Master Collection

What is DevOps and what core problem does it solve?

DevOps is a cultural, organizational, and technical philosophy combining Software Development (Dev) and IT Operations (Ops). It breaks down organizational silos to enable faster, more reliable software delivery through automation, continuous integration, continuous delivery, and shared responsibility. It eliminates the "Wall of Confusion" where developers wrote code without operational awareness and operators deployed code without understanding development context.

What are the Three Ways of DevOps?

1. Flow (Left-to-Right): Accelerate the flow of work from development to operations to customers by minimizing work-in-progress (WIP) and automating delivery pipelines.
2. Feedback (Right-to-Left): Establish rapid, continuous feedback loops from production to development via telemetry and retrospectives.
3. Continuous Learning & Experimentation: Foster a high-trust culture that encourages risk-taking, experimentation, and institutional learning from failure.

What is the difference between DevOps and Agile?

Agile focuses on iterative software development, rapid customer feedback, and adaptive planning during the coding and product management phases. DevOps extends Agile principles across the entire lifecycle, encompassing build, test, infrastructure provisioning, deployment, monitoring, and live operations.

What are DORA Metrics? List all four core metrics.

1. Deployment Frequency (DF): How often an organization deploys code to production.
2. Lead Time for Changes (LTFC): Time from code commit to running in production.
3. Change Failure Rate (CFR): Percentage of deployments requiring immediate hotfix/rollback.
4. Time to Restore Service (TTRS / MTTR): Time to recover from a production outage.

What benchmarks define an "Elite" DORA performer?

Elite teams achieve: Deployment Frequency on-demand (multiple times per day), Lead Time for Changes $< 1$ hour, Change Failure Rate between 0%–15%, and Time to Restore Service $< 1$ hour.

What is Continuous Integration (CI)?

CI is the engineering practice where developers integrate code into a shared repository frequently. Every merge triggers automated builds, linters, and unit/integration test suites to detect bugs early.

What is Continuous Delivery (CD) vs Continuous Deployment (CD)?

Continuous Delivery automates software release staging so code is always production-ready, requiring a single manual approval to deploy. Continuous Deployment automates the entire journey—every passing commit deploys directly into live production with zero human intervention.

What is Infrastructure as Code (IaC)?

Managing and provisioning compute, storage, and networking infrastructure via machine-readable definition files (e.g., Terraform HCL, Kubernetes YAML) rather than manual console interaction.

What is Configuration Drift?

The divergence of live infrastructure settings from the declared IaC templates in Git, usually caused by manual emergency changes made directly in cloud consoles or servers.

What is Immutable Infrastructure?

An operational paradigm where servers or containers are never patched or modified in-place. Updates require building a new image/container from scratch, testing it, and terminating the old instance.

What is the "You Build It, You Run It" model?

A foundational DevOps organizational model coined by Werner Vogels (CTO of Amazon) where the engineering team that writes a service is also responsible for deploying, operating, and supporting it in production.

What is Shift-Left Security (DevSecOps)?

Integrating security testing (SAST, SCA, secret scanning, container scanning) early in the software development lifecycle rather than conducting security reviews as an afterthought before release.

What is a Monolith vs Microservices Architecture?

Monoliths bundle all business logic, database access, and UI into a single codebase and deployment unit. Microservices decompose functionality into autonomous, loosely coupled services communicating over network APIs (REST, gRPC, Kafka).

What are the Twelve Factors of the 12-Factor App?

1. Codebase, 2. Dependencies, 3. Config, 4. Backing Services, 5. Build/Release/Run, 6. Processes, 7. Port Binding, 8. Concurrency, 9. Disposability, 10. Dev/Prod Parity, 11. Logs, 12. Admin Processes.

What is Trunk-Based Development?

A branching strategy where all developers commit small, frequent changes directly to a single shared branch (main), avoiding long-lived feature branches and merge conflicts.

What is GitFlow and why is it often considered an anti-pattern for CI/CD?

GitFlow uses long-lived branches (develop, feature, release, hotfix, master). It delays integration testing, causes painful merge conflicts ("merge hell"), and slows deployment velocity.

What is a Blue-Green Deployment?

Maintaining two identical production environments: Blue (active production) and Green (idle staging). Traffic is switched instantly via the load balancer from Blue to Green upon successful verification.

