Medium DevOps interview questions

The question that separates people who have debugged a hung rollout from people who have read about one. The interesting half is not the signal, it is PID 1.

A staple of every networking round, and the follow-up is always about TLS termination. Knowing which layer sees what decides most of the answer.

The oldest question in systems interviewing and still the best, because it is unbounded: every layer you can describe is another layer you could debug.

Two different resources produce the same errno, and the second one is invisible unless you know to look. One command distinguishes them.

The scripting round in disguise. The constraint is the question: it exists to see whether you stream or whether you load, and everything else is about whether the script is safe to run twice.

The two-syscall duet behind every process on the box. The follow-ups live in what survives the transition, and candidates who skip that fail the next question.

A routine cloud operation with three layers that can quietly disagree. The strong answer is an ordered procedure you could run during business hours, without a reboot.

The answer is yes, and then the real question starts. Asymmetric routing and silent drops punish anyone who treats the routing tables as one flat list.

Most hand-written units boot in dev and die in production. The gap is Type selection, restart policy, and the drop-in workflow vendors expect you to respect.

The flags are the easy part. The scored part is proving you can capture on a saturated box without adding load, then read the file afterward like evidence.

Two authentications happen in every SSH session, and the one usually left out is the server proving itself to you. Knowing who proves what, and where your agent socket ends up, is the scored material.

The signature is unmistakable once seen: handshakes complete, then the connection freezes at the same byte count every time. Here is the probe sequence and the fixes, ranked.

Enterprise loops pair these topics because they test L2 literacy plus vendor coordination together. The scored insight is that LACP spreads flows, not packets, and needs the switch to agree.

Everyone knows ulimit -n. The interview question is which process inherits which value, why limits.conf did nothing for your service, and how you size the ceiling honestly.

Five commands separate people who have actually built this from people who read about it once. Here is the working sequence, plus the gotchas that break it.

Table full is the symptom everyone knows. The interview answer lives one layer down: per-state timers, the five-day ESTABLISHED default, and what conntrack -S says about hash pressure.

One round trip versus two is the headline, but the ops-relevant differences hide in what stays plaintext, how resumption works, and which middlewares the change broke.

Multiplexing removes application-level queuing and hands the problem to TCP. Here is where the blocking really lives, the loss math behind it, and the four levers that help.

A reset at a suspiciously round number is a fingerprint, not a bug. Matching client keepalives to the lowest timer in the path is the fix; here is the full ladder of knobs.

Most throughput tests measure the tester, not the network. Single stream versus parallel, slow start, sender-side retransmits, and the CPU ceiling: how to produce a number you can act on.

X-Forwarded-For, PROXY protocol v1 and v2, and the trust boundaries between them. Get the layer wrong and your rate limiting, geo rules and audit trails all key off the balancer's address.

Anycast turns BGP convergence into your failover mechanism. Sessions stick to the site they landed on, monitoring must go per-site, and a route you cannot withdraw cleanly is worse than DNS.

Sets instead of thousand-rule chains, one engine for both IP families, atomic ruleset swaps, and a compatibility shim with sharp edges. Migration risk lives in coexistence and tooling assumptions, not syntax.

Copy-on-write freezes a point-in-time view while the database keeps writing. Fat snapshots overflow into invalid backups and thin pools exhaust into frozen volumes: size both deliberately.

Transparent versus explicit hugepages is a control question, not a size question. Fork-heavy stores suffer THP copy-on-write amplification while large-resident databases gain TLB reach.

Most candidates can sell serverless. The question asks you to argue against it, which needs a real understanding of the execution model rather than the marketing.

Database redundancy still needs reconnecting clients. Distinguish the deployment type, then measure how promotion and DNS changes affect application requests.

The services-and-enterprise interview staple. There is a defensible answer and it is not 'always re-platform': the decision is a function of change tolerance, deadline reality and what the workload is worth.

DNS failover is a blunt instrument with three delays stacked on top of each other: detection, propagation and client caching. Knowing their sizes tells you when DNS is the right layer at all.

The cheapest storage class is rarely the cheapest answer. Retrieval pricing, minimum durations and per-transition fees decide whether a lifecycle rule saves money or manufactures waste.

Large object uploads are a reliability design problem, not a bandwidth one. Parts, retries and the completion call decide whether a flaky link costs one chunk or the whole night.

Volume choice is IO-shape matching: burst buckets, provisioned IOPS and throughput designs behave very differently under mixed OLTP-plus-batch load. Average latency graphs hide the failure entirely.

Sessions, locks and pub/sub are three very different contracts with the same server. Knowing which guarantees each one lacks is the difference between a cache and an outage.

Fleet-wide replacement is a traffic-shaping problem: bake once, wave through in controlled batches, watch the alarms, and keep the exit open. In-place patching is the alternative and usually the regret.

