CandidateToHR

Top DevOps Interview Questions Interview Questions | CandidateToHR

Crack your DevOps interview. Covers CI/CD, Docker, Jenkins, Infrastructure as Code, Linux fundamentals, and Monitoring.

CandidateToHR provides highly optimized, professional tech career resources. Build, customize, and analyze your tech career credentials completely free.

50 real-world DevOps questions covering continuous integration, containers, infrastructure automation, and system administration.

Top Interview Questions & Answers

Beginner Interview Questions

Q: What is DevOps?
A: DevOps is a set of practices, cultural philosophies, and tools that integrates and automates the processes between software development (Dev) and IT operations (Ops). The goal is to shorten the systems development life cycle and provide continuous delivery with high software quality.
Q: What is Continuous Integration (CI)?
A: CI is a software development practice where developers regularly merge their code changes into a central repository. Automated builds and tests are immediately run on the new code to quickly detect and locate integration errors.
Q: What is Continuous Delivery vs Continuous Deployment (CD)?
A: Continuous Delivery ensures that code changes are automatically built, tested, and prepared for a release to production, but the final deployment requires manual human approval. Continuous Deployment goes one step further: every change that passes the automated tests is automatically deployed to production without human intervention.
Q: What is Git?
A: Git is a distributed version control system designed to handle everything from small to very large projects with speed and efficiency. It allows multiple developers to work on the same codebase simultaneously, tracking changes and enabling branching and merging.
Q: Explain the difference between `git merge` and `git rebase`.
A: `git merge` takes the contents of a source branch and integrates it into a target branch, creating a new 'merge commit' that ties the histories together. `git rebase` moves the entire feature branch to begin on the tip of the master branch, rewriting commit history to create a clean, linear project history without merge commits.
Q: What is Docker?
A: Docker is an open-source platform that uses OS-level virtualization to deliver software in packages called containers. Containers bundle the application source code with all its dependencies (libraries, frameworks) into a single artifact, ensuring the application runs identically on any environment.
Q: Difference between a Virtual Machine and a Docker Container?
A: A Virtual Machine (VM) includes the application, dependencies, and a full, heavy guest Operating System, managed by a Hypervisor. A Docker Container includes the application and dependencies but shares the host machine's OS kernel. Containers are lightweight, start in milliseconds, and use vastly fewer resources than VMs.
Q: What is a Dockerfile?
A: A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image. Using `docker build`, Docker reads these instructions step-by-step to automatically generate a Docker Image.
Q: What is Infrastructure as Code (IaC)?
A: IaC is the process of managing and provisioning computing infrastructure (servers, networks, databases) through machine-readable definition files (code), rather than physical hardware configuration or interactive configuration tools (GUI). Terraform and Ansible are prime examples.
Q: What is Jenkins?
A: Jenkins is an open-source automation server built in Java. It helps automate the non-human parts of the software development process, primarily serving as the backbone for establishing Continuous Integration and Continuous Delivery (CI/CD) pipelines.
Q: What is Linux?
A: Linux is a free, open-source, monolithic kernel operating system. Because of its stability, security, and open-source nature, it is the foundational operating system for almost all servers, containers, and cloud environments used in DevOps.
Q: Explain `chmod` and file permissions in Linux.
A: `chmod` is a Linux command used to change the access permissions of file system objects. Permissions are divided into Read (4), Write (2), and Execute (1). They are applied to the User (owner), Group, and Others. For example, `chmod 755 script.sh` grants full access (7) to the owner, and read/execute (5) to group and others.
Q: What does the `grep` command do?
A: `grep` stands for Global Regular Expression Print. It is a command-line utility used to search for specific text patterns or regular expressions within files or streams of text (e.g., filtering log files for 'ERROR').
Q: What is SSH?
A: Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. It is the standard method for system administrators to securely log into remote Linux servers to execute terminal commands.
Q: What is the difference between a Web Server and an Application Server?
A: A Web Server (like Nginx or Apache) is designed to serve static web content (HTML, CSS, images) via HTTP. An Application Server (like Tomcat or Node.js) executes dynamic business logic, interacts with databases, and generates dynamic content to send back to the web server.
Q: What is configuration management?
A: Configuration Management is a systems engineering process for establishing and maintaining consistency of a product's performance, functional, and physical attributes. Tools like Ansible, Chef, and Puppet ensure that all servers in a fleet have the exact same software versions, patches, and config files.
Q: What are microservices?
A: Microservices architecture structures an application as a collection of small, loosely coupled, independently deployable services organized around business capabilities. Each service runs its own process and communicates via lightweight mechanisms (usually HTTP APIs), allowing teams to deploy and scale services independently.

