Chapter 70: DevOps Interview Questions by Topic and Company
70.6 CI/CD, GitHub Actions and GitLab CI Interview Questions
CI/CD mhanje commit pasun production paryant cha rasta. To rasta ek goshti sarkha sanga.
What you will learn in this lesson
- 28 real CI/CD, GitHub Actions and GitLab CI questions with short answers
- Which companies asked them, from public interview stories
- Fresher, experienced and senior levels
- A simple way to answer: why, what, how
Why: the problem
CI/CD is the heart of DevOps. Interviewers want the full path from a commit to production, with safety checks on the way.
What: how to read this lesson
Each question has a short answer in three parts.
- Why: the reason the thing exists.
- What: the plain meaning.
- How: how you use it, often with a small command.
"Asked at" names a company only when a public interview story says the question was asked there. No tag means it is a common question that many companies ask.
Companies with the most questions in this lesson: Infosys (9), Accenture (5), TCS (4), Wipro (3), HCLTech (3), LTIMindtree (2).
How: answer any question in 4 steps
- Start with the reason. One sentence.
- Give the plain meaning. No big words.
- Show one command or file.
- Add one example from your work. Then stop and wait.
Fresher questions
Q1. What is CI/CD?
Why: It is the heart of DevOps.
What: CI: every change is built and tested automatically. CD: tested changes are delivered (or deployed) to environments automatically.
How: Explain your pipeline from commit to prod in steps.
Q2. How is continuous integration achieved?
Why: They want practice, not definitions.
What: Developers merge small changes often; each push triggers build and tests.
How: Use PR checks, fast unit tests, branch protection and quick feedback.
Q3. What is the difference between continuous delivery and continuous deployment?
Why: A classic question.
What: Delivery: always ready to release, with a manual click to prod. Deployment: every passing change goes to prod automatically.
Q4. What are artifacts in CI/CD?
Why: Build once, deploy many times.
What: An artifact is the build output: jar, zip, Docker image.
How: Store in Nexus, Artifactory, S3 or a registry; deploy the same artifact to all environments.
Q5. What deployment strategies do you know?
Why: Safe release is a must.
What: Recreate, rolling, blue-green, canary, A/B.
How: Rolling is default in K8s; blue-green for quick switch-back; canary for small-risk testing.
Q6. What is GitHub Actions?
Why: Very common for new projects.
What: GitHub's built-in CI/CD. Workflows are YAML files in .github/workflows that run on events.
How: Workflow → jobs → steps; steps run commands or reuse actions.
on: [push]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npm ci && npm test
Q7. What is .gitlab-ci.yml?
Why: GitLab CI is common in Indian MNCs.
What: The file that defines stages and jobs for GitLab pipelines.
How: Jobs run on GitLab runners; use rules to control when they run.
stages: [build, test]
build:
stage: build
script: [make build]
Experienced questions (2-5 years)
Q8. Explain the flow from code commit to production deployment.
Why: Shows you understand the full system.
What: Commit → PR + checks → merge → build → test → scan → push image → deploy to dev/stage → approval → prod → monitor.
How: Name the tools you used at each step.
Q9. How do you secure a CI/CD pipeline?
Why: Pipelines hold keys to production.
What: Protect code, secrets, runners and artifacts.
How: Use SAST, dependency and image scans, secret stores, least-privilege roles (OIDC), signed artifacts, branch protection, audit logs.
Q10. What is SAST and DAST?
Why: Security testing in pipelines.
What: SAST scans source code without running it (SonarQube, Semgrep). DAST tests the running app from outside (OWASP ZAP).
How: Run SAST on every PR, DAST against staging.
Q11. How do you keep secrets out of pipeline logs?
Why: Leaked logs leak keys.
What: CI tools mask registered secrets, but echo or debug flags can still leak them.
How: Use the secret store, avoid set -x around secrets, mask outputs, and scan logs.
::add-mask::$TOKEN
Q12. A pipeline takes 45 minutes. How do you speed it up?
Why: Slow pipelines hurt productivity.
What: Find the slowest stages first.
How: Cache dependencies and Docker layers, run jobs in parallel, split tests, build only changed services, use bigger runners.
Q13. What is the difference between stages and jobs?
Why: Basic pipeline design.
What: Jobs are units of work that run on a runner. Stages group jobs and run in order.
How: Jobs in one stage can run in parallel.
Q14. How do you create reusable pipeline templates for 50 microservices?
Why: Copy-paste does not scale.
What: Keep one template and let each service pass parameters.
How: Use Jenkins shared libraries, GitHub reusable workflows, or GitLab include templates.
jobs:
build:
uses: org/ci/.github/workflows/build.yml@v1
with: {service: payments}
Q15. What is the difference between hosted and self-hosted agents/runners?
Why: It affects cost and security.
What: Hosted runners are managed by the vendor and fresh each time. Self-hosted run on your machines with your network access.
How: Self-hosted for private network access or special hardware; harden and isolate them.
Q16. How do you set up a CI/CD pipeline for microservices across many repos?
Why: Real projects have many services.
What: Each service builds its own image; deployment config lives in Git.
How: Use shared templates, semantic versions, a registry, and GitOps (Argo CD) for deploys.
Q17. How do you get zero-downtime deployments?
