DevOps & Cloud Interview Prep: Real Scenarios & Answers

Jaksot

• Terragrunt at Scale: Dependency Graphs, Circular Deps & OCI Versioning 17.06.2026 19min

  Managing a Terragrunt dependency graph across 500+ modules without hitting circular dependencies or version drift is one of the hardest scaling problems in platform engineering.You'll learn:How to map and audit a large Terragrunt dependency graph using terragrunt graph-dependencies and DAG visualisation toolsPatterns for structuring module hierarchies to prevent circular dependencies before they reach CIEnforcing module versioning with OCI registries — why OCI beats Git tags at this scaleHow to segment a 500+ module monorepo into dependency tiers so targeted runs stay fastCommon failure modes: implicit dependencies, missing mock_outputs, and run-all ordering bugsKeywords: Terragrunt dependency graph, Terragrunt at scale, OCI module registry, circular dependencies Terraform, platform engineering IaC🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• External Secrets Operator: Vault Dynamic Secrets in Kubernetes Without Sidecars 17.06.2026 16min

  External Secrets Operator lets you sync HashiCorp Vault dynamic secrets directly into Kubernetes Secrets — no Vault Agent sidecars, no annotation sprawl.You'll learn:How ESO's ExternalSecret and SecretStore CRDs map Vault paths to Kubernetes SecretsWhy dynamic secrets (short-lived, auto-rotated) are preferable to static tokens and how ESO handles lease renewalThe auth methods ESO supports for talking to Vault — Kubernetes auth vs. AppRole and when to use eachCommon failure modes: stale secrets after Vault seal, RBAC misconfigs, and refresh interval gotchasHow to scope a ClusterSecretStore safely across namespaces without over-permissioningKeywords: External Secrets Operator, HashiCorp Vault Kubernetes integration, dynamic secrets management, Vault sidecar alternative, Kubernetes secrets sync🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Jenkins Helm Deadlocks: Diagnose with jstack and Mutex Locks 16.06.2026 15min

  Parallel Jenkins jobs deploying Helm charts can deadlock silently — here's how to catch and fix mutex contention before it kills your pipeline.You'll learn:Why concurrent Helm deploys compete for the same release lock and how that surfaces as a deadlock in JenkinsHow to run jstack against the Jenkins JVM to capture thread dumps and identify which threads are waiting on a monitor lockReading mutex lock output to pinpoint the blocked executor and the thread holding itHelm-side mitigations: namespace isolation, --atomic flag behaviour, and serialising releases with lockfiles or pipeline lock() stepsWhen to escalate from a workaround to a structural fix — separate agents, dedicated namespaces, or a Helm operator patternKeywords: Jenkins parallel jobs deadlock, Helm chart deployment lock, jstack thread dump Jenkins, mutex lock CI/CD pipeline, Jenkins pipeline concurrency🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• CloudFormation Drift Detection: AWS Config + Lambda Auto-Remediation 16.06.2026 17min

  Learn how to enforce CloudFormation stack drift detection at scale using AWS Config rules and Lambda-driven auto-remediation — a common architecture question in senior Cloud and DevOps interviews.You'll learn:How AWS Config detects configuration drift against CloudFormation expected stack states using managed and custom rulesWiring an EventBridge rule to trigger a Lambda function when Config flags a stack as DRIFTEDLambda remediation patterns: re-running cloudformation detect-stack-drift vs. forcing a stack update to reconcile out-of-band changesGotchas around drift detection cost, IAM permissions for the Config recorder, and distinguishing intentional changes from real driftHow to scope remediation safely — alerting vs. hard auto-rollback and when each is appropriate in productionKeywords: CloudFormation drift detection, AWS Config auto-remediation, Lambda CloudFormation remediation, IaC drift enforcement, AWS Config rules interview🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• DynamoDB Multi-Region Cost: Cut Data Transfer 70% 15.06.2026 24min

  Reducing DynamoDB Global Tables data transfer costs by 70% is achievable in a multi-region Active-Active setup — if you know where the money is actually going.You'll learn:Why replicated write costs dominate in DynamoDB Global Tables and how to model them accuratelyUsing write sharding and conditional writes to reduce unnecessary replication trafficDAX (DynamoDB Accelerator) placement per region to cut cross-region read fallbackArchitecting read patterns to stay local — avoiding the latency and cost of cross-region readsCost monitoring with AWS Cost Explorer tags scoped to replication vs. application trafficKeywords: DynamoDB Global Tables cost optimization, multi-region Active-Active AWS, DynamoDB replication costs, AWS data transfer cost reduction🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Flyway + Kubernetes: Rolling Back Failed DB Migrations 15.06.2026 25min

