20 DevOps Interview Questions (And What Interviewers Are Actually Listening For)

Most DevOps interview question lists are just glossaries — "What is Docker?" followed by a textbook definition. That's not how real interviews work. A good interviewer isn't checking whether you memorized a term; they're checking whether you've actually operated these systems under real conditions. Here's a set of questions organized by category, with a note on what a strong answer actually reveals.

CI/CD

1. Walk me through what happens from a `git push` to production in a pipeline you've built. — Tests whether you've actually built one end-to-end, not just used one someone else configured.
2. What's the difference between a rolling deployment and a blue/green deployment, and when would you choose one over the other? — Tests judgment about downtime, rollback speed, and cost tradeoffs, not just definitions.
3. How do you handle a secret (API key, DB password) in a pipeline without leaking it into logs or version control? — A very common real-world mistake; strong candidates mention secret managers, masked variables, and least-privilege access.
4. Describe a pipeline failure you had to debug. What was your process? — Listening for a systematic approach: reproduce, isolate, check logs, roll back if needed — not just "I fixed it."
5. What's your rollback strategy if a deployment breaks production at 2 AM? — Tests whether you think about failure paths in advance, not just the happy path.

Containers & Kubernetes

1. What's the difference between a Docker image and a container? — Basic, but a surprising number of candidates blur this.
2. How does a Kubernetes Service route traffic to Pods, and what happens during a rolling update? — Tests whether you understand the mechanism, not just that "it load balances."
3. What's the difference between a Deployment and a StatefulSet, and when do you need a StatefulSet? — Reveals whether you've dealt with stateful workloads (databases, queues) in K8s, which is harder than stateless apps.
4. How do you debug a Pod stuck in CrashLoopBackOff? — Listening for `kubectl logs`, `kubectl describe`, checking resource limits, and readiness/liveness probes — the actual troubleshooting sequence.
5. What are resource requests and limits, and what happens if you don't set them? — Tests understanding of scheduling and noisy-neighbor problems, not just syntax.

Infrastructure as Code

1. What's Terraform state, and why is it dangerous to edit or lose it? — Reveals whether you understand *why* remote state and locking matter, not just that they exist.
2. How do you structure Terraform code for multiple environments (dev/staging/prod) without duplicating everything? — Tests real project experience with modules and workspaces.
3. What's the blast radius if someone runs `terraform apply` with a stale plan? — Tests whether you think about safety mechanisms, not just the happy path of provisioning.
4. CloudFormation vs. Terraform — when would you pick one over the other? — Tests whether you have an actual opinion grounded in tradeoffs, not just brand loyalty.

Monitoring & Incident Response

1. What metrics would you alert on for a production API, and why those specifically? — Tests whether you understand alert fatigue and signal vs. noise, not just "alert on everything."
2. Tell me about an incident you were part of. What was the timeline, and what changed afterward? — Listening for a blameless postmortem mindset and concrete follow-up actions, not just a war story.
3. What's the difference between logs, metrics, and traces, and when do you reach for each? — Basic observability literacy that's surprisingly often missing.
4. How do you know a deployment is healthy before you consider it "done"? — Tests whether verification is part of your process or an afterthought.

Security (DevSecOps)

1. Where in a CI/CD pipeline would you add security scanning, and what would you scan for? — Tests whether you think about security as a pipeline stage (SAST, container scanning, secret scanning) rather than a separate afterthought.
2. What's the principle of least privilege, and give a real example of applying it to an IAM role. — Tests whether this is a practiced habit or a term you've only read about.

If you can answer most of these with a specific example from something you've actually built — even a personal lab project — you're already ahead of most candidates. That's exactly why our DevOps training is built around hands-on labs and capstone projects instead of slides: it gives you real answers to questions like these, not memorized definitions.