Why: Users should not see deploys.
What: New version starts before the old one stops, and traffic moves only to ready pods.
How: Rolling update with maxUnavailable 0, readiness probes, graceful shutdown, and backward-compatible DB changes.
strategy:
rollingUpdate: {maxSurge: 1, maxUnavailable: 0}
Q18. What happens to in-flight requests during a blue-green switch?
Why: Cutover must not drop users.
What: Requests already on blue continue only if blue stays up long enough.
How: Use connection draining (deregistration delay), keep blue running a while, and make clients retry safely.
Q19. How do you deploy database changes in a pipeline?
Why: DB changes are the riskiest part.
What: Use migration tools (Flyway, Liquibase) with versioned scripts.
How: Make changes backward compatible (expand, then contract), back up first, and run migrations as a separate step.
flyway migrate
Q20. CI passes but CD fails. How do you investigate?
Why: Deploy steps fail for different reasons than tests.
What: CD touches real environments: credentials, network, config, quotas.
How: Read the deploy log, check access/permissions, environment config and secrets, cluster events, and compare with the last good deploy.
Q21. Build time suddenly doubled. What do you check?
Why: Slowness means something changed.
What: Common causes: cache lost, new dependencies, slow runner, network, more tests.
How: Compare stage timings with an old run, check cache hits and runner load.
Q22. How do you use secrets and OIDC in GitHub Actions?
Why: Long-lived cloud keys are risky.
What: Secrets are stored encrypted per repo or environment. OIDC lets the job get short-lived AWS credentials without keys.
How: Use aws-actions/configure-aws-credentials with role-to-assume and permissions: id-token: write.
permissions:
id-token: write
contents: read
Q23. What is a matrix build?
Why: Test on many versions at once.
What: A matrix runs the same job with different values.
How: Use it for multiple Node/Python versions or OSes.
strategy:
matrix:
node: [18, 20, 22]
Q24. GitLab CI vs Jenkins: what would you choose?
Why: Tool choice questions are common.
What: GitLab CI is built into GitLab with simple YAML. Jenkins is separate and very flexible with plugins.
How: Choose GitLab CI if code is on GitLab and you want less upkeep.
Q25. How do you add security tools to a CI/CD pipeline?
Why: DevSecOps is expected now.
What: Each tool checks one risk.
How: Secret scan (Gitleaks), SAST (SonarQube/Semgrep), dependency scan (OWASP Dependency-Check, Snyk), image scan (Trivy), IaC scan (Checkov, tfsec).
Q26. How do you handle environments (dev, QA, prod) in a pipeline?
Why: One pipeline must deploy everywhere.
What: Same artifact, different config per environment.
How: Use environment-specific values files/variables, protected prod environment, and approvals.
Q27. What is semantic versioning?
Why: Release naming.
What: MAJOR.MINOR.PATCH: breaking, new feature, bug fix.
How: Tag images and releases with it.
v2.3.1
Q28. What is a feature flag?
Why: Release without deploy risk.
What: A switch in config to turn features on or off at run time.
How: Lets you deploy code dark and enable slowly.
Practice tasks
Medium How do you keep secrets out of pipeline logs?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you create reusable pipeline templates for 50 microservices?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you get zero-downtime deployments?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you deploy database changes in a pipeline?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is GitHub Actions?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you use secrets and OIDC in GitHub Actions?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium What is a matrix build?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is .gitlab-ci.yml?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Homework: try at home
- Pick five questions you find hard.
- Write your own answer for each in three lines.
- Record yourself answering them. Listen once and improve.
Recap
In short
- Answer in order: why, what, how, then one example.
- Show one small command when you can.
- "Asked at" comes from public interview stories.
- Practise aloud; do not memorise word for word.
FAQ
Do I need to learn all 28 questions?
No. Start with the fresher ones. Then add the experienced ones for your level.
Should I memorise these answers?
No. Understand the why, then say it in your own words. Interviewers notice memorised lines.
What if I do not know an answer?
Say so honestly. Then explain how you would find out, step by step.
Are these questions only for one company?
No. "Asked at" shows where people said it was asked. Other companies ask the same things.
How long should an answer be?
About 30 to 60 seconds. Give a reason, a plain meaning and one example.
Is a lab really needed?
Yes. Running the command once makes your answer real and confident.
Interview questions
Practise these five first. Many companies asked them.
- Explain the flow from code commit to production deployment. - Commit → PR + checks → merge → build → test → scan → push image → deploy to dev/stage → approval → prod → monitor.
- What deployment strategies do you know? - Recreate, rolling, blue-green, canary, A/B.
- What is CI/CD? - CI: every change is built and tested automatically.
- How do you secure a CI/CD pipeline? - Protect code, secrets, runners and artifacts.
- How do you keep secrets out of pipeline logs? - CI tools mask registered secrets, but echo or debug flags can still leak them.
Quick quiz
Q1. What is CI/CD?
CI: every change is built and tested automatically.
Q2. What is the difference between stages and jobs?
Jobs are units of work that run on a runner.
Q3. How do you deploy database changes in a pipeline?
Use migration tools (Flyway, Liquibase) with versioned scripts.
Q4. How do you add security tools to a CI/CD pipeline?
Each tool checks one risk.
Samajla ka?
Revision card
Interview card