  When a database migration fails mid-deploy, your Kubernetes job hooks and Flyway versioning strategy are the difference between a five-minute fix and a 2am incident.You'll learn:How to structure Flyway versioned and undo migrations so a failed V3 doesn't leave your schema in a half-applied stateUsing Kubernetes init containers and Job postStart/preStop hooks to gate application rollout on migration success or failureWhy flyway repair matters when checksums break and how to use it safely in CI pipelinesPatterns for keeping application code and schema changes in sync across canary and blue-green deploymentsWhat interviewers actually want to hear when they ask about zero-downtime schema migrations at scaleKeywords: Flyway rollback strategy, Kubernetes job hooks database, schema versioning DevOps interview, failed database migration recovery🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Terraform Apply Timeouts: IAM Role Batching at Scale 14.06.2026 22min

  When terraform apply times out creating 100+ IAM roles, the culprit is usually AWS API throttling combined with Terraform's default parallelism — here's how to fix it.You'll learn:Why the default parallelism=10 isn't always safe and when raising it to -parallelism=50 helps vs. hurtsHow AWS IAM's eventual-consistency model causes race conditions during bulk role creationBatching strategies: splitting large role sets across multiple terraform apply runs or using for_each with targeted appliesReading AWS API throttle errors in Terraform debug output (TF_LOG=DEBUG) to confirm the real bottleneckExponential backoff and retry tuning via the AWS provider's max_retries settingKeywords: terraform apply timeout, AWS IAM role throttling, terraform parallelism, terraform at scale, IAM API rate limits🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• GitHub Actions at 10K Daily Builds: Runner Strategy for Scale 14.06.2026 24min

  When GitHub Actions pipelines hit thousands of daily builds, your runner strategy becomes a first-class infrastructure decision — here's how to choose between self-hosted runners, larger hosted runners, and the Kubernetes executor.You'll learn:How GitHub-hosted larger runners (up to 64-core) reduce ops overhead versus self-hosted, and where the cost curve flipsSelf-hosted runner autoscaling with actions-runner-controller (ARC) on Kubernetes — ephemeral pods per job, KEDA-based scaling triggersKubernetes executor trade-offs: pod startup latency, RBAC isolation, and shared caching via persistent volumes or S3-backed artifact storesQueue depth, job concurrency limits, and why runner group segmentation matters at 10K+ builds per dayCommon failure modes: runner re-use contamination, Docker-in-Docker socket conflicts, and rate-limit exhaustion on the GitHub APIKeywords: GitHub Actions self-hosted runners, actions-runner-controller Kubernetes, scaling CI pipelines, GitHub larger runners, ARC autoscaling🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• FIPS 140-3 on EKS: Bottlerocket OS and KMS Hardware Modules 13.06.2026 16min

  Enforcing FIPS 140-3 compliance on an EKS cluster means locking down every layer — from the OS to the key management hardware — and this episode walks through exactly how Bottlerocket and AWS KMS make that possible.You'll learn:Why Bottlerocket OS ships with a FIPS-validated kernel and how to verify its cryptographic module status at node bootstrapHow AWS KMS custom key stores backed by CloudHSM satisfy the hardware security module requirement under FIPS 140-3Enforcing TLS 1.2+ with FIPS-approved cipher suites across EKS control plane and data plane communicationIAM and pod-level controls to ensure workloads only call FIPS-compliant API endpointsCommon audit failures — weak cipher negotiation, unvalidated node images — and how to catch them before an assessor doesKeywords: FIPS 140-3 EKS, Bottlerocket FIPS compliance, AWS KMS CloudHSM, EKS security hardening, FIPS validated Kubernetes🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• AWS Lookout for Metrics: Killing Alert Fatigue at Scale 13.06.2026 17min

  When you're drowning in 1,000+ alerts a day, AWS Lookout for Metrics can route only the anomalies that matter directly to Slack or Teams — here's how to wire it up.You'll learn:How AWS Lookout for Metrics uses ML to separate real anomalies from noise across CloudWatch, S3, and RDS data sourcesRouting detected anomalies to Slack or Microsoft Teams via SNS topics and Lambda webhook integrationsTuning sensitivity thresholds to reduce false positives without missing critical incidentsGrouping related alerts into a single notification so on-call engineers see context, not a flood of individual triggersWhere Lookout for Metrics fits alongside existing tools like PagerDuty, OpsGenie, and CloudWatch AlarmsKeywords: alert fatigue DevOps, AWS Lookout for Metrics, ML anomaly detection AWS, Slack alerting pipeline, SRE on-call interview questions🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Cross-Account IAM Roles: Auditing with Access Analyzer 12.06.2026 19min