Intermediate Interview Questions

Q: Explain the architecture of Jenkins and how distributed builds work.
A: Jenkins uses a Master-Agent architecture. The Jenkins Master server handles the UI, HTTP requests, schedules builds, and dispatches them to Agents. Agents (or nodes) are separate machines (or dynamic containers) that execute the actual build steps. This allows Jenkins to scale horizontally and build code across different operating systems simultaneously.
Q: What is a Jenkinsfile?
A: A Jenkinsfile is a text file that contains the definition of a Jenkins Pipeline and is checked into source control (Pipeline-as-Code). It can be written in Declarative syntax (structured, easier to read) or Scripted syntax (Groovy code, highly flexible). It ensures the CI/CD pipeline is version-controlled alongside the application code.
Q: What is Ansible and how does it work?
A: Ansible is an open-source Configuration Management and IT automation tool. Unlike Chef or Puppet, Ansible is 'agentless'. It does not require any software to be installed on the target nodes. It simply connects via SSH, pushes execution modules (written in Python) derived from YAML 'Playbooks', executes them, and removes them.
Q: Explain the difference between mutable and immutable infrastructure.
A: Mutable infrastructure means servers are continually updated, patched, and modified in-place over time, leading to 'configuration drift' where servers slowly become unique. Immutable infrastructure means a server is never modified after it is deployed. If an update is needed, the old server is destroyed and replaced with a completely new server built from a new image.
Q: What is Terraform and the concept of 'State'?
A: Terraform is an IaC tool by HashiCorp used to provision cloud infrastructure. It uses a declarative language (HCL). The `terraform.tfstate` file maps the real-world deployed resources to your configuration. When you run `terraform plan`, it compares your HCL files to the state file to calculate the exact creation, modification, or deletion operations needed.
Q: Difference between Docker Image and Docker Container?
A: A Docker Image is a read-only template built from a Dockerfile; it contains the application, libraries, and environment. A Docker Container is the active, running instance of an image. You can spin up hundreds of isolated containers from a single image.
Q: What are Docker Volumes?
A: Containers are ephemeral; if a container is deleted, all data created inside it is lost. Docker Volumes are directories stored on the host filesystem and mounted into the container. They provide persistent storage independent of the container's lifecycle, essential for running databases in Docker.
Q: Explain Blue-Green Deployment.
A: Blue-Green is a deployment strategy that minimizes downtime and risk. You maintain two identical production environments: Blue (active) and Green (idle). The new version is deployed to Green and tested. Once verified, the load balancer routes traffic from Blue to Green instantly. If an issue occurs, rollback is instantaneous by routing back to Blue.
Q: Explain Canary Deployment.
A: A Canary deployment rolls out a new release to a small subset of users (e.g., 5%) while the rest stay on the old version. The team monitors the canary group for errors or performance degradation. If successful, the rollout gradually increases to 100%. It reduces the blast radius of a bad release.
Q: What is NGINX and what are its primary use cases?
A: NGINX is a high-performance HTTP web server, reverse proxy, load balancer, and API gateway. In DevOps, it is primarily used as a reverse proxy sitting in front of application servers (like Node.js or Python) to handle SSL termination, load balancing, caching, and serving static assets efficiently.
Q: What is Prometheus?
A: Prometheus is an open-source systems monitoring and alerting toolkit. It operates on a 'pull' model, scraping metrics (like CPU, memory, HTTP errors) via HTTP from configured target endpoints. It stores data in a powerful time-series database and uses PromQL to query data, often visualized using Grafana.
Q: What is ELK Stack?
A: ELK stands for Elasticsearch (a NoSQL search and analytics engine), Logstash (a server-side data processing pipeline that ingests, transforms, and sends logs), and Kibana (a data visualization dashboard). It is the industry standard for centralized log aggregation, allowing engineers to search through millions of microservice logs instantly.
Q: Explain `systemd` and `systemctl` in Linux.
A: `systemd` is the init system and system manager that has become the new standard for Linux distributions. It initializes components after boot and manages background services (daemons). `systemctl` is the command-line utility used to interact with `systemd`, allowing you to start, stop, enable, and check the status of services.
Q: What is DNS and how does it work?
A: Domain Name System (DNS) is the phonebook of the internet. It translates human-readable domain names (google.com) into machine-readable IP addresses. The resolution process hits the local cache, then the Root servers, then the TLD servers (.com), and finally the Authoritative Name Server, which holds the actual IP.
Q: What is a Reverse Proxy?
A: A forward proxy sits in front of client machines to intercept outbound requests. A reverse proxy sits in front of backend web servers to intercept inbound requests. It provides security, load balancing, SSL termination, and caching, ensuring clients never communicate directly with the application servers.
Q: How does SSH key-based authentication work?
A: It uses asymmetric cryptography. You generate a key pair: a Public Key (placed on the remote server in `~/.ssh/authorized_keys`) and a Private Key (kept strictly secure on your local machine). When connecting, the server encrypts a challenge message using your public key; your SSH client decrypts it using the private key, proving your identity without transmitting passwords.
Q: What is a Cron Job?
A: Cron is a time-based job scheduler in Unix-like operating systems. Users configure a `crontab` file to schedule scripts or commands to run automatically at specified times, dates, or intervals. The syntax consists of five fields: minute, hour, day of month, month, and day of week.

