DevOps Engineer interview questions

Linux permissions define read, write, and execute access separately for the owner, group, and others.

• Numeric permissions use read = 4, write = 2, and execute = 1, with values added for each access class.
• chmod 755 gives the owner 7, or full access, while the group and others get 5, or read and execute without write.
• A directory needs execute permission to be entered, even when it has read permission.

root has unrestricted system access, while sudo grants a regular user elevated rights for a specific command.

• sudo records who ran the privileged command, providing an audit trail that shared root access does not.
• Working as root makes every mistake fully privileged, so a mistyped rm command or faulty script can damage the system without a safety barrier.
• The safer practice is to use a personal account and invoke sudo only for commands that require elevated rights.

Linux process inspection starts by finding the process and its PID, then stopping it with the least disruptive signal.

• ps aux and top show running processes, PIDs, CPU, and memory usage, while pgrep searches by process name.
• kill PID sends SIGTERM, allowing the process to shut down cleanly and release resources.
• kill -9 sends uncatchable SIGKILL and is a last resort because immediate termination can skip cleanup, corrupt data, or leave locks behind.

systemd services are managed with systemctl, and their logs are read through journalctl.

• systemctl status nginx shows whether nginx is running, along with its PID and recent log lines; start, stop, and restart control its current state.
• systemctl enable nginx configures startup at boot, but enabling a service is separate from starting it now.
• journalctl -u nginx shows service history, and journalctl -u nginx -f follows new entries live; a manually started but disabled service will not return after reboot.

grep searches text, find locates files, and shell pipes combine them into practical log-analysis commands.

• grep -i error app.log searches without regard to case, -r searches directories recursively, and -C 3 includes three context lines around each match.
• find can filter by name, age, or size; find /var/log -name '*.log' -mtime -1 lists log files modified within the last day.
• Piping find into grep searches selected files, while piping grep into wc -l counts matching log lines.

Shell pipes connect commands, while redirection sends their output and error streams to files.

• A pipe passes stdout from one command to the next, so cat app.log | grep error | wc -l counts lines containing error.
• The > operator overwrites a file, while >> appends to it.
• 2>&1 merges stderr into stdout so errors are captured with normal output, which prevents silent failures in cron jobs and CI scripts.

The Linux filesystem hierarchy gives standard locations to configuration, changing data, user files, temporary data, and programs.

• /etc stores configuration, while /var stores changing data and /var/log specifically stores logs.
• /home contains user directories, and /tmp provides temporary scratch space that may be cleared on reboot.
• /usr and /bin contain programs; knowing these locations makes /etc and /var/log the first places to check for service configuration and failures on an unfamiliar server.

A full disk incident requires locating the affected filesystem, removing data safely, and preventing recurrence.

• df -h identifies the full filesystem, and commands such as du -sh /var/* combined with sort locate the largest directories.
• Common causes are runaway logs, old backups, and Docker artifacts; rotate or truncate logs and clean package or container caches with their own tools.
• Do not blindly delete a file still held open by a running process, because its space remains allocated until the process releases it.
• Configure log rotation and disk-usage alerts so the team can act before usage reaches 100 percent.

Environment variables are process-level key-value settings, and PATH controls where the shell looks for commands.

• Processes inherit environment variables at startup, commonly using them for database URLs, API keys, and mode switches instead of hardcoding configuration.
• PATH lists command directories, so an installed executable outside those directories can still produce command not found.
• Exporting a variable in one terminal does not update an already running service, because its environment was fixed when that process started.

SSH is an encrypted protocol for remote shell access, and key authentication is safer than password authentication.

• A private key stays on the client machine, while its matching public key is placed on the server.
• Keys resist password brute force and are not repeatedly typed where they could be observed; disabling password login removes a common attack path on internet-facing servers.
• The private key never leaves the client and should itself be protected with a passphrase.

scp is convenient for simple copies over SSH, while rsync is better for efficient or repeatable synchronization.