What is a Canary Deployment?

Releasing a new software version to a small percentage of live users (e.g., 5%) while monitoring telemetry. If error rates remain healthy, traffic is incrementally shifted to 100%.

What is a Feature Flag (Toggle)?

A conditional code statement that decouples code deployment from feature release, allowing features to be toggled on/off in production via an API or UI without redeploying code.

What is Dark Launching?

Deploying new backend code to production to process live data or shadow requests in the background without exposing any visible UI changes to users.

What is Observability vs Monitoring?

Monitoring tracks predefined metrics against known thresholds ("Is the system up?"). Observability allows engineers to infer the internal state of a system based on its telemetry outputs ("Why is the system broken?").

What are the Three Pillars of Observability?

Metrics (aggregable numbers), Logs (timestamped discrete event records), and Distributed Traces (request lifecycle spans across services).

What is Chaos Engineering?

The discipline of proactively injecting controlled failures (killing pods, adding network latency, severing database links) into distributed systems to verify resilience before real outages occur.

What is FinOps?

Cloud Financial Operations—a cross-functional framework bringing financial accountability to variable cloud spending, optimizing cloud unit economics while maintaining engineering velocity.

What is SRE (Site Reliability Engineering)?

A discipline pioneered by Google applying software engineering principles to operations and infrastructure problems to maximize system reliability and availability.

What is an Internal Developer Platform (IDP)?

A self-service portal (e.g., Backstage) providing "Golden Paths" that automate infrastructure provisioning, CI/CD, and compliance to reduce developer cognitive load.

What is a Golden Path (Paved Road)?

A supported, standardized, and automated route for building and deploying software that incorporates all organizational security, infrastructure, and compliance best practices by default.

What is Cognitive Load in software engineering?

The total mental effort required for a developer to perform their job. High cognitive load (managing Docker, K8s, Terraform, IAM, monitoring) slows feature velocity; Platform Engineering aims to minimize it.

What is Conway’s Law?

Organizations design systems that mirror their own communication structures. Siloed teams build monolithic architectures; decoupled cross-functional teams build microservice architectures.

What is Idempotency?

A property of an operation where executing it once or multiple times produces the exact same end-state result without side effects.

What is Configuration Management?

Automating the installation of packages, OS kernel parameters, and configuration files across servers in a consistent, repeatable state (e.g., Ansible, Puppet).

What is a Deployment Pipeline?

An automated implementation of the build, test, package, and deploy steps that software undergoes from developer commit to production release.

What is a Rollback Strategy?

A predefined, automated procedure to revert a system to its previous known stable version when a deployment introduces defects.

What is Artifact Repository Management?

Storing and versioning compiled binaries, container images, Helm charts, and language packages in centralized registries (e.g., Nexus, Artifactory, GitHub Packages).

What is Continuous Feedback?

Continuously gathering APM metrics, user analytics, error logs, and customer feedback from production and integrating them into product backlogs.

What is the Single Source of Truth principle?

Storing all application configurations, infrastructure code, and operational policies in a single centralized, version-controlled repository (typically Git).

What is Technical Debt in DevOps?

The implied cost of choosing quick, suboptimal workarounds (manual server patches, hardcoded configs) over well-architected solutions, compounding future operational maintenance overhead.

What is Zero-Downtime Deployment?

Deploying new application versions without interrupting active user requests or causing connection drops (achieved via Rolling Updates, Blue-Green, or Canary deployments).

What is Backward Compatibility in API design?

Ensuring that updates to APIs or database schemas do not break older client applications or existing data consumers.

What is Semantic Versioning (SemVer)?

A standard versioning convention: MAJOR.MINOR.PATCH (e.g., 2.1.0), where MAJOR indicates breaking changes, MINOR indicates backward-compatible features, and PATCH indicates bug fixes.

What is Self-Healing Infrastructure?

Systems designed to automatically detect and remediate failures without human intervention (e.g., Kubernetes restarting crashed containers or cloud Auto Scaling Groups replacing unhealthy instances).

What is a Monorepo vs Polyrepo?

Monorepos hold multiple projects/microservices in a single repository; Polyrepos store each microservice in its own independent repository.

