JPMorgan Chase DevOps Engineer interview questions

The answer is yes, and then the real question starts. Asymmetric routing and silent drops punish anyone who treats the routing tables as one flat list.

Two authentications happen in every SSH session and most candidates narrate only one. Knowing who proves what, and where your agent socket ends up, is the scored material.

One round trip versus two is the headline, but the ops-relevant differences hide in what stays plaintext, how resumption works, and which middlewares the change broke.

A reset at a suspiciously round number is a fingerprint, not a bug. Matching client keepalives to the lowest timer in the path is the fix; here is the full ladder of knobs.

Copy-on-write freezes a point-in-time view while the database keeps writing. Fat snapshots overflow into invalid backups and thin pools exhaust into frozen volumes: size both deliberately.

VRRP heartbeats, market data feeds, mDNS noise and cluster chatter all ride multicast, and all of it assumes a switched LAN. Why clouds drop it and what replaces it.

The question that separates console users from people who have debugged a permissions failure across accounts. Evaluation order is deterministic and knowing it makes AccessDenied readable.

A design question with a clear answer at this scale, and the reasoning is what scores. The three options solve different problems and peering and Transit Gateway connect networks while PrivateLink exposes services.

Database redundancy still needs reconnecting clients. Distinguish the deployment type, then measure how promotion and DNS changes affect application requests.

Ask whether Multi-AZ means a DB instance or a DB cluster. One has a non-readable standby; the other has two readers. That distinction decides whether the proposal can relieve the primary.

Direct encryption hits a 4 KB wall and a shared throughput quota. Envelope encryption routes around both, and the key policy underneath is central to authorizing key use.

Cross-account access is easy to grant and easy to get wrong. External IDs, scoped roles and audit trails separate a controlled bridge from an open door any tenant can walk through.

Instance metadata is a local credential vending machine and SSRF is the coin slot. IMDSv2 raises the bar at the host; layered defences and blast-radius limits finish the job.

Residency is not a checkbox on the primary datastore. Where bytes sit, who holds keys, and where logs, backups and analytics quietly replicate decide whether the deal signs.

Four tiers, four bills. Stating RTO and RPO per tier turns a vague resilience wish into a decision leadership can actually price, and the testing story is where candidates fold.

Allow-listing egress starts free with security groups and ends with TLS-breaking appliances. Each rung costs latency, money and political capital, and knowing where to stop is the actual test.

Four options with genuinely different costs, and the requirement is usually narrower than it first sounds. Establish whether it is about the network path, the data residency, or the provider's retention terms, because those need different answers.

The private endpoint can be healthy while an office resolver still returns the public address. Trace the lookup from the failing client before changing access rules.

Everyone can say state maps config to reality. The follow-up that separates candidates is what else is in the file, and what that means for who may read it.

Reading a plan is a skill separate from writing HCL. People trusted with production approves read the diff in a fixed order, and one of the checks is what the plan does not contain.

sensitive = true stops the echo, not the storage. The complete answer walks the value through git, plan artifacts, state, and provider side effects, naming which mitigation closes which leak.

Scan plan JSON on every pull request, run new rules advisory for two weeks, and block only what is law. Waivers live in version control with an owner and an expiry date, or the gate becomes noise within a quarter.

state rm, import, moved and removed blocks each treat a different wound. The senior signal is not reciting commands, it is the backup, lock and plan ritual wrapped around touching production state.

Rotation is an expand-contract migration for credentials: stage the new secret, prove every reader picked it up, revoke the old one, and treat the revocation as the test. The outage risk lives in clients and connection pools, not in Terraform.

Provisioning is a four-actor handshake between the PV controller, a sidecar, a driver and a backend. Knowing who calls whom turns every stuck PVC from mystery into checklist.

Pull auth resolves on the node before any container exists. Candidates who can order the credential chain and read 401 versus 403 versus 429 in events diagnose this in minutes; the rest rotate secrets blind.

Fail protects the policy, Ignore protects availability, and every real answer starts with per-webhook threat model plus scoping. The canonical outage, a webhook that rejects its own restart, separates the people who have run this from those who read about it.

Pod-level SIGTERM handling and node-level shutdown coordination are different mechanisms, and conflating them is the trap. The kubelet can only drain pods on power-off if it participates in systemd's shutdown sequence.