Advanced Interview Questions

Q: How do you achieve Zero Downtime Deployment with Docker and CI/CD?
A: Using orchestration tools like Kubernetes or AWS ECS. The CI pipeline builds a new Docker image and updates the deployment manifest. Kubernetes implements a 'Rolling Update'. It spins up a new pod with the new image, waits for the health check/readiness probe to pass, routes traffic to it, and gracefully terminates an old pod, repeating this until the fleet is fully replaced.
Q: Explain GitOps.
A: GitOps is an operational framework that takes DevOps best practices (version control, compliance, CI/CD) and applies them to infrastructure automation. The Git repository is the single source of truth for declarative infrastructure and applications. Software agents (like ArgoCD or Flux) run inside the cluster, continuously comparing the live state to the Git state, and automatically pulling and applying changes if they drift.
Q: How do you handle secrets management in a CI/CD pipeline?
A: Hardcoding secrets in Git is catastrophic. Solutions: 1) Store secrets in Jenkins Credentials Manager or GitHub Secrets, injecting them as ephemeral environment variables during the build. 2) For infrastructure, use a dedicated Vault (HashiCorp Vault, AWS Secrets Manager). The application authenticates via IAM or tokens at runtime to fetch secrets directly into memory, keeping them completely out of the pipeline logs.
Q: What happens when you type a URL into a browser and hit enter (DevOps perspective)?
A: 1) DNS Resolution (Browser cache -> OS cache -> Resolver -> Root -> TLD -> Authoritative DNS). 2) TCP 3-way handshake with the server's IP. 3) TLS handshake for HTTPS. 4) HTTP Request hits the Load Balancer/Reverse Proxy (NGINX). 5) LB forwards to a healthy Application Server. 6) App queries DB, processes logic, generates HTML/JSON. 7) HTTP Response traverses back. 8) Browser parses DOM and fetches assets.
Q: How does Terraform handle locking, and why is it important?
A: When running Terraform in a team, two people running `terraform apply` simultaneously could corrupt the state file. Terraform uses State Locking. If the state is stored remotely (e.g., in an S3 bucket), Terraform uses a DynamoDB table to acquire a lock before applying. Anyone else attempting an apply will be blocked until the lock is released.
Q: What are Linux inodes?
A: An inode (index node) is a data structure on a Unix filesystem that stores metadata about a file or directory (size, permissions, ownership, physical disk block locations), but NOT the file's name or its actual data. If a disk runs out of inodes (e.g., millions of tiny files), you cannot create new files even if there is plenty of disk space left.
Q: Explain Load Balancing Algorithms.
A: 1) Round Robin: Distributes requests sequentially across servers. 2) Least Connections: Sends the request to the server with the fewest active connections. 3) IP Hash: Uses the client's IP address to deterministically map them to the same server every time (session stickiness). 4) Weighted: Assigns more traffic to servers with higher specs.
Q: What is the difference between a forward proxy and a reverse proxy?
A: A Forward Proxy sits in front of a group of client machines. When a client makes a request to the internet, the proxy intercepts it to enforce security, bypass regional blocks, or cache content (hiding the client's IP from the server). A Reverse Proxy sits in front of web servers, intercepting incoming traffic to balance load and protect the backend infrastructure (hiding the server's IP from the client).
Q: How do you troubleshoot a server that is running out of memory but the application process shows low usage?
A: The issue is likely the Linux Page Cache. Linux aggressively uses free RAM to cache disk I/O to speed up reads/writes. This shows up as 'used' memory, but it's completely normal; the kernel instantly reallocates it if applications need it. Check `free -m` and look at the `available` column, not the `used` column. If `available` is truly low, investigate zombies, kernel leaks, or `tmpfs` mounts.
