Conquering the DevOps Interview: A Comprehensive Guide to Top Questions and Answers

Submit an interview question

Questions and answers sent in will be looked over and edited by Toptal, LLC, and may or may not be posted, at their sole discretion.

Toptal sourced essential questions that the best DevOps engineers can answer. Driven from our community, we encourage experts to submit questions and offer feedback.

What challenges exist when creating DevOps pipelines?

Database migrations and new features are common challenges increasing the complexity of DevOps pipelines.

Feature flags are a common way of dealing with incremental product releases inside of CI environments.

The system might not be usable after a failed database migration that was set to run at a certain time. There are multiple ways to prevent and mitigate potential issues:

• The deployment is actually triggered in multiple steps. The first step in the pipeline starts the process of making the app. The migrations are run in the application context. The migrations will start the deployment pipeline if they go well; if not, the application won’t be deployed.
• Define a convention that all migrations must be backwards compatible. All features are implemented using feature flags in this case. Application rollbacks are therefore independent of the database.
• Make a Docker-based app that builds a separate production mirror from scratch every time it is deployed. This production mirror is used for integration tests without the risk of damaging any important infrastructure.

It is always recommended to use database migration tools that support rollbacks. 2 .

How do Containers communicate in Kubernetes?

A Pod is a mapping between containers in Kubernetes. A Pod may contain multiple containers. In an overlay network, pods have a flat network hierarchy and talk to each other in a flat way. This means that any pod in the overlay network could theoretically talk to any other pod. 3 .

How do you restrict the communication between Kubernetes Pods?

If the CNI network plugin you use supports the Kubernetes network policy API, Kubernetes lets you set network policies that limit who can access the network.

Policies can restrict based on IP addresses, ports, and/or selectors. (Selectors are a Kubernetes-specific feature that allow connecting and associating rules or components between each other. For example, you may connect specific volumes to specific Pods based on labels by leveraging selectors. ).

Apply to Join Toptals Development Network

and enjoy reliable, steady, remote Freelance DevOps Engineer Jobs

What is a Virtual Private Cloud or VNet?

Cloud providers allow fine grained control over the network plane for isolation of components and resources. In general there are a lot of similarities among the usage concepts of the cloud providers. As you dig deeper, though, you’ll find that different cloud service providers handle this separation in very different ways.

In Azure, this is known as a Virtual Network (VNet). In AWS and GCE, it’s known as a Virtual Private Cloud (VPC).

These technologies segregate the networks with subnets and use non-globally routable IP addresses.

Routing differs among these technologies. In AWS, customers have to set their own routing tables, but in Azure VNets, all resources let traffic flow using the system route.

Security policies also contain notable differences between the various cloud providers. 5 .

How do you build a hybrid cloud?

There are multiple ways to build a hybrid cloud. A common way is to create an VPN tunnel between the on-premise network and the cloud VPC/VNet.

AWS Direct Connect or Azure ExpressRoute connects a private data center to the VPC without going through the public internet. This is the method of choice for large production deployments. 6 .

What is CNI, how does it work, and how is it used in Kubernetes?

The Container Network Interface (CNI) is an API specification that is focused around the creation and connection of container workloads.

CNI has two main commands: add and delete. Configuration is passed in as JSON data.

As soon as the CNI plugin is added, a virtual Ethernet device pair is made and linked between the Host network namespace and the Pod network namespace. Once IPs and routes are created and assigned, the information is returned to the Kubernetes API server.

An important feature that was added in later versions is the ability to chain CNI plugins. 7 .

How does Kubernetes orchestrate Containers?

Kubernetes Containers are scheduled to run based on their scheduling policy and the available resources.

A queue holds all the Pods that need to run. The scheduler then takes a pod from the queue and sets a time for it to run. If it fails, the error handler adds it back to the queue for later scheduling. 8 .

What is the difference between orchestration and classic automation? What are some common orchestration solutions?

Classic automation includes automating software installation and system configuration, such as setting up users, permissions, and security baselines. Orchestration, on the other hand, is more concerned with how existing and new services connect and work together. (Configuration management covers both classic automation and orchestration. ).

Most cloud providers have components for application servers, caching servers, block storage, message queueing databases etc. They can usually be configured for automated backups and logging. All of these parts are provided by the cloud provider, so all that needs to be done to make an infrastructure solution is to put them together.

The amount of traditional automation that needs to be done in the cloud depends on how many parts can be used. The more existing components there are the less classic automatic is necessary.

In local or On-Premise settings, you have to automate the creation of these parts before you can put them together.

For AWS a common solution is CloudFormation, with lots of different types of wrappers around it. Azure uses deployments and Google Cloud has the Google Deployment Manager.

A common orchestration solution that is cloud-provider-agnostic is Terraform. It is closely connected to all clouds and provides a standard language for describing states. This language describes resources (like virtual machines, networks, and subnets) and data (which refers to current states on the cloud). ).

These days, most configuration management tools come with parts for managing the cloud providers’ orchestration solutions or APIs. 9 .

What is the difference between CI and CD?

CI stands for “continuous integration” and CD is “continuous delivery” or “continuous deployment. ” CI is the foundation of both continuous delivery and continuous deployment. Continuous delivery and continuous deployment automate releases whereas CI only automates the build.

The goal of continuous delivery is to make software that can be released at any time. However, releases to production are still chosen by hand and done by someone. Continuous deployment goes one step further and actually releases these components to production systems. 10 .

Describe some deployment patterns.

Blue Green Deployments and Canary Releases are common deployment patterns.

In blue green deployments you have two identical environments. The “green” environment hosts the current production system. Deployment happens in the “blue” environment.

Problems are checked in the “blue” environment, and if everything is fine, load balancing and other parts are moved from the “green” environment to the “blue” one.