• scp uses cp-like syntax, for example scp app.tar.gz user@server:/opt/, and works well for a single small file.
• rsync transfers only differences, shows progress, resumes interrupted transfers, and can mirror directory trees, including deleting files removed at the source.
• Repeated syncs, large trees, and unreliable connections favor rsync, which is why it has often been used in deployment scripts.

A slow server is diagnosed by measuring which resource class is saturated before changing anything.

• top or htop shows load average relative to CPU count, CPU-heavy processes, and memory pressure; free -h confirms RAM and swap usage, and heavy swapping can cause severe slowdown.
• df -h checks for full filesystems, while iostat or iotop reveals saturated disk I/O when CPU is idle but the system remains slow.
• Classify the bottleneck as CPU, memory, disk, or network, then investigate that resource instead of guessing.

DNS resolves names such as api.example.com to IP addresses and caches the results.

• A resolver checks available caches first, then follows the chain through root, TLD, and the domain's authoritative DNS servers.
• An A record maps a name to an IPv4 address, while a CNAME makes one name an alias of another.
• Each answer is cached for its TTL, so old values can remain visible until caches expire and DNS changes therefore do not propagate instantly.

TCP favors reliable delivery, while UDP favors low overhead and latency.

• TCP establishes a connection and uses acknowledgments and retransmissions to deliver complete data in order, which suits HTTP, databases, and SSH.
• UDP sends packets without a connection or delivery guarantee, which suits DNS queries, video streaming, and metrics where speed matters more than completeness.
• Their failures differ: TCP can stall and retry when data is lost, while UDP may silently lose packets.

A port identifies the service process that should receive traffic sent to an IP address.

• The operating system routes incoming traffic to the process listening on the destination port, allowing one IP to host many services.
• Common ports are 22 for SSH, 80 for HTTP, 443 for HTTPS, 53 for DNS, 5432 for PostgreSQL, 3306 for MySQL, and 6379 for Redis.
• ss -tlnp or netstat shows actual listeners, helping distinguish a stopped service from one listening on the wrong port.

HTTPS is HTTP protected by TLS encryption and server identity verification.

• The server presents a certificate issued by a trusted certificate authority to prove its identity.
• During the TLS handshake, the client verifies the certificate chain and both sides establish session keys used to encrypt subsequent traffic.
• Certificates expire, so automated renewal such as Let's Encrypt is essential; browsers can reject a service with an expired certificate just as users would experience an outage.

A load balancer distributes incoming requests across multiple instances of a service.

• Sharing traffic across instances increases total capacity.
• Health checks remove failed instances from rotation, improving availability.
• A stable frontend address allows instances to be added, removed, or updated behind it, enabling rolling deployments without downtime.

curl can isolate DNS, TLS, connection, and application problems by showing exactly how a web endpoint responds.

• curl -I https://api.example.com/health quickly returns the status and headers, while -v shows the full exchange, including TLS and request details.
• The -w option with timing variables reveals where latency occurs, and -H with -d can reproduce an authenticated POST request sent by a client.
• Comparing these results from different points helps determine whether the service itself is broken or the network path from the user is failing.

A firewall limits network exposure by allowing only traffic that matches explicit rules.

• Rules filter by source address, protocol, and port, dropping traffic that is not allowed.
• Cloud security groups perform this role for attached instances and are usually stateful, so return traffic for an allowed connection passes automatically.
• A default-deny setup can expose 443 publicly, restrict 22 to trusted addresses, and allow database ports only from the application group; every open rule needs a clear reason because it adds attack surface.

A reverse proxy accepts client requests and forwards them to backend applications behind one entry point.

• nginx can terminate TLS so applications do not manage certificates, and it can efficiently serve static files and compress responses.
• It can add headers, apply rate limits, and route different paths to different services.
• Request buffering absorbs slow clients so application workers are not occupied by poor client connections.