What is Shift-Right Testing?

Testing software in live production environments under real user traffic using feature flags, canary rollouts, synthetic monitoring, and chaos experiments.

What is Telemetry in DevOps?

The automated collection and transmission of operational measurements, performance data, and diagnostics from distributed systems to monitoring tools.

What is a Blameless Culture?

A high-trust workplace culture that treats errors as systemic opportunities to improve tooling and processes rather than punishing individual human mistakes.

What is a GameDay in SRE?

A scheduled exercise where engineering teams simulate production outages and disaster recovery failovers to validate monitoring, alerting, and operational runbooks.

What is a Dead Letter Queue (DLQ)?

A dedicated message queue that isolates unprocessable or malformed messages after repeated retry failures to prevent consumer queue blocking.

What is the Bulkhead Pattern?

Isolating critical system resources (thread pools, memory, database connections) into distinct compartments so failure of one dependency does not crash the entire application.

What is Circuit Breaking?

A design pattern that prevents an application from repeatedly executing an operation that is failing, allowing downstream dependencies time to recover.

What is Rate Limiting vs Throttling?

Rate limiting restricts how many requests a specific user/IP can make in a given time window; throttling regulates server-side processing speed to match downstream resource capacity.

What is an SLI (Service Level Indicator)?

A quantifiable metric that measures service performance at a specific moment in time (e.g., Proportion of HTTP requests returning status 200 in $< 200\text{ms}$).

What is an SLO (Service Level Objective)?

An internal reliability target agreed upon between Dev and SRE teams (e.g., 99.9% of requests must meet the SLI over a rolling 30-day window).

What is an SLA (Service Level Agreement)?

A legally binding contract with customers specifying penalties (financial credits, refunds) if the service fails to meet agreed uptime levels.

What is an Error Budget?

The exact mathematical inverse of an SLO: $\text{Error Budget} = 100% - \text{SLO}$. It defines the acceptable headroom of downtime or failures a service can accumulate without breaching user trust.

What happens when an Error Budget is exhausted (0%)?

Non-critical feature deployments are frozen, and 100% of engineering bandwidth shifts to bug fixing, technical debt reduction, and reliability engineering.

What is Toil in SRE?

Operational work that is manual, repetitive, automatable, tactical, devoid of enduring engineering value, and scales linearly with service growth.

What is the Google SRE 50% Rule for Toil?

A maximum of 50% of an SRE's time should be spent on operational toil and on-call duties; the remaining 50%+ must be dedicated to software engineering projects that permanently eliminate toil.

What are the Four Golden Signals of Monitoring?

Latency (time to process requests), Traffic (demand/throughput), Errors (rate of failed requests), and Saturation (how close resources are to full capacity).

What is the RED Method?

A monitoring framework for request-driven microservices: Rate (req/sec), Errors (failed req/sec), and Duration (latency distribution).

What is the USE Method?

A monitoring framework for infrastructure resources: Utilization (time resource was busy), Saturation (queue depth), and Errors (error counts).

What is MTTD (Mean Time to Detect)?

The average time elapsed between the inception of a system incident and when the engineering team or monitoring system detects it.

What is MTTR (Mean Time to Resolve / Restore)?

The average time taken from detecting a production failure to completely restoring normal system operations for users.

What is MTBF (Mean Time Between Failures)?

The average time elapsed between operational system failures, measuring overall infrastructure stability.

What is MTTF (Mean Time to Failure)?

The expected operating time of a non-repairable system or hardware component before it completely fails.

What is a Blameless Post-Mortem?

A structured, collaborative retrospective conducted after an incident that assumes engineers acted with good intentions, focusing on systemic, architectural, and procedural root causes.

What are the core sections of a Post-Mortem document?

1. Executive Summary & Impact, 2. UTC Incident Timeline, 3. Root Cause Analysis (5 Whys), 4. What Went Well / Poorly, 5. SMART Action Items with owners.

What is the 5 Whys technique in root cause analysis?

An iterative interrogative technique where you ask "Why?" five consecutive times to drill down past surface symptoms to the fundamental organizational or architectural root cause.

What is Alert Fatigue and how do you prevent it?