Service control policies cap what anyone in a member account can do, no matter what their IAM admins wrote. The craft is choosing a handful of denials that age well.

Hybrid DNS fails in both directions independently. Outbound rules carry VPC queries to your data centre, inbound endpoints bring on-prem queries back here, and both halves need wiring.

Origin access control pins the bucket to your distribution, and signed URLs or cookies decide who plays what. Get the expiry wrong and the leak comes back with a signature on it.

Queue, log and router solve different problems that all get called events. Picking by workload shape beats picking by whichever service the team already knows.

Orchestration buys a visible state machine with declared retries; choreography buys independence and coupling debt. Money paths usually deserve the state machine.

Account-per-team is the right instinct, but hand-rolled account setup drifts within a month. Vending turns governance into a pipeline with an SLA instead of a ticket queue.

Four tiers, four bills. Stating RTO and RPO per tier turns a vague resilience wish into a decision leadership can actually price, and the testing story is where candidates fold.

Latency budgets decide architecture, and most teams buy edge compute before earning it with caching and protocol work. Know which rung of the ladder your problem actually needs.

A dead-letter queue with no owner is a landfill with a nicer name. Triage discipline separates teams that recover messages from teams that archive regret.

Guaranteed capacity and discounted capacity are different products. Peak season needs both, arranged in layers and verified with a game day before the traffic arrives.

Allow-listing egress starts free with security groups and ends with TLS-breaking appliances. Each rung costs latency, money and political capital, and knowing where to stop is the actual test.

The private endpoint can be healthy while an office resolver still returns the public address. Trace the lookup from the failing client before changing access rules.

Moving a Kubernetes service account changes its token subject. Separate pod mutation, federation trust and Key Vault authorization before adding permissions.

Everyone can say state maps config to reality. The follow-up that separates candidates is what else is in the file, and what that means for who may read it.

Everyone answers state locking. The follow-up is what happens when locking is not configured, and what you do with a stale lock at 2am, which is where the answer gets real.

A staple of services-company interviews, and the boring answer (provisioning versus configuration) is only half of it. The useful half is what happens when you push either tool past its model.

The question that finds out whether someone writes playbooks or writes shell scripts wrapped in YAML. Idempotence is a property of the module you chose, not of Ansible.

State layout needs an access boundary. Separate environment credentials and restrict who can assume them; a directory name cannot contain a mistaken apply.

Extract too early and you maintain a wrapper nobody thanks you for. Here is the extraction trigger, the semver contract that maps onto Terraform surfaces, and the parallel-release path for breaking changes.

Everyone recites that depends_on forces ordering. The stronger half of the answer is the graph you never see: implicit edges from references, why file layout orders nothing, and what explicit edges cost.

The table is half the answer. The other half is who holds credentials, who repairs a stuck lock at night, and why the boring option usually wins until RBAC demands grow teeth.

One ForceNew attribute turns an edit into a destroy. Know the schema mechanics, the four lifecycle levers, and why create_before_destroy trades downtime for name collisions.

Three lifecycle arguments influence replacement and drift handling: create_before_destroy, prevent_destroy, and ignore_changes. Each earns its place through an incident story, and each has a failure mode that is worth naming before you reach for it.

Scan plan JSON on every pull request, run new rules advisory for two weeks, and block only what is law. Waivers live in version control with an owner and an expiry date, or the gate becomes noise within a quarter.

Managed platforms sell governance, not execution: locked state with RBAC, plans on every pull request, and audit logs. Price them per resource under management against the engineering hours self-hosting quietly burns.

Static INI files die somewhere near two hundred hosts. Point inventory plugins at the systems that already know the truth, derive groups from tags with constructed inventory, and plan for stale hosts before they page you.

Vault's weakness is the single shared password, not the AES256 underneath. The senior answer covers rekey ceremonies on offboarding, encrypt_string for readable diffs, labelled vault-ids per environment, and shrinking what needs encrypting at all.

Idempotence describes one run; convergence describes the fleet across time. Scheduled check-mode sweeps with diff reporting, alerts above a learned baseline, and a hard rule that incident hotfixes become pull requests the same day.

Promote the same code version, then generate and approve a separate saved plan against each environment's state and inputs. Pin, apply each reviewed artifact in sequence, and let the gates rise as you approach production. Environment branches quietly undo all of it.

Provider upgrades are a scheduled platform product: automatic version inventory, a canary stack inside days, automation that fans out pinned bumps with plan output attached. Estates without this routine get upgraded by deprecation deadlines.

Preview environments succeed or die on teardown: webhook destroys plus a nightly janitor with a TTL. Get the data policy and cost tagging right or the invoice ends the experiment before the demo does.

Distinguish a gated Terraform run workflow from a cloud controller that reconciles continuously. Both can start from Git, but they expose different approval, drift and credential boundaries.

Rotation is an expand-contract migration for credentials: stage the new secret, prove every reader picked it up, revoke the old one, and treat the revocation as the test. The outage risk lives in clients and connection pools, not in Terraform.

Registries live or die on upgrade ergonomics, not on publishing features. Green example plans gate every tag, automation delivers upgrade PRs with plan output to consumers, and retirement is a census plus a date.

The single most common Kubernetes interview question, and the one where a vague answer is most obvious. Every stage you name is a place the interviewer can ask you to debug.

Both run pods, so the answer sounds obvious until an interviewer asks what happens when you delete one. The guarantees are narrower and more specific than most candidates think.

Everyone can recite the three. Explain what each failure causes, and why a badly configured liveness probe is more dangerous than none at all.

The pair everyone configures and few can explain. QoS hints at eviction risk, but usage versus requests and Pod priority determine node-pressure ranking, and CPU and memory behave completely differently when you exceed them.

A practical question with a precise answer, and the size is not the real cost. Pull time on every node, registry storage, and attack surface all scale with it.

Both solve the same surface problem and they disagree about how. Compare what each mechanism makes hard, and notices that the GitOps tool you use changes the calculus.

A specific configuration trap with a clean explanation. Both controllers act on the same signal from opposite directions, which can produce unstable feedback depending on their policies and workload.

PDB governs voluntary disruptions only and does not gate rolling updates at all. Describing it as 'it keeps N pods alive' states the part it does not do, since it constrains voluntary eviction and not the machine that fails.

Init containers are the easy half. The hard half is why plain sidecars race your app at both ends of the pod's life, and what restartPolicy Always changes about that.

Three propagation mechanisms live inside this one question and only one of them is automatic. Instant reload is the common assumption and the kubelet has never offered it.

Rootless is the rare security control with a visible invoice. Compare its effective resource controls, storage behaviour and remaining host-user access.

Multiple schedulers are supported, rarely understood, and dangerous in a specific way. The strong answer names the deadlock that gang scheduling fixes and the capacity race it can open.

Provisioning is a four-actor handshake between the PV controller, a sidecar, a driver and a backend. Knowing who calls whom turns every stuck PVC from mystery into checklist.

Quotas are admission-time contracts counted in requests, not measured usage. That single sentence explains most quota outages, most quota confusion, and the reason LimitRange must sit beside every quota.

Dockershim is gone and the CRI contract decides what a runtime must do. The senior-level part is the shim model: a supervisor process that owns exit codes and stdio so the daemon can die without taking workloads with it.

Pull auth resolves on the node before any container exists. Ordering the credential chain and reading 401 against 403 against 429 in the events turns this into a minutes-long diagnosis; without it the only move left is rotating secrets blind.

Fail protects the policy, Ignore protects availability, and every real answer starts with per-webhook threat model plus scoping. The canonical outage, a webhook that rejects its own restart, separates the people who have run this from those who read about it.

Priority is one number with three separate effects: scheduling order, preemption victim selection, and eviction order under node pressure. Conflating those is the trap; designing tiers that survive both a full cluster and a hot node is the pass.

Anti-affinity is binary and falls over at scale; topologySpreadConstraints give you numeric skew control across labeled domains. The subtle parts are eligibility filtering before the skew math, and the fact that Kubernetes never rebalances anything for you.

Utilization-based scaling is the wrong sensor when work arrives as backlog. The design questions are threshold math against drain rate, reaction-time bounds from polling, and why lag-driven fleets oscillate without generous targets and idempotent consumers.

Two artifacts hide under 'Kubernetes backup' and they recover different things. The misses are what decides whether a restore works: volume bytes, encryption keys, and everything that never lived in etcd at all.

Tenancy is a dial from policy-based soft isolation to hard cluster boundaries with a virtual-control-plane middle ground. The scored answer picks by blast radius requirements and names what each model still leaves shared.

Pods authenticate with JWTs minted per-pod now, not eternal Secrets. The scored answer separates authentication from authorization, explains audience binding, and treats automount as opt-in rather than ambient.

Scale-downers mark a node removable only when every pod on it can leave safely. Your batch workload died because nothing marked it special. The mechanism is a filter cascade, and the fix is priorities, PDBs and annotations.

Kubelet resource metrics to metrics-server to aggregated API to HPA controller: every hop adds lag and averaging. Walking the path and naming where it distorts demand separates operators from dashboard readers.

Yes, the proxy moves: one L4 agent per node, eBPF in-kernel, waypoints only where L7 policy demands. The scored answer quantifies the sidecar bill, compares where each architecture lands the proxy, and names migration risks.

Hard versus soft rules, topology keys, weights that lose to everything else, and the IgnoredDuringExecution half nobody remembers. Placement shapes blast radius only when paired with disruption budgets.

Exit codes, the previous-container log, and a little-known file at /dev/termination-log that carries a container's last words into kubectl output. Scale triage starts with classification, not with opening pods.

Kind precedence orders manifests, hooks jump the queue with their own weights and delete policies, and --atomic plus --wait turn hope into rollback. Split charts along blast radius, not folder aesthetics.

Heartbeats, conditions and taints are the only vocabulary the control plane understands. NPD translates journald and kernel ring messages into that vocabulary; custom plugins carry your hardware's dialect.

Volumes grow online and never shrink; StatefulSet template changes normally replace pods ordinal by ordinal; supported in-place pod resize is a separate path. The craft is expanding storage first, gating rolls with partition, and letting replication lag set the pace.

A ladder from health-checked global DNS through endpoint mirroring to mesh east-west gateways. The deciding axis is trust boundary and failure isolation, not any mesh's feature matrix.

An end-of-maintenance date changes the risk even while traffic stays healthy. The work is proving routing and security parity before moving a production hostname.

Route attachment and cross-namespace backend access have different owners. Use route status to find the failing boundary before broadening any permission.

Compare rollout capacity, traffic exposure and state compatibility, then work through a payments canary with too little evidence to promote.

Follow commit identities through a rebase, recover a collaborator’s work with an explicit boundary, and explain the limits of force-with-lease and revert.

Calculate the pipeline critical path, separate runner queues from execution, and improve feedback time without hiding flaky or skipped checks.

The security argument for GitOps is more specific than 'Git is the source of truth'. Pull deployment can remove cluster credentials from CI, and that single fact is most of the case.

Follow scheduling eligibility, job isolation and artifact transfer, then diagnose a queued job whose available runners cannot satisfy its requirements.

One Application declaring others sounds like trivia until you need to rebuild a cluster in an afternoon or hand a team a bounded slice of the platform. Here is when the pattern earns its keep, and when ApplicationSet should replace it.

Long-lived branches pile up merge debt until integration becomes a gamble. There is a named technique that ships a three-month refactor in releasable increments, and its final step is deletion.

Distinguish executor capacity, placement and provisioning failures, then size an agent pool from measured resource use and cleanup behaviour.

If every environment rebuilds, staging never validated the bytes production runs. The promotion model auditors and 2am responders both love, plus the costs nobody mentions until adoption.

The honest mechanics of merging to trunk many times a day: flags, fast CI, trunk locks, and the conditions under which you should not run it at all.

Deployment and release are two decisions, not one. Choose stable cohorts, test failure defaults and propagation, and retire temporary flags without breaking older application versions.

A registry grows because every commit mints digests nobody pulls again. Reference-aware retention keeps rollback targets and audit chains while expiring the debris.

Quarantine is a holding cell with an expiry date, not a landfill. Per-test flake rates, entry evidence, an enforced expiry review, and the cap that turns fixing into priority.

Green PRs can still break main because they were validated against a stale tip. Merge queues revalidate the exact combination that lands, trading extra validation work for coverage of combined changes.

Base layers are dependencies: digest-pin them, let bots bump them weekly, and let CVE disclosures trigger scoped rebuilds through the normal pipeline. Days, not quarters.

Cost per merge beats cost per minute. Attribute spend by pipeline, attack caches and matrix sprawl first, and know what self-hosted runners really cost.

A freeze enforced by email is a suggestion. Tier services, put the window in deploy tooling, price exceptions honestly, and review service outcomes and the cost of delayed changes.

For scheduled and stateful workloads the exposure unit is records and time, not requests: shadow runs on real input, row-level diff budgets, checkpoint compatibility, one-cycle warm standby.

Staging is a snowflake maintained by accretion. Rank drift sources by risk, shrink them mechanically with parity by construction, and stop calling staging the last line of defence.

Backports look trivial until a cherry-pick conflicts. Branch-per-line discipline, forward-port-first ordering, and an honest EOL calendar are what keep three versions shippable at once.

Central pipeline logic fails two ways: forked copies that drift, or a platform team queue every change must wait behind. Versioned templates with pinned consumers and declared hooks avoid both.

Pipeline credentials are the keys to production and git history is forever. Scoping per stage, runtime-minted short-lived identities, expiry-enforced rotation, and a revoke-first leak playbook.

kubectl-edit happens when no designed emergency path exists. What an expedited lane may drop, what it must never drop, and how pre-authorization plus follow-up tickets keep it honest.

Application redeployment and module downgrades both require current-state checks. The asymmetry that forces expand-contract discipline and plan-reviewed upgrades instead of promote-and-rollback pipelines.

The arithmetic takes ten seconds and is the part most often skipped. The stall is the signal: it means error budgets are something you have read about rather than used.

A question with a right answer and a subtle reason. Histogram versus summary is the part that catches people, and it turns on whether you can aggregate across instances.

Tracing is the only telemetry that answers where the time went across services. The mechanism is context propagation, and the reason teams fail at it is that one uninstrumented hop breaks the chain.

OpenTelemetry is an API and a wire protocol, not a product. Candidates who promise instant multi-vendor bliss have never run the collector in production or negotiated with a vendor who knows it.

Day-one telemetry is cheap and retrofitting it costs an incident. The answer that scores names the linking layer (trace IDs in logs, exemplars on metrics) that turns three tools into one story.

Dashboard sprawl is an operating-model problem wearing a tooling costume. The scored answer moves definitions into git, attaches ownership metadata to every panel, and deletes without ceremony.

The data-path question separates people who have sized a cluster from people who installed one. Shard sizing, refresh versus flush, and each ILM phase carry one specific failure mode apiece.

Choose what evidence must survive, then price the collection path. A tail policy can only inspect traces that reach it; low SDK sampling changes the guarantee before the collector sees a span.

Metrics describe the server's experience; synthetics describe the user's. The strong answer designs a few money-path journeys from real geographies, pages only on persistent failure, and budgets for script rot.

The kernel watches syscalls, sockets and short-lived processes that userspace agents polling every few seconds never meet. Know what eBPF adds, what it costs, and the security conversation it starts.

Forty healthy islands equal one blind estate. Compare the consolidation patterns honestly, keep alerting local, curate what crosses the WAN, and make the global view read-only and cheap.

Routing rots because orgs change faster than configs. The senior answer treats ownership as data resolved from a catalog at fire time, with drift detection on the routing itself.

Rotation length decides focus versus fatigue, handoff quality decides whether Tuesday inherits Monday's mess, and follow-the-sun only works when every region holds real authority.

Facilitation is mechanics: timeline before theories, blame converted into system questions, actions with owners tracked to closure. Include the defensive engineer and the exec who wants a head.

Attribution is an incentive-design problem: own-team labels at ingest, unit pricing per signal, monthly showback before any chargeback, sanctioned levers so teams can actually respond.

Detectors earn their keep on seasonal aggregates and fleets of similar series, run in shadow mode with measured precision. They lie on low-volume series, bursty workloads and regime changes.

MTTR is three clocks hiding in one number. Profile detection, diagnosis and fix separately from incident timestamps; attack whichever clock dominates, which is almost never rollback speed.

Internal platforms hide a trap: the direct user is an engineer, but the real traffic belongs to their customers. Define SLIs from the consumer's vantage and turn the error budget into roadmap currency.

Sampling keeps proportions and loses rare individuals; filtering keeps chosen classes complete and loses whatever you misclassified. Decide retention at write time, keep counters always, rehydrate the rest.

Assert on the shape of a trace: which spans ran, in what order, with which attributes. Catches the cross-service regressions unit and contract tests structurally miss, at the price of instrumentation discipline.

Severity inflation and silent underdeclaration are both incentive problems, not wording problems. Anchor levels to impact and obligations, pre-write example scenarios, and make declaring severe safe.

HTTP success can carry a rejected-span count. Replaying that batch can duplicate accepted telemetry, while enlarging the queue cannot repair invalid data.

A common scenario question, and the one where a list of commands most often stands in for an argument about what each one eliminates. Empty logs is the clue, not the obstacle.

The pods are Running, the dashboard is green, and users get errors. The gap between Running and receiving traffic is where this question lives, and it has a precise answer.

Tests whether you know that Kubernetes waits, and for how long. The default timings surprise most candidates, and they explain why a node failure hurts longer than people expect.

A deceptively deep question, because there are at least six places a version can get stuck and they span the pipeline, the cluster and the edge. Work the path in order.

Tests the mitigate-before-diagnose reflex under time pressure, plus whether you know the two ways a disk can be full and the trap that makes freed space not come back.

Automation can renew a certificate without deploying it correctly. Check the served leaf and chain, the client trust store and the exact verification failure.

An idle database with a starved application is the tell. The connections are held, not used. More database capacity does not release leaked connections.

Repeated action items are a measurable defect with a mechanical cause. Answering 'culture' without a mechanism describes the symptom back rather than fixing it.

Emergency mode after a storage change is usually one line in fstab. The order of operations is what decides the outcome here, along with whether the recovery preserves data-mount dependencies rather than booting past them.

One saturated core on a proxy is rarely about raw traffic volume. It is a parallelism failure with three usual suspects, and the per-thread view names the culprit in minutes.

A hang suggests missing progress; a refusal suggests an explicit error. Packet evidence distinguishes firewall behavior from routing failures and closed listeners. Then rule counters, not eyeballs, finger the guilty line.

Everyone reaches for reinstall. The disciplined path is one journal file, four failure signatures, and an explicit decision about whether this host deserves surgery at all.

The reflex is rollback and it is usually right. Shared state, changed credentials and unavailable old artifacts can make an undo incomplete or unsafe. Verify those dependencies before choosing the recovery.

Nothing errors because dropping unmatched lines is documented behaviour. Counting the tagged failures converts an invisible leak into a number, and numbers have owners.

The box looks CPU-starved but the CPUs are starving themselves. Reading the reclaim loop correctly separates people who have sat on the console from people who have read about it.

The backup is doing its job and the database is paying for it. Attribution first, then enforcement that actually binds on modern kernels, because priority support depends on the active kernel and IO scheduler.

Self-healing unavailability is a timeout arithmetic story. Pull the balancer's removal timestamps, lay them against the GC log, and the pause that ejects the instance will be sitting there in plain sight.

Spikes that march in step with BGSAVE are a page-size story, not a network story. Check actual huge-page usage, fork duration and copy-on-write pressure on the deployed kernel.

More partitions should mean more throughput, so why did the backlog deepen? Because rebalance behavior depends on the group protocol, and the way consumers divide work decides who pays for it.

The outage window closed, but every process born since then still tries to fetch secrets at boot with nothing to fall back on. Why restarts keep reopening an incident that already ended.

Exit codes said green while the warehouse went hollow. Where detection should have sat, why retries could not help, and the backfill discipline finance will actually accept.

Purges act on exact cache keys, and the edge is full of variants the purge never named. Verify per variant at real POPs, then fix the key model instead of chasing URLs forever.

Slow leaks hide inside restart cycles and percentage thresholds. Plot weeks of absolute memory against deploys, prove it with profiler deltas, and alert on predicted time-to-limit instead.

Stateful firewalls keep established flows alive after their rule vanishes, so cleanup day passes every check and lag appears days later. Flow logs name the hour; inventories prevent the repeat.

Fork failures can reflect PID limits or memory allocation failure even when host RAM looks available. Find which ceiling broke, cap PIDs per cgroup so one team's leak costs one pod, and fix the unbounded spawn.

A drain that hangs without erroring is almost always eviction being refused, and the two refusals that look identical from the outside have opposite fixes.

Raising the limit buys hours and proves nothing. The six-hour periodicity is the diagnosis: something is opening descriptors on a code path that never closes them.

Two commands disagreeing is the diagnosis, not the mystery. A deleted file with an open handle is invisible to du and fully charged by df, and rm made it worse rather than better.

The volume is in one availability zone and the scheduler cannot move it. Spare capacity in the other two zones is not spare capacity for this pod, and no amount of scaling helps.

A health endpoint that returns 200 because the process is running tells you the process is running. Interviewers want to hear where you draw the line between a check that pages and a check that removes traffic.

The pod's resolver is configured to try five search domains before the real one. An uncached external hostname can trigger several search-expanded queries before its absolute lookup, and the failures are what you are paying for.

Running pods already have their images, so a credential expiry is invisible until something needs to start. That gap is why this always surfaces during an unrelated incident, at the worst moment.

Every SDK fetches its credentials from a link-local metadata endpoint with a modest request budget. Enough containers refreshing at once and the endpoint starts refusing, which the SDK reports as an auth problem.

Somebody silenced it during an incident nine days ago to stop the noise, and nothing ever expired the silence. The monitoring was working perfectly and nobody was listening.

Easy to define and easy to fail. The scoring half is where each gate sits, what it does to build time, and the honest admission of what the whole set misses.

An incident response question wearing a Git costume. The wrong instinct is to rewrite history first, and it costs you the hour that matters.

Most clusters fail an RBAC review on the same handful of patterns. Naming them concretely, plus the namespace-first design that prevents them, is what separates operators from tutorial readers.

Naming the replacement is the floor of this question. What scores is the audit-then-warn-then-enforce sequence and an honest answer about the vendor chart you cannot fix.

Reciting injection classes you cannot fix is the trap. The scored move maps each risk category to a lever an ops or platform engineer owns, from response headers to metadata endpoints.

Warn forever becomes wallpaper; block on day one gets the gate switched off. The durable answer is a severity-and-fixability matrix plus suppressions that expire.

Tool selection is the shallow half of secrets questions. Senior answers live in the mechanics: dual-validity windows, consumer caching, and revocation you have actually tested rather than assumed.

Threat modelling dies as a document ritual and lives as a design-stage habit. The answer that scores: tier reviews by blast radius, short sessions on RFCs, findings filed where engineers already work.

Tamper evidence is an architecture property, not a log setting. Off-box forwarding, append-only storage under separate credentials, hash chains and a verification job that actually runs.

Push approval is a weak factor and fatigue is its predictable failure mode. Stop the campaign with number matching and rate limits; end the attack class with passkeys, device gating and a hardened helpdesk.

Break-glass exists to restore login when the identity provider is the thing that died. Few accounts, sealed hardware factors, an alert on every authentication, a printed runbook and a quarterly drill.

Volumetric floods die at the anycast edge; everything else reaches your origin anyway. The origin leak, expensive endpoints and unproxied surfaces decide whether a CDN is armour or decoration.

One directory as source of truth, conventionally named groups, apps mapping groups to roles in code. Protocol choice matters less than mapping discipline and a joiner-mover-leaver wire that actually removes access.

A pentest report is evidence, not a backlog. Triage by exploitability and blast radius, reproduce before you believe, commit to deadlines you can defend, and publish the burn-down so the dates are yours.

The dangerous question is not whether the vendor is secure but what the integration can touch once connected. Scope of granted access, data flow, offboarding, then tier the vendor and match effort to tier.

Escapes ride kernel bugs, privileged configuration and host mounts, not namespace magic. Cut the syscall and capability surface first, sandbox only what the trust boundary demands, and build nodes expecting compromise.

Choose by trust boundary, not fashion: mesh-issued mTLS inside a cluster, audience-bound tokens across teams and clouds, both together at scale. Static shared secrets are the thing being replaced.

Adoption is a product problem: templates with tested safe defaults, guardrails that start in audit mode, and metrics on paved-road share. Remove reasons to leave the road rather than writing memos.

CAP is not a menu of two letters per system. The scored answer knows what the theorem claims (narrowly), what most engineers misquote, and what a split-brain costs when both halves accept writes.

The most rehearsed design question, which is exactly why the interesting parts are the ones blog posts skip: redirect semantics, key generation under failure, and analytics kept off the hot path.

Two contracts in one system: an OTP with a 30-second promise and a sale announcement reaching fifty million phones without burning providers. Priority lanes and double-layer dedup decide the grade.

Flags sit on the request path of everything, so a slow flag service is a site-wide outage waiting to happen. Local snapshots, propagation numbers and audit trails are where this design is decided, because they determine what happens when the flag service itself is unavailable.

Type-ahead is a latency budget wearing a search costume: keystrokes arrive every 200 milliseconds, so anything slower feels broken. Prefix indexes, freshness tiers, and typo tolerance are the scored parts.

Size stored sessions from expiry and creation rates, then decide how quickly logout must take effect and what failover may forget.

Never-delete is a policy, not a control. Auditors and attackers both want to know what stops an admin with broad credentials, and the answer has to be mechanical.

The app server that proxies uploads through itself is the design that fails this question. Direct-to-storage, validate after arrival, and make CDN invalidation almost never necessary.

The difficult decisions are preserving offline intent and enforcing rules that span devices. Name the conflict classes and handle each deliberately rather than proposing a CRDT framework on instinct, because most of these conflicts have a domain answer that no merge algorithm can supply.

Every candidate lists the three isolation models. The offer-worthy answer prices them per tenant, does the migration fan-out arithmetic, and lands on a hybrid with reversal conditions.

Ladders and player logic are the warm-up. Cache topology, egress arithmetic, and knowing which quality metric actually predicts churn are what separate the answers.

Vendor limits are a shared budget your own teams will fight over. Broker the capacity, degrade by priority lane, and never let feature code see vendor HTTP semantics.

Cron fires at wall-clock times; a scheduler reasons about data intervals and blocked frontiers. The scored details are per-partition idempotency and catch-up semantics.

A catalogue nobody updates is worse than no catalogue, because people trust it once and get burned. Derive everything you can from systems that are already true, and make the rest a gate rather than a request.

Build once and move the same bytes. The moment an environment rebuilds from source, you are testing something that has never run anywhere, and no amount of pipeline output can tell you what production holds.

An untested backup is a belief, not a control. The design that matters is the one that restores automatically on a schedule and verifies the result, because that is the only thing that produces a recovery time you can quote.

A published event is an API with no version negotiation and consumers you cannot enumerate. The design is a registry that refuses an incompatible change at publish time, because after publication your options are all bad.

A shared cluster produces one bill and no answer. Attribution is a measurement problem first and a cultural one second, and the number that changes behaviour is not the one finance asked for.

The difference between scaling node groups and provisioning nodes is the whole answer. One picks from shapes you defined in advance; the other reads the pending pods and buys what they need.

Everyone quotes the discount. Fewer candidates can describe what happens when a notice arrives late or a worker disappears without completing shutdown and why some workloads shrug it off while others lose hours of compute.

Percentage savings make every quarter look like a win and tell you almost nothing. A denominator tied to revenue is the one that survives scrutiny, because it is the only one a finance conversation can act on.

Data transfer appears on nobody's architecture diagram and reliably appears on the invoice. The strong answer enumerates the taxed flows, ranks the levers, and knows which tax is worth paying.

Over-requested CPU and memory can prevent efficient node packing. Cutting them safely is a measurement problem with a reliability trap sitting in the middle of it.

The licence fee is visible and the engineering time is not, so omitting internal effort can make building look artificially cheap. The fix is pricing internal effort honestly, including its maintenance tail.

Central teams optimise well and get ignored; federated teams own outcomes and drown in tooling. The mature answer is a hub-and-spoke split by decision type, and the interview tests whether you can say exactly who decides what.

An upfront purchase, a refund and two currencies can produce several valid totals. Work out which total finance needs, then prove every adjustment from the source rows.

A budget miss can coexist with lower cost per request. Separate demand, usage intensity and price effects before assigning an efficiency target.

The instinct is to build a portal. The ticket mix decides whether a portal helps at all, and most teams never count it.

Refuse every exception and teams leave the platform without telling you. Grant them freely and you are patching nine stacks. The detail that decides it is whether the exception has an expiry date.

Registration coverage tells you a script ran. It says nothing about whether an engineer has ever found the portal worth opening.

The expensive part of these incidents is almost never the fix. It is the twenty minutes spent deciding whose incident it is.

A generated template is a copy, not a link. Drift is not a discipline failure, it is the predictable result of the mechanism you chose.

Complaints measure volume and confidence, not cost. The loudest team is usually the one most comfortable complaining, which is not the same as the one losing the most time.

Forty minutes is a symptom with at least four different causes, and three of them are cheaper to fix than moving everyone's development to a remote machine.

Support demand grows with teams multiplied by surface area, and headcount does not. The only durable lever is removing the reason people ask.

Operational load is not a discipline problem. It is the interest payment on everything the team shipped without an owner, and it compounds.

Every capability a platform accepts is a permanent operational commitment. Teams that cannot say no end up operating six things badly instead of two things well.

A training job is an hours-long computation with no user watching. Whether an interruption costs four minutes or four days is decided entirely by checkpoint cadence and restart semantics designed before the run.

An incident answer needs your actual decisions, the evidence behind them and the effect on users. A wrong turn belongs in the story only if it happened.

Explain a technical disagreement you lost, how you supported the chosen implementation and which evidence would justify reopening the decision.

Prepare an accountable account of a technical mistake: disclosure, recovery decisions, a tested prevention measure and the residual risk.

Turn a deadline dispute into a reviewable plan with capacity arithmetic, dependencies, scope choices and a clear acceptance boundary.

Assess a late deployment through change scope, recovery evidence and support coverage, then make a concrete release or deferral recommendation.

Facilitate a disputed design by stopping personal attacks, separating testable assumptions from priorities and assigning a decision owner.

Investigate on-call workload with responder feedback and paging evidence, then verify that relief and alert changes preserve service coverage.

Explain mentoring through an observed blocker, a bounded owned task, useful feedback and evidence that the engineer can apply the learning independently.

Use shared evidence and an agreed experiment to resolve a cross-team production problem, while containing impact and escalating time-sensitive risk.

Correct mistaken incident attribution with evidence, protect the response from a false diagnosis and follow through on the shared record.

Communicate a threatened delivery or recovery commitment with known facts, uncertainty, a recommendation and the decision needed before options expire.

Delegate a technical outcome with authority, capacity and acceptance criteria, while preserving the decisions and commitments assigned to the lead.

Explain a reliability objection through the failing mechanism, a feasible alternative and an explicit decision about the remaining service risk.

Resolve competing urgent requests using consequences, deadlines, uncertainty and real capacity, with explicit decisions about deferred work.

Turn difficult feedback into a testable improvement, while checking its factual basis and keeping unfair or inappropriate treatment separate.

Address repeated test and review bypasses through verified evidence, immediate risk containment and a repair that preserves the required coverage.

Make early incident reporting practical through a usable escalation path, constructive response and visible corrective work, without turning reports into a performance quota.

Explain an AI feature failure through its promised outcome, observed quality gap, bounded recovery and the evidence needed for another release.

Build a reliability proposal with observed impact, uncertain risk, implementation cost and a verification plan that supports an explicit priority decision.

Evaluate a bespoke platform request by its user need, lifetime support cost and available alternatives, then record the decision and any bounded exception.

Build a first-ninety-day plan from service risk and observed work, with safe shadowing, tested runbooks and one measurable operating improvement.

Handle a slipping dependency through a tested interface, honest integration status and an early decision about scope, resources or the external commitment.

Reduce a critical knowledge dependency with funded transfer work, tested operating documentation and demonstrated backup capability, without inventing personal motives.

Publish useful outage updates with verified impact, explicit unknowns and a next-update time, while keeping account-specific details in the right channel.

Resolve a security release finding with verified affected components, deployment context and an authorized remediation or exception decision.

Keep incident coverage working while investigating missed notifications, with private conversation, tested escalation and appropriate management support.

Report an unnoticed production problem promptly through the right channel, distinguish actual impact from a near miss and verify the control or detection gap it reveals.

Transfer incident responsibility with current impact, evidence-qualified hypotheses, active changes and the next authorized decision, followed by explicit acceptance.

Evaluate a hiring concern against role-related evidence, the quality of the interview sample and the agreed assessment process, without giving unevidenced impressions veto power.