Platform Engineer interview questions
100 real questions with model answers and explanations for Platform Engineer candidates.
See a Platform Engineer resume example →Practice with flashcards
Spaced repetition · Hunter Pass
Questions
A platform team builds reusable services and workflows that developers can consume without opening a ticket.
- DevOps is a way of sharing delivery and operations responsibility, not necessarily a separate product team.
- A platform team turns repeated tasks such as service creation into supported self-service capabilities.
- Its output is judged by developer use and reduced friction, not only by infrastructure uptime.
Why interviewers ask this: The interviewer checks whether the candidate sees platform engineering as an internal product rather than a renamed operations team.
Platform engineering improves the supported path developers use, while SRE focuses on service reliability and operational risk.
- A platform engineer may provide a Kubernetes deployment template with safe defaults.
- An SRE may define an SLO, investigate error-budget burn, and improve incident response.
- The teams can share tooling, but their primary users and outcomes differ.
Why interviewers ask this: The interviewer is testing whether the candidate separates developer enablement from reliability work without treating them as competitors.
The platform provides working capabilities, while the portal is one interface through which developers discover and use them.
- The platform can include CI workflows, Kubernetes environments, secrets, and observability.
- A portal such as Backstage can show services, documentation, templates, and links to those capabilities.
- A polished portal without functioning workflows is not an internal developer platform.
Why interviewers ask this: The interviewer wants a clear boundary between the platform itself and its user interface.
It means treating internal developers as users whose recurring problems guide platform work.
- The team learns how developers create, deploy, and debug services before choosing a solution.
- Capabilities need documentation, support, ownership, and a usable lifecycle like external products.
- Feedback and adoption determine whether an addition solved the problem.
Why interviewers ask this: The interviewer checks whether the candidate connects technical work to real internal user needs.
A capability is self-service when a developer can complete a supported task safely without waiting for a platform engineer.
- The input and result are clear, such as creating a repository and test environment from a template.
- Validation rejects unsafe values early and explains how to correct them.
- Documentation and observable status let the developer understand progress and failures.
Why interviewers ask this: The interviewer evaluates whether the candidate understands that self-service includes guardrails and feedback, not only automation.
They are well-supported ways to complete common work with working defaults and minimal decisions.
- A service template can provide CI, deployment, ownership metadata, and dashboards together.
- Developers may leave the path when their service has a valid need, so it is guidance rather than a trap.
- The platform team maintains the path as tools and developer needs change.
Why interviewers ask this: The interviewer checks whether the candidate understands both the convenience and the voluntary nature of a supported path.
An escape hatch lets a team handle a legitimate exception without bypassing all platform safety controls.
- A service needing a special runtime may supply a reviewed custom manifest instead of the default template.
- The exception should have an owner and a documented reason so support boundaries stay clear.
- Repeated exceptions are evidence that the standard workflow may need a new supported option.
Why interviewers ask this: The interviewer wants to see that the candidate balances safe defaults with real developer constraints.
A service catalog gives one searchable record of software components and the people responsible for them.
- A developer can find the repository, documentation, dashboard, and support contact for a service.
- Ownership data shortens routing during a failed deployment or dependency question.
- Catalog entries must be updated with the service lifecycle or they quickly lose trust.
Why interviewers ask this: The interviewer checks whether the candidate understands the catalog as operational metadata, not merely a list of links.
A useful entry names the service owner, lifecycle, system, repository, and support contact.
- The owner should be a maintained team identifier rather than one person who may leave.
- Lifecycle values such as experimental, production, or deprecated set user expectations.
- Links to a runbook and dashboard give developers a direct debugging path.
Why interviewers ask this: The interviewer evaluates whether the candidate can name metadata that makes a catalog entry actionable.
Backstage can combine a software catalog, documentation, templates, and links to engineering tools.
- Catalog descriptors connect components to owners, systems, and lifecycle metadata.
- Software Templates can create a repository and apply the platform team’s supported starting structure.
