Goldman Sachs DevOps Engineer interview questions

Interviewers use this to sort memorised trivia from people who have chased a slow lookup. Three roles, one bit, and the caching rules most candidates repeat incorrectly.

The answer is yes, and then the real question starts. Asymmetric routing and silent drops punish anyone who treats the routing tables as one flat list.

SIGKILL writes no stack trace and the application cannot defend itself. The verdict is already sitting in the kernel ring buffer, and reading it precisely is the skill being priced.

One CPU doing all the packet work is a topology failure, not a tuning mystery. RSS queues, MSI-X vectors, local_cpulist and irqbalance: the whole chain from symptom to pin.

Patching is easy; surviving the rollout is the interview. Staged rings with health gates, what livepatching can and cannot buy you, and the rollback plan you write before starting.

Copy-on-write freezes a point-in-time view while the database keeps writing. Fat snapshots overflow into invalid backups and thin pools exhaust into frozen volumes: size both deliberately.

VRRP heartbeats, market data feeds, mDNS noise and cluster chatter all ride multicast, and all of it assumes a switched LAN. Why clouds drop it and what replaces it.

The question that separates console users from people who have debugged a permissions failure across accounts. Evaluation order is deterministic and knowing it makes AccessDenied readable.

Volume choice is IO-shape matching: burst buckets, provisioned IOPS and throughput designs behave very differently under mixed OLTP-plus-batch load. Average latency graphs hide the failure entirely.

Direct encryption hits a 4 KB wall and a shared throughput quota. Envelope encryption routes around both, and the key policy underneath is central to authorizing key use.

Service control policies cap what anyone in a member account can do, no matter what their IAM admins wrote. The craft is choosing a handful of denials that age well.

Gateway endpoints avoid NAT processing for supported traffic. Interface endpoints have hourly and processing fees; cost savings depend on traffic, while access restrictions need explicit policies.

Instance metadata is a local credential vending machine and SSRF is the coin slot. IMDSv2 raises the bar at the host; layered defences and blast-radius limits finish the job.

Account-per-team is the right instinct, but hand-rolled account setup drifts within a month. Vending turns governance into a pipeline with an SLA instead of a ticket queue.

Allow-listing egress starts free with security groups and ends with TLS-breaking appliances. Each rung costs latency, money and political capital, and knowing where to stop is the actual test.

Everyone answers state locking. The follow-up is what happens when locking is not configured, and what you do with a stale lock at 2am, which is where the answer gets real.

Drift is a governance problem wearing a tooling costume. Detection is easy; the scored content is attribution (who changed it and why) and the policy decision that most teams avoid making.

The table is half the answer. The other half is who holds credentials, who repairs a stuck lock at night, and why the boring option usually wins until RBAC demands grow teeth.

sensitive = true stops the echo, not the storage. The complete answer walks the value through git, plan artifacts, state, and provider side effects, naming which mitigation closes which leak.

Scan plan JSON on every pull request, run new rules advisory for two weeks, and block only what is law. Waivers live in version control with an owner and an expiry date, or the gate becomes noise within a quarter.

Distinguish a gated Terraform run workflow from a cloud controller that reconciles continuously. Both can start from Git, but they expose different approval, drift and credential boundaries.

Default-deny egress breaks name resolution before it breaks anything else, and every connection times out confusingly. The practitioners are the ones who test with positive AND negative probes and know their CNI's fine print.

Namespaces partition resources, not trust. This question finds the people who know which sysctls are namespaced, which ones change every tenant at once, and when only a second kernel will do.

Quotas are admission-time contracts counted in requests, not measured usage. That single sentence explains most quota outages, most quota confusion, and the reason LimitRange must sit beside every quota.

Every control plane component depends on the API server, so who starts the API server? The bootstrap paradox sits at the heart of every cluster, and the kubelet plus a directory of files is the accepted way out.

Upgrades look like rolling restarts right up to the morning the CNI stops talking to the new kubelet. The scored answer is ordering, skew policy, and addon sequencing, not courage under pressure.

Two artifacts hide under 'Kubernetes backup' and they recover different things. The misses are what decides whether a restore works: volume bytes, encryption keys, and everything that never lived in etcd at all.