Overwhelming on-call engineers with noisy, non-actionable alerts, leading to missed critical incidents. Prevented by alerting strictly on user-facing SLO symptoms and dynamic burn rates.

What is a Multi-Window Multi-Burn-Rate Alert?

Google SRE alerting standard that calculates the consumption speed of an error budget across short (1 hour) and long (6 hours) windows to page engineers only when error budget is rapidly burning.

What is RTO (Recovery Time Objective)?

The maximum acceptable duration of system downtime after a disaster before service is restored (measures downtime duration).

What is RPO (Recovery Point Objective)?

The maximum acceptable amount of data loss measured in time backward from the point of disaster (measures data loss).

What is an On-Call Escalation Policy?

A predefined workflow in paging systems (PagerDuty, Opsgenie) that routes alerts to a primary on-call engineer, escalating to secondary engineers or engineering managers if unacknowledged within 5–10 minutes.

What is an Incident Commander (IC)?

The designated leader during a critical production outage responsible for coordinating investigation tasks, assigning roles, managing communications, and making high-level recovery decisions.

What is a Runbook (Playbook)?

A documented, step-by-step technical guide for on-call engineers describing how to diagnose, triage, and resolve specific alert conditions or system failures.

What is Automated Remediation?

Using software routines (EventBridge, Lambda, Kubernetes Operators) to detect specific operational failures and execute corrective actions (restarting pods, resizing disks) with zero human intervention.

What is Capacity Planning in SRE?

Forecasting future resource demands (compute, memory, storage, database IOPS) based on organic user growth and marketing spikes to ensure systems scale proactively before saturation occurs.

What is Load Shedding?

Intentionally dropping low-priority background requests when a server approaches 100% CPU/memory saturation to guarantee critical transactions succeed with low latency.

What is Graceful Degradation?

Designing applications to remain functional with reduced features when non-essential downstream services fail (e.g., showing static recommendations if the recommendation engine is down).

What is the Thundering Herd Problem?

A scenario where thousands of clients retry a failed network request simultaneously at the exact same millisecond, overwhelming recovering backend servers. Prevented by Exponential Backoff with Jitter.

What is Exponential Backoff with Jitter?

A retry algorithm where wait intervals double with each attempt ($2^n$) combined with randomized variance (jitter) to desynchronize retry storms across clients.

What is High Availability (HA)?

Designing systems with redundant components across multiple fault domains (Availability Zones, regions) to ensure continuous operation without a Single Point of Failure (SPOF).

What does "Three Nines" vs "Four Nines" vs "Five Nines" uptime mean?

99.9% (Three Nines) = max 43.2 min downtime/month; 99.99% (Four Nines) = max 4.32 min downtime/month; 99.999% (Five Nines) = max 25.9 sec downtime/month.

What is Active-Active vs Active-Passive High Availability?

Active-Active runs multiple redundant systems processing live traffic simultaneously; Active-Passive runs a primary active system while a secondary standby system remains idle, ready to take over on failover.

What is Split-Brain in distributed systems?

A state where a network partition isolates nodes in a cluster, causing both sides to believe the other has failed and independently elect leaders, leading to severe data corruption.

How is Split-Brain prevented?

By enforcing a strict quorum consensus requirement ($\lfloor N/2 \rfloor + 1$) on leader election and running odd numbers of master nodes (3, 5, 7).

What is the CAP Theorem?

In a distributed data store with a Network Partition (P), you must choose between Consistency (C - all nodes see the same data) or Availability (A - every request receives a non-error response).

What is the PACELC Theorem?

An extension of CAP: If there is a Partition, choose Availability or Consistency; Else (normal state), choose Latency or Consistency.

What is Eventual Consistency?

A consistency model where, given no new updates, all replicas across a distributed system will eventually converge and return the latest value.

What is Distributed Tracing?

Tracking the end-to-end flow of a single request across multiple microservices to measure latency contributions and identify bottleneck spans.

What is Continuous Profiling?

Low-overhead, continuous collection of CPU, memory, and thread contention call stacks directly from production workloads using kernel eBPF probes (e.g., Pyroscope).

What is Blackbox Probing?

Pinging external endpoints (HTTP GET, TCP SYN, DNS lookup) from outside the infrastructure to verify user-facing service availability.

What is Whitebox Monitoring?