- Plugins can surface CI status or Grafana links without moving the underlying systems into Backstage.
Why interviewers ask this: The interviewer checks practical understanding of Backstage without confusing it with the whole platform.
Templates make common service setup repeatable and include platform defaults from the first commit.
- They can create CI configuration, ownership metadata, a container build, and deployment manifests together.
- Required inputs such as service name and owner are validated once instead of copied by hand.
- A template needs versioned maintenance because stale dependencies spread to every new service.
Why interviewers ask this: The interviewer wants to see that the candidate recognizes both the leverage and maintenance cost of templates.
Platform documentation should let a developer complete one workflow and recover from its common failures.
- A quick start lists prerequisites, exact inputs, expected output, and a verification step.
- Troubleshooting maps visible symptoms to checks rather than saying only to contact the platform team.
- Examples should use the current template and be tested when the workflow changes.
Why interviewers ask this: The interviewer checks whether the candidate writes task-focused documentation that supports self-service.
I collect feedback immediately after a developer uses a workflow and attach it to the exact step that caused friction.
- A short form can ask whether the task completed, how long it took, and what blocked it.
- Support requests reveal repeated failures that developers may not report in a survey.
- I confirm proposed fixes with the affected developer before treating the issue as solved.
Why interviewers ask this: The interviewer evaluates whether feedback is tied to observable platform workflows and follow-up.
A useful first signal is the percentage of started service creations that reach a healthy test deployment without manual platform help.
- Completion shows more than page views because it measures the intended developer outcome.
- Time from template start to healthy deployment exposes slow or confusing steps.
- Support requests for the workflow add context when the completion rate falls.
Why interviewers ask this: The interviewer checks whether the candidate chooses a developer outcome rather than a vanity metric.
A container is an isolated process packaged with the application files and runtime dependencies it needs.
- It shares the host kernel, so it is lighter than a full virtual machine.
- The same image can run in CI, a developer environment, and Kubernetes, reducing environmental differences.
- The platform still supplies runtime configuration, secrets, networking, and resource boundaries.
Why interviewers ask this: The interviewer tests the container model and its value for a repeatable developer path.
An image is an immutable package, while a container is a running instance created from that package.
- The platform build produces and tags an image once for later deployment.
- Kubernetes can start several containers from the same image for one service.
- Changes made inside a running container disappear when it is replaced unless data uses persistent storage.
Why interviewers ask this: The interviewer checks a basic distinction needed to reason about builds and deployments.
Each Dockerfile instruction can create a cached layer, so stable steps should come before frequently changing source files.
- Copying dependency manifests before application code lets dependency installation reuse the cache.
- A small final image reduces registry transfer time and unnecessary packages.
- The same Dockerfile in CI makes image creation repeatable for every developer.
Why interviewers ask this: The interviewer evaluates whether the candidate understands basic image construction and reusable build performance.
A Pod is the smallest Kubernetes unit that runs one or more tightly coupled containers together.
- Containers in a Pod share its network identity and can share mounted volumes.
- A service template usually creates Pods through a Deployment rather than asking developers to manage them directly.
- Pods are replaceable, so application state should not depend on one Pod surviving.
Why interviewers ask this: The interviewer checks whether the candidate understands the basic workload unit and its disposable nature.
A Deployment maintains the requested number of application Pods and updates them from a declared Pod template.
- Its replica count expresses how many Pod copies the platform should keep running.
- Changing the image starts a controlled rollout and records a new revision.
- If a Pod disappears, the Deployment controller creates a replacement.
Why interviewers ask this: The interviewer tests whether the candidate can connect a Deployment to repeatable application delivery.
A Service gives a stable network address for a changing set of selected Pods.
- Its selector finds Pods through labels rather than fixed Pod IP addresses.
- The Service port is the port clients call, while targetPort is where the container listens.
- A platform template can create the Service consistently so teams do not hand-wire discovery.
Why interviewers ask this: The interviewer checks understanding of stable discovery and port mapping for developer workloads.