  Auditing cross-account IAM roles is one of those senior interview topics where vague answers kill your chances — here's how to use AWS IAM Access Analyzer and Policy Sentry to give a precise, credible response.You'll learn:How IAM Access Analyzer detects externally accessible roles and flags unintended cross-account trust relationshipsHow Policy Sentry helps you write and audit least-privilege IAM policies by mapping actions to resource ARNsThe difference between resource-based and identity-based policy analysis — and why interviewers expect you to know bothHow to interpret Access Analyzer findings and translate them into remediation steps during a live interviewCommon gotchas: why a role with no findings isn't necessarily safe, and how SCPs interact with cross-account accessKeywords: cross-account IAM roles, AWS IAM Access Analyzer, Policy Sentry, least privilege IAM, cloud security interview questions🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Container Runtime Security: seccomp, AppArmor & eBPF LSM 10.06.2026 18min

  Blocking zero-day exploits in container runtimes means layering seccomp, AppArmor, and eBPF LSM hooks — and knowing exactly where each one fits in the kernel's enforcement chain.You'll learn:How seccomp profiles restrict syscall surfaces and which calls are most dangerous to leave open in container workloadsWriting and applying AppArmor profiles to constrain file, network, and capability access at the container levelWhere eBPF LSM hooks sit relative to seccomp and AppArmor — and why stacking them closes gaps neither covers aloneCommon misconfigurations that leave runtime defenses bypassable even when all three are nominally enabledHow to audit enforcement gaps using tools like bpftrace, strace, and amicontainedKeywords: container runtime security, seccomp profiles Kubernetes, AppArmor containers, eBPF LSM hooks, zero-day exploit prevention🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• FinOps 2.0: Forecast GenAI Cloud Spend with AWS Cost Explorer and Prophet 10.06.2026 14min

  Forecasting cloud spend for a generative AI workload means dealing with wildly variable GPU instance costs, token-based API charges, and inference traffic spikes — here's how to model it with the AWS Cost Explorer API and Facebook Prophet.You'll learn:How to pull historical cost data via the AWS Cost Explorer API using get_cost_and_usage with granularity and filter parameters scoped to your GenAI servicesWhy Prophet handles the irregular seasonality and step-change cost patterns common in AI workloads better than ARIMA-style modelsHow to separate fixed infrastructure costs (SageMaker endpoints, EKS nodes) from variable token/inference costs before feeding data into your forecast modelHow to set anomaly detection thresholds and wire Cost Explorer Anomaly Detection alongside your Prophet forecast as a sanity checkFinOps tagging strategy for GenAI apps — without clean cost allocation tags, your forecast data is noiseKeywords: FinOps cloud cost forecasting, AWS Cost Explorer API, Prophet ML forecasting, generative AI cloud spend, SageMaker cost optimization🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Secret Scanning in CI: Stop AWS Keys Leaking to GitHub 08.06.2026 28min

  Secret scanning with Gitleaks and pre-commit hooks is your last line of defence before AWS credentials hit a public GitHub repo — here's how to set it up properly in CI.You'll learn:How to install and configure Gitleaks to scan for AWS keys, tokens, and other secrets before a commit landsWhy pre-commit hooks catch leaks that CI pipeline scans miss — and how to wire both togetherWhat to do when a secret has already been pushed: rotation steps, git history scrubbing with git filter-repo, and GitHub secret scanning alertsHow interviewers expect you to reason about defence-in-depth: pre-commit → CI gate → repo-level scanning as layered controlsCommon gotchas: hooks that only run locally, bypassing with --no-verify, and enforcing server-side rulesKeywords: secret scanning CI/CD, Gitleaks pre-commit hook, prevent AWS keys GitHub, DevOps security interview, credentials leaking git🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• VPC Flow Log Anomaly Detection: Amazon Detective + Athena ML 08.06.2026 12min

  Learn how to implement VPC flow log anomaly detection by combining Amazon Detective's graph-based investigation with Athena ML queries to surface real network threats.You'll learn:How Amazon Detective ingests VPC flow logs and builds behavior baselines using machine learning automaticallyWriting Athena ML USING FUNCTION queries against flow log data in S3 to flag statistical outliers in traffic volume or destination portsHow to tie Detective findings back to specific ENIs, IAM roles, and EC2 instances for faster blast-radius assessmentWhere Athena ML ends and Detective begins — and why using both beats either alone for senior-level interviewsCommon gotchas: log format versions, partition projection in Athena, and Detective's 48-hour data warm-up windowKeywords: VPC flow logs anomaly detection, Amazon Detective interview, Athena ML queries AWS, cloud security monitoring interview, AWS network threat detection🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Karpenter Multi-Team Clusters: NodePools, Weights & Isolation 06.06.2026 38min

