DevOps & Cloud Interview Prep: Real Scenarios & Answers

Secret scanning with Gitleaks and pre-commit hooks is your last line of defence before AWS credentials hit a public GitHub repo — here's how to set it up properly in CI.You'll learn:How to install and configure Gitleaks to scan for AWS keys, tokens, and other secrets before a commit landsWhy pre-commit hooks catch leaks that CI pipeline scans miss — and how to wire both togetherWhat to do when a secret has already been pushed: rotation steps, git history scrubbing with git filter-repo, and GitHub secret scanning alertsHow interviewers expect you to reason about defence-in-depth: pre-commit → CI gate → repo-level scanning as layered controlsCommon gotchas: hooks that only run locally, bypassing with --no-verify, and enforcing server-side rulesKeywords: secret scanning CI/CD, Gitleaks pre-commit hook, prevent AWS keys GitHub, DevOps security interview, credentials leaking git🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

Learn how to implement VPC flow log anomaly detection by combining Amazon Detective's graph-based investigation with Athena ML queries to surface real network threats.You'll learn:How Amazon Detective ingests VPC flow logs and builds behavior baselines using machine learning automaticallyWriting Athena ML USING FUNCTION queries against flow log data in S3 to flag statistical outliers in traffic volume or destination portsHow to tie Detective findings back to specific ENIs, IAM roles, and EC2 instances for faster blast-radius assessmentWhere Athena ML ends and Detective begins — and why using both beats either alone for senior-level interviewsCommon gotchas: log format versions, partition projection in Athena, and Detective's 48-hour data warm-up windowKeywords: VPC flow logs anomaly detection, Amazon Detective interview, Athena ML queries AWS, cloud security monitoring interview, AWS network threat detection🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

Architecting a single Karpenter cluster for ML, Backend, and Batch teams means getting NodePool weights and taint-based isolation right — or pods land somewhere expensive and wrong.You'll learn:How to define separate NodePools per team — ml-gpu (p3/p4 instances), backend (m5/m6), and batch-spot (Spot, any family)How Karpenter's spec.weight field drives pool selection: higher weight wins, ties break randomlyThe exact selection sequence — Karpenter first finds every pool that can satisfy the pod, then ranks by weightWhy taints alone aren't enough: pairing gpu=true:NoSchedule and spot=true:NoSchedule with matching tolerations gives you hard isolationSenior gotcha: labels control scheduling preference, taints enforce it — you need both for airtight multi-team separationKeywords: Karpenter NodePool weights, multi-team Kubernetes cluster, Karpenter GPU NodePool, Karpenter spot instances, Kubernetes taint isolation🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

When your security team mandates a specific AMI, private subnets, custom security groups, and encrypted EBS, Karpenter's EC2NodeClass is exactly where all of that infrastructure detail lives.You'll learn:The core separation of concerns: NodePool defines what to provision (requirements, constraints); EC2NodeClass defines how (the cloud-provider infrastructure details)How to pin a specific AMI using amiSelectorTerms and lock nodes to private subnets via tag-based subnetSelectorTermsConfiguring securityGroupSelectorTerms and enforcing EBS encryption through blockDeviceMappings in the EC2NodeClass specHow nodeClassRef wires a NodePool to a NodeClass — and why one NodeClass can back many NodePools, making AMI rotation straightforwardKeywords: Karpenter EC2NodeClass, Karpenter NodePool vs NodeClass, Karpenter AMI selection, Karpenter private subnets, Kubernetes node provisioning security🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

Your cluster is burning 50 nodes at 10% utilization at 2 AM with a stale AMI — here's exactly how Karpenter's disruption engine handles both problems automatically.You'll learn:Setting consolidationPolicy: WhenEmptyOrUnderutilized with a consolidateAfter: 30s window to drain and terminate underutilized nodesHow Karpenter's drift detection compares live node spec against the current NodeClass — and marks nodes drifted when the AMI changesUsing expireAfter: 720h to force a rolling node refresh every 30 days as a TTL safety netWhy consolidation, drift, and expiration are all forms of the same primitive: Karpenter's disruption mechanismKeywords: Karpenter consolidation, Karpenter drift detection, node expiration TTL, Kubernetes node lifecycle, Karpenter NodePool disruption🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

