50 Cloud DevOps Practices Interview Questions and Answers (With Scenarios)

Key takeaways

• Interviewers test understanding of principles and trade-offs, not tool names alone.
• Key areas: CI/CD and DORA metrics, Terraform and Ansible, Docker and Kubernetes, SLOs and DR, DevSecOps and observability.
• Be ready for scenarios: a failed deployment, drift, a crashing pod or a cost spike.
• Practise answers aloud with an example from a lab or project.
• Always mention rollback, monitoring and security.

How should you use these questions?

Cloud DevOps interviews mix concepts with scenarios: "a deployment failed, what do you do?" or "how would you design this pipeline?". For each question below, read the short answer, then practise saying it in your own words with an example from a project or lab. The strongest answers state a trade-off. The Kubernetes and Docker documentation, Docker docs, and your cloud provider's documentation are the best places to confirm details.

Culture and delivery

1. What is DevOps and what problem does it solve?

DevOps joins development and operations through shared ownership and automation, so software is released in small, frequent, reliable steps. It reduces handoff delays and the blame that comes with separate teams.

2. What is the difference between continuous integration, continuous delivery and continuous deployment?

CI merges and tests code often. Continuous delivery keeps every build ready to release, with a manual approval to ship. Continuous deployment releases every change that passes tests automatically.

3. What are the DORA metrics?

Deployment frequency, lead time for changes, change failure rate and time to restore service. They measure delivery speed and stability together.

4. What is trunk-based development and why use it?

Developers merge small changes to a main branch frequently, using feature flags for unfinished work. It reduces long-lived branches and painful merges.

5. What is a feature flag?

A configuration switch that turns functionality on or off without a new deployment. It separates deployment from release and enables gradual rollouts and quick rollback.

6. What makes a good CI/CD pipeline?

Fast feedback, reproducible builds, automated tests, security checks, artefacts built once and promoted between environments, clear failure messages and the ability to roll back.

7. What is a blameless postmortem?

A review after an incident that focuses on causes, timeline and improvements instead of fault. It encourages honest reporting and learning.

8. What is shift-left testing?

Moving testing and security checks earlier in the lifecycle, for example unit tests and dependency scans on every commit, because defects are cheaper to fix early.

9. What is GitOps?

A practice in which the desired state of infrastructure and applications is stored in Git, and an automated agent, such as Argo CD or Flux, keeps the live system matching it. Changes happen through pull requests.

10. What is the difference between a build artefact and a deployment?

An artefact is the built output, such as a container image or package, versioned and stored in a registry. A deployment is putting a specific artefact into an environment.

Infrastructure as code and configuration

11. Why use infrastructure as code in the cloud?

It makes environments repeatable, reviewable and version controlled, reduces manual errors and allows quick recreation after failure. It also documents the infrastructure.

12. What is the difference between declarative and imperative approaches?

Declarative code describes the desired end state, as Terraform does. Imperative code gives the steps to run, like a shell script. Declarative tools work out the steps themselves.

13. What is Terraform state and why is it sensitive?

State maps your configuration to real resources. It can contain secrets and must be stored remotely with locking and access control, not committed to Git.

14. What is configuration drift and how do you handle it?

Drift is when real infrastructure no longer matches its code because of manual changes. Detect it with plan or drift tools, restrict manual access and reapply the code.

15. What is idempotency?

Running an operation repeatedly gives the same result without extra side effects. Tools such as Ansible modules aim for idempotent behaviour so reruns are safe.

16. How do Ansible and Terraform differ?

Terraform provisions infrastructure such as networks and servers. Ansible configures systems and applications. Many teams use Terraform to create resources and Ansible to configure them.

17. What are immutable infrastructure and pets versus cattle?

Immutable infrastructure is replaced, not patched in place. Pets are unique servers you nurse; cattle are identical and disposable. The cloud favours cattle.

18. How should secrets be managed in pipelines?

Keep them in a secrets manager or the CI platform's secret store, inject at runtime, rotate regularly, scope them narrowly and never commit them. Prefer short-lived credentials such as OIDC federation to long-lived keys.

19. What is a module and why use it?

A reusable, parameterised unit of infrastructure code. Modules reduce duplication and enforce standards across teams.

20. How do you test infrastructure code?

Lint and validate, run a plan in a safe environment, use policy checks, run unit or integration tests with a tool such as Terratest, and apply to a non-production environment first.

Containers and Kubernetes

21. What is the difference between a container and a virtual machine?

A container shares the host kernel and packages an application with its dependencies, so it starts quickly and is lightweight. A VM runs a full guest operating system on a hypervisor and offers stronger isolation.

22. What makes a good Dockerfile?

A small trusted base image, minimal layers, a non-root user, pinned versions, a multi-stage build, a .dockerignore and no secrets inside the image.

23. What is Kubernetes used for?

Orchestrating containers: scheduling, scaling, self-healing, service discovery, rolling updates and configuration management across a cluster of machines.

24. What is the difference between a Deployment and a StatefulSet?

A Deployment manages interchangeable stateless pods. A StatefulSet gives pods stable identities and storage, which suits databases and other stateful workloads.

25. How do liveness and readiness probes differ?

A liveness probe tells Kubernetes when to restart a stuck container. A readiness probe tells it when a pod can receive traffic.

26. How does a rolling update work and how do you roll back?

Kubernetes replaces pods gradually while keeping the service available. Roll back with kubectl rollout undo to the previous revision.

27. What are requests and limits?

Requests are the resources the scheduler reserves for a container. Limits are the maximum it may use. Setting both prevents noisy neighbours and unexpected evictions.

28. How do you troubleshoot a pod in CrashLoopBackOff?

Use kubectl describe pod for events, kubectl logs --previous for the last crash, check the image, command, config, probes and resource limits, then fix the cause.

29. What is a Helm chart?

A package of Kubernetes manifests with templating and values, used to install and upgrade applications repeatably. See the Kubernetes documentation for the core objects it deploys.

30. How do you control who can do what in Kubernetes?

With role-based access control (RBAC): roles define permissions, and role bindings assign them to users or service accounts. Apply least privilege.

Cloud operations and reliability

31. What is the shared responsibility model?

The cloud provider secures the underlying infrastructure, while the customer secures what they put on it, such as data, identities, configuration and applications. The split varies by service type.

32. What is the difference between scaling up and scaling out?

Scaling up adds resources to one machine. Scaling out adds more instances. Scaling out improves availability but needs stateless design or shared state.

33. What is auto scaling and what can go wrong?

Capacity adjusts to demand using metrics or schedules. Problems include slow start-up, wrong thresholds, scaling loops and cost surprises, so test and set limits.

34. What are blue-green and canary deployments?

Blue-green runs two environments and switches traffic from old to new, enabling instant rollback. Canary sends a small share of traffic to the new version first and expands if metrics stay healthy.

35. What are SLI, SLO and SLA?

A service level indicator is a measurement, such as latency. An objective is the internal target for it. An agreement is a contractual commitment to customers, often with penalties.

36. What is an error budget?

The amount of unreliability allowed by an SLO. If you have budget left you can ship faster; if it is spent, the focus moves to reliability.

37. How do you design for high availability in the cloud?

Spread across availability zones, remove single points of failure, use load balancers and health checks, automate failover, back up data and test failure scenarios.

38. What are RPO and RTO?

Recovery point objective is how much data loss is tolerable, measured in time. Recovery time objective is how long recovery may take. They shape backup and disaster recovery design.

39. How do you control cloud cost?

Tag resources, set budgets and alerts, right-size, use autoscaling and scheduled shutdowns for non-production, pick suitable pricing models and review unused resources regularly.

40. What is chaos engineering?

Deliberately injecting failures, such as stopping instances, in a controlled way to find weaknesses before real incidents do. Begin in test environments with clear safeguards.

Security and monitoring

41. What is DevSecOps?

Building security into the delivery pipeline and culture: automated scans, secure defaults, shared responsibility and fast feedback rather than a final security gate.

42. Which security checks belong in a pipeline?

Secret scanning, static analysis (SAST), dependency and licence scanning (SCA), container image scanning, infrastructure as code policy checks and dynamic testing (DAST) on staging.

43. What is least privilege and how is it applied in the cloud?

Granting only the permissions needed. Use narrow IAM roles, avoid wildcard permissions, separate duties, use temporary credentials and review access regularly.

44. What is a software bill of materials (SBOM)?

A list of the components and dependencies in a piece of software. It helps teams respond quickly when a vulnerability appears in a library.

45. What is the difference between monitoring and observability?

Monitoring checks known conditions through metrics and alerts. Observability lets you ask new questions of a system using logs, metrics and traces.

46. What are the three pillars of observability?

Logs, metrics and traces. Together they show what happened, how the system is performing and how a request moved across services.

47. How do you reduce alert fatigue?

Alert on symptoms users feel, tie alerts to SLOs, remove noisy or duplicate alerts, add runbooks and review alerts after incidents.

48. Which tools are commonly used for monitoring?

Prometheus for metrics, Grafana for dashboards, Loki or an ELK stack for logs, OpenTelemetry for instrumentation and cloud-native services such as CloudWatch, Azure Monitor and Cloud Monitoring.

49. How do you handle an outage?

Acknowledge, assess impact, communicate, mitigate first (roll back or fail over), find the cause later, document the timeline and hold a blameless review with action items.

50. What does a good on-call practice look like?

Clear ownership, manageable load, good runbooks, escalation paths, fair rotation and time to fix recurring problems so that incidents become less frequent.

Scenario prompts to practise

1. A deployment passes tests but latency doubles in production. How do you investigate and roll back?
2. Design a pipeline for a containerised web app, from commit to production, with security checks.
3. Terraform shows changes you did not make. What happened and what do you do?
4. A pod keeps restarting after a configuration change. Walk through your commands.
5. Your cloud bill doubled this month. How do you find out why?

Common mistakes in DevOps interviews

• Listing tools without explaining why you chose them.
• Skipping rollback, monitoring and security in a pipeline design.
• Claiming experience you cannot demonstrate with specifics.
• Ignoring cost and reliability trade-offs.

Next steps

Practise by building a project: containerise an app, deploy it through a pipeline and monitor it. For guided training, see our DevOps course. For more questions, read top 50 DevOps interview questions and top 50 CI/CD interview questions.

Related reading

• Mastering the Essential Tools and Technologies for a DevOps Career