Skip to content

Platform Engineer interview questions

100 real questions with model answers and explanations for Platform Engineer candidates.

See a Platform Engineer resume example

Practice with flashcards

Spaced repetition · Hunter Pass

Questions

devopsplatform-engineering

A platform team builds reusable services and workflows that developers can consume without opening a ticket.

  • DevOps is a way of sharing delivery and operations responsibility, not necessarily a separate product team.
  • A platform team turns repeated tasks such as service creation into supported self-service capabilities.
  • Its output is judged by developer use and reduced friction, not only by infrastructure uptime.

Why interviewers ask this: The interviewer checks whether the candidate sees platform engineering as an internal product rather than a renamed operations team.

kubernetessre

Platform engineering improves the supported path developers use, while SRE focuses on service reliability and operational risk.

  • A platform engineer may provide a Kubernetes deployment template with safe defaults.
  • An SRE may define an SLO, investigate error-budget burn, and improve incident response.
  • The teams can share tooling, but their primary users and outcomes differ.

Why interviewers ask this: The interviewer is testing whether the candidate separates developer enablement from reliability work without treating them as competitors.

idpdeveloper-portal

The platform provides working capabilities, while the portal is one interface through which developers discover and use them.

  • The platform can include CI workflows, Kubernetes environments, secrets, and observability.
  • A portal such as Backstage can show services, documentation, templates, and links to those capabilities.
  • A polished portal without functioning workflows is not an internal developer platform.

Why interviewers ask this: The interviewer wants a clear boundary between the platform itself and its user interface.

platform-as-product

It means treating internal developers as users whose recurring problems guide platform work.

  • The team learns how developers create, deploy, and debug services before choosing a solution.
  • Capabilities need documentation, support, ownership, and a usable lifecycle like external products.
  • Feedback and adoption determine whether an addition solved the problem.

Why interviewers ask this: The interviewer checks whether the candidate connects technical work to real internal user needs.

self-service

A capability is self-service when a developer can complete a supported task safely without waiting for a platform engineer.

  • The input and result are clear, such as creating a repository and test environment from a template.
  • Validation rejects unsafe values early and explains how to correct them.
  • Documentation and observable status let the developer understand progress and failures.

Why interviewers ask this: The interviewer evaluates whether the candidate understands that self-service includes guardrails and feedback, not only automation.

golden-path

They are well-supported ways to complete common work with working defaults and minimal decisions.

  • A service template can provide CI, deployment, ownership metadata, and dashboards together.
  • Developers may leave the path when their service has a valid need, so it is guidance rather than a trap.
  • The platform team maintains the path as tools and developer needs change.

Why interviewers ask this: The interviewer checks whether the candidate understands both the convenience and the voluntary nature of a supported path.

escape-hatches

An escape hatch lets a team handle a legitimate exception without bypassing all platform safety controls.

  • A service needing a special runtime may supply a reviewed custom manifest instead of the default template.
  • The exception should have an owner and a documented reason so support boundaries stay clear.
  • Repeated exceptions are evidence that the standard workflow may need a new supported option.

Why interviewers ask this: The interviewer wants to see that the candidate balances safe defaults with real developer constraints.

service-catalog

A service catalog gives one searchable record of software components and the people responsible for them.

  • A developer can find the repository, documentation, dashboard, and support contact for a service.
  • Ownership data shortens routing during a failed deployment or dependency question.
  • Catalog entries must be updated with the service lifecycle or they quickly lose trust.

Why interviewers ask this: The interviewer checks whether the candidate understands the catalog as operational metadata, not merely a list of links.

ownershipservice-catalog

A useful entry names the service owner, lifecycle, system, repository, and support contact.

  • The owner should be a maintained team identifier rather than one person who may leave.
  • Lifecycle values such as experimental, production, or deprecated set user expectations.
  • Links to a runbook and dashboard give developers a direct debugging path.

Why interviewers ask this: The interviewer evaluates whether the candidate can name metadata that makes a catalog entry actionable.

developer-portalbackstage

Backstage can combine a software catalog, documentation, templates, and links to engineering tools.

  • Catalog descriptors connect components to owners, systems, and lifecycle metadata.
  • Software Templates can create a repository and apply the platform team’s supported starting structure.
  • Plugins can surface CI status or Grafana links without moving the underlying systems into Backstage.

