DevOps Interview Questions 2026: 15 Real Questions, Model Answers and the Red Flags to Avoid

Your build is green, your Terraform plan is clean, and the interviewer asks why the deployment that worked in staging returned 502s in production for eleven minutes. That is the real DevOps interview. Everything before it is a filter.

Take an illustrative candidate: Nikhil, a Java developer since 2019 at a mid-size Pune product company who drifted into being the de facto release person. He has debugged Helm charts at midnight and never once had to explain it to a stranger in forty five minutes. His knowledge is shaped like scar tissue rather than answers.

What DevOps Interview Questions Actually Test in 2026

A typical Indian product or GCC loop runs three to four rounds: a screening call on tooling vocabulary, a technical round on CI/CD and infrastructure as code, a troubleshooting scenario, and a manager round on ownership and on-call. The tooling round is easiest to prepare and least predictive, which is why panels now weight scenarios. What rises with seniority is the size of the thing you are expected to own.

The signal behind each question

DevOps Interview Questions on Fundamentals and Culture (Q1 to Q4)

Q1. What is DevOps, in your own words? Answer in loop time: it is shortening the distance between a code change and verified evidence that the change works in production, and making the people who wrote it responsible for that evidence. Then attach your own number. "A change took nine days to reach production and we cut it to under a day by deleting a manual UAT gate" is a complete answer.

Q2. Which metrics prove a DevOps change worked? Deployment frequency, lead time for change, change failure rate, time to restore. Say which you would move first. The 2025 DORA research found that teams adopting AI coding tools increased throughput while delivery instability rose too, which hands you the argument that lead time quoted without change failure rate is a vanity metric.

Q3. What is a blameless postmortem, and have you run one? The point is not kindness. Engineers hide causes from systems that punish them, so blame costs you the data. Describe the artefact: a timeline, contributing factors, the detection gap, and actions with owners and dates. If you have never run one, say so, then describe the one that should have happened.

Q4. Continuous delivery or continuous deployment? Delivery means every passing commit is releasable and a human presses the button. Deployment removes the human. Name the condition you would need: automated rollback plus a change failure rate low enough that an unattended bad deploy is survivable. For a two person platform team at a mid-size insurer, delivery is the right ceiling. Say so. Also read: What Is CI/CD?

CI/CD Interview Questions: Secrets, Cache and Build Time (Q5 to Q8)

Q5. Your pipeline takes 28 minutes. Reduce it. Refuse to guess: ask for per step timings first. Then work the levers in payoff order, which is caching dependency installs, splitting tests across parallel jobs, skipping jobs whose paths did not change, and only then bigger runners. Know the cost side too. GitHub's Free plan includes 2,000 Actions minutes a month for private repositories and is unmetered on standard runners for public ones, with Linux overage around $0.006 a minute as of January 2026. A careless matrix build is a real invoice.

Q6. Show me how you cache and prevent overlapping deploys. Two blocks earn their keep on the whiteboard:

name: ci
on: [push]
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip
      - run: pip install -r requirements.txt
      - run: pytest -n auto --maxfail=1

The concurrency block is the one most candidates miss. Without it, three pushes in a minute become three overlapping deploys and a race you debug on a Saturday.

Q7. How do you manage secrets across environments? Three parts: OIDC federation from CI to the cloud, so no long lived access key exists to leak; a dedicated store such as Vault for anything the app reads at runtime; a rotation schedule with a named owner. Add that you scan for secrets in pre-commit rather than only in CI, because by CI the secret is already in git history.

Q8. Which deployment strategy have you actually run, and what did it cost? Rolling, blue-green and canary are not interchangeable. Blue-green doubles compute for the overlap window, which on a 40 node cluster is a number you should estimate aloud. Canary needs traffic shaping and a metric to promote on, which is why teams reach for Argo Rollouts; the project shipped Rollouts v1.10.0 on 5 August 2026 and Argo CD 3.5.3 on 14 September 2026. Only ever done rolling updates? Say so, then say what you would need before attempting canary.