Locked questions
- 21
What role does Kubernetes Ingress play in a standard service path?
networkingkubernetes - 22
Why does a platform place developer workloads in Kubernetes namespaces?
namespaceskuberneteskubernetes-tenancy - 23
How do Kubernetes labels and selectors work in a platform template?
kubernetes - 24
When should a platform template use a ConfigMap?
configkubernetesconfiguration - 25
How should a Kubernetes Secret be used in a safe developer workflow?
secretskubernetesconfiguration - 26
Why do platform defaults include Kubernetes resource requests, limits, and cost labels?
kubernetescapacity - 27
What is the difference between readiness and liveness probes?
health-checks - 28
What does basic Kubernetes RBAC control in a self-service workflow?
rbackubernetesself-service - 29
What does a basic Kubernetes NetworkPolicy do for platform workloads?
kubernetesnetwork-policy - 30
What is a Helm chart in a repeatable platform deployment?
deploymenthelmworkloads - 31
What is the purpose of a Helm values file?
helm - 32
What does declarative infrastructure mean in Terraform?
terraform - 33
What is a Terraform provider?
terraform - 34
What is a Terraform resource block?
terraform - 35
Why does Terraform keep a state file?
terraform - 36
How do Terraform plan and apply preserve an exactly reviewed change in a platform workflow?
terraform - 37
Why would a platform team create a Terraform module?
terraformplatform-engineering - 38
What is a Terraform output useful for in self-service provisioning?
terraformself-service - 39
Why does a team use remote Terraform state?
terraform - 40
How do GitLab CI and GitHub Actions structure their CI workflows?
ci-cd - 41
What is a CI artifact and how does it help a platform workflow?
artifacts - 42
How is a CI cache different from an artifact?
cachingartifacts - 43
How should secrets enter a standard CI pipeline?
ci-cdsecretsconfiguration - 44
What is the difference between continuous integration and continuous delivery?
ci-cd - 45
What is the core idea of GitOps for a developer platform?
gitops - 46
What do sync status, a sync operation, and drift mean in Argo CD?
iacgitops - 47
How do metrics, logs, and traces answer different debugging questions?
monitoring - 48
What are Prometheus and Grafana used for in a basic platform setup?
monitoring - 49
What does OpenTelemetry provide to a platform and its application teams?
observability - 50
What are an SLI and an SLO for a platform workflow?
slislo - 51
A developer creates a service from the platform template, but the owner field is empty. What do you do?
- 52
A generated Backstage catalog entry does not appear, and validation says the component kind is missing. How do you fix it?
componentsvalidationbackstage - 53
The golden-path guide says to set replicas, but the current template exposes replicaCount. How do you handle the mismatch?
soft-skillsreplication - 54
A Docker build in the service template cannot find package.json even though the file exists. What do you check?
dockernpmtemplates - 55
Every small source change causes the shared Docker build to reinstall all dependencies. What is the local fix?
dockerdependencies - 56
A deployment uses the image tag latest and a developer cannot tell which commit is running. What do you change?
deploymentcontainersworkloads - 57
A newly generated service is in CrashLoopBackOff. How do you follow the platform runbook?
runbookstroubleshooting - 58
A template deployment shows ImagePullBackOff. What do you check first?
kubernetes-deploymentdeploymentworkloads - 59
A developer’s Pod stays Pending after using the platform template. What is your basic check sequence?
workloadskubernetes-workloads - 60
A generated Service has no endpoints although its Pods are Ready. What is the likely local problem?
endpoints - 61
A Service has endpoints, but requests to port 80 fail while the container listens on 8080. What do you inspect?
containersendpoints - 62
A readiness default in the shared golden-path template sends traffic to slow-starting services too early. How do you diagnose and fix it?
health-checks - 63
The shared golden-path liveness default checks an external database, so a brief outage restarts Pods for several teams. What do you change?
databasehealth-checks - 64
A ConfigMap file is missing from Pods generated by the shared golden-path template for more than one team. How do you debug it?