Why interviewers ask this: The interviewer checks practical understanding of Backstage without confusing it with the whole platform.

templates

Templates make common service setup repeatable and include platform defaults from the first commit.

  • They can create CI configuration, ownership metadata, a container build, and deployment manifests together.
  • Required inputs such as service name and owner are validated once instead of copied by hand.
  • A template needs versioned maintenance because stale dependencies spread to every new service.

Why interviewers ask this: The interviewer wants to see that the candidate recognizes both the leverage and maintenance cost of templates.

documentation

Platform documentation should let a developer complete one workflow and recover from its common failures.

  • A quick start lists prerequisites, exact inputs, expected output, and a verification step.
  • Troubleshooting maps visible symptoms to checks rather than saying only to contact the platform team.
  • Examples should use the current template and be tested when the workflow changes.

Why interviewers ask this: The interviewer checks whether the candidate writes task-focused documentation that supports self-service.

feedback

I collect feedback immediately after a developer uses a workflow and attach it to the exact step that caused friction.

  • A short form can ask whether the task completed, how long it took, and what blocked it.
  • Support requests reveal repeated failures that developers may not report in a survey.
  • I confirm proposed fixes with the affected developer before treating the issue as solved.

Why interviewers ask this: The interviewer evaluates whether feedback is tied to observable platform workflows and follow-up.

A useful first signal is the percentage of started service creations that reach a healthy test deployment without manual platform help.

  • Completion shows more than page views because it measures the intended developer outcome.
  • Time from template start to healthy deployment exposes slow or confusing steps.
  • Support requests for the workflow add context when the completion rate falls.

Why interviewers ask this: The interviewer checks whether the candidate chooses a developer outcome rather than a vanity metric.

containers

A container is an isolated process packaged with the application files and runtime dependencies it needs.

  • It shares the host kernel, so it is lighter than a full virtual machine.
  • The same image can run in CI, a developer environment, and Kubernetes, reducing environmental differences.
  • The platform still supplies runtime configuration, secrets, networking, and resource boundaries.

Why interviewers ask this: The interviewer tests the container model and its value for a repeatable developer path.

containers

An image is an immutable package, while a container is a running instance created from that package.

  • The platform build produces and tags an image once for later deployment.
  • Kubernetes can start several containers from the same image for one service.
  • Changes made inside a running container disappear when it is replaced unless data uses persistent storage.

Why interviewers ask this: The interviewer checks a basic distinction needed to reason about builds and deployments.

docker

Each Dockerfile instruction can create a cached layer, so stable steps should come before frequently changing source files.

  • Copying dependency manifests before application code lets dependency installation reuse the cache.
  • A small final image reduces registry transfer time and unnecessary packages.
  • The same Dockerfile in CI makes image creation repeatable for every developer.

Why interviewers ask this: The interviewer evaluates whether the candidate understands basic image construction and reusable build performance.

workloadskuberneteskubernetes-workloads

A Pod is the smallest Kubernetes unit that runs one or more tightly coupled containers together.

  • Containers in a Pod share its network identity and can share mounted volumes.
  • A service template usually creates Pods through a Deployment rather than asking developers to manage them directly.
  • Pods are replaceable, so application state should not depend on one Pod surviving.

Why interviewers ask this: The interviewer checks whether the candidate understands the basic workload unit and its disposable nature.

kubernetesdeploymentworkloads

A Deployment maintains the requested number of application Pods and updates them from a declared Pod template.

  • Its replica count expresses how many Pod copies the platform should keep running.
  • Changing the image starts a controlled rollout and records a new revision.
  • If a Pod disappears, the Deployment controller creates a replacement.

Why interviewers ask this: The interviewer tests whether the candidate can connect a Deployment to repeatable application delivery.

kubernetes

A Service gives a stable network address for a changing set of selected Pods.

  • Its selector finds Pods through labels rather than fixed Pod IP addresses.
  • The Service port is the port clients call, while targetPort is where the container listens.
  • A platform template can create the Service consistently so teams do not hand-wire discovery.

Why interviewers ask this: The interviewer checks understanding of stable discovery and port mapping for developer workloads.

