DevOps Junior - Technical Assessment

Candidate information

Full name

Email

Phone (optional)

Years of experience

CV / Resume Accepted formats: PDF, DOC, DOCX. Maximum 5MB

Knowledge questions

This Dockerfile has several problems: `FROM ubuntu:latest\nRUN apt-get update\nRUN apt-get install -y python3 pip\nCOPY . /app\nRUN pip install -r /app/requirements.txt\nCMD python3 /app/main.py`. What are they?

The only problem is missing `WORKDIR /app` before COPY, which causes relative paths to not work correctly inside the container

The main problem is using Ubuntu as base image instead of Alpine, since Alpine is always more secure and faster regardless of the use case

Uses `latest` (not reproducible), unnecessary separate layers (each RUN creates a layer), no multi-stage build, runs as root, no `.dockerignore`, and does not combine RUN commands to reduce layers

CMD should be ENTRYPOINT because CMD does not allow passing arguments to the container and ENTRYPOINT is the only correct way to define the main process

What is the difference between CMD and ENTRYPOINT, and between COPY and ADD in Docker?

CMD defines default command (overridable at runtime). ENTRYPOINT defines the fixed executable (CMD passes as arguments). COPY only copies local files. ADD also extracts tars and accepts URLs (but COPY is recommended for clarity)

They are pairs of completely interchangeable synonyms maintained for backward compatibility with earlier versions of the Dockerfile format

ENTRYPOINT is an obsolete directive that was replaced by CMD in Docker 2.0 and should not be used in modern Dockerfiles

ADD is more secure than COPY because it validates checksums of copied files and prevents inclusion of malicious files in the image

When to choose EC2 vs ECS vs Lambda vs Fargate in AWS?

Always use Lambda because it is cheaper in all possible scenarios and has no limitations on execution time or available resources

ECS and Fargate are exactly the same service with different commercial names; AWS keeps them separate only for marketing and billing reasons

Lambda can run any type of application without time, memory, or state limits, completely replacing the need for containers or servers

EC2: full server control (legacy apps, GPU). ECS/Fargate: orchestrated containers (Fargate = serverless containers without managing instances). Lambda: short event-driven functions (<15min, stateless). Choice depends on control needed vs operational overhead

What is the difference between Security Group and NACL (Network ACL) in AWS?

They are exactly the same security mechanism with different names, applied at the same level of AWS network infrastructure

Security Group: stateful (return traffic automatically allowed), instance/ENI level, only ALLOW rules. NACL: stateless (requires explicit rules for inbound AND outbound), subnet level, allows ALLOW and DENY, evaluated by rule number

NACL is always more secure than Security Group in all scenarios because it operates at a lower level of the network stack and filters earlier

Security Group only works with EC2 instances and is not compatible with ECS, Fargate, Lambda, or any other AWS managed service

What are the Azure equivalents of S3, Lambda, and RDS?

S3 → Azure Files (file storage), Lambda → Azure Virtual Machines (compute), RDS → CosmosDB (globally distributed database)

S3 → Azure Queue Storage (message queues), Lambda → Azure Logic Apps (workflows), RDS → Azure Table Storage (key-value NoSQL)

Azure has no equivalent services to AWS; each cloud platform has a completely different and incompatible architecture

S3 → Azure Blob Storage, Lambda → Azure Functions, RDS → Azure SQL Database / Azure Database for PostgreSQL/MySQL — services with equivalent functionality in each category

What is the difference between Cloud Run, Cloud Functions, and GKE in Google Cloud?

Cloud Functions: event-driven functions (similar to Lambda). Cloud Run: serverless containers with auto-scaling to zero (similar to Fargate). GKE: managed Kubernetes for full container orchestration (maximum control)

Three different commercial names for the same serverless compute service on Google Cloud Platform, differentiated only by pricing plan

GKE is completely serverless like Cloud Run and requires no node management or infrastructure configuration from the user

Cloud Functions can run complete Docker containers with multiple processes, making it equivalent to GKE for most use cases

In Kubernetes, what are Pod, Deployment, and Service and how do they relate?