configkubernetesconfiguration - 65
A generated Pod reports that a referenced Secret was not found. What do you verify?
workloadsconfigurationkubernetes-workloads - 66
A runbook command says a Deployment is missing, but the developer can see it in the portal. What namespace check do you make?
workloadsnamespaceskubernetes-tenancy - 67
A developer’s service account gets Forbidden when reading ConfigMaps. How do you debug RBAC?
rbacconfigkubernetes - 68
A service can no longer reach its database after the template adds a default-deny NetworkPolicy. What do you do?
databasenetwork-policy - 69
A developer sets replicaCounts in Helm values, but the release still has one replica. How do you find the typo?
helmreplication - 70
A Helm release fails because the rendered manifest is invalid. What is your first local step?
helm - 71
Before installing a changed Helm chart for a developer, how do you use a dry run?
helm - 72
A Terraform change fails the platform formatting check. What do you do?
terraform - 73
terraform validate reports an unsupported argument in a platform module call. How do you resolve it?
terraformvalidation - 74
A Terraform plan for one developer database unexpectedly shows destroy and create. What do you do?
terraformdatabase - 75
A platform Terraform run says the remote state is locked. What is the safe response?
terraform - 76
A Terraform module rejects a developer’s replica_count value because it is a string. How do you fix the input?
terraformreplication - 77
A provisioning job succeeds, but the developer cannot find the new service endpoint. What Terraform output fix helps?
terraformendpoints - 78
A database already exists, but the new Terraform module wants to create it again. What basic import workflow do you follow?
terraformdatabase - 79
A test report produced for several teams is missing in the publish job of a reusable CI workflow. What artifact check do you make?
artifacts - 80
A reusable CI workflow serves stale dependency caches to several teams after their lockfiles change. What do you fix?
dependenciespackagingcaching - 81
A CI deploy job prints part of an API token in its debug output. What do you do?
tokensapideployment - 82
A production deploy job runs on every feature branch. Which pipeline condition do you correct?
deploymentgitci-cd - 83
A shared pipeline stops at a failing unit test before image publication. What should a junior platform engineer do?
unitci-cd - 84
A standard Terraform job in a shared CI workflow hangs waiting for interactive input. How do you fix the golden workflow?
terraform - 85
Argo CD marks a developer application OutOfSync after a reviewed Git change. What do you inspect?
gitgitops - 86
An approved manifest is in Git, but Argo CD has not applied it. What sync checks do you make?
gitgitops - 87
Argo CD reports an application Synced but Degraded. How do you explain and debug it?
gitops - 88
Prometheus shows a new platform-created service target as down. What do you check?
monitoring - 89
A standard platform alert generated for many teams fires after one Pod restart, so developers ignore it. How do you improve the default?
workloadskubernetes-workloadsalerting - 90
A generated Grafana dashboard is empty although Prometheus has service metrics. What do you inspect?
monitoringdashboards - 91
Generated services from several teams lack trace IDs in logs because of a shared platform logging default. How do you diagnose and fix it?
logging - 92
A developer Pod is Pending because its platform default requests 8 CPUs for a small service. What do you change?
workloadskubernetes-workloads - 93
A container is OOMKilled after adopting the standard memory limit. What is your local response?
containersdecision-makingmemory - 94
A cost report groups a new developer workload under unknown. How do you fix attribution?
- 95
A developer requests a new message queue by chat, but the platform has a supported request form. How do you respond?
formsqueuesdata-structures - 96
Developers repeatedly abandon a self-service database form at the network section. What do you do?
self-servicedatabaseforms - 97
A service generated from the template builds locally but its standard health path returns 404. What do you check?
- 98
A developer follows the CrashLoopBackOff runbook, but its first command uses an old container name. What do you change?
containersrunbookstroubleshooting - 99
A platform CI runner queue grows because every branch runs a large image scan twice. What small fix do you make?
data-structures - 100
A developer uses the platform escape hatch for a custom deployment and asks for support after it fails. How do you handle it?
escape-hatchesdeploymentsoft-skills