Top 100 DevOps Interview Questions and Answers [2026]

1. What is DevOps?

Answer: DevOps is a set of practices, cultural philosophies, and tools that combines software development (Dev) and IT operations (Ops) to shorten the software development lifecycle while delivering features, fixes, and updates frequently and reliably. It emphasizes collaboration, automation, continuous integration, continuous delivery, and monitoring throughout the application lifecycle. DevOps breaks down silos between development and operations teams, enabling faster innovation and improved system reliability.

2. What are the key principles of DevOps?

Answer: The key principles of DevOps include:

• Collaboration: Breaking down silos between Dev and Ops teams
• Automation: Automating repetitive tasks in build, test, and deployment
• Continuous Integration: Frequently merging code changes into a shared repository
• Continuous Delivery: Automatically preparing code changes for production release
• Monitoring & Feedback: Continuous monitoring and quick feedback loops
• Infrastructure as Code: Managing infrastructure through code and version control

3. What is the difference between Continuous Integration, Continuous Delivery, and Continuous Deployment?

Answer:

• Continuous Integration (CI): Developers frequently merge code changes into a central repository, triggering automated builds and tests to detect integration issues early
• Continuous Delivery (CD): Extends CI by automatically preparing code changes for release to production. Deployment to production requires manual approval
• Continuous Deployment: Goes further by automatically deploying every change that passes all test stages to production without manual intervention

4. What is Infrastructure as Code (IaC)?

Answer: Infrastructure as Code (IaC) is the practice of managing and provisioning computing infrastructure through machine-readable configuration files rather than manual processes. IaC enables version control for infrastructure, makes deployments repeatable and consistent, reduces human error, and allows infrastructure changes to be reviewed and tested like application code. Popular IaC tools include Terraform, AWS CloudFormation, Ansible, Pulumi, and Azure Resource Manager templates.

5. What is Version Control and why is it important in DevOps?

Answer: Version control is a system that records changes to files over time, allowing you to recall specific versions later. In DevOps, it's crucial because it enables collaboration among team members, maintains history of all changes, allows rollback to previous versions, supports branching and merging for parallel development, and integrates with CI/CD pipelines for automated builds. Git is the most widely used version control system, with platforms like GitHub, GitLab, and Bitbucket providing collaboration features.

6. What is a microservices architecture?

Answer: Microservices architecture is an approach where an application is built as a collection of small, independent services that communicate through APIs. Each microservice focuses on a specific business capability, can be developed, deployed, and scaled independently, uses its own database, and can be written in different programming languages. Benefits include improved scalability, faster development cycles, fault isolation, and easier maintenance. However, it adds complexity in service coordination, monitoring, and debugging.

7. What is the difference between Agile and DevOps?

Answer: While Agile and DevOps complement each other, they have different focuses:

• Agile: Focuses on iterative development, collaboration with customers, and adapting to change. Primarily addresses development practices and project management
• DevOps: Extends Agile by bridging development and operations, emphasizing automation, continuous delivery, and infrastructure management
• Key Difference: Agile ends at software development, while DevOps continues through deployment and operations

8. What is a DevOps pipeline?

Answer: A DevOps pipeline is an automated sequence of processes that takes code from version control through build, test, and deployment stages to production. A typical pipeline includes: source code management, build automation, automated testing (unit, integration, security), artifact storage, deployment to staging/production environments, and monitoring. Pipelines ensure consistent, repeatable deployments and enable rapid feedback on code quality.

9. What is configuration management?

Answer: Configuration management is the practice of handling changes systematically to maintain system integrity over time. In DevOps, it involves automating the provisioning and configuration of servers and applications to ensure consistency across environments. Popular configuration management tools include Ansible (agentless, uses YAML), Puppet (uses Ruby DSL), Chef (uses Ruby), and SaltStack. These tools enable idempotent operations, meaning running them multiple times produces the same result.

10. What is containerization and how does it differ from virtualization?

Answer:

• Virtualization: Creates complete virtual machines with their own operating systems running on a hypervisor. Each VM requires significant resources for the full OS
• Containerization: Packages applications with their dependencies in isolated containers that share the host OS kernel. Containers are lightweight, start in seconds, and use fewer resources
• Key Benefits of Containers: Portability across environments, consistent behavior, efficient resource usage, faster startup, and easier scaling

11. What are the benefits of DevOps?

Answer: Key benefits of DevOps include:

• Faster Delivery: Accelerated time-to-market with frequent releases
• Improved Collaboration: Better communication between development and operations
• Higher Quality: Automated testing catches bugs early
• Increased Reliability: Infrastructure as Code ensures consistent environments
• Better Scalability: Automation enables efficient scaling
• Reduced Costs: Automation reduces manual work and errors
• Faster Recovery: Quick rollback capabilities and monitoring

12. What is a build artifact?

Answer: A build artifact is the output produced by a build process, such as compiled code, executable files, Docker images, JAR/WAR files, or deployment packages. Artifacts are stored in artifact repositories like JFrog Artifactory, Nexus Repository, AWS ECR, or Docker Hub. Proper artifact management ensures traceability, enables rollback to previous versions, and maintains consistency between environments.

13. What is blue-green deployment?

Answer: Blue-green deployment is a release strategy that reduces downtime and risk by running two identical production environments called Blue and Green. At any time, one environment (e.g., Blue) serves production traffic while the other (Green) is idle or runs the new version. After testing the new version in Green, traffic is switched from Blue to Green. If issues arise, traffic can instantly switch back to Blue. This enables zero-downtime deployments and quick rollbacks.

14. What is canary deployment?

Answer: Canary deployment is a strategy where a new version is gradually rolled out to a small subset of users before full deployment. The name comes from coal miners using canaries to detect dangerous gases. In DevOps, you deploy the new version to a small percentage of servers or users (e.g., 5%), monitor for issues, then gradually increase traffic. This minimizes the impact of potential bugs since only a small portion of users are affected initially.