A pending ML training job needing 8 GPUs is a classic Karpenter interview scenario — here's the exact four-step lifecycle an interviewer expects you to walk through.You'll learn:Why the K8s scheduler marks pods unschedulable and how Karpenter's controller watches for that signalHow Karpenter evaluates all pod constraints at once — resource requests, nodeSelector, nodeAffinity, tolerations, and topology spreadHow it calls the EC2 API to select the right instance (p3.16xlarge for 8 GPUs) in the correct availability zoneWhy Karpenter provisions the node but the K8s scheduler still does the final pod binding — a gotcha that trips up a lot of candidatesKeywords: Karpenter node provisioning, Kubernetes GPU scheduling, pending pods interview question, Karpenter vs cluster autoscaler, K8s scheduler lifecycle🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

Migrating a stateful .NET app from Azure VMs to Azure Container Apps without dropping a single request — including SQL Server Always On AG failover — is exactly the kind of scenario senior interviewers throw at platform engineers.You'll learn:How to containerize a stateful .NET app and handle session/state externalization before cutoverAzure Container Apps environment setup: managed environments, Dapr sidecars, and ingress configuration for gradual traffic shiftingSQL Server Always On Availability Group failover patterns — listener routing, read-scale replicas, and avoiding split-brain during migrationBlue/green and weighted traffic strategies in Azure Container Apps to achieve zero-downtime cutoverCommon gotchas: persistent volume claims, connection string management with Key Vault references, and health probe tuningKeywords: Azure Container Apps migration, SQL Server Always On failover, zero downtime .NET containerization, stateful app Azure Kubernetes migration, platform engineering interview🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

Scaling Argo CD across 100+ teams demands more than one cluster — this episode breaks down how to architect multi-tenant Argo CD with SSO, cluster sharding, and hard namespace boundaries.You'll learn:How to integrate SSO (Dex/OIDC) with Argo CD RBAC to enforce per-team access without shared admin credentialsWhen and how to shard Argo CD across multiple Application Controllers to avoid reconciliation bottlenecks at scaleNamespace isolation strategies — AppProject restrictions, resource whitelists, and preventing cross-team blast radiusHow to structure AppProjects so each team only sees and deploys to their own namespaces and clustersCommon gotchas: overlapping RBAC rules, controller memory pressure, and misconfigured destination restrictionsKeywords: Argo CD multi-tenancy, Argo CD SSO OIDC, Argo CD cluster sharding, AppProject namespace isolation, GitOps platform engineering🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

When legacy workloads need NET_RAW, blanket Pod Security Admission enforcement breaks them — this episode walks through using Kyverno mutation policies to handle the exception without weakening your cluster-wide baseline.You'll learn:Why NET_RAW is dropped by the Kubernetes restricted and baseline PSA profiles and what that breaks in practiceHow to write a Kyverno mutate policy that injects a securityContext exception for specific legacy workloadsNamespace-scoping strategies so your mutation doesn't accidentally widen the attack surface cluster-wideHow to test policy enforcement with kubectl --dry-run and Kyverno's CLI before rolling to productionCommon gotchas: policy ordering, admission webhook conflicts, and audit vs enforce mode differencesKeywords: Kyverno mutation policy, Pod Security Admission NET_RAW, Kubernetes pod security, PSA legacy workloads, Kyverno securityContext🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud

Cold start mitigation for Java 21 Lambda at 50K RPS is one of the most punishing interview questions for senior cloud engineers — here's how to compare the three real options without hand-waving.You'll learn:How SnapStart snapshots the Afterburner-restored JVM state and where it still adds latency on restoreWhy Provisioned Concurrency keeps execution environments warm but drives up cost at sustained 50K RPSWhere GraalVM native compilation wins on p99 cold-start time and what you sacrifice in build complexity and reflection supportHow to frame the tradeoff in an interview: cost per invocation, tail latency SLOs, and CI/CD pipeline impactWhich option AWS recommends for high-throughput workloads and why that answer depends on traffic shapeKeywords: Java Lambda cold start, SnapStart vs provisioned concurrency, GraalVM native Lambda, AWS Lambda 50K RPS, Lambda performance tuning🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud