting on one specific, narrow cause risks genuinely missing an entirely different problem that produces the exact same real, user-facing impact.

Ansible genuinely uses simple YAML playbooks and requires genuinely no agent installed on target servers, communicating over SSH. Chef and Puppet both genuinely require an agent installed on each managed server and use their own genuinely specific configuration language, generally offering more genuinely powerful capability at the cost of a steeper genuine learning curve.

A playbook is a genuinely YAML file defining a set of tasks to actually be applied to a group of servers, describing the genuinely desired state, like ensuring a specific package is installed or a specific service is genuinely running, rather than the exact step-by-step commands to actually get there.

An inventory is a genuine list of servers (and groups of servers) that Ansible can actually target, letting a playbook be genuinely applied to a specific, defined set of machines, like all web servers or genuinely just the production database servers.

Run it genuinely first against a disposable test environment, like a local virtual machine or a genuinely temporary cloud instance, confirming it produces the actual expected result and doesn't genuinely cause an unintended side effect, before ever actually applying it to a real production server.

A Deployment manages a set of genuinely identical Pods, ensuring a specified number are always genuinely running and handling a genuinely smooth rolling update when a new version is deployed. It's typically what a CI/CD pipeline actually updates when deploying a genuinely new version of an application to a Kubernetes cluster.

After building and pushing a genuinely new container image, the pipeline updates the Kubernetes Deployment to reference that genuinely new image tag, typically using kubectl or a tool like Helm, triggering Kubernetes's own genuine rolling update mechanism to actually roll out the new version gradually.

Helm is a genuine package manager for Kubernetes, letting you define, install, and upgrade a genuinely complex application, made up of many individual Kubernetes resources, as one genuinely single, cohesive unit called a chart, rather than manually managing a growing collection of genuinely separate YAML files.

Keep every genuinely previous container image tag readily available in the registry, and use kubectl rollout undo (or the equivalent through Helm) to quickly genuinely revert a Deployment back to its genuinely previous, known-good version, ideally triggered through the exact same automated pipeline.

Applying directly with kubectl genuinely, manually pushes a change from wherever it's actually run. A GitOps approach treats a Git repository as the genuine source of truth, with a tool like Argo CD continuously watching it and automatically applying any genuine change, providing a clearer, genuinely auditable record of exactly what changed and when.

Rather than genuinely configuring a pipeline manually through a CI tool's own web interface, pipeline as code defines the genuine pipeline's steps in a version-controlled file alongside the actual application code, letting pipeline changes genuinely go through the same review and history tracking as any other code change.

A feature flag lets you actually deploy code to production while keeping a genuinely new feature hidden or disabled, then turn it on for a genuinely specific subset of users independently of the actual deployment itself. This genuinely decouples deploying code from actually releasing a feature to real users.

Run a genuinely fast subset of critical tests immediately on every commit for quick feedback, and run a genuinely fuller, deeper test suite less frequently, perhaps before a production deployment specifically, since it naturally takes meaningfully longer but doesn't need to genuinely run on every single individual change.

A dedicated secrets manager, or the CI/CD platform's own built-in encrypted secrets storage, holds sensitive values securely, injected into the pipeline at genuine runtime as an environment variable, rather than being hardcoded directly into the pipeline configuration file itself, which would otherwise expose it in version control.

I'd investigate the actual root cause, often a genuine timing issue or shared test state, rather than simply retrying it repeatedly and hoping it genuinely passes eventually, since a genuinely flaky test that's tolerated rather than fixed gradually erodes the whole team's trust in the pipeline's own results.

An error budget is the genuinely acceptable amount of unreliability allowed before an SLO is genuinely violated, calculated as 100% minus the SLO target. If a team has genuinely burned through its error budget for a given period, that's a genuine signal to actually slow down releases and focus on reliability rather than genuinely shipping more new features.

Toil is genuinely manual, repetitive operational work that scales linearly with genuine system growth and provides genuinely no lasting improvement once completed, like manually restarting a genuinely failed service every single time it happens. Reducing toil through automation genuinely frees up an engineer's time for work that actually provides genuinely lasting value instead.

A blameless postmortem focuses on genuinely understanding the systemic, actual factors that allowed an incident to genuinely happen, rather than blaming a specific individual for a mistake. It's preferred because a genuinely blame-focused culture discourages people from being honest about a genuine mistake, which ultimately makes future incidents genuinely more likely, not less.

Define genuinely clear escalation paths and runbooks for common, known incident types, rotate on-call responsibility fairly across the team to genuinely avoid burnout, and hold a genuine, structured postmortem after every significant incident to actually feed learnings back into preventing a genuine recurrence.

Chaos engineering involves deliberately injecting controlled failures, like killing a service instance or introducing artificial network latency, into a genuinely running system to actually verify it genuinely handles those failures gracefully, rather than just assuming it does based on the design alone.

MTTD measures how long it genuinely takes to notice an incident is actually happening at all. MTTR measures how long it genuinely takes to actually restore service once an incident has been detected. Tracking both separately matters because a team might genuinely be fast at fixing issues once they know about them, while still having a genuine, real problem with slow detection that a single combined metric would hide.