  Architecting a single Karpenter cluster for ML, Backend, and Batch teams means getting NodePool weights and taint-based isolation right — or pods land somewhere expensive and wrong.You'll learn:How to define separate NodePools per team — ml-gpu (p3/p4 instances), backend (m5/m6), and batch-spot (Spot, any family)How Karpenter's spec.weight field drives pool selection: higher weight wins, ties break randomlyThe exact selection sequence — Karpenter first finds every pool that can satisfy the pod, then ranks by weightWhy taints alone aren't enough: pairing gpu=true:NoSchedule and spot=true:NoSchedule with matching tolerations gives you hard isolationSenior gotcha: labels control scheduling preference, taints enforce it — you need both for airtight multi-team separationKeywords: Karpenter NodePool weights, multi-team Kubernetes cluster, Karpenter GPU NodePool, Karpenter spot instances, Kubernetes taint isolation🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Karpenter EC2NodeClass: AMI, Subnets, and EBS Config 05.06.2026 36min

  When your security team mandates a specific AMI, private subnets, custom security groups, and encrypted EBS, Karpenter's EC2NodeClass is exactly where all of that infrastructure detail lives.You'll learn:The core separation of concerns: NodePool defines what to provision (requirements, constraints); EC2NodeClass defines how (the cloud-provider infrastructure details)How to pin a specific AMI using amiSelectorTerms and lock nodes to private subnets via tag-based subnetSelectorTermsConfiguring securityGroupSelectorTerms and enforcing EBS encryption through blockDeviceMappings in the EC2NodeClass specHow nodeClassRef wires a NodePool to a NodeClass — and why one NodeClass can back many NodePools, making AMI rotation straightforwardKeywords: Karpenter EC2NodeClass, Karpenter NodePool vs NodeClass, Karpenter AMI selection, Karpenter private subnets, Kubernetes node provisioning security🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Karpenter Consolidation & Drift: 2 AM Node Cleanup 28.02.2026 25min

  Your cluster is burning 50 nodes at 10% utilization at 2 AM with a stale AMI — here's exactly how Karpenter's disruption engine handles both problems automatically.You'll learn:Setting consolidationPolicy: WhenEmptyOrUnderutilized with a consolidateAfter: 30s window to drain and terminate underutilized nodesHow Karpenter's drift detection compares live node spec against the current NodeClass — and marks nodes drifted when the AMI changesUsing expireAfter: 720h to force a rolling node refresh every 30 days as a TTL safety netWhy consolidation, drift, and expiration are all forms of the same primitive: Karpenter's disruption mechanismKeywords: Karpenter consolidation, Karpenter drift detection, node expiration TTL, Kubernetes node lifecycle, Karpenter NodePool disruption🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Karpenter Lifecycle: How GPU Pods Get Unstuck 26.01.2026 39min

  A pending ML training job needing 8 GPUs is a classic Karpenter interview scenario — here's the exact four-step lifecycle an interviewer expects you to walk through.You'll learn:Why the K8s scheduler marks pods unschedulable and how Karpenter's controller watches for that signalHow Karpenter evaluates all pod constraints at once — resource requests, nodeSelector, nodeAffinity, tolerations, and topology spreadHow it calls the EC2 API to select the right instance (p3.16xlarge for 8 GPUs) in the correct availability zoneWhy Karpenter provisions the node but the K8s scheduler still does the final pod binding — a gotcha that trips up a lot of candidatesKeywords: Karpenter node provisioning, Kubernetes GPU scheduling, pending pods interview question, Karpenter vs cluster autoscaler, K8s scheduler lifecycle🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
• Azure Container Apps Migration: Zero-Downtime .NET & SQL AG 18.09.2025 16min

  Migrating a stateful .NET app from Azure VMs to Azure Container Apps without dropping a single request — including SQL Server Always On AG failover — is exactly the kind of scenario senior interviewers throw at platform engineers.You'll learn:How to containerize a stateful .NET app and handle session/state externalization before cutoverAzure Container Apps environment setup: managed environments, Dapr sidecars, and ingress configuration for gradual traffic shiftingSQL Server Always On Availability Group failover patterns — listener routing, read-scale replicas, and avoiding split-brain during migrationBlue/green and weighted traffic strategies in Azure Container Apps to achieve zero-downtime cutoverCommon gotchas: persistent volume claims, connection string management with Key Vault references, and health probe tuningKeywords: Azure Container Apps migration, SQL Server Always On failover, zero downtime .NET containerization, stateful app Azure Kubernetes migration, platform engineering interview🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud