DevOps & Cloud Interview Prep: Real Scenarios & Answers

DevOps & Cloud Interview Prep: Real Scenarios & Answers

By https://DevOpsInterview.CloudTechnology
Download on the App Store

DevOps & Cloud Interview Prep: Real Scenarios & Answers episodes

  • SLO Error Budget Burn Rate: Azure Zone Outage Math

    If your service has a 99.99% SLO and Azure drops a zone for 15 minutes, here's exactly how to calculate the error budget burn rate before your next SRE interview.

    You'll learn:

    • How to derive total monthly error budget from a 99.99% SLO (~4.38 minutes/month)
  • Why a 15-minute outage consumes roughly 3.4x your entire monthly budget — and how to show that math
  • The burn rate formula interviewers expect: burn rate = error rate / (1 − SLO target)
  • How fast vs. slow burn rates map to alerting windows in Google's SRE workbook approach
  • Common gotchas: partial zone failures, dependency blame, and how to frame mitigation in your answer

    • Keywords: SLO error budget burn rate, Azure availability zone outage, SRE interview questions, error budget calculation, 99.99 SLO math

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    11 min
  • PCI-DSS Serverless Payments on GCP: Confidential VMs, CEKM & Binary Authorization

    Designing a PCI-DSS compliant serverless payments architecture on GCP means getting Confidential VMs, Cloud External Key Manager, and Binary Authorization working together — here's how to answer that in a senior interview.

    You'll learn:

    • How Confidential VMs provide hardware-level memory encryption to satisfy PCI-DSS data-in-use requirements
  • Why Cloud External Key Manager (CEKM) lets you hold encryption keys outside GCP's control — and what that means for scope reduction
  • How Binary Authorization enforces cryptographic attestation so only verified container images reach your payment workloads
  • The serverless boundary decisions (Cloud Run vs bare GKE) that affect your Cardholder Data Environment scope
  • Common interview gotchas around shared responsibility, audit logging with Cloud Audit Logs, and VPC Service Controls for perimeter defence

    • Keywords: PCI-DSS GCP architecture, Confidential VMs interview, Cloud External Key Manager, Binary Authorization Cloud Run, serverless payments compliance

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    19 min
  • Cross-Account EKS with AWS CDK: VPC Peering and Transit Gateway

    Deploying EKS clusters across AWS accounts with CDK is a common senior interview scenario — here's how to handle VPC peering, Transit Gateway attachments, and IAM trust policies correctly.

    You'll learn:

    • How to structure a multi-account CDK app using Stacks across environments with explicit env account/region targets
  • When to use VPC peering vs Transit Gateway for cross-account EKS network connectivity, and the trade-offs at scale
  • How to wire up Transit Gateway attachments and route table propagation so worker nodes can reach shared services
  • Cross-account IAM role assumptions and EKS RBAC config required for cluster access from a management account
  • Common CDK gotchas: bootstrap trust policies, asset S3 bucket permissions, and cross-account CFN execution roles

    • Keywords: cross-account EKS CDK, AWS Transit Gateway EKS, VPC peering Kubernetes, multi-account EKS architecture, AWS CDK EKS interview

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    14 min
  • OpenTelemetry + CloudWatch Logs Insights: Tracing Serverless Apps

    Correlating OpenTelemetry traces with CloudWatch Logs Insights across Lambda and Step Functions is a common senior interview scenario — here's exactly how to answer it.

    You'll learn:

    • How to propagate trace context (W3C TraceContext headers) across Lambda invocations and Step Functions state transitions so trace IDs land in your structured logs
  • Configuring the AWS Distro for OpenTelemetry (ADOT) Lambda layer to auto-instrument functions without cold-start penalties
  • Writing CloudWatch Logs Insights queries that join on trace_id to reconstruct an end-to-end execution timeline across services
  • Where correlation breaks — async Step Functions callbacks, missing X-Amzn-Trace-Id propagation, and log sampling mismatches
  • Trade-offs between ADOT, X-Ray native SDK, and a third-party collector like the OpenTelemetry Collector on Fargate

    • Keywords: OpenTelemetry Lambda tracing, CloudWatch Logs Insights trace correlation, ADOT Step Functions, serverless observability interview questions

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    19 min
  • Terraform State Splitting: terraform state rm + moved Blocks

    Splitting a monolithic 4GB Terraform state file into scoped microstates is one of the nastiest live-infrastructure challenges you'll face — here's how to do it without downtime using terraform state rm and moved blocks.

    You'll learn:

    • Why state files balloon past 4GB and why that breaks plan/apply performance
  • How to use terraform state rm to surgically extract resources without destroying them
  • Using moved blocks to re-home resources into child state backends cleanly
  • Sequencing the migration to avoid drift, lock contention, and accidental deletes
  • How to validate microstate integrity with terraform state list and targeted plans before cutting over

    • Keywords: terraform state splitting, terraform state rm, moved blocks terraform, monorepo to microstate migration, terraform refactor interview

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    21 min
  • Monorepo CI at Scale: Bazel Caching for 1,000 Microservices

    Designing a monorepo CI pipeline that doesn't collapse under 1,000 microservices means getting Bazel remote caching and selective test execution right from the start.