Terraform Interview Questions: State, Locking and Drift (Q9 to Q11)

Terraform interview questions converge on state, because state is where teams hurt themselves. The current stable line is Terraform 1.16, with 1.16.4 released on 23 September 2026.

Q9. What is Terraform state and why does it matter? It maps resources in your configuration to real resources in the cloud, with their last known attributes, so without it Terraform cannot tell "create this" from "update that". It also holds sensitive attribute values, which makes a state file committed to git a security incident waiting for a date.

Q10. Two engineers run apply at the same time. What happens? Without locking, interleaved writes corrupt state. With a locking remote backend, the second apply waits. The current S3 answer is native locking, introduced in Terraform 1.10 and stabilised in 1.11, which replaces the DynamoDB table pattern:

terraform {
  backend "s3" {
    bucket       = "acme-tfstate-prod"
    key          = "platform/network/terraform.tfstate"
    region       = "ap-south-1"
    encrypt      = true
    use_lockfile = true
  }
}

Terraform writes a small .tflock object beside the state file using S3 conditional writes. If a run dies mid-apply and leaves the lock held, you clear it deliberately with the lock ID from the error message:

$ terraform apply
Error: Error acquiring the state lock
  ID:        9f2c1d44-7b0e-4a11-9c2f-0d55e1b3a842
  Operation: OperationTypeApply

$ terraform force-unlock 9f2c1d44-7b0e-4a11-9c2f-0d55e1b3a842
$ terraform state list | head

Say the quiet part: force-unlock is safe only after confirming no apply is still running. Candidates who reach for it reflexively are the reason state gets corrupted. The sibling question is drift. Detect it with terraform plan in a scheduled CI job that fails on a non-empty diff, and prevent it by removing console write access in production.

Q11. When would you not use Terraform? A trade-off question, so take a position. Terraform is weak at ordering steps inside an application release and at stateful work needing a sequence of API calls, so I would not use it for database migrations or for Kubernetes application manifests that a GitOps controller handles better. Also read: What Is Infrastructure as Code? On the Azure side, the AZ-305 and AZ-400 program covers the same ground with Bicep and Azure Pipelines.

Kubernetes Interview Questions: Triage and Blue-Green (Q12 to Q14)

Kubernetes interview questions reward operators over readers, and current knowledge. Versions 1.37.1, 1.36.5 and 1.35.9 all shipped on 15 September 2026, the project maintains only the three newest minor branches, and 1.34 reaches end of life on 27 October 2026. If your cluster is older, be ready to say why.

Q12. Deployment, StatefulSet or DaemonSet? Deployments manage interchangeable stateless pods and will replace any of them without ceremony. StatefulSets give stable network identities and stable volume claims, which a three node database replica set needs. DaemonSets put one pod on every node, which is how log shippers work. The follow up is usually "so where does Kafka go", and the answer is StatefulSet, because ordinal identity survives rescheduling.

Q13. Explain blue-green in Kubernetes without a service mesh. Two complete ReplicaSets with different version labels, and you move one Service selector. Drawing it beats describing it.

Q14. What breaks about blue-green that nobody mentions? Database schema. Both versions share one database during the overlap, so every migration must be backward compatible or the switch is not reversible. Say that unprompted and you will be remembered.

The Scenario Round: A Worked 2am Answer (Q15)

Q15. A deploy went out, the pipeline is green, and error rates jumped. Walk me through it. The structure that scores is observe, narrow, decide, act, and the way to narrate it is as commands. This is exactly the night Nikhil has lived and cannot yet say out loud. Worked end to end:

$ kubectl rollout status deploy/web -n prod
Waiting for rollout: 4 of 6 updated replicas are available...

$ kubectl get pods -n prod -l app=web
web-7d9c5f8b64-2xk9q   0/1   CrashLoopBackOff   4   3m
web-7d9c5f8b64-ptm4v   1/1   Running            0   3m

$ kubectl logs web-7d9c5f8b64-2xk9q -n prod --previous | tail -5
psycopg2.OperationalError: FATAL: remaining connection slots are reserved

$ kubectl describe pod web-7d9c5f8b64-2xk9q -n prod | grep -A3 Events
  Warning  BackOff  2m  kubelet  Back-off restarting failed container

$ kubectl rollout undo deploy/web -n prod
deployment.apps/web rolled back

Then read the output aloud. The pipeline was green because it tested the image, not the environment: the release raised connection pool size per pod, six pods multiplied it, and the Postgres max_connections ceiling was hit. Rollback, then fix the pool setting, then add a connection count alert. Mitigate, diagnose, prevent. That ordering is what panels are listening for.

Symptom to first command

The follow up is almost always "roll back or fix forward?". Decide by time to safety: if the fix is understood and inside a few minutes of pipeline time, fix forward, otherwise roll back and investigate without an audience. Where the thing released is a model rather than a service, that same reasoning sits at the centre of 360DT's MLOps engineer course.

DevOps Interview Questions for Freshers: What Changes Without Production Experience

You cannot fake incidents, so stop trying. Own one small system completely. "I deploy my Django app to one EC2 instance from GitHub Actions, the Terraform is in the repo, and a deploy takes four minutes" outscores three certificates and no running URL.

Expect scaled down versions of the same questions: what happens between git push and a running container, what a Dockerfile layer is and why order matters, how to grant a teammate access without sharing your key. The Linux round is unavoidable and the cheapest to prepare. Also read: the Linux commands cheat sheet for DevOps, then practise until ss, journalctl and df -h are muscle memory.

One honest caveat. DevOps is a poor first job, because panels want judgement built from having broken things, and two years as a developer or sysadmin buys that faster than two years of tutorials. Treat an adjacent role as the on-ramp. The certifications overview shows which credentials open those doors.

6 Answers That Get DevOps Candidates Rejected

How to Prepare for DevOps Interview Questions in 8 Weeks

Preparation that works is not reading question banks. It is building one system you can describe in forensic detail, then rehearsing the description. Weeks one to three, build a pipeline that deploys a container to a cloud you pay for. Weeks four to six, add Terraform, monitoring and a deliberate rollback. Weeks seven and eight, break it on purpose and write postmortems you can quote.

If you are also sitting the AWS DevOps Engineer Professional exam, its official guide doubles as a study map, because the weights mirror what interviews ask. The exam runs 180 minutes over 75 questions, costs $300, and needs 750 of 1000 to pass, with the credential valid for 36 months.

Pipelines increasingly ship models and agents, not only services. The agent deployment work in the AI engineer course and the lakehouse pipeline work in the Microsoft Fabric data engineering program sit either side of a modern DevOps role, and safely reviewing a generated Terraform module is its own skill, which the CCDV-F prep course drills.

In Nikhil's position I would not read another list of fifty questions. I would take the three worst nights of the last two years, turn each into a four sentence story with a symptom, a command, a decision and a prevention, and rehearse them aloud until they are boring. A few true stories told well beats having read everything. Then pressure test them in a free webinar or a demo class, and if you want that eight week plan supervised rather than self-driven, that is what the AWS Solutions Architect and DevOps Engineer course is for.

Related guides

• DevOps Engineer Salary in India 2026 so you know what band to target before the compensation conversation starts.
• SAA-C03 vs DOP-C02: Which AWS Certification First if you are deciding which exam to sit before the interview season.
• DevOps Roadmap 2026, Week by Week for the longer version of the eight week prep sprint in this guide.
• System Administrator to DevOps Engineer in India if you are coming from operations and want to know what transfers.
• What Is Kubernetes? to shore up the vocabulary behind the triage questions above.
• DevOps Jobs in Dubai 2026 if you are interviewing for a Gulf role and need the market picture.

Frequently asked questions

About this guide. 360 Digital Transformation is an Anthropic Partner. Other certification bodies, vendors and employers named here are not affiliated with us. Tools and versions change quickly; commands and figures cited were checked on 3 October 2026.