Q: Explain Service Mesh.
A: In a massive microservices architecture, managing communication, security, and observability between hundreds of services is complex. A Service Mesh (like Istio or Linkerd) injects a 'sidecar' proxy container into every pod. The application only talks to localhost. The sidecar handles routing, mutual TLS encryption (mTLS), retries, and emits telemetry data, abstracting networking logic away from developers.
Q: What is the role of an Ingress Controller?
A: In Kubernetes, a LoadBalancer service provisions a cloud load balancer per service, which gets expensive. An Ingress Controller (like NGINX Ingress) is a single entry point (one Load Balancer) that evaluates HTTP path/host rules defined in Ingress resources to route traffic internally to various different services within the cluster.
Q: How does Docker networking work under the hood?
A: Docker uses Linux network namespaces to isolate container networks. By default, it creates a virtual bridge (`docker0`) on the host. Containers get virtual ethernet interfaces (`veth`) attached to this bridge. Docker dynamically manipulates `iptables` rules on the host to perform Network Address Translation (NAT), allowing containers to communicate with the outside world and exposing specific ports.
Q: What is Chaos Engineering?
A: Chaos Engineering (popularized by Netflix's Chaos Monkey) is the practice of intentionally injecting failures into a production system (like terminating instances, simulating network latency, or crashing databases) to test the system's resilience and observability. The goal is to identify weaknesses before they cause unscheduled outages.
Q: How do you monitor and alert on a microservices architecture effectively?
A: Avoid 'alert fatigue' by alerting only on Symptoms (user impact), not Causes. Use the Four Golden Signals (Latency, Traffic, Errors, Saturation). Implement Distributed Tracing (Jaeger, OpenTelemetry) by passing a correlation ID through HTTP headers across all microservices, allowing you to trace the exact path of a slow request through the entire system.
Q: What is the `OOM Killer` in Linux?
A: The Out Of Memory (OOM) Killer is a kernel mechanism. When the OS critically runs out of RAM and swap space, it cannot function. The OOM Killer activates, calculates an `oom_score` for all running processes (based on memory usage and priority), and ungracefully terminates the highest-scoring process to free memory and save the system from crashing.
Q: Explain the difference between SLA, SLO, and SLI in Site Reliability Engineering.
A: Service Level Agreement (SLA) is the legal/business contract with users (e.g., 99.9% uptime) that dictates penalties if breached. Service Level Objective (SLO) is the internal engineering goal, set strictly higher than the SLA (e.g., 99.95%) to act as a buffer. Service Level Indicator (SLI) is the actual, real-time mathematical measurement of the service's performance (e.g., successful requests / total requests).

Frequently Asked Questions

How many questions are covered in this guide?

This guide covers 50+ of the most frequently asked questions.

Are these questions suitable for beginners?

Yes, the guide is divided into beginner, intermediate, and advanced sections.

How often is this guide updated?

We update our interview questions quarterly to ensure they reflect current industry standards.

Should I memorize the answers?

No, it is better to understand the underlying concepts rather than memorizing answers word-for-word.

Are these questions asked at FAANG companies?

Yes, many of these questions are standard in interviews at top tech companies like Google, Amazon, and Meta.

Related Resources & Next Steps