Three alternative ways to deploy the same application in a cluster, chosen based on the size of the development team

A Pod contains multiple Deployments within itself, and each Deployment manages an independent Service to expose its endpoints

Pod: minimum execution unit (one or more containers). Deployment: manages Pod replicas with rolling updates and rollbacks. Service: exposes Pods as a stable network endpoint (ClusterIP, NodePort, LoadBalancer) with service discovery

Service is a resource exclusively designed for databases and cannot be used to expose web applications or APIs to external traffic

This Terraform code has an error: `resource "aws_instance" "web" { ami = aws_ami.custom.id } resource "aws_ami" "custom" { source_instance_id = aws_instance.web.id }`. What is it?

Missing the `provider "aws" {}` block with region and credentials configuration, without which Terraform cannot communicate with the AWS API

The problem is only that the `instance_type` attribute is missing from the `aws_instance` resource, which is a mandatory field for creating EC2 instances

Missing `terraform init` execution before `terraform plan`, which causes providers to not be downloaded and resources to not be recognized

Circular reference: the instance depends on the AMI and the AMI depends on the instance. Terraform cannot resolve the creation order. Solution: break the dependency using an existing AMI or intermediate resources

What is Terraform state and why should it not be committed to the repository?

State is just an informational log of historical changes that Terraform generates for debugging with no functional impact on infrastructure management

The state (terraform.tfstate) maps real resources to configuration, contains IDs, IPs, and potentially secrets. Not committed because: contains sensitive data, causes team conflicts, and can be corrupted. Use remote backend (S3 + DynamoDB lock)

State regenerates automatically on every `terraform plan` execution and does not need to be saved or managed in any special way

Can be committed to the repository without issues as long as the repo is private, since Git encryption protects the sensitive data contained within

What are the typical stages of a CI/CD pipeline and the difference between CI and CD?

CI and CD are exactly the same thing expressed with different acronyms; both terms refer to the complete software automation process

CI is a concept exclusive to frontend projects (JavaScript/TypeScript) and CD is exclusively for backend projects (Java/Python/Go)

A CI/CD pipeline only needs two stages: build and direct deploy to production, without intermediate validation or testing steps

CI (Continuous Integration): lint → build → unit tests → integration tests (on each push). CD (Continuous Delivery/Deployment): deploy to staging → smoke tests → deploy to production (manual or automatic). CI validates code, CD delivers it

What is Ansible and how does it differ from Terraform?

They are completely identical tools with different syntax (HCL vs YAML) that perform exactly the same infrastructure functions

Ansible completely replaces Terraform in all use cases, making it unnecessary to use both tools in the same project

Terraform: declarative infrastructure (create/destroy cloud resources — IaC). Ansible: server configuration and provisioning (install software, configure services — Configuration Management). Terraform for "what exists", Ansible for "how it is configured"

Terraform is exclusively for software configuration within servers and Ansible is for creating cloud infrastructure like VPCs and databases

How to automate deployment after a push to the main branch using webhooks?

Configure a webhook in GitHub/GitLab that sends POST to the server/CI on push to main. The receiver validates the signature (secret), verifies the branch, and executes the deploy pipeline. Alternative: GitHub Actions/GitLab CI with trigger on push to main

Webhooks do not have the technical capability to trigger automatic deployments because they are unidirectional and cannot execute commands on remote servers

Deployment must always be manual with human approval; full deploy automation is a bad practice that introduces security risks

Deploy automation only works with Jenkins as CI/CD tool; GitHub Actions and GitLab CI do not support triggers based on push events

Coding challenge

Create a complete CI/CD pipeline using GitHub Actions or GitLab CI that includes all stages from lint to staging deployment. Also include a docker-compose.yml for local development.

Requirements

Pipeline with stages: lint, unit tests, multi-stage Docker build, push to registry, deploy to staging
Optimized multi-stage Dockerfile (builder + runtime)
docker-compose.yml for local development with hot-reload
Secrets managed as CI environment variables (not hardcoded)
Pipeline status notification (Slack, email, or similar)

Examples

Input: Push to main branch with changes in src/

Output:

Pipeline executes: lint (ESLint/Flake8) → tests → build Docker image → push to ECR/GHCR → deploy to staging with health check

Accepted technologies

GitHub Actions
GitLab CI
Docker + Docker Compose
Terraform (optional for infra)
Any language for the sample app

Solution submission

Repository URL * Supported platforms: GitHub, GitLab, Bitbucket Enter a valid repository URL (https://github.com, gitlab.com, or bitbucket.org followed by owner/repository)

DevOps - Junior