15. What is the role of a DevOps Engineer?

Answer: A DevOps Engineer bridges development and operations teams, focusing on:

• Building and maintaining CI/CD pipelines
• Implementing and managing infrastructure as code
• Container orchestration with Docker and Kubernetes
• Cloud infrastructure management (AWS, Azure, GCP)
• Monitoring, logging, and alerting systems
• Automation of manual processes
• Security integration (DevSecOps)
• Performance optimization and troubleshooting

16. What are the stages of a typical CI/CD pipeline?

Answer: A typical CI/CD pipeline includes:

• Source: Code is committed to version control, triggering the pipeline
• Build: Code is compiled, dependencies resolved, artifacts created
• Test: Unit tests, integration tests, security scans executed
• Deploy to Staging: Artifacts deployed to staging environment
• Acceptance Testing: End-to-end tests, performance tests in staging
• Deploy to Production: Release to production (manual or automatic)
• Monitoring: Post-deployment monitoring and alerting

17. What is Jenkins and how does it work?

Answer: Jenkins is an open-source automation server used for building, testing, and deploying software. It works by defining jobs or pipelines that execute a series of steps. Jenkins uses a master-agent architecture where the master schedules jobs and agents execute them. Pipelines can be defined using Jenkinsfile (Pipeline as Code) with declarative or scripted syntax. Jenkins integrates with thousands of plugins for version control, build tools, testing frameworks, and deployment targets.

18. What is the difference between declarative and scripted Jenkins pipelines?

Answer:

• Declarative Pipeline: Uses a predefined structure with `pipeline`, `stages`, `steps` blocks. Easier to read, has built-in validation, and is the recommended approach for most use cases
• Scripted Pipeline: Uses Groovy scripting with more flexibility and control. Starts with `node` block. Better for complex scenarios requiring programmatic control but harder to maintain
• Recommendation: Start with declarative and only use scripted for advanced requirements

19. What is GitLab CI/CD?

Answer: GitLab CI/CD is a built-in continuous integration and delivery platform in GitLab. It uses a `.gitlab-ci.yml` file in the repository root to define pipeline stages, jobs, and configurations. GitLab Runners execute the jobs on various platforms. Key features include Auto DevOps, container registry integration, environment management, merge request pipelines, and detailed pipeline visualization. It's tightly integrated with GitLab's version control and project management features.

20. What is GitHub Actions?

Answer: GitHub Actions is GitHub's native CI/CD platform that automates workflows directly from repositories. Workflows are defined in YAML files under `.github/workflows/` directory. Key concepts include workflows (automated procedures), events (triggers like push, pull_request), jobs (sets of steps running on a runner), and actions (reusable units of code). GitHub provides hosted runners (Ubuntu, Windows, macOS) and supports self-hosted runners. The marketplace offers thousands of pre-built actions.

21. What are webhooks and how are they used in CI/CD?

Answer: Webhooks are HTTP callbacks that send real-time data to other applications when specific events occur. In CI/CD, webhooks are used to trigger pipelines automatically when code is pushed, pull requests are created, or branches are merged. For example, GitHub can send a webhook to Jenkins when code is pushed, triggering a build. This eliminates the need for polling and enables immediate pipeline execution upon code changes.

22. What is a multi-branch pipeline?

Answer: A multi-branch pipeline automatically creates pipeline jobs for each branch in a repository that contains a Jenkinsfile (or equivalent configuration). It enables branch-specific builds, allowing teams to test feature branches independently before merging. The pipeline automatically discovers new branches, runs builds, and removes pipelines for deleted branches. This is essential for Git flow workflows with feature branches, develop, and main branches.

23. How do you handle secrets in CI/CD pipelines?

Answer: Secrets should never be stored in code or pipeline files. Best practices include:

• Using secret management tools like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault
• Configuring CI/CD platform's built-in secret stores (Jenkins credentials, GitLab CI variables, GitHub Secrets)
• Masking secrets in logs to prevent exposure
• Rotating secrets regularly and using short-lived tokens
• Implementing least privilege access for secrets

24. What is pipeline as code?

Answer: Pipeline as Code is the practice of defining CI/CD pipelines in version-controlled configuration files rather than through UI configurations. Examples include Jenkinsfile, .gitlab-ci.yml, and .github/workflows/*.yml. Benefits include version history, code review for pipeline changes, reusability across projects, easier testing and debugging, and treating pipeline definitions as first-class code artifacts. This enables the same change management practices for pipelines as for application code.

25. What are build triggers in Jenkins?

Answer: Build triggers determine when a Jenkins job runs:

• SCM Polling: Jenkins periodically checks for changes in version control
• Webhooks: External systems trigger builds via HTTP requests
• Scheduled (Cron): Builds run at specified times using cron syntax
• Upstream/Downstream: Builds triggered by completion of other jobs
• Manual: User-initiated builds via Jenkins UI or API
• Remote Trigger: Builds triggered via authenticated URL

26. What is a build agent/runner?

Answer: A build agent (Jenkins) or runner (GitLab/GitHub) is a machine that executes CI/CD jobs. Agents can be physical machines, VMs, containers, or cloud instances. They connect to the CI/CD server to receive and execute work. Benefits of distributed agents include parallel execution, specialized environments (different OS, tools), load distribution, and isolation. Agents can be labeled/tagged to route specific jobs to appropriate environments (e.g., jobs requiring GPU, specific OS, or security clearance).

27. How do you implement rollback in CI/CD?

Answer: Rollback strategies include:

• Artifact-based: Keep previous artifacts and deploy the last known good version
• Blue-green: Switch traffic back to the previous (blue) environment
• Kubernetes rollback: Use `kubectl rollout undo` to revert deployments
• Database migrations: Implement reversible migrations and rollback scripts
• Feature flags: Toggle off problematic features without redeployment
• Git revert: Revert commits and trigger new deployment pipeline

28. What is the difference between CI/CD platforms: Jenkins vs GitLab CI vs GitHub Actions?

Answer:

• Jenkins: Self-hosted, highly customizable with 1800+ plugins, steep learning curve, requires maintenance, supports any VCS
• GitLab CI: Integrated with GitLab, easy setup, built-in container registry, Auto DevOps, SaaS and self-hosted options
• GitHub Actions: Integrated with GitHub, simple YAML syntax, large marketplace, free for public repos, good for open source
• Choice depends on existing infrastructure, team expertise, and specific requirements

29. What are pipeline artifacts and how do you manage them?

Answer: Pipeline artifacts are files generated during builds that need to be preserved for later stages or external use. Management best practices include:

• Store artifacts in dedicated repositories (Artifactory, Nexus, S3, ECR)
• Use semantic versioning for artifact identification
• Implement retention policies to manage storage costs
• Sign artifacts for security verification
• Generate and store build metadata (build number, commit SHA, timestamps)
• Pass artifacts between pipeline stages using built-in mechanisms

30. How do you optimize CI/CD pipeline performance?

Answer: Pipeline optimization strategies include:

• Parallelization: Run independent jobs concurrently
• Caching: Cache dependencies, Docker layers, and build outputs
• Incremental builds: Only rebuild changed components
• Test optimization: Run fast tests first, parallelize test suites
• Docker layer optimization: Order Dockerfile commands for better caching
• Resource allocation: Right-size agents based on workload
• Skip unnecessary stages: Use conditional execution based on changes

31. What is Docker and how does it work?

Answer: Docker is a containerization platform that packages applications with their dependencies into standardized units called containers. Docker uses Linux kernel features like namespaces (for isolation) and cgroups (for resource limits). Key components include: Docker Engine (runtime), Docker Images (read-only templates), Docker Containers (running instances), Docker Hub (image registry), and Docker Compose (multi-container orchestration). Containers share the host OS kernel, making them lightweight and fast compared to VMs.

32. What is the difference between Docker image and Docker container?

Answer:

• Docker Image: A read-only template containing application code, runtime, libraries, and dependencies. Images are built from Dockerfiles and can be stored in registries. They are immutable and versioned
• Docker Container: A running instance of an image. Containers are ephemeral by default, have a writable layer on top of the image, and can be started, stopped, moved, and deleted. Multiple containers can run from the same image

33. What is a Dockerfile and what are its main instructions?

Answer: A Dockerfile is a text file containing instructions to build a Docker image. Key instructions include:

• FROM: Specifies the base image
• RUN: Executes commands during image build
• COPY/ADD: Copies files from host to image
• WORKDIR: Sets the working directory
• ENV: Sets environment variables
• EXPOSE: Documents which ports the container listens on
• CMD/ENTRYPOINT: Specifies the command to run when container starts
• ARG: Defines build-time variables

34. What is the difference between CMD and ENTRYPOINT?

Answer:

• CMD: Provides default arguments for the container. Can be overridden when running the container with `docker run image command`
• ENTRYPOINT: Defines the executable that always runs. Arguments passed to `docker run` are appended to ENTRYPOINT
• Best Practice: Use ENTRYPOINT for the main command and CMD for default arguments. Example: `ENTRYPOINT ["python"]` with `CMD ["app.py"]`

35. What are Docker volumes and why are they important?

Answer: Docker volumes are the preferred mechanism for persisting data generated and used by Docker containers. Volumes are managed by Docker and stored outside the container's writable layer. Benefits include: data persistence beyond container lifecycle, sharing data between containers, better performance than bind mounts, easier backup and migration, and works on both Linux and Windows. Types include named volumes, anonymous volumes, and bind mounts.

36. What is Docker Compose?

Answer: Docker Compose is a tool for defining and running multi-container Docker applications. Using a YAML file (docker-compose.yml), you configure application services, networks, and volumes. With a single command (`docker-compose up`), you create and start all services. It's ideal for development environments, testing, and small-scale deployments. Key features include service definitions, environment variables, health checks, resource limits, and networking between containers.

37. What are Docker networking modes?

Answer: Docker provides several networking modes:

• Bridge (default): Creates a private network on the host, containers can communicate via this network
• Host: Removes network isolation, container uses host's network directly
• None: Disables networking for the container
• Overlay: Enables communication between containers across multiple Docker hosts (used in Swarm)
• Macvlan: Assigns MAC address to container, making it appear as physical device

38. How do you optimize Docker image size?

Answer: Image optimization techniques include:

• Multi-stage builds: Use separate stages for building and running
• Smaller base images: Use Alpine or distroless images instead of full OS
• Minimize layers: Combine RUN commands with && and cleanup in same layer
• .dockerignore: Exclude unnecessary files from build context
• Remove build dependencies: Don't include compilers, build tools in final image
• Use specific tags: Avoid :latest, use version-specific base images

39. What is a multi-stage Docker build?

Answer: Multi-stage builds use multiple FROM statements in a Dockerfile, each starting a new build stage. You can copy artifacts from one stage to another, leaving behind build dependencies in intermediate stages. This creates smaller, more secure final images. Example: First stage uses a full SDK image to compile code, second stage uses a minimal runtime image and copies only the compiled binary. This is especially useful for compiled languages like Go, Java, and .NET.

40. What is Docker layer caching and how do you leverage it?

Answer: Docker builds images in layers, caching each layer. If a layer hasn't changed, Docker uses the cached version. To leverage caching:

• Order Dockerfile instructions from least to most frequently changing
• Copy package files (package.json, requirements.txt) before copying source code
• Install dependencies before copying application code
• Use .dockerignore to exclude files that invalidate cache
• Consider BuildKit for advanced caching with --mount=type=cache

41. How do you secure Docker containers?

Answer: Docker security best practices include:

• Run as non-root: Use USER instruction to run as unprivileged user
• Use official images: Start from trusted, verified base images
• Scan images: Use tools like Trivy, Snyk, or Clair for vulnerability scanning
• Limit capabilities: Drop unnecessary Linux capabilities
• Read-only filesystem: Mount containers with --read-only when possible
• Resource limits: Set memory and CPU limits
• Sign images: Use Docker Content Trust for image verification

42. What is the difference between COPY and ADD in Dockerfile?

Answer:

• COPY: Simple file/directory copying from host to image. Preferred for most use cases as it's more transparent
• ADD: Has additional features: can extract tar archives automatically and can download files from URLs
• Best Practice: Use COPY unless you specifically need ADD's features. ADD's URL download is discouraged; use RUN with curl/wget instead for better caching and visibility

43. What is Docker Swarm?

Answer: Docker Swarm is Docker's native container orchestration tool. It turns a group of Docker hosts into a single virtual host, providing: cluster management integrated with Docker Engine, declarative service model, scaling, desired state reconciliation, multi-host networking, service discovery, load balancing, rolling updates, and secure communication between nodes. While simpler than Kubernetes, it's less feature-rich and has lower market adoption. It's suitable for simpler orchestration needs.

44. How do you debug a Docker container?

Answer: Docker debugging techniques include:

• docker logs: View container stdout/stderr logs
• docker exec -it: Execute commands inside running container
• docker inspect: View detailed container configuration and state
• docker stats: Monitor resource usage in real-time
• docker events: Stream real-time events from Docker daemon
• Override ENTRYPOINT: Start container with shell for investigation
• docker cp: Copy files between container and host for analysis

45. What is Docker BuildKit and what are its benefits?

Answer: BuildKit is Docker's next-generation build system with significant improvements:

• Parallel builds: Builds independent stages concurrently
• Better caching: More granular cache management, cache imports/exports
• Build secrets: Secure handling of secrets during build
• SSH forwarding: Access private repositories during build
• Output formats: Build directly to OCI image, tarball, or registry
• Better error messages: More informative build output
• Enable with `DOCKER_BUILDKIT=1` or configure in daemon.json

46. What is Kubernetes and why is it used?

Answer: Kubernetes (K8s) is an open-source container orchestration platform that automates deploying, scaling, and managing containerized applications. It's used because it provides: automatic bin packing (efficient resource usage), self-healing (restarts failed containers), horizontal scaling, service discovery and load balancing, automated rollouts and rollbacks, secret and configuration management, storage orchestration, and batch execution. Originally developed by Google, it's now maintained by CNCF.

47. Explain the Kubernetes architecture.

Answer: Kubernetes has a master-worker architecture:

• Control Plane (Master): API Server (entry point), etcd (distributed key-value store), Scheduler (assigns pods to nodes), Controller Manager (maintains desired state)
• Worker Nodes: Kubelet (agent ensuring containers run), Kube-proxy (network rules), Container Runtime (Docker/containerd)
• Add-ons: DNS, Dashboard, Ingress Controller, Monitoring (Prometheus)

48. What is a Pod in Kubernetes?

Answer: A Pod is the smallest deployable unit in Kubernetes, representing a single instance of a running process. A Pod encapsulates one or more containers that share: the same network namespace (IP address and port space), storage volumes, and lifecycle. Containers in a pod communicate via localhost. Pods are ephemeral and disposable; they're not meant to be repaired but replaced. Most workloads run single-container pods, but multi-container pods are used for sidecar patterns.

49. What is the difference between Deployment, StatefulSet, and DaemonSet?

Answer:

• Deployment: For stateless applications. Manages ReplicaSets, supports rolling updates, rollbacks, and scaling. Pods are interchangeable
• StatefulSet: For stateful applications. Provides stable, unique network identifiers, stable persistent storage, and ordered, graceful deployment/scaling. Used for databases, Kafka, etc.
• DaemonSet: Ensures a copy of a pod runs on all (or selected) nodes. Used for log collectors, monitoring agents, network plugins

50. What is a Kubernetes Service and what types are there?

Answer: A Service is an abstraction that defines a logical set of Pods and a policy to access them, providing stable networking. Types include:

• ClusterIP (default): Internal-only IP, accessible within cluster
• NodePort: Exposes service on each node's IP at a static port (30000-32767)
• LoadBalancer: Exposes service externally using cloud provider's load balancer
• ExternalName: Maps service to external DNS name
• Headless: No cluster IP, returns pod IPs directly (for StatefulSets)

51. What is an Ingress in Kubernetes?

Answer: Ingress is an API object that manages external access to services in a cluster, typically HTTP/HTTPS. It provides: load balancing, SSL/TLS termination, name-based virtual hosting, and path-based routing. An Ingress Controller (like nginx-ingress, Traefik, or HAProxy) implements the Ingress rules. Ingress consolidates routing rules into a single resource, reducing the need for multiple LoadBalancer services and providing more control over external traffic.

52. What are ConfigMaps and Secrets?

Answer:

• ConfigMaps: Store non-confidential configuration data as key-value pairs. Can be consumed as environment variables, command-line arguments, or configuration files in a volume
• Secrets: Store sensitive data (passwords, tokens, keys) in base64-encoded format. Similar to ConfigMaps but designed for confidential data. Should be combined with encryption at rest and RBAC
• Both decouple configuration from container images, enabling the same image in different environments

53. What are namespaces in Kubernetes?

Answer: Namespaces provide a mechanism for isolating groups of resources within a single cluster. They're useful for: dividing cluster resources among multiple teams/projects, implementing resource quotas and limit ranges, separating environments (dev, staging, prod) within a cluster, and applying network policies. Default namespaces include: default, kube-system (system components), kube-public (public resources), and kube-node-lease. Most resources are namespace-scoped; some (like nodes, persistent volumes) are cluster-scoped.

54. What are Persistent Volumes (PV) and Persistent Volume Claims (PVC)?

Answer:

• Persistent Volume (PV): A piece of storage provisioned by an administrator or dynamically using StorageClasses. It's a cluster resource independent of pods
• Persistent Volume Claim (PVC): A request for storage by a user. It specifies size, access modes, and optionally StorageClass. PVCs bind to available PVs
• Access Modes: ReadWriteOnce (single node), ReadOnlyMany (multiple nodes read-only), ReadWriteMany (multiple nodes read-write)

55. What is Helm and why is it used?

Answer: Helm is the package manager for Kubernetes, helping you define, install, and upgrade applications. Key concepts:

• Charts: Packages of pre-configured Kubernetes resources
• Values: Customization parameters for charts
• Releases: Running instances of charts in a cluster
• Benefits: reusability, versioning, dependency management, templating, easy rollbacks, and a large ecosystem of community charts

56. What are liveness and readiness probes?

Answer:

• Liveness Probe: Checks if a container is running. If it fails, kubelet kills the container and applies restart policy. Used to detect and recover from deadlocks
• Readiness Probe: Checks if a container is ready to serve traffic. If it fails, the pod is removed from service endpoints until it passes. Used during startup or heavy load
• Startup Probe: Checks if the application has started. Disables liveness/readiness checks until it succeeds. Used for slow-starting containers
• Probe types: HTTP GET, TCP socket, or exec command

57. How does Kubernetes handle rolling updates?

Answer: Rolling updates in Kubernetes Deployments gradually replace old pods with new ones:

• maxSurge: Maximum pods above desired count during update (e.g., 25%)
• maxUnavailable: Maximum pods that can be unavailable during update (e.g., 25%)
• New ReplicaSet is created, scaled up while old is scaled down
• Health checks ensure new pods are ready before continuing
• Rollback with `kubectl rollout undo` if issues detected
• History maintained in ReplicaSets for version tracking

58. What is a Kubernetes Operator?

Answer: A Kubernetes Operator is a method of packaging, deploying, and managing a Kubernetes application using custom resources and custom controllers. Operators encode operational knowledge (deployment, scaling, backup, recovery) into software. They use Custom Resource Definitions (CRDs) to extend the Kubernetes API. Examples include: Prometheus Operator, MongoDB Operator, and PostgreSQL Operator. Operators automate complex stateful application management that would otherwise require manual intervention.

59. What is Horizontal Pod Autoscaler (HPA)?

Answer: HPA automatically scales the number of pod replicas based on observed metrics like CPU utilization, memory usage, or custom metrics. It works by: monitoring metrics (via Metrics Server or custom metrics adapter), comparing against target threshold, and adjusting replica count. Configuration includes minimum and maximum replicas, target utilization percentage, and scale-up/down policies. HPA queries metrics every 15 seconds by default and ensures smooth scaling without oscillation.

60. What are Network Policies in Kubernetes?

Answer: Network Policies specify how pods can communicate with each other and other network endpoints. They use label selectors to select pods and define rules for ingress (incoming) and egress (outgoing) traffic. Key concepts:

• By default, pods accept traffic from any source
• Network policies are additive; if any policy selects a pod, only allowed traffic is permitted
• Requires a network plugin that supports NetworkPolicy (Calico, Cilium, Weave)
• Essential for implementing zero-trust security within clusters

61. What is AWS CodePipeline?

Answer: AWS CodePipeline is a fully managed continuous delivery service that automates build, test, and deploy phases. It integrates with CodeCommit, CodeBuild, CodeDeploy, and third-party tools. Key features: visual workflow designer, parallel and sequential execution, manual approvals, stage transitions, CloudWatch integration for monitoring, and integration with S3, ECR, ECS, Lambda, and Elastic Beanstalk as deployment targets.

62. Explain the difference between CodeBuild, CodeDeploy, and CodeCommit.

Answer:

• CodeCommit: Managed Git repository service. Stores source code, similar to GitHub/GitLab
• CodeBuild: Fully managed build service. Compiles code, runs tests, produces artifacts. Uses buildspec.yml for configuration
• CodeDeploy: Deployment service that automates deployments to EC2, Lambda, ECS, or on-premises. Supports rolling, blue-green, and canary deployments. Uses appspec.yml

63. What is AWS ECS and how does it compare to EKS?

Answer:

• ECS (Elastic Container Service): AWS's proprietary container orchestration. Simpler, tightly integrated with AWS services, lower learning curve, uses Task Definitions
• EKS (Elastic Kubernetes Service): Managed Kubernetes service. Industry-standard, portable across clouds, larger ecosystem, steeper learning curve
• Fargate: Serverless compute for both ECS and EKS, no server management needed
• Choose ECS for AWS-centric workloads; EKS for Kubernetes expertise or multi-cloud portability

64. What is AWS CloudFormation?

Answer: CloudFormation is AWS's Infrastructure as Code service that lets you model and provision AWS resources using templates (JSON or YAML). Key features: declarative syntax, drift detection, change sets for preview, stack dependencies, cross-stack references, and rollback on failure. Templates define resources, parameters, mappings, conditions, and outputs. CloudFormation maintains state and handles resource creation order. Alternative: AWS CDK provides programming language support.

65. What is AWS Lambda and how is it used in DevOps?

Answer: AWS Lambda is a serverless compute service that runs code in response to events without managing servers. In DevOps, Lambda is used for:

• CI/CD automation (custom CodePipeline actions)
• Infrastructure automation (respond to CloudWatch events)
• ChatOps (Slack bot integrations)
• Log processing and analysis
• Security automation (respond to GuardDuty findings)
• Custom resource providers for CloudFormation

66. What is Amazon ECR?

Answer: Amazon Elastic Container Registry (ECR) is a fully managed Docker container registry. Features include: private repositories with IAM-based access, image scanning for vulnerabilities, image lifecycle policies for cleanup, cross-region and cross-account replication, encryption at rest, and integration with ECS, EKS, and CodeBuild. It supports Docker CLI commands and OCI-compliant images. ECR Public provides free public image hosting.

67. What is AWS Systems Manager?

Answer: AWS Systems Manager provides visibility and control of AWS infrastructure. Key capabilities:

• Run Command: Execute commands remotely on EC2 instances
• Parameter Store: Secure storage for configuration and secrets
• Session Manager: Secure shell access without SSH keys or bastion hosts
• Patch Manager: Automate OS patching
• State Manager: Maintain desired configuration state
• Automation: Create runbooks for common tasks

68. What is Amazon CloudWatch and how is it used for monitoring?

Answer: CloudWatch is AWS's monitoring and observability service. It provides:

• Metrics: Collect and track metrics from AWS resources and applications
• Logs: Centralized log collection, storage, and analysis
• Alarms: Alert based on metric thresholds or anomaly detection
• Dashboards: Visualize metrics and logs
• Events/EventBridge: React to system changes
• Container Insights: Monitor containerized applications
• Synthetics: Monitor endpoints with canary scripts

69. What is AWS IAM and best practices for DevOps?

Answer: IAM (Identity and Access Management) controls access to AWS resources. DevOps best practices include:

• Implement least privilege principle
• Use IAM roles for applications/services (not access keys)
• Enable MFA for all users, especially with console access
• Use instance profiles for EC2 applications
• Implement service control policies (SCPs) for guardrails
• Regular access key rotation and unused credential removal
• Use IAM policies versioning and audit with Access Analyzer

70. What is AWS Elastic Beanstalk?

Answer: Elastic Beanstalk is a PaaS that handles deployment, capacity provisioning, load balancing, auto-scaling, and monitoring. You simply upload your code, and Beanstalk handles the infrastructure. It supports multiple platforms (Java, .NET, PHP, Node.js, Python, Ruby, Go, Docker). It provides full control over underlying resources while abstracting infrastructure management. Useful for simpler applications or teams wanting to focus on code rather than infrastructure.

71. What is Terraform and how does it work?

Answer: Terraform is an open-source Infrastructure as Code tool by HashiCorp that lets you define and provision infrastructure using declarative configuration files (HCL - HashiCorp Configuration Language). Terraform works by: reading configuration files, building a dependency graph, comparing desired state with current state (stored in state file), and making API calls to providers (AWS, Azure, GCP, etc.) to reach desired state. Key commands: `terraform init`, `plan`, `apply`, and `destroy`.

72. What is Terraform state and why is it important?

Answer: Terraform state is a JSON file that maps configuration to real-world resources. It's important because it: tracks resource metadata and attributes, enables dependency management, allows Terraform to determine what needs to change, supports team collaboration (remote state), and maintains resource identity across applies. State should be stored remotely (S3, Terraform Cloud, Azure Blob) with locking to prevent concurrent modifications and corruption.

73. What are Terraform providers?

Answer: Providers are plugins that enable Terraform to interact with cloud platforms, SaaS providers, and other APIs. Each provider offers resources (managed objects) and data sources (read-only information). Providers are declared in configuration and downloaded during `terraform init`. Examples include: aws, azurerm, google, kubernetes, and helm. Provider versioning is critical for reproducibility. The Terraform Registry hosts thousands of community and official providers.

74. What is the difference between Terraform and Ansible?

Answer:

• Terraform: Declarative, focuses on infrastructure provisioning (servers, networks, databases), maintains state, immutable infrastructure approach, cloud-agnostic
• Ansible: Procedural (with declarative elements), focuses on configuration management and application deployment, agentless, uses SSH, mutable infrastructure approach
• Use Together: Terraform provisions infrastructure, Ansible configures it. Both have some overlap but complement each other well

75. What are Terraform modules?

Answer: Modules are reusable, self-contained packages of Terraform configuration. They encapsulate groups of resources with input variables and outputs. Benefits include: code reusability, consistency across projects, abstraction of complexity, versioning, and easier maintenance. Modules can be local directories, Git repositories, or from the Terraform Registry. Root module is the main working directory. Best practice: use modules for repeatable infrastructure patterns.

76. What is terraform plan and terraform apply?

Answer:

• terraform plan: Creates an execution plan showing what changes will be made without actually making them. It refreshes state, compares with configuration, and shows additions, modifications, and deletions. Essential for reviewing changes before applying
• terraform apply: Executes the planned changes to reach the desired state. It can auto-approve or prompt for confirmation. Can use a saved plan file from `terraform plan -out=planfile`

77. How do you manage Terraform state in a team environment?

Answer: Team state management best practices:

• Remote Backend: Store state in S3 + DynamoDB (locking), Azure Blob, GCS, or Terraform Cloud
• State Locking: Prevent concurrent modifications using DynamoDB or backend's native locking
• Workspaces: Separate state files for different environments (dev, staging, prod)
• Access Control: IAM policies restricting who can read/write state
• Encryption: Enable encryption at rest for state files
• Never commit state: Add terraform.tfstate* to .gitignore

78. What are Terraform workspaces?

Answer: Workspaces allow you to manage multiple distinct state files for the same configuration. Use cases include managing multiple environments (dev, staging, prod) with the same code. Each workspace has its own state file. The default workspace is named "default". Access current workspace with `terraform.workspace`. Note: For significantly different environments, separate directories or modules may be preferable over workspaces.

79. What is terraform import?

Answer: `terraform import` brings existing infrastructure under Terraform management by adding resources to state. Process: write the resource block in configuration, run `terraform import resource_type.name id`, then verify with `terraform plan`. Limitations: only imports state, doesn't generate configuration (though Terraform 1.5+ has experimental config generation). Use cases: migrating manually created resources, disaster recovery, adopting Terraform incrementally.

80. What are Terraform best practices?

Answer: Key Terraform best practices:

• Use version control for all configurations
• Pin provider and module versions
• Use remote state with locking
• Modularize reusable components
• Use consistent naming conventions
• Implement CI/CD for Terraform (plan in PR, apply on merge)
• Use variables and locals appropriately
• Document with descriptions for variables and outputs
• Run `terraform fmt` and `terraform validate` in CI
• Use policy-as-code (Sentinel, OPA) for guardrails

81. What is a Jenkinsfile?

Answer: A Jenkinsfile is a text file containing the definition of a Jenkins Pipeline, stored in source control. It enables Pipeline as Code, allowing the pipeline definition to be version-controlled, reviewed, and audited alongside application code. Jenkinsfiles support both declarative syntax (structured, recommended) and scripted syntax (Groovy-based, more flexible). The file typically defines stages like Build, Test, Deploy with their respective steps.

82. What is Jenkins shared library?

Answer: A shared library is a repository containing reusable Groovy code that can be used across multiple Jenkins pipelines. It helps with: code reuse across projects, standardization of pipeline logic, separation of pipeline logic from application code, and maintaining DRY principles. Libraries are stored in Git with a specific directory structure (vars/, src/, resources/). They can be loaded globally or per-pipeline using @Library annotation.

83. How do you secure Jenkins?

Answer: Jenkins security best practices:

• Enable authentication (LDAP, Active Directory, OAuth)
• Configure authorization (Matrix-based, Role-based access)
• Enable CSRF protection
• Use HTTPS for Jenkins UI and API
• Secure agent-to-master communication
• Use credentials plugin for secrets management
• Regularly update Jenkins and plugins
• Audit logs and use Security Advisor plugin
• Restrict script approval and Groovy sandbox

84. What is Jenkins Blue Ocean?

Answer: Blue Ocean is a modern UI for Jenkins that provides: a visual pipeline editor, improved pipeline visualization with real-time status, native support for branch and pull request pipelines, better error handling and log display, and personalized dashboard. It's designed to simplify pipeline creation and improve user experience. While still available, development has slowed and many features are now in classic Jenkins.

85. How do you backup and restore Jenkins?

Answer: Jenkins backup strategies include:

• JENKINS_HOME: Back up the entire JENKINS_HOME directory containing all configuration
• Thin Backup Plugin: Scheduled backups with retention policies
• Configuration as Code (JCasC): Store Jenkins configuration in YAML files in Git
• Job DSL: Define jobs as code for reproducibility
• Docker/Kubernetes: Use persistent volumes and treat Jenkins as cattle
• Critical items: config.xml, jobs/, plugins/, secrets/, users/

86. What is Jenkins Configuration as Code (JCasC)?

Answer: JCasC is a plugin that allows Jenkins configuration to be defined in YAML files. Benefits include: version-controlled configuration, reproducible Jenkins setups, easier disaster recovery, automated Jenkins provisioning, and GitOps-compatible management. It can configure: system settings, security realms, credentials, tools, cloud agents, and plugins. Configuration is loaded at startup or can be reloaded without restart.

87. How do you scale Jenkins?

Answer: Jenkins scaling strategies:

• Distributed Builds: Add more agents (static or dynamic)
• Cloud Agents: AWS, Azure, Kubernetes plugins for on-demand agents
• Kubernetes: Run Jenkins on K8s with dynamic pod agents
• Master Optimization: Offload builds to agents, increase heap size
• High Availability: Active-passive setup with shared storage
• Pipeline Optimization: Parallel stages, caching, artifact management

88. What are Jenkins environment variables?

Answer: Jenkins provides built-in environment variables accessible in pipelines:

• BUILD_NUMBER: Current build number
• BUILD_ID: Build identifier (same as BUILD_NUMBER for pipelines)
• JOB_NAME: Name of the job
• WORKSPACE: Absolute path to the workspace
• GIT_COMMIT: Git commit hash (with Git plugin)
• BRANCH_NAME: Branch being built (in multibranch)
• Custom variables can be set using `environment` block in declarative pipelines

89. What is Prometheus and how does it work?

Answer: Prometheus is an open-source monitoring and alerting toolkit. Key features: pull-based metrics collection (scrapes targets via HTTP), time-series database, powerful query language (PromQL), service discovery, alerting via Alertmanager, and integration with Grafana for visualization. It works by scraping metrics endpoints (usually /metrics) at configured intervals. Targets are discovered via static config or service discovery (Kubernetes, Consul, DNS).

90. What is Grafana?

Answer: Grafana is an open-source analytics and visualization platform. It supports multiple data sources (Prometheus, CloudWatch, Elasticsearch, InfluxDB, etc.). Features include: customizable dashboards, alerting, annotations, templating variables, plugins ecosystem, and user management. Grafana is commonly paired with Prometheus for metrics visualization but also works with logs (Loki) and traces (Tempo, Jaeger) for full observability.

91. What is the ELK/EFK Stack?

Answer:

• Elasticsearch: Distributed search and analytics engine that stores and indexes logs
• Logstash/Fluentd: Data processing pipeline that collects, transforms, and sends logs (ELK uses Logstash, EFK uses Fluentd)
• Kibana: Visualization layer for exploring and dashboarding log data
• Together they provide centralized logging: collection, storage, search, and visualization. Fluentd is lighter and more Kubernetes-native than Logstash

92. What are the four golden signals of monitoring?

Answer: From Google's SRE book, the four golden signals are:

• Latency: Time to service a request. Distinguish between successful and failed requests
• Traffic: Demand on the system (requests per second, transactions per second)
• Errors: Rate of failed requests (explicit failures, implicit failures, policy violations)
• Saturation: How "full" the service is (CPU, memory, I/O utilization)
• These provide a baseline for any service's health and should be prioritized in alerting

93. What is distributed tracing?

Answer: Distributed tracing tracks requests as they flow through microservices, providing end-to-end visibility. A trace represents a request's journey, composed of spans (individual operations). Key concepts: trace ID (unique request identifier), span ID, parent span, and baggage (context propagation). Tools include Jaeger, Zipkin, AWS X-Ray, and Datadog APM. It helps identify: latency bottlenecks, failed dependencies, and service interactions.

