interview real time questions and answers

1. Tell me about yourself.
   I am DevOps Engineer with more than 5 years experience. I started at Southwest Airlines as Cloud Engineer, and after one year I got promoted to DevOps Engineer. Since September 2023 I work at Capital One. Mostly I work with AWS, Kubernetes, Terraform and GitLab CI/CD. I also used Azure, and monitoring tools like Prometheus, Grafana and Datadog. I support production, do on-call, and work on reliability, security and cost. I like to automate manual work and help developers ship apps safely.

2. Why BigTime?
   You are building AI-powered platform, and I think AI brings many good opportunities for DevOps. Your stack is AWS, Kubernetes, Terraform and GitLab, and this is what I work with every day. I also like that engineers get ownership and solve problems independently.

3. What is your day to day?
   In the morning I check alerts and dashboards in Datadog and Grafana. Then standup. Most of the day I work on Terraform, GitLab pipelines and deployments to EKS with Helm. I help developers when deployments fail. I do patching, upgrades, cost and security work. When I am on-call, I handle incidents. I update documentation in Confluence.

4. Tell me about a hard production incident.
   After a release we had 60 replicas in 3 Availability Zones, and HTTP 500 errors went up to 18 percent. I was the on-call engineer. I checked dashboards, logs, Kubernetes deployment status and the deployment history. The errors started with the release, so we rolled back to the last stable version. I checked that pods were healthy and the error rate went down. Root cause was wrong database connection setting in the new version. After this I added canary deployments, smoke tests in the pipeline, automatic rollback on high error rate, and wrote a postmortem and runbook.

5. How do you replace long-lived credentials?
   I move secrets to Vault or AWS Secrets Manager with automatic rotation. Apps on EKS use IAM roles for service accounts, so pods get short-lived credentials. GitLab pipelines use OIDC to assume IAM roles, no static AWS keys. EC2 and Windows servers use instance roles. For RDS, passwords are in Secrets Manager with rotation. This helps with SOC 2 audits too.

6. Windows EC2 in production, you cannot RDP, and you cannot restart. What do you do?
   First I check if the app still works for users, maybe only RDP is broken. I check status checks, security group port 3389, NACL, route table, and the Route 53 record. Then I use SSM Session Manager or Run Command with PowerShell. I check if the RDP service is running and restart only this service, check Windows firewall, CPU, memory and disk space. I look at the console screenshot, system log and CloudWatch metrics. If restart is really needed, I take a snapshot, move traffic to other instances behind the load balancer, talk to the team, and do it in a maintenance window.

7. How did you save $160K?
   I added cost allocation tags so we see who spends what. I rightsized big EC2 instances, turned off dev and test at night and weekends, cleaned unused EBS volumes, snapshots and load balancers. S3 lifecycle policies to cheaper storage. Better EKS node sizing and autoscaling. Savings Plans and Reserved Instances for stable workloads. Budgets and alerts in Cost Explorer and CloudWatch.

8. How did you reduce MTTD by 25 percent?
   I made better dashboards in Grafana and Datadog for each service. Alerts based on real symptoms like error rate, latency and pod restarts. I removed noisy alerts so the team trusts them. I added health checks and synthetic monitoring. Alerts go to PagerDuty and Slack with runbook links.

9. Biggest issue you fixed with Grafana?
   Booking service on EKS was slow every few days. I made a dashboard with memory, restarts and latency together. Memory went up slowly, then pods got OOMKilled and latency jumped. It was a memory leak and low memory limits. Developers fixed the leak, I fixed requests and limits and added alerts for memory growth and restarts.

10. What are the RDS replication types?
    Multi-AZ is synchronous replication to a standby in another Availability Zone, for high availability and automatic failover, you cannot read from it. Read Replicas are asynchronous, for scaling reads and reporting, can be cross-region, and can be promoted for disaster recovery. SQL Server Multi-AZ uses Always On or mirroring.

11. RDS vs Aurora?
    Standard RDS is managed database with its own EBS storage per instance. Aurora is AWS cloud database for MySQL and PostgreSQL. Storage is shared and separate from compute, data copied 6 times across 3 Availability Zones, storage grows automatically. Up to 15 replicas with very low lag, failover under 30 seconds. Aurora is faster but more expensive. Aurora does not support SQL Server.

12. GitLab pipeline with two different AWS roles, how do you configure?
    I use GitLab OIDC. The job gets an ID token and assumes IAM role. Role one is read-only for terraform plan, runs on merge requests. Role two has write permissions for apply and deploy, and the trust policy allows only main branch, protected branch and production environment. Stages are validate, plan, apply, deploy. Apply is manual approval with the saved plan. Deploy updates kubeconfig and runs helm upgrade. In EKS I map the role to RBAC with access entries, so it deploys only to its namespaces.

13. What happens when you type bigtime.net in browser?
    DNS finds the IP with UDP port 53, through the resolver to Route 53. Then TCP three-way handshake, SYN, SYN-ACK, ACK. Then TLS handshake on port 443, server sends certificate and they agree on keys. Then HTTP GET request. Traffic goes through CloudFront or load balancer, then to EC2 or EKS, and the app talks to RDS. Response comes back and browser shows the page.