Two artifacts hide under 'Kubernetes backup' and they recover different things. Interviewers grade the misses: volume bytes, encryption keys, and everything that never lived in etcd at all.

Pods authenticate with JWTs minted per-pod now, not eternal Secrets. The scored answer separates authentication from authorization, explains audience binding, and treats automount as opt-in rather than ambient.

Three API servers behind one health-checked endpoint, etcd on its own quorum, leader election everywhere else. The scored part is naming what degrades quietly before anything alerts.

Two-phase deletion, a controller that purges content, finalizers holding the door. Stuck CRD instances, dead webhooks and GitOps recreates are the real story; standards prevent the ticket.

If every environment rebuilds, staging never validated the bytes production runs. The promotion model auditors and 2am responders both love, plus the costs nobody mentions until adoption.

A registry grows because every commit mints digests nobody pulls again. Reference-aware retention keeps rollback targets and audit chains while expiring the debris.

Base layers are dependencies: digest-pin them, let bots bump them weekly, and let CVE disclosures trigger scoped rebuilds through the normal pipeline. Days, not quarters.

A freeze enforced by email is a suggestion. Tier services, put the window in deploy tooling, price exceptions honestly, and judge the policy by incidents prevented.

Pipeline credentials are the keys to production and git history is forever. Scoping per stage, runtime-minted short-lived identities, expiry-enforced rotation, and a revoke-first leak playbook.

The data-path question separates people who have sized a cluster from people who installed one. Shard sizing, refresh versus flush, and each ILM phase carry one specific failure mode apiece.

Attribution is an incentive-design problem: own-team labels at ingest, unit pricing per signal, monthly showback before any chargeback, sanctioned levers so teams can actually respond.

Sampling keeps proportions and loses rare individuals; filtering keeps chosen classes complete and loses whatever you misclassified. Decide retention at write time, keep counters always, rehydrate the rest.

Severity inflation and silent underdeclaration are both incentive problems, not wording problems. Anchor levels to impact and obligations, pre-write example scenarios, and make declaring severe safe.

A two-second dependency should cost you latency, not three services. The mechanics are arithmetic: Little's law plus retry amplification. The fix is a budget, not a ban.

A hang suggests missing progress; a refusal suggests an explicit error. Packet evidence distinguishes firewall behavior from routing failures and closed listeners. Then rule counters, not eyeballs, finger the guilty line.

An unchanged pipeline failing in one environment means the environment moved, not the code. Failures that start on an expiry boundary narrow the field to two suspects fast.

NFS waits can stall shutdown and inflate load average while CPUs stay idle. Check the blocked kernel path before deciding whether signals or mount recovery can release it.

The leaf is valid and the root is trusted, yet verification fails. The gap lives in the middle of the chain, and the exact verify code names it before you open a single config file.

The outage window closed, but every process born since then still tries to fetch secrets at boot with nothing to fall back on. Why restarts keep reopening an incident that already ended.

Every client fails at once, which rules out pods and points at shared PKI. Know which certificates share one expiry clock, and the ten-minute fix that avoids a rebuild.

Split-brain writes are a fencing failure first and a data problem second. Freeze writes, read the divergence boundary from replication positions, and let the payment ledger arbitrate reality.

Easy to define and easy to fail. The scoring half is where each gate sits, what it does to build time, and the honest admission of what the whole set misses.

Workload authentication, traffic encryption and authorization need separate verification. Admission and RBAC constrain who can deploy a workload that bypasses those controls.

An incident response question wearing a Git costume. The wrong instinct is to rewrite history first, and it costs you the hour that matters.

The single highest-value security change available to most pipelines, and the reason it works is worth understanding rather than configuring. It removes the secret rather than protecting it.

Three terms that get used interchangeably and answer three different questions. The one that makes them operational is the admission rule at the end: no provenance, no deploy.

Four tools that solve the same sentence and differ on one question: where does the plaintext end up? In a regulated environment that question decides the answer.

Everyone endorses least privilege; few can describe how they would measure over-permission across a fleet. The scoring answer names the evidence source, the tiered remediation, and the break-glass hatch that makes it survivable.

Most clusters fail an RBAC review on the same handful of patterns. Naming them concretely, plus the namespace-first design that prevents them, is what separates operators from tutorial readers.

Tool selection is the shallow half of secrets questions. Senior answers live in the mechanics: dual-validity windows, consumer caching, and revocation you have actually tested rather than assumed.

The reframe that scores: many controls contain machine-checkable assertions; others require human evidence. Guardrails prevent, gates stop pipelines, drift detection watches live state, and evidence falls out as a byproduct.

Tamper evidence is an architecture property, not a log setting. Off-box forwarding, append-only storage under separate credentials, hash chains and a verification job that actually runs.

Miners prove unauthorized workload execution, not a particular intrusion sequence. Parallel identity and network containment, backup control-plane protection, rebuild-don't-clean, and restore points older than patient zero.

Exceptions rot when they lack expiry dates, named owners and an aggregate view. Structured records where engineers work, auto-expiry with teeth, and a monthly portfolio review that treats growth as a control failure.

A pentest report is evidence, not a backlog. Triage by exploitability and blast radius, reproduce before you believe, commit to deadlines you can defend, and publish the burn-down so the dates are yours.

Trace who can read ciphertext, who can decrypt it and who can administer the keys. Key rotation, rewrapping and data re-encryption solve different problems.

The classic napkin-math question. The number in the prompt is the question, and candidates who draw the architecture before doing the arithmetic design something the physics forbids.

The design round where the honest answer is mostly about data. Stateless traffic across regions is straightforward; the database is where active-active is either solved or pretended.

The migration question, and the trap is answering with a target architecture. What is being scored is sequencing: how you get there without a rewrite and without a release freeze.

Every candidate says replication and failover. The scoring answer names the replication mode, states the resulting data loss window, and explains how the cluster avoids two primaries.

CAP is not a menu of two letters per system. The scored answer knows what the theorem claims (narrowly), what most engineers misquote, and what a split-brain costs when both halves accept writes.

Timeouts guarantee uncertainty, not failure: the first request may have succeeded after the client gave up. The idempotency key pattern is the industry answer; the scored details are storage, expiry and concurrency.

Sharding buys write headroom and bills you in joins, foreign keys, and every future migration. The key choice is a query-pattern bet; the resharding choreography separates operators from diagram artists.

Never-delete is a policy, not a control. Auditors and attackers both want to know what stops an admin with broad credentials, and the answer has to be mechanical.

This is a machine identity problem wearing a secrets costume. Candidates who start at encryption miss that authentication of the caller and delivery mechanics are the real design space.

Listing the match job is table stakes. The scored material is the breaks taxonomy, the suspense account, and why every match must be replayable from immutable raw files.

Most tagging initiatives are spring cleans that rot within two quarters. The durable answer treats the schema like an API contract enforced where resources are born, and knows which lever actually wins.

Prompts contain whatever the user typed, which in a support product is names, account numbers and medical detail. Full-text logging is a data-protection decision, not a debugging preference.

A mandatory gateway can centralize limits and filtering, while applications authorize business actions. Neither a prompt nor a PII classifier guarantees that sensitive data stays private.

Most of the obligation lands on the product, but three parts land on infrastructure: an inventory of what is deployed, evidence of what it did, and the ability to turn it off. Those are platform capabilities and they take months to retrofit.

A slipped cutover, a security finding, a committed date dying. The scored skill is bad news delivered early by you, structured as facts, impact, options and one recommendation.

Urgency inflation is the default state of platform teams. Interviewers score whether you replace shouting with a shared queue, verified impact, and tradeoffs the requesters can see.

The question that separates people who have debugged a hung rollout from people who have read about one. The interesting half is not the signal, it is PID 1.

A staple of every networking round, and the follow-up is always about TLS termination. Knowing which layer sees what decides most of the answer.

The oldest question in systems interviewing and still the best, because it is unbounded: the interviewer stops you when you run out of depth, and where you stop is the score.

The question that reveals whether someone knows what load average actually counts on Linux. It is not a CPU metric, and that single fact resolves the whole thing.

The classic ephemeral port exhaustion question. Most candidates know the phrase TIME_WAIT; far fewer know which side accumulates it and why the popular fix is dangerous.

Two different resources produce the same errno, and the second one is invisible unless you know to look. One command distinguishes them.

The scripting round in disguise. The constraint is the question: it exists to see whether you stream or whether you load, and everything else is about whether the script is safe to run twice.

A beginner question with a senior follow-up hiding in it. Once you know a hard link is a second name for an inode, log rotation and backup behaviour both stop being mysterious.