Best-effort objects, one-hour TTL, deduplicated by count, invisible unless shipped out. Events narrate scheduling and lifecycle decisions; treating them as durable records is the expensive mistake.

Volumes grow online and never shrink; StatefulSet template changes normally replace pods ordinal by ordinal; supported in-place pod resize is a separate path. The craft is expanding storage first, gating rolls with partition, and letting replication lag set the pace.

Jenkins is mostly plugins, they have a dependency graph nobody drew, and the controller is a single point of failure for every team. The answer is a rehearsal against a copy of production, not a maintenance window and hope.

Redeploying the old tag reverses code and nothing else. What separates staff-level answers is a per-change map of what rolls back in seconds, what rolls back in days, and what only moves forward.

A registry grows because every commit mints digests nobody pulls again. Reference-aware retention keeps rollback targets and audit chains while expiring the debris.

A freeze enforced by email is a suggestion. Tier services, put the window in deploy tooling, price exceptions honestly, and review service outcomes and the cost of delayed changes.

Pipeline credentials are the keys to production and git history is forever. Scoping per stage, runtime-minted short-lived identities, expiry-enforced rotation, and a revoke-first leak playbook.

A token naming the right repository does not prove that the approved deployment workflow ran. Bind the caller, deployment context and called workflow into the cloud trust contract.

The roles question is really a delegation test: can you split commanding the incident from fixing it? Name the roles, the comms cadence, and the handoff discipline that keeps 3am coherent.

Spending the budget is arithmetic; enforcing consequences is politics plus automation. The answer that lands names trigger thresholds, the deploy gate that blocks releases, and the dated escape valve.

Facilitation is mechanics: timeline before theories, blame converted into system questions, actions with owners tracked to closure. Include the defensive engineer and the exec who wants a head.

MTTR is three clocks hiding in one number. Profile detection, diagnosis and fix separately from incident timestamps; attack whichever clock dominates, which is almost never rollback speed.

Severity inflation and silent underdeclaration are both incentive problems, not wording problems. Anchor levels to impact and obligations, pre-write example scenarios, and make declaring severe safe.

Repeated action items are a measurable defect with a mechanical cause. Answering 'culture' without a mechanism describes the symptom back rather than fixing it.

A hang suggests missing progress; a refusal suggests an explicit error. Packet evidence distinguishes firewall behavior from routing failures and closed listeners. Then rule counters, not eyeballs, finger the guilty line.

NFS waits can stall shutdown and inflate load average while CPUs stay idle. Check the blocked kernel path before deciding whether signals or mount recovery can release it.

The box looks CPU-starved but the CPUs are starving themselves. Reading the reclaim loop correctly separates people who have sat on the console from people who have read about it.

Mixed resolution after a transfer is not propagation voodoo. Compare the parent delegation, authoritative answers and validation results. NXDOMAIN and SERVFAIL are clues; neither names a unique cause.

The heap is the part you configured and the smaller part of what the process uses. The kernel counts everything the cgroup touches, including the page cache the JVM never asked for.

Easy to define and easy to fail. The scoring half is where each gate sits, what it does to build time, and the honest admission of what the whole set misses.

Workload authentication, traffic encryption and authorization need separate verification. Admission and RBAC constrain who can deploy a workload that bypasses those controls.

An incident response question wearing a Git costume. The wrong instinct is to rewrite history first, and it costs you the hour that matters.

The single highest-value security change available to most pipelines, and the reason it works is worth understanding rather than configuring. It removes the secret rather than protecting it.

Three terms that get used interchangeably and answer three different questions. The one that makes them operational is the admission rule at the end: no provenance, no deploy.

Four tools that solve the same sentence and differ on one question: where does the plaintext end up? In a regulated environment that question decides the answer.

Everyone endorses least privilege; few can describe how they would measure over-permission across a fleet. The scoring answer names the evidence source, the tiered remediation, and the break-glass hatch that makes it survivable.

Tool selection is the shallow half of secrets questions. Senior answers live in the mechanics: dual-validity windows, consumer caching, and revocation you have actually tested rather than assumed.

The reframe that scores: many controls contain machine-checkable assertions; others require human evidence. Guardrails prevent, gates stop pipelines, drift detection watches live state, and evidence falls out as a byproduct.

Threat modelling dies as a document ritual and lives as a design-stage habit. The answer that scores: tier reviews by blast radius, short sessions on RFCs, findings filed where engineers already work.

Tamper evidence is an architecture property, not a log setting. Off-box forwarding, append-only storage under separate credentials, hash chains and a verification job that actually runs.

Break-glass exists to restore login when the identity provider is the thing that died. Few accounts, sealed hardware factors, an alert on every authentication, a printed runbook and a quarterly drill.

Labels without consequences die quietly. Attach classification to enforced defaults in Terraform modules, propagate tags to every copy of the data, and give engineers twenty worked examples instead of a taxonomy lecture.

The default answer is 'horizontal' because interviews reward it. The correct answer names the constraint that makes distribution expensive and knows when one big machine is the engineering choice.

Timeouts guarantee uncertainty, not failure: the first request may have succeeded after the client gave up. The idempotency key pattern is the industry answer; the scored details are storage, expiry and concurrency.

Flags sit on the request path of everything, so a slow flag service is a site-wide outage waiting to happen. Local snapshots, propagation numbers and audit trails are where this design is decided, because they determine what happens when the flag service itself is unavailable.

Never-delete is a policy, not a control. Auditors and attackers both want to know what stops an admin with broad credentials, and the answer has to be mechanical.

Leases prevent dead holders but not overlapping ones. The staff-level answer is fencing tokens and a candid account of why quorum lock services without downstream checks are still probabilistic.

This is a platform-organization question disguised as infrastructure. Score comes from separating enforcement from ownership and explaining what stops the gateway becoming a smart ESB.

Cron fires at wall-clock times; a scheduler reasons about data intervals and blocked frontiers. The scored details are per-partition idempotency and catch-up semantics.

The auditor does not require a meeting, they require evidence that changes are authorised, tested and reversible. Generate that evidence from the pipeline and the board stops being the bottleneck.

An untested backup is a belief, not a control. The design that matters is the one that restores automatically on a schedule and verifies the result, because that is the only thing that produces a recovery time you can quote.

Four purchase instruments, one fleet, and a finance team asking why you did not commit to everything at maximum discount. The scoring rubric rewards the arithmetic of being wrong, not the discount table.

The licence fee is visible and the engineering time is not, so omitting internal effort can make building look artificially cheap. The fix is pricing internal effort honestly, including its maintenance tail.

Communicate a threatened delivery or recovery commitment with known facts, uncertainty, a recommendation and the decision needed before options expire.

Defend a change with irreversible effects by separating code rollback, data recovery and external correction, with explicit recovery objectives and tested limits.

Reduce a critical knowledge dependency with funded transfer work, tested operating documentation and demonstrated backup capability, without inventing personal motives.

Assess a signed vendor choice against the actual requirements and contract, then support a bounded implementation or raise material new evidence through its owners.

Multi-AZ is the answer and the reason matters more than the acronym. Each tier fails differently, and the database is the one where high availability means a failover with a real gap, not zero interruption.

The question that separates people who have debugged a hung rollout from people who have read about one. The interesting half is not the signal, it is PID 1.

One is layer 4 and regional, one is layer 7 and regional, one is layer 7 and global. Answer on those two axes and the choice makes itself, including when you need two of them together.

Ordering and retransmission are what TCP adds, and both of them cost time. Naming something that deliberately gives them up, and saying why, is what turns a textbook answer into a real one.

A staple of every networking round, and the follow-up is always about TLS termination. Knowing which layer sees what decides most of the answer.

The oldest question in systems interviewing and still the best, because it is unbounded: every layer you can describe is another layer you could debug.

Experienced answers are ordered and verifiable: minimal base, benchmark applied as code, identity and exposure next, then continuous proof it stayed that way. Checklists recited out of order are the tell.

Five stages, and which one you are stuck in tells you what to fix. A machine that reaches a GRUB prompt has a different problem from one that hangs waiting on a filesystem that no longer exists.