14. How do you make sure the app uses S3 securely, encryption in transit?
    Bucket policy denies requests when aws:SecureTransport is false, so only HTTPS. I can require TLS 1.2 with s3:TlsVersion. App uses IAM role, least privilege, no keys. VPC gateway endpoint so traffic stays private, and bucket policy limited to this endpoint. Block Public Access on. Check with CloudTrail and AWS Config rule s3-bucket-ssl-requests-only.

15. Some S3 objects are not encrypted with your KMS key, why and how to fix?
    Default encryption works only for new objects, so old objects keep old encryption. Also if the client sends its own encryption header, it overrides the default. I find them with S3 Inventory. I re-encrypt with S3 Batch Operations copy in place. To prevent, bucket policy denies PutObject if encryption is not aws:kms or the key ID is not my key ARN. KMS key policy allows only the right roles. AWS Config for monitoring.

16. Same Terraform module in dev and prod, you add an IP range, dev plan is clean, prod plan wants to destroy route table associations. Why?
    The module uses count with a list. Terraform tracks resources by index. In prod the list is longer or in different order, so new item shifts indexes and Terraform wants to destroy and recreate. Fix is for_each with stable keys like the IP range. Use moved blocks or terraform state mv to move existing resources without destroy. Add prevent_destroy on critical resources, and require approval in the pipeline if prod plan shows destroy. Also check drift with plan -refresh-only and provider versions.

17. Kubernetes app gets 502 for about 10 seconds during every deployment. Readiness probe is present. What do you check?
    Most likely old pods shutting down. Kubernetes sends SIGTERM and removes the pod at the same time, but the load balancer still sends traffic for few seconds. Fix is preStop hook with sleep 10 to 15 seconds, app handles SIGTERM gracefully, terminationGracePeriodSeconds longer than the sleep. Rolling update with maxUnavailable 0 and maxSurge 1. With ALB, enable pod readiness gates and check deregistration delay and keep-alive timeout. Add PodDisruptionBudget. Check ALB logs and pod events.

18. How do you use AI in your work?
    I use chat for quick questions and errors. For bigger tasks I use AI agents like Claude Code. It reads the repo, makes a plan, changes Terraform or pipelines, and runs terraform plan or tests. I review the plan and the changes before merge. Agents use tools through MCP and need limited permissions, like read-only in prod and no apply without human approval. I never put secrets or customer data into AI tools.

Next round they may also ask these, because they are in the job description:

1. How do you deploy and monitor .NET apps?
   I build the app in GitLab CI with dotnet build and dotnet test, then package it. For Windows on EC2, I deploy with PowerShell scripts or SSM Run Command to IIS, and take the server out of the load balancer during deploy. For Linux, I put .NET Core in Docker and deploy to EKS or ECS with Helm. For monitoring I use CloudWatch agent for Windows logs and IIS logs, and Datadog APM or OpenTelemetry for traces, errors and response time.

2. How do you patch Windows and Linux servers?
   I use AWS Systems Manager Patch Manager with patch baselines and maintenance windows. First patch dev and test, then prod. For prod, I patch in groups, so not all servers behind the load balancer go down at once. Before patching I take snapshots. After patching I check the app health and the compliance report in SSM. For EKS nodes I update the AMI and do rolling node replacement.

3. EKS vs ECS vs App Runner?
   EKS is Kubernetes, more control and flexible, good for complex apps, but more work to manage. ECS is AWS own container service, simpler, works well with Fargate and other AWS services. App Runner is the simplest, you give it image or code, and AWS handles everything, good for small web apps and APIs.

4. What is Helmfile?
   Helmfile manages many Helm releases in one file. You define all charts, versions and values for each environment in one place, and run helmfile apply. It is good for keeping environments consistent and works well in CI/CD.

5. What is Terragrunt and why use it?
   Terragrunt is a wrapper for Terraform. It keeps the code DRY, so you don't copy the same backend and provider config in every environment. It manages remote state config, dependencies between modules, and lets you run plan or apply across many modules and accounts.

6. How do you help with SOC 2?
   I make sure access is least privilege with IAM roles and SSO, encryption at rest with KMS and in transit with TLS, logs in CloudTrail and CloudWatch, vulnerability scanning with Inspector or image scanning in the pipeline, and patching. I keep evidence and documentation ready for auditors, like access reviews and change history from GitLab merge requests.

7. What is your disaster recovery approach?
   First we agree on RTO and RPO with the business. Backups for RDS with automated snapshots and cross-region copies, S3 versioning and replication, all infrastructure in Terraform so we can rebuild fast. We write a DR runbook and test it, because a plan that is not tested does not work.

8. Have you worked with Lambda?
   Yes, I used Lambda for automation, like stopping dev instances at night, cleaning old snapshots, and processing S3 events. I deploy it with Terraform, give it a small IAM role, and monitor with CloudWatch logs and alarms for errors and duration.

9. What is Ansible used for?
   Configuration management. It connects to servers over SSH for Linux or WinRM for Windows, and runs playbooks to install software, change config and patch. It is agentless and idempotent, so you can run it many times and it gives the same result.

10. Biggest weakness?
    Sometimes I go too deep into a problem and want to fix it myself. Now I set a time limit, and if I don't solve it, I ask the team early.

11. Where do you see yourself in 3 to 5 years?
    I want to grow into Senior or Lead DevOps Engineer, own bigger parts of the platform, and help build automation and AI tools for the team.