Advanced DevOps Interview Questions
194 questions
How would you design a synthetic load test to reproduce and measure Lambda's bursty cold-start pattern before it shows up in production?
AdvancedAWSLambda7 min
How would you tune a hedge-request delay so it targets genuine cold-start tail latency without firing on every normal request?
AdvancedAWSLambda7 min
How would you audit all S3 buckets in an account for their current Block Public Access and policy configuration, at scale?
AdvancedAWSS37 min
How would you decide whether an S3 public-write exposure is a supply-chain security incident requiring broader notification, versus a contained issue?
AdvancedAWSS37 min
How would you determine, after an S3 public-write exposure, exactly which objects were added, modified, or deleted if versioning wasn't enabled?
AdvancedAWSS37 min
A security scanner just flagged one of your production S3 buckets as publicly readable. Walk through how you'd respond in the first hour and prevent a repeat.
AdvancedAWSS3Security10 min
How would you design alerting so a public S3 exposure is caught within minutes, rather than being discovered by an external scanner or a customer report?
AdvancedAWSS38 min
How would your incident response differ if an exposed S3 bucket allowed public write access, not just public read?
AdvancedAWSS38 min
How does the Kubernetes cluster autoscaler decide which node pool to scale when multiple pools could satisfy a pending pod?
AdvancedAzureKubernetesAKS7 min
Your AKS cluster is under CPU pressure and pods are stuck Pending, but the cluster autoscaler isn't adding nodes. How would you troubleshoot it?
AdvancedAzureKubernetesAKS10 min
How would Karpenter-style node provisioning change the troubleshooting process compared to the traditional Kubernetes cluster autoscaler?
AdvancedKubernetes7 min
A team converted their AKS cluster to a private cluster for security reasons. The next day, several engineers and a CI/CD pipeline can no longer run kubectl commands at all. How do you diagnose this?
AdvancedAzureKubernetesAKS7 min
How would you let a pod in AKS call a Key Vault or Storage API using its own Azure identity, without mounting any credential file or secret into the pod at all?
AdvancedAzureKubernetesAKS7 min
An App Service using Managed Identity to call a storage account worked fine for months. After a Private Endpoint was added to that storage account, the App Service started failing to reach it. Why?
AdvancedAzureApp ServiceBlob Storage7 min
A Consumption-plan Azure Function triggered by new Blob Storage uploads is intermittently missing events during bursty upload periods — why, and how do you fix it?
AdvancedAzureAzure FunctionsBlob Storage7 min
How would you design a zero-downtime, safely-rollback-able release process for an App Service using deployment slots?
AdvancedAzureApp Service8 min
A CI/CD pipeline that's authenticated successfully for months suddenly starts failing with an authentication error, right after the security team enabled a new Conditional Access policy. What's happening?
AdvancedAzure7 min
A Function App using Managed Identity to read a Key Vault secret works most of the time, but intermittently fails on startup with an authorization error. How do you actually diagnose this?
AdvancedAzureKey Vault7 min
How would you keep a fleet of self-hosted Azure Pipelines agents consistent over time as tool requirements evolve, instead of them slowly drifting apart?
AdvancedAzure Pipelines7 min
A single Azure service connection with subscription-wide Contributor access is used by every pipeline, including ones that only read a storage account. What's wrong here?
AdvancedAzure Pipelines7 min
A lifecycle policy quietly moved a set of blobs to Archive tier months ago, and now someone urgently needs one back within the hour. What are your actual options?
AdvancedAzureBlob Storage7 min
A storage account's firewall was locked down to specific VNets for security, and now diagnostic logging and a few other first-party Azure integrations silently stopped working. What's actually happening?
AdvancedAzureBlob Storage6 min
A compliance requirement says certain records must be provably unmodifiable for seven years. How would you design this with Blob Storage's immutability features, and what breaks if you choose the wrong policy type?
AdvancedAzureBlob Storage7 min
A script has 'set -e' at the top, but a failing command inside a function doesn't stop the script the way you'd expect. Why not, and how do you fix it?
AdvancedBash7 min