Canary releases are ones that only give certain features to a small group of users to lower the risk of releasing new features to everyone. 11 .

[AWS] How do you setup a Virtual Private Cloud (VPC)?

VPCs on AWS generally consist of a CIDR with multiple subnets. Every VPC in AWS can have one internet gateway (IG), which is used to send and receive traffic from and to the internet. The subnet with the IG is considered the public subnet and all others are considered private.

The components needed to create a VPC on AWS are described below:

• Making a new VPC resource that is empty and gives it a CIDR
• A public subnet that parts of the system can be reached from the internet This subnet requires an associated IG.
• A private network that can connect to the internet through a NAT gateway The NAT gateway is positioned inside the public subnet.
• A route table for each subnet.
• Two routes, each with its own route table: one routes traffic through the IG and the other routes traffic through the NAT gateway.
• The route tables are then associated to their respective subnets.
• Then, a security group decides what kind of traffic can come in and go out.

This methodology is conceptually similar to physical infrastructure. 12 .

Describe IaC and configuration management.

The idea behind Infrastructure as Code (IaC) is that infrastructure configuration should be managed and tracked in files instead of by hand or through graphical user interfaces. This makes it easier to expand the infrastructure and, more importantly, it makes it easier to see what changes have been made by using a versioning system.

Configuration management systems are software systems that allow managing an environment in a consistent, reliable, and secure way.

Using a domain-specific language (DSL) that is optimized to describe the state and configuration of system components lets many people work together on the system configuration of thousands of servers at the same time.

CFEngine was among the first generation of modern enterprise solutions for configuration management.

Their goal was to create a space that could be used again and again by automating tasks like setting up users, groups, and responsibilities and installing software.

Second generation systems brought configuration management to the masses. Puppet and Chef can both run on their own, but most of the time they are set up in master/agent mode, where the master sends configuration to the agents.

Ansible is new compared to the aforementioned solutions and popular because of the simplicity. The configuration is stored in YAML and there is no central server. The state configuration is transferred to the servers through SSH (or WinRM, on Windows) and then executed. The downside of this procedure is that it can become slow when managing thousands of machines. 13 .

How do you design a self-healing distributed service?

Any system that claims to be able to fix itself must be able to deal with errors and splitting (i.e. e. when part of the system cannot access the rest of the system) to a certain extent.

For databases, a common way to deal with partition tolerance is to use a quorum for writes. This means that every time something is written, a minimum number of nodes must confirm the write.

The minimum number of nodes necessary to gracefully recover from a single-node fault is three nodes. That way the healthy two nodes can confirm the state of the system.

For cloud applications, it is common to distribute these three nodes across three availability zones. 14 .

Describe a centralized logging solution.

Logging solutions are used for monitoring system health. Both events and metrics are generally logged, which may then be processed by alerting systems. Metrics could be any kind of continuous data that is always being watched, like load, storage space, memory, or anything else. It allows detecting events that diverge from a baseline.

Event-based logging, on the other hand, might include things like application exceptions that are sent to a central location to be analyzed, fixed bugs, or processed further.

A commonly used open-source logging solution is the Elasticsearch-Kibana-Logstash (ELK) stack. Stacks like this generally consist of three components:

• A storage component, e.g. Elasticsearch.
• A daemon that reads logs or metrics, like Logstash or Fluentd In taking in a lot of data and adding or processing metadata while it does so is its job. For example, it might add geolocation information for IP addresses.
• A visualization tool like Kibana that can show important pictures of the current state of the system at any time

Most cloud solutions either have their own centralized logging solutions with one or more of the above products or connect them to the infrastructure they already have. For example, AWS CloudWatch has all of the above features and is deeply integrated into every part of AWS. It also lets you send data at the same time to AWS S3 for cheap long-term storage.

Another popular commercial solution for centralized logging and analysis both on premise and in the cloud is Splunk. Splunk is thought to be very scalable, and it’s often used as a Security Information and Event Management (SIEM) system. It also supports advanced table and data models.

There is more to interviewing than tricky technical questions, so these are intended merely as a guide. Not every good candidate for the job will be able to answer all of them, and answering all of them doesn’t mean they are a good candidate. At the end of the day, hiring remains an art, a science — and a lot of work.

Tired of interviewing candidates? Not sure what to ask to get you a top hire?

Let Toptal find the best people for you.

Our Exclusive Network of DevOps Engineers

Looking to land a job as a DevOps Engineer?

Let Toptal find the right job for you.

Job Opportunities From Our Network

3+ yrs DevOps Engineer LIVE Interview #interviewquestions #devopstraining #cloudtraining #devops

FAQ

What do they ask in a DevOps interview?

How do I ace DevOps interview?

What are the basic DevOps interview questions?

We’ve divided the questions into basic DevOps interview questions and advanced DevOps interview questions. 1. What is DevOps? DevOps is a software development practice where development and IT operations are combined from the initial point of designing a product to deployment in the markets. 2. What is the basic premise of DevOps?

What questions do devops engineers ask?

Interviewers may also ask a series of in-depth questions that require multistep answers to assess your problem-solving skills and evaluate your experience in greater detail. Here are a few in-depth DevOps engineer interview questions: Provide a portfolio of your DevOps projects and explain each.

What does a DevOps job look like?

DevOps methodology relies on collaboration between the operations team and the development team of an organization. Accordingly, a DevOps position requires you to showcase a combination of skills during an interview.

What are the most critical questions related to DevOps?

“One of the most critical questions related to DevOps is related to DevOps tools…” It is not enough to be aware of DevOps tools (anybody can Google them) but a seasoned developer should be able to recommend the most suitable tool as per the client’s needs.