    You'll learn:

    • How to structure a monorepo CI pipeline so only affected services trigger builds — using Bazel's dependency graph to compute the minimal affected set
  • Configuring Bazel remote caching (local cache, shared remote cache via gRPC or HTTP) to avoid rebuilding unchanged targets across parallel CI workers
  • Selective testing strategies: combining bazel query with --build_event_stream to identify and run only impacted test targets
  • Common failure modes at scale — cache poisoning, overly broad BUILD file dependencies, and flaky remote executor connections
  • How to structure the CI orchestration layer (GitHub Actions, Buildkite, or Tekton) to fan out Bazel shards without thrashing the remote cache

    • Keywords: monorepo CI pipeline, Bazel remote caching, selective testing microservices, CI at scale DevOps interview, platform engineering build systems

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    21 min
  • Azure RBAC with Pulumi: Dynamic Roles from YAML

    Learn how to generate dynamic Azure RBAC role assignments using Pulumi with YAML-driven definitions — including tag-scoped conditions like restricting storage access to env:prod resources only.

    You'll learn:

    • How to define custom Azure RBAC roles in YAML and hydrate them through Pulumi's automation layer
  • Using condition and conditionVersion fields in role assignments to enforce attribute-based access control (ABAC)
  • Scoping storage permissions to resources matching specific tag key/value pairs at assignment time
  • Structuring Pulumi component resources so YAML definitions stay DRY across multiple environments
  • Common gotchas: condition syntax errors, propagation delays, and principal vs. scope mismatches

    • Keywords: Azure RBAC Pulumi, dynamic role assignments Azure, Pulumi YAML infrastructure, Azure ABAC tag conditions, custom RBAC roles interview

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    18 min
  • Prometheus Cardinality: Cutting 10M Series to 500K for Istio

    Taming Prometheus cardinality explosion in an Istio service mesh — dropping from 10 million to 500K active series using relabel_configs and recording rules — is exactly the kind of production war story senior SRE interviews dig into.

    You'll learn:

    • Why Istio telemetry generates cardinality explosions and which high-cardinality labels (source_workload, destination_service, pod IPs) are the usual culprits
  • How to use metric_relabel_configs to drop or rewrite labels before series are ingested into TSDB storage
  • Writing recording rules to pre-aggregate high-resolution Istio metrics into lower-cardinality rollups
  • Using topk and cardinality analysis queries to identify which metrics are burning your series budget
  • Trade-offs between dropping labels at scrape time versus aggregating at query time — and why interviewers care about the difference

    • Keywords: Prometheus cardinality, Istio metrics, relabel_configs, recording rules, TSDB series limit

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    23 min
  • Conftest in Argo CD: Block Public S3 Buckets at GitOps Gate

    A developer pushes a Terraform module with a public S3 bucket — here's exactly how to catch and block it in your Argo CD pipeline using Conftest policy-as-code before it ever reaches production.

    You'll learn:

    • How Conftest integrates with Argo CD as a pre-sync hook to enforce OPA policies on Terraform plans
  • Writing a Rego rule that flags acl = public-read or block_public_acls = false on aws_s3_bucket resources
  • Where in the GitOps workflow the gate fires — and why admission controllers alone aren't enough for IaC drift
  • How to surface policy failures as Argo CD sync errors so engineers see the violation before merge, not after deploy
  • Common gotchas: Terraform plan JSON output format, conftest namespace mismatches, and false positives on legacy modules

    • Keywords: Conftest Argo CD policy, OPA Terraform GitOps, block public S3 bucket IaC, GitOps security controls, Rego policy Terraform plan

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    19 min
  • Terragrunt at Scale: Dependency Graphs, Circular Deps & OCI Versioning

    Managing a Terragrunt dependency graph across 500+ modules without hitting circular dependencies or version drift is one of the hardest scaling problems in platform engineering.

    You'll learn:

    • How to map and audit a large Terragrunt dependency graph using terragrunt graph-dependencies and DAG visualisation tools
  • Patterns for structuring module hierarchies to prevent circular dependencies before they reach CI
  • Enforcing module versioning with OCI registries — why OCI beats Git tags at this scale
  • How to segment a 500+ module monorepo into dependency tiers so targeted runs stay fast
  • Common failure modes: implicit dependencies, missing mock_outputs, and run-all ordering bugs

    • Keywords: Terragrunt dependency graph, Terragrunt at scale, OCI module registry, circular dependencies Terraform, platform engineering IaC

    🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

    20 min

About DevOps & Cloud Interview Prep: Real Scenarios & Answers

From the publisher's feed

Real DevOps and Cloud interview questions, answered the way a senior engineer actually would. Each episode breaks down a production scenario — Kubernetes, AWS, Azure, GCP, Terraform, CI/CD, observability, security - with the short answer, the deep dive, and the gotchas interviewers probe for.