CI/CD Interview Questions (50+ Detailed Q&A)
1. Concepts & Pipelines
1. CI vs CD vs CD
1. CI vs CD vs CD
Answer:
- CI (Integration): Merge code often -> Build -> Test. Detect bugs early.
- CD (Delivery): Code is ready to deploy. Artifact created. Manual approval to Prod.
- CD (Deployment): Zero touch. Pass test -> Auto Deploy to Prod.
2. Idempotency in DevOps
2. Idempotency in DevOps
Answer:
Running a script twice produces the same result.
Example:
mkdir flow fails 2nd time. mkdir -p is idempotent.
Ansible/Terraform are idempotent.3. Pipeline Stages
3. Pipeline Stages
Answer:
Checkout -> Lint -> Compile/Build -> Unit Test -> SAST -> Package (Docker) -> Publish Artifact -> Deploy Dev -> Integration Test -> Deploy Staging -> E2E Test -> Deploy Prod.
4. Mutable vs Immutable Infrastructure
4. Mutable vs Immutable Infrastructure
Answer:
- Mutable: SSH into server,
apt-get update. Drift happens. Hard to reproduce. - Immutable: Build new Image/VM. Replace old one. Consistent. Rollback easy.
5. Configuration Management vs Provisioning
5. Configuration Management vs Provisioning
Answer:
- Provisioning: Create Infra (Terraform, CloudFormation).
- Config Mgmt: Configure OS/Software (Ansible, Chef, Puppet).
6. Monorepo vs Polyrepo CI
6. Monorepo vs Polyrepo CI
Answer:
- Monorepo: Smart change detection needed (Did
/libchange? Build all dependents). Shared tooling. - Polyrepo: Simple. Repo change = Pipeline run. Dependency hell.
7. Artifact Management
7. Artifact Management
Answer:
Store binaries (Jar, Docker Image).
Nexus, Artifactory, Container Registry.
Versioned, Immutable.
8. Self-hosted vs SaaS Runners
8. Self-hosted vs SaaS Runners
Answer:
- SaaS (GitHub Actions): Easy. Pay/min. Security risk (Shared environment).
- Self-hosted: Control hardware, Network access (VPC), Cheaper at scale. Maintenance overhead.
9. Pipeline as Code
9. Pipeline as Code
Answer:
Defining workflow in YAML/Groovy (
Jenkinsfile, .gitlab-ci.yml) stored in Git.
Version controlled, Peer reviewed.10. Fan-out / Parallelism
10. Fan-out / Parallelism
Answer:
Splitting tests (Unit, Integration, Lint) to run concurrently to reduce pipeline time.
Matrix builds (Node 14, 16, 18).
2. Testing Strategies
11. The Testing Pyramid
11. The Testing Pyramid
Answer:
Shape: Pyramid.
- Base: Unit (70%). Fast, Cheap.
- Middle: Integration (20%).
- Top: E2E (10%). Slow, Flaky. If Inverted (Pizza/IceCream Cone): Anti-pattern. Slow feedback loop.
12. Unit vs Integration vs E2E
12. Unit vs Integration vs E2E
Answer:
- Unit: Single function/class. Mock everything.
- Integration: Interaction (Service + DB).
- E2E: Full user journey (Selenium/Cypress). Real browser.
13. Smoke Testing / Sanity Testing
13. Smoke Testing / Sanity Testing
Answer:
- Smoke: “Is it on fire?”. Basic check (Can I login?). Run after deployment.
- Sanity: Check specific new functionality.
14. Code Coverage
14. Code Coverage
Answer:
% of code executed during tests.
Metric, not goal. 100% coverage doesn’t mean bug free.
15. Static Analysis (Linting)
15. Static Analysis (Linting)
Answer:
Check code without running it. Formatting, Syntax, Potential bugs.
ESLint, SonarQube.
16. Shift Left Testing
16. Shift Left Testing
Answer:
Testing early in the lifecycle (Dev machine, pre-commit) rather than waiting for QA phase.
17. Flaky Tests
17. Flaky Tests
Answer:
Passes sometimes, fails others (Timing, Network).
Fix: Retries, Isolate environment, remove sleep() use waitFor().
18. Contract Testing (Pact)
18. Contract Testing (Pact)
Answer:
For Microservices.
Ensures Consumer and Provider agree on API schema.
Prevents breaking changes.
19. Performance Testing
19. Performance Testing
Answer:
- Load: Normal expected load.
- Stress: Breaking point.
- Soak: Long duration (Memory leaks).
- Spike: Sudden burst. Tool: JMeter, K6.
20. Test Data Management
20. Test Data Management
Answer:
Don’t use Prod data (Privacy).
Synthetic data or Anonymized dump.
Reset after test.
3. Deployment Patterns
21. Blue Green Deployment
21. Blue Green Deployment
Answer:
PROD (Blue). Deploy to Idle (Green).
Test Green.
Switch Load Balancer -> Green.
Rollback: Switch back.
Cost: Double resource usage.
22. Canary Deployment
22. Canary Deployment
Answer:
Deploy to small % (5%).
Monitor metrics (Errors, Latency).
