Question 1

What is Git?

Accepted Answer

Git is a distributed version control system that tracks changes to source code over time. Each developer has a complete copy of the project history on their local machine, unlike centralized systems like SVN. This enables offline work and provides better resilience as there is no single point of failure.

Question 2

What is the /etc directory in Linux?

Accepted Answer

The /etc directory contains system and application configuration files installed on the system. It is a standard location where administrators find configuration files to modify to customize system behavior. Common files include /etc/passwd for users, /etc/hosts for local DNS resolution, and /etc/fstab for file system mounting.

Question 3

What is the TCP protocol?

Accepted Answer

TCP (Transmission Control Protocol) is a reliable transport protocol that guarantees in-order data delivery. It establishes a connection before sending data (3-way handshake) and verifies that each packet is received via acknowledgments. Use TCP for applications requiring reliability like HTTP, HTTPS, SSH or FTP.

Question 4

What is the main difference between a Docker container and a virtual machine?

Accepted Answer

A container shares the host operating system kernel and only isolates processes, while a virtual machine includes a complete OS with its own kernel. Containers are therefore much lighter (a few MB vs several GB) and start in seconds instead of minutes. This architectural difference makes containers ideal for rapid deployments and horizontal scalability.

Question 5

What is a Pod in Kubernetes?

Accepted Answer

A Pod is the smallest deployable unit in Kubernetes. It encapsulates one or more containers that share the same network namespace, storage space, and IP address. Containers within a Pod can communicate via localhost and share the same lifecycle. In most cases, a Pod contains a single main container, but sidecar containers can be added for features like logging or monitoring.

Question 6

What is a CNI (Container Network Interface) in Kubernetes?

Accepted Answer

A CNI is a plugin that implements the network interface for containers in Kubernetes. It is responsible for allocating IP addresses to pods and configuring networking to enable pod-to-pod communication. Every Kubernetes cluster requires a CNI to function, and the choice of CNI impacts available network features like NetworkPolicies or performance characteristics.

Question 7

What is a StatefulSet in Kubernetes?

Accepted Answer

A StatefulSet guarantees stable and predictable identity for each pod (pod-0, pod-1, etc.) along with individual persistent storage. Unlike Deployments designed for stateless applications, StatefulSets maintain pod startup and shutdown order. They are essential for distributed databases, cache systems like Redis Cluster, or applications requiring stable network identity.

Question 8

What are the three Pod Security Standards levels defined by Kubernetes?

Accepted Answer

Kubernetes defines three Pod Security Standards levels: Privileged (no restrictions), Baseline (minimally restrictive, blocks known privilege escalations like hostNetwork or privileged containers), and Restricted (highly restrictive, follows hardening best practices with runAsNonRoot, seccomp, etc.). These levels enable progressive security adoption based on application needs.

Question 9

What is an SBOM (Software Bill of Materials) in the context of container security?

Accepted Answer

An SBOM is a comprehensive inventory of all software components contained in a container image, including libraries, dependencies, and their versions. It enables rapid identification of known vulnerabilities and tracking of risky components in the supply chain. Automated SBOM generation with tools like Syft or CycloneDX has become essential practice for maintaining visibility into transitive dependencies and meeting compliance requirements.

Question 10

What is the main role of a service mesh like Istio in a microservices architecture?

Accepted Answer

A service mesh manages communication between microservices by providing traffic management, observability, and security features without modifying application code. Istio injects a sidecar proxy (Envoy) next to each pod to intercept and manage all network traffic. This centralizes configuration for retry, timeout, circuit breaking, mTLS, and distributed tracing at the infrastructure level rather than the application level.

Câu hỏi phỏng vấn DevOps

Sẵn sàng cho phỏng vấn DevOps?

Khám phá tất cả chủ đề DevOps

Version Control & Git

Linux Fundamentals

Shell Scripting & Bash

Networking Basics

Docker Fundamentals

CI/CD Fundamentals

GitHub Actions

GitLab CI/CD

Jenkins

Kubernetes Basics

Kubernetes Networking

Kubernetes Advanced

Ingress & API Gateway

Terraform Basics

Terraform Advanced

Ansible & Configuration Management

AWS Essentials

Azure Fundamentals

GCP Fundamentals

Monitoring & Prometheus

Logging & ELK Stack

Alerting & Incident Response

Cloud Identity & Secrets

CI/CD Pipeline Security

Helm & Kubernetes

Runtime & Cluster Security

Container Supply Chain Security

Service Mesh & Istio

GitOps & ArgoCD

Progressive Delivery

Distributed Observability

Disaster Recovery & Backup

Performance Optimization

Cloud Cost Optimization

SRE Principles

Chaos Engineering

Platform Engineering

Nắm vững DevOps cho lần phỏng vấn tiếp theo