Preparing for an AWS Cloud Engineer, Site Reliability Engineer (SRE), or DevOps Engineer interview in 2026? Top employers test beyond basic CLI syntax. They look for deep architectural intuition across Kubernetes networking, multi-stage Docker builds, GitOps automation, and Terraform state management. Here are the 50 most frequently asked questions.
Part 1: Linux & Docker Containerization
Q1 How do you debug high CPU and memory usage on a Linux server?
Answer: 1. Run top or htop to identify high-utilization PID processes. 2. Press Shift + P for CPU sort, Shift + M for memory sort. 3. Check disk I/O bottlenecks using iostat -xz 1 and iotop. 4. Inspect memory consumption using free -m and check for OOM (Out Of Memory) killer kills in kernel logs via dmesg -T | grep -i oom.
Q2 What is the difference between CMD and ENTRYPOINT in a Dockerfile?
Answer: ENTRYPOINT sets the immutable default executable command for the container that should not be overridden easily (e.g., ENTRYPOINT ["nginx"]). CMD defines the default parameters passed to the entrypoint, which can be easily overridden from the CLI during docker run image [args].
Q3 How do Docker Multi-Stage Builds reduce production container image size?
Answer: Multi-stage builds use separate FROM instructions in a single Dockerfile. The first "build" stage compiles binaries and downloads heavy SDKs (e.g., Go compiler or Maven). The final stage copies only the compiled binary into a minimal distroless or Alpine base image, shrinking image sizes from 1GB+ down to under 30MB and eliminating build-tool security vulnerabilities.
Q4 What is the difference between Git Merge and Git Rebase?
Answer: Git Merge: Preserves exact chronological commit history by creating a non-destructive 3-way merge commit. Git Rebase: Re-applies commits from the feature branch on top of the base branch tip, producing a linear, clean commit history without extra merge commits. Rebase should never be used on shared public branches.
Part 2: Kubernetes (CKA) Architecture & Networking
Q5 Explain the Kubernetes Control Plane components.
Answer: 1. kube-apiserver: The central REST gateway that validates and executes all cluster operations. 2. etcd: Highly available distributed key-value store holding the complete cluster state. 3. kube-scheduler: Assigns newly created pods to optimal worker nodes based on resource capacity, affinity, and taints. 4. kube-controller-manager: Runs core controllers (Node, Deployment, EndpointSlice).
Q6 What are Kubernetes Liveness, Readiness, and Startup Probes?
Answer: Startup Probe: Verifies whether slow-starting applications have completed boot up. Liveness Probe: Checks if the container is healthy; if it fails, Kubelet kills and restarts the container. Readiness Probe: Determines if the container is ready to accept user network traffic; if it fails, the pod's IP is removed from Service Endpoints.
Q7 What is the difference between ClusterIP, NodePort, and LoadBalancer Services?
Answer: 1. ClusterIP: Default service type; exposes the service on an internal-only IP inside the cluster. 2. NodePort: Exposes the service on a static high port (30000-32767) on every worker node's external IP. 3. LoadBalancer: Integrates directly with cloud providers (AWS NLB/ALB) to provision a dedicated cloud load balancer routing traffic to NodePorts.
Q8 How do you debug a Pod stuck in CrashLoopBackOff?
Answer: 1. Run kubectl describe pod <pod-name> to check exit code (e.g., 137 = OOMKilled, 1 = application error) and Events. 2. View previous container run logs: kubectl logs <pod-name> --previous. 3. Check configuration and secret mounting errors. 4. Temporarily override entrypoint to sleep 3600 to shell in and investigate files.
Part 3: AWS Architecture & Terraform Infrastructure as Code
Q9 Design a Highly Available 3-Tier Web Application on AWS.
Answer: 1. Public Tier: Route 53 with CloudFront CDN and an Application Load Balancer (ALB) across 3 Availability Zones (AZs). 2. Application Tier: EC2 Auto-Scaling Group or EKS containers in Private Subnets with egress access via NAT Gateways. 3. Database Tier: Multi-AZ Amazon RDS (Aurora PostgreSQL) in isolated private database subnets with automated read replicas and KMS encryption at rest.
Q10 What is the difference between AWS Security Groups and Network ACLs (NACLs)?
Answer: Security Groups: Operate at the instance/ENI level. They are stateful (inbound allowed traffic automatically permits outbound responses) and support only Allow rules. NACLs: Operate at the subnet boundary. They are stateless (explicit rules required for both inbound and outbound) and evaluate ordered rule numbers with support for both Allow and Deny.
Q11 Explain the difference between Terraform count and for_each.
Answer: count creates resources indexed by integer (0, 1, 2). If you remove an item from the middle of the list, Terraform destroys and recreates all subsequent resources. for_each iterates over maps or sets of strings with discrete keys, allowing individual resources to be updated or removed without affecting neighboring elements.
Q12 How do you detect and reconcile Terraform State Drift?
Answer: Run terraform plan -refresh-only. This queries real-world cloud APIs, updates the local state representation without modifying cloud resources, and outputs any manual out-of-band changes. To align live infrastructure back with code, run terraform apply.