Gradually increase (10%, 50%, 100%).
Limits blast radius.
23. Rolling Update
23. Rolling Update
Answer:
Replace instances one by one (or batch).
Zero downtime.
Risk: Version compatibility (Running v1 and v2 same time).
24. Feature Toggles (Flags)
24. Feature Toggles (Flags)
Answer:
Deploy code to prod but keep it hidden behind
if (flag).
Decouples Deployment (Binary move) from Release (Feature visibility).
A/B Testing.25. Shadow Deployment (Dark Launch)
25. Shadow Deployment (Dark Launch)
Answer:
Traffic copy (Mirroring).
Send Request to v1 and v2. Return v1 result. Compare v2 result async.
Test accuracy/performance without user impact.
26. GitOps (ArgoCD)
26. GitOps (ArgoCD)
Answer:
Git is Truth.
Cluster Agent (Argo) pulls state from Git -> Applies to K8s.
Detects Drift (Manual changes reverted).
27. Recreate Strategy
27. Recreate Strategy
Answer:
Down all old. Up all new.
Downtime exists.
Needed if Schema change is backward incompatible or Singleton app.
28. Rollback Strategy
28. Rollback Strategy
Answer:
Auto-rollback on health check failure.
Versioned artifacts essential.
Database rollback is the hard part (Backward compatible schema changes).
29. A/B Testing
29. A/B Testing
Answer:
Experiment. Group A sees feature X, Group B sees Y. Measure conversion.
Business decision, not just technical.
30. Environment Promotion
30. Environment Promotion
Answer:
Artifact built ONCE.
Promoted
Dev -> QA -> Prod.
Configuration injected per env (Env vars).
Never rebuild for Prod (Risk different code).4. Security (DevSecOps)
31. SAST vs DAST
31. SAST vs DAST
Answer:
- SAST: Static. Source Code scan. (Whitebox). Find SQLi pattern.
- DAST: Dynamic. Running App scan. (Blackbox). Attack running endpoint.
32. Dependency Scanning (SCA)
32. Dependency Scanning (SCA)
Answer:
Software Composition Analysis.
Check
package.json against CVE database (Snyk, Dependabot).
Find vulnerable libraries.33. Container Scanning
33. Container Scanning
Answer:
Scan Docker layers for OS vulnerabilities (Trivy, Clair).
34. Secrets Management in CI
34. Secrets Management in CI
Answer:
Never commit output.
Use GH Secrets / Vault.
Mask secrets in logs.
35. Least Privilege
35. Least Privilege
Answer:
CI Runner should have minimal IAM permissions.
Don’t give Admin.
36. Signed Commits
36. Signed Commits
Answer:
GPG signing. Verify author identity.
37. Supply Chain Attack
37. Supply Chain Attack
Answer:
Attacker compromises a dependency (npm pip) or build tool (SolarWinds).
Mitigation: Lockfiles, Vendor dependencies, SLSA.
38. Image Signing
38. Image Signing
Answer:
Notary / Cosign.
Ensures image running in Prod is the one built by CI.
39. Compliance as Code
39. Compliance as Code
Answer:
OPA (Open Policy Agent).
Ensure Infra meets rules (No public Buckets) in pipeline.
40. Hardening CI Environment
40. Hardening CI Environment
Answer:
Ephemeral runners (clean slate).
Network isolation.
Audit logs.
5. Tools & Troubleshooting
41. Docker in Docker (DinD)
41. Docker in Docker (DinD)
Answer:
Running Docker commands inside a Docker container (Agent).
Needs Privileged mode (Security risk) or Socket binding.
Kaniko builds images without Daemon.
42. Jenkins vs GitHub Actions
42. Jenkins vs GitHub Actions
Answer:
- Jenkins: Old, Powerful, Plugin hell, Self-hosted maintenance.
- GHA: YAML, Integrated, Marketplace, SaaS.
43. Build Caching
43. Build Caching
Answer:
Cache
node_modules or maven repo.
Speeds up build. Use checksum of lockfile as cache key.44. Semantic Versioning
44. Semantic Versioning
Answer:
Major.Minor.Patch (1.0.0).
Breaking.Feature.Fix.
45. Changelog Generation
45. Changelog Generation
Answer:
Conventional Commits (
feat: login, fix: bug).
Auto generate changelog based on types.46. Why did the pipeline fail?
46. Why did the pipeline fail?
Answer:
- Read Logs.
- Reproduce locally.
- Check environment diff (Env vars).
- Flakiness?
47. Terraform State in CI
47. Terraform State in CI
Answer:
Store State remotely (S3 + Locking).
Never in Git.
48. Handling Database Migrations
48. Handling Database Migrations
Answer:
Run as a Job in CD (Pre-sync hook).
Tools: Flyway, Liquibase.
49. ChatOps
49. ChatOps
Answer:
Trigger deploy via Slack bot (
/deploy prod).
Visibility for team.50. DORA Metrics
50. DORA Metrics
Answer:
Measuring DevOps performance.
- Deployment Frequency.
- Lead Time for Changes (Code to Prod).
- Change Failure Rate.
- Time to Restore Service (MTTR).