94. What is alerting best practice in DevOps?

Answer: Alerting best practices include:

• Alert on symptoms, not causes: Focus on user-visible impact
• Reduce noise: Only alert on actionable issues
• Use severity levels: Critical (immediate action), warning (attention needed), info (awareness)
• Include context: Runbook links, relevant dashboards, recent changes
• Implement escalation: Define escalation paths and on-call rotations
• Review regularly: Eliminate alerts that don't lead to action
• Test alerts: Ensure alerts fire when expected

95. What is Application Performance Monitoring (APM)?

Answer: APM tools monitor application performance at the code level, providing: transaction tracing, error tracking, performance metrics, dependency mapping, and user experience monitoring. Key metrics include response time, throughput, error rates, and resource utilization. Popular APM tools: Datadog, New Relic, Dynatrace, AppDynamics, and Elastic APM. APM helps identify slow database queries, memory leaks, N+1 queries, and third-party service issues.

96. What is DevSecOps?

Answer: DevSecOps integrates security practices into every phase of the DevOps lifecycle, shifting security "left" to earlier stages. Key principles: security as code, automated security testing, shared responsibility for security, continuous security monitoring, and threat modeling in design. It includes: secure coding practices, static/dynamic analysis, dependency scanning, infrastructure security, compliance automation, and security in monitoring. The goal is to build security into the pipeline rather than bolting it on later.

97. What is SAST and DAST?

Answer:

• SAST (Static Application Security Testing): Analyzes source code without executing it. Finds vulnerabilities like SQL injection, XSS, buffer overflows. Runs early in pipeline. Tools: SonarQube, Checkmarx, Fortify
• DAST (Dynamic Application Security Testing): Tests running applications by simulating attacks. Finds runtime vulnerabilities, misconfigurations. Runs against deployed application. Tools: OWASP ZAP, Burp Suite
• Both should be integrated into CI/CD for comprehensive security coverage

98. What is container image scanning?

Answer: Container image scanning analyzes Docker images for security vulnerabilities before deployment. It checks: OS packages for CVEs, application dependencies, misconfigurations, secrets or sensitive data, and compliance with policies. Tools include: Trivy, Snyk Container, Clair, Anchore, and AWS ECR scanning. Best practice: scan images in CI/CD pipeline, block deployment of images with critical vulnerabilities, and continuously scan running containers.

99. What is HashiCorp Vault?

Answer: HashiCorp Vault is a secrets management tool that provides secure storage and access to sensitive data. Features include:

• Secret Storage: Encrypted key-value store for secrets
• Dynamic Secrets: Generate credentials on-demand (databases, AWS, etc.)
• Data Encryption: Encrypt data without storing it (encryption as a service)
• Leasing & Renewal: Time-bound secrets with automatic revocation
• Revocation: Revoke single secrets or entire secret trees
• Integrates with CI/CD pipelines, Kubernetes, and cloud platforms

100. What security practices should be automated in a CI/CD pipeline?

Answer: Key automated security practices:

• Pre-commit: Secrets scanning (git-secrets, detect-secrets)
• Build Stage: SAST, dependency scanning (npm audit, Snyk), license compliance
• Test Stage: DAST, infrastructure scanning, API security testing
• Container Stage: Image scanning, Dockerfile linting, base image verification
• Deployment: IaC security scanning (tfsec, checkov), compliance validation
• Runtime: RASP, container runtime security, security monitoring
• Gate deployments on security scan results; fail builds with critical vulnerabilities

2. Prepare for Scenario-Based Questions

DevOps interviews often include real-world scenarios:

• "How would you design a CI/CD pipeline for a microservices application?"
• "A production deployment failed. Walk me through your troubleshooting process."
• "How would you handle secrets in a Kubernetes environment?"
• "Design a monitoring and alerting strategy for a new application."
• Practice explaining your thought process and trade-offs

3. Know Your Tools Deeply

Be prepared to discuss tools in depth:

• Understand architecture and internal workings (not just commands)
• Know when to use each tool and their trade-offs
• Be familiar with best practices and anti-patterns
• Stay current with new features and industry trends
• Prepare examples from your real-world experience

4. Scripting and Automation Skills

Demonstrate automation proficiency:

• Be comfortable with Bash scripting for automation tasks
• Know Python for more complex automation and tooling
• Understand YAML/JSON for configuration files
• Practice writing pipeline scripts (Jenkinsfile, .gitlab-ci.yml)
• Be ready for live coding or whiteboard exercises

How do I prepare for a DevOps interview in 30 days?

Week 1: Review fundamental concepts (CI/CD, IaC, containers). Week 2: Deep dive into Docker and Kubernetes. Week 3: Practice with Terraform, Jenkins, and cloud services. Week 4: Mock interviews, hands-on projects, and revision. Spend 2-3 hours daily on practice and study.

What skills are most important for DevOps interviews in 2026?

Kubernetes orchestration, cloud platforms (especially AWS), Terraform for IaC, CI/CD pipeline design, monitoring and observability, security automation (DevSecOps), and scripting skills (Bash, Python). Soft skills like communication and problem-solving are equally important.

Is DevOps a good career in India in 2026?

Absolutely. DevOps continues to grow with over 50,000+ job openings in India. Average salaries range from ₹5-50 LPA depending on experience. Companies across all sectors are adopting DevOps practices, creating strong demand. Hyderabad, Bangalore, and Pune are major hiring markets.

What's the difference between DevOps and SRE interviews?

DevOps interviews focus on CI/CD, automation, and tooling. SRE interviews emphasize reliability, SLOs/SLIs/SLAs, incident management, and capacity planning. SRE roles often require stronger coding skills and system design knowledge. Many skills overlap, but SRE has a stronger operations and reliability focus.

Which DevOps certification should I get first?

Start with AWS Certified Cloud Practitioner for cloud fundamentals, then AWS Solutions Architect Associate. For containers, get Docker Certified Associate before CKA. For IaC, HashiCorp Terraform Associate is valuable. Finally, target AWS DevOps Professional for comprehensive validation.