I'd weigh how genuinely frequently the task actually needs to be performed and how genuinely risky a manual mistake would be, against the real upfront cost of building and maintaining automation for it. A genuinely rare, low-risk task might not genuinely justify automation, while a genuinely frequent or high-risk one very often does.

Use genuinely reusable Terraform modules defining the shared infrastructure pattern once, and a genuinely separate set of environment-specific variable files supplying the actual specific values, like instance size or environment name, for each individual environment, avoiding a genuinely near-identical copy of the same configuration repeated across environments.

A multi-cloud strategy genuinely runs infrastructure across more than one cloud provider, offering genuine benefits like avoiding vendor lock-in, at the real cost of genuinely maintaining expertise and tooling across multiple, genuinely different providers, each with its own specific APIs and quirks that don't genuinely translate directly between them.

GitOps treats a Git repository as the genuine single source of truth for a system's desired state, with a tool continuously watching that repository and automatically applying any genuine change to actually match the live system's own real state to it, extending version-controlled, auditable change management from application code to infrastructure itself.

Require a genuine plan step showing exactly what would actually change before applying anything, paired with a genuinely required human review or approval for any change affecting production, and use state locking to genuinely prevent two people from applying conflicting changes to the exact same infrastructure at the exact same time.

I'd look at how much genuinely duplicated effort exists across teams solving the exact same underlying infrastructure problems independently, and how much genuinely inconsistent practice has resulted from that fully decentralized approach. A shared platform genuinely pays for itself once that duplicated effort and inconsistency become a real, measurable cost.

A centralized secrets manager supporting genuine automatic rotation, combined with an application design that genuinely reloads a rotated secret without requiring a full restart, lets a secret actually be rotated regularly and safely, without the kind of coordinated, risky, all-at-once manual update a genuinely less automated setup would require.

Migrate incrementally, starting with a genuinely lower-risk, willing pilot team to work out real issues before a broader rollout, running the old and new systems genuinely in parallel during a transition period, and investing in genuinely clear documentation and support so each subsequent team's own migration goes noticeably faster than the very first one did.

I check whether it's genuinely solving the real, underlying problem rather than its symptom, whether it accounts for genuine failure modes rather than only the happy path, and whether it's genuinely consistent with patterns already established elsewhere in the organization's own infrastructure.

Bake genuinely required standards directly into shared pipeline templates or a platform's own default configuration, so a team consuming that shared setup inherits good practice automatically by default, rather than relying on every individual team remembering to genuinely follow a written guideline on their own.

I'd weigh the actual, concrete gap the new tool would genuinely fill against the real cost of a team learning something genuinely new and any existing tooling or process that would actually need real migration effort. A migration is worth it once it's addressing a genuinely concrete, currently-felt problem, not simply because a newer tool exists.

I'd check for a genuinely shared underlying cause first, a change to shared CI/CD infrastructure, a genuine credential expiring, or an issue with a shared dependency, rather than assuming each individual service genuinely, independently broke on its own at the exact same coincidental moment.

Track pipeline success rate and genuine execution time over time, alerting if either degrades meaningfully, since a pipeline that's quietly becoming slower or less reliable eventually erodes the whole team's trust in it and their overall willingness to genuinely rely on it for frequent releases.

Treat the shared template's actual interface, its required inputs and outputs, as a genuine contract with every consuming team. Adding a genuinely new optional input is generally safe. Changing or removing something existing needs a documented deprecation period and direct communication before actual removal.

I'd make sure one person is clearly driving the incident and coordinating across the involved teams, prioritizing genuinely mitigating user impact, rolling back a recent, suspicious change if the timing genuinely lines up, over fully understanding root cause immediately, and hold a genuine, blameless postmortem afterward to actually improve for next time.

I'd look specifically at whether the current CI/CD infrastructure and deployment process would genuinely bottleneck under significantly more frequent, concurrent pipeline runs, and prioritize addressing that specific constraint, more build capacity, better queuing, before it actually starts genuinely, visibly slowing teams down.

This is a judgment question interviewers use to see how you reason under genuine uncertainty, not to test a specific textbook fact. A strong answer names the actual constraint that forced the decision, the realistic options that were genuinely on the table, why you picked one knowing it wasn't guaranteed to be right, and what you'd do differently with what you know now.

I'd pair them directly with actually diagnosing a real, past incident together, walking through exactly what happened and why, rather than treating infrastructure reliability as an entirely genuinely separate skill someone else always simply handles for them. Seeing a real, concrete example tends to build that instinct far more effectively than a general lecture on best practices alone.

I wouldn't lead with automation as an abstract best practice. I'd point to a specific, real, already-experienced incident caused by a manual deployment mistake, and show concretely how an automated pipeline would have actually prevented that exact same specific problem from happening in the first place.

I'd bring the actual, concrete ownership and expertise question into focus directly, rather than a general, abstract territorial preference for one team over the other. Most disagreements like this genuinely resolve once both sides are looking at who's actually best positioned to maintain that specific piece of work reliably over the genuine long term.

I'd translate the investment into terms leadership already tracks: the hours currently spent on manual deployments and firefighting preventable incidents, and how much faster the team could genuinely ship features with that time recovered. Framed as engineering time returned and risk reduced, it competes far better for prioritization than framed as infrastructure spending for its own sake.