Locked questions

  • 21

    What role does Kubernetes Ingress play in a standard service path?

    networkingkubernetes
  • 22

    Why does a platform place developer workloads in Kubernetes namespaces?

    namespaceskuberneteskubernetes-tenancy
  • 23

    How do Kubernetes labels and selectors work in a platform template?

    kubernetes
  • 24

    When should a platform template use a ConfigMap?

    configkubernetesconfiguration
  • 25

    How should a Kubernetes Secret be used in a safe developer workflow?

    secretskubernetesconfiguration
  • 26

    Why do platform defaults include Kubernetes resource requests, limits, and cost labels?

    kubernetescapacity
  • 27

    What is the difference between readiness and liveness probes?

    health-checks
  • 28

    What does basic Kubernetes RBAC control in a self-service workflow?

    rbackubernetesself-service
  • 29

    What does a basic Kubernetes NetworkPolicy do for platform workloads?

    kubernetesnetwork-policy
  • 30

    What is a Helm chart in a repeatable platform deployment?

    deploymenthelmworkloads
  • 31

    What is the purpose of a Helm values file?

    helm
  • 32

    What does declarative infrastructure mean in Terraform?

    terraform
  • 33

    What is a Terraform provider?

    terraform
  • 34

    What is a Terraform resource block?

    terraform
  • 35

    Why does Terraform keep a state file?

    terraform
  • 36

    How do Terraform plan and apply preserve an exactly reviewed change in a platform workflow?

    terraform
  • 37

    Why would a platform team create a Terraform module?

    terraformplatform-engineering
  • 38

    What is a Terraform output useful for in self-service provisioning?

    terraformself-service
  • 39

    Why does a team use remote Terraform state?

    terraform
  • 40

    How do GitLab CI and GitHub Actions structure their CI workflows?

    ci-cd
  • 41

    What is a CI artifact and how does it help a platform workflow?

    artifacts
  • 42

    How is a CI cache different from an artifact?

    cachingartifacts
  • 43

    How should secrets enter a standard CI pipeline?

    ci-cdsecretsconfiguration
  • 44

    What is the difference between continuous integration and continuous delivery?

    ci-cd
  • 45

    What is the core idea of GitOps for a developer platform?

    gitops
  • 46

    What do sync status, a sync operation, and drift mean in Argo CD?

    iacgitops
  • 47

    How do metrics, logs, and traces answer different debugging questions?

    monitoring
  • 48

    What are Prometheus and Grafana used for in a basic platform setup?

    monitoring
  • 49

    What does OpenTelemetry provide to a platform and its application teams?

    observability
  • 50

    What are an SLI and an SLO for a platform workflow?

    slislo
  • 51

    A developer creates a service from the platform template, but the owner field is empty. What do you do?

  • 52

    A generated Backstage catalog entry does not appear, and validation says the component kind is missing. How do you fix it?

    componentsvalidationbackstage
  • 53

    The golden-path guide says to set replicas, but the current template exposes replicaCount. How do you handle the mismatch?

    soft-skillsreplication
  • 54

    A Docker build in the service template cannot find package.json even though the file exists. What do you check?

    dockernpmtemplates
  • 55

    Every small source change causes the shared Docker build to reinstall all dependencies. What is the local fix?

    dockerdependencies
  • 56

    A deployment uses the image tag latest and a developer cannot tell which commit is running. What do you change?

    deploymentcontainersworkloads
  • 57

    A newly generated service is in CrashLoopBackOff. How do you follow the platform runbook?

    runbookstroubleshooting
  • 58

    A template deployment shows ImagePullBackOff. What do you check first?

    kubernetes-deploymentdeploymentworkloads
  • 59

    A developer’s Pod stays Pending after using the platform template. What is your basic check sequence?

    workloadskubernetes-workloads
  • 60

    A generated Service has no endpoints although its Pods are Ready. What is the likely local problem?

    endpoints
  • 61

    A Service has endpoints, but requests to port 80 fail while the container listens on 8080. What do you inspect?

    containersendpoints
  • 62

    A readiness default in the shared golden-path template sends traffic to slow-starting services too early. How do you diagnose and fix it?

    health-checks
  • 63

    The shared golden-path liveness default checks an external database, so a brief outage restarts Pods for several teams. What do you change?

    databasehealth-checks
  • 64

    A ConfigMap file is missing from Pods generated by the shared golden-path template for more than one team. How do you debug it?

    configkubernetesconfiguration
  • 65

    A generated Pod reports that a referenced Secret was not found. What do you verify?

    workloadsconfigurationkubernetes-workloads
  • 66

    A runbook command says a Deployment is missing, but the developer can see it in the portal. What namespace check do you make?

    workloadsnamespaceskubernetes-tenancy
  • 67

    A developer’s service account gets Forbidden when reading ConfigMaps. How do you debug RBAC?

    rbacconfigkubernetes
  • 68

    A service can no longer reach its database after the template adds a default-deny NetworkPolicy. What do you do?

    databasenetwork-policy
  • 69

    A developer sets replicaCounts in Helm values, but the release still has one replica. How do you find the typo?

    helmreplication
  • 70

    A Helm release fails because the rendered manifest is invalid. What is your first local step?

    helm
  • 71

    Before installing a changed Helm chart for a developer, how do you use a dry run?

    helm
  • 72

    A Terraform change fails the platform formatting check. What do you do?

    terraform
  • 73

    terraform validate reports an unsupported argument in a platform module call. How do you resolve it?

    terraformvalidation
  • 74

    A Terraform plan for one developer database unexpectedly shows destroy and create. What do you do?

    terraformdatabase
  • 75

    A platform Terraform run says the remote state is locked. What is the safe response?

    terraform
  • 76

    A Terraform module rejects a developer’s replica_count value because it is a string. How do you fix the input?

    terraformreplication
  • 77

    A provisioning job succeeds, but the developer cannot find the new service endpoint. What Terraform output fix helps?

    terraformendpoints
  • 78

    A database already exists, but the new Terraform module wants to create it again. What basic import workflow do you follow?

    terraformdatabase
  • 79

    A test report produced for several teams is missing in the publish job of a reusable CI workflow. What artifact check do you make?

    artifacts
  • 80

    A reusable CI workflow serves stale dependency caches to several teams after their lockfiles change. What do you fix?

    dependenciespackagingcaching
  • 81

    A CI deploy job prints part of an API token in its debug output. What do you do?

    tokensapideployment
  • 82

    A production deploy job runs on every feature branch. Which pipeline condition do you correct?

    deploymentgitci-cd
  • 83

    A shared pipeline stops at a failing unit test before image publication. What should a junior platform engineer do?

    unitci-cd
  • 84

    A standard Terraform job in a shared CI workflow hangs waiting for interactive input. How do you fix the golden workflow?

    terraform
  • 85

    Argo CD marks a developer application OutOfSync after a reviewed Git change. What do you inspect?

    gitgitops
  • 86

    An approved manifest is in Git, but Argo CD has not applied it. What sync checks do you make?

    gitgitops
  • 87

    Argo CD reports an application Synced but Degraded. How do you explain and debug it?

    gitops
  • 88

    Prometheus shows a new platform-created service target as down. What do you check?

    monitoring
  • 89

    A standard platform alert generated for many teams fires after one Pod restart, so developers ignore it. How do you improve the default?

    workloadskubernetes-workloadsalerting
  • 90

    A generated Grafana dashboard is empty although Prometheus has service metrics. What do you inspect?

    monitoringdashboards
  • 91

    Generated services from several teams lack trace IDs in logs because of a shared platform logging default. How do you diagnose and fix it?

    logging
  • 92

    A developer Pod is Pending because its platform default requests 8 CPUs for a small service. What do you change?

    workloadskubernetes-workloads
  • 93

    A container is OOMKilled after adopting the standard memory limit. What is your local response?

    containersdecision-makingmemory
  • 94

    A cost report groups a new developer workload under unknown. How do you fix attribution?

  • 95

    A developer requests a new message queue by chat, but the platform has a supported request form. How do you respond?

    formsqueuesdata-structures
  • 96

    Developers repeatedly abandon a self-service database form at the network section. What do you do?

    self-servicedatabaseforms
  • 97

    A service generated from the template builds locally but its standard health path returns 404. What do you check?

  • 98

    A developer follows the CrashLoopBackOff runbook, but its first command uses an old container name. What do you change?

    containersrunbookstroubleshooting
  • 99

    A platform CI runner queue grows because every branch runs a large image scan twice. What small fix do you make?

    data-structures
  • 100

    A developer uses the platform escape hatch for a custom deployment and asks for support after it fails. How do you handle it?

    escape-hatchesdeploymentsoft-skills