Inspecting internal application runtime metrics (JVM heap, thread counts, database connection pool stats) emitted from within the code.

What is High Cardinality in metrics?

A metric with a large number of unique label key-value pairs (e.g., tagging Prometheus metrics with user_id or email), which exhausts time-series database memory.

What is Synthetic Monitoring?

Running automated scripts or headless browser bots that periodically execute user journeys (e.g., searching, adding to cart, checking out) to detect failures before real users encounter them.

What is Real User Monitoring (RUM)?

Telemetry captured directly within end users' client browsers or mobile apps to measure real-world page load times, network latencies, and JavaScript errors.

What is a Service Dependency Graph?

A dynamic visual topology mapping all upstream and downstream network relationships between microservices, databases, and third-party APIs.

What is Dark Traffic Mirroring (Shadowing)?

Duplicating live production HTTP requests and sending an asynchronous copy to a new version without returning responses to users, testing performance under real payloads.

What is an SRE Error Budget Policy?

A formal business contract defining agreed-upon operational restrictions (deployment freezes, focus on reliability) when an error budget reaches zero.

What is Chaos Mesh?

A cloud-native chaos engineering platform for Kubernetes that injects faults (pod failure, network latency, CPU stress, I/O corruption) via Custom Resource Definitions (CRDs).

What is Observability as Code (OaC)?

Defining Grafana dashboards, Prometheus alerting rules, and OpenTelemetry collector configs in declarative code files versioned in Git.

What is Platform Engineering?

The discipline of designing and building toolchains and self-service workflows (Internal Developer Platforms) that enable software developers to build, test, deploy, and operate software independently.

What is "Platform as a Product"?

Treating the internal developer platform as a software product where internal developers are the customers, employing product managers to gather feedback, measure adoption, and iterate on Developer Experience (DevEx).

What is Spotify Backstage?

An open-source CNCF framework for building unified developer portals, featuring a centralized Software Catalog, documentation as code (TechDocs), and software templates (Golden Paths).

What is a Software Template in Platform Engineering?

A pre-configured boilerplate repository (scaffolding) that provisions a fully compliant microservice with CI/CD pipelines, Dockerfile, Helm charts, monitoring dashboards, and security scans in 1 click.

What is Developer Experience (DevEx)?

How friction-free, intuitive, and efficient it is for software engineers to write code, run tests, debug services, and deploy changes to production.

What is Developer Velocity Index (DVI)?

A metric framework measuring how effectively an organization's tooling, culture, and practices empower developers to innovate and deliver business value rapidly.

What is Crossplane?

An open-source CNCF project that turns Kubernetes into a universal control plane, allowing platform teams to manage cloud resources (S3, RDS) as Kubernetes Custom Resources (CRDs).

What is a Composite Resource Definition (XRD) in Crossplane?

A custom Kubernetes API defined by a platform team that bundles multiple cloud resources into a single self-service abstraction for developers (e.g., kind: DatabaseInstance).

What is Kratix?

A framework for building multi-cloud, multi-cluster platforms on Kubernetes that delivers reusable infrastructure and service "Promises" to development teams.

What is the Open Feature standard?

A vendor-agnostic CNCF standard providing unified SDKs and APIs for feature flag management across languages.

What is the Score specification in Platform Engineering?

A developer-centric, workload-oriented specification that describes how an application runs without needing to know target environment Kubernetes or Terraform details.

What is FinOps and what are its three core phases?

Cloud Financial Operations. The three phases are: Inform (visibility and tagging), Optimize (rate reduction and right-sizing), and Operate (continuous governance).

What is Cloud Unit Economics?

Measuring cloud spend relative to direct business metrics (e.g., Cost per Active User, Cost per Transaction Processed, Cost per GB Streamed).

What is a Cloud Savings Plan?

A flexible pricing model offering up to 72% discount on compute usage (EC2, Fargate, Lambda) in exchange for a 1- or 3-year hourly spend commitment.

What are Reserved Instances (RIs)?

A discount commitment model tied to specific cloud instance families, OS, and regions in exchange for 1- or 3-year term commitments.

What are Cloud Spot Instances?

Spare cloud provider compute capacity offered at up to 90% discount, with the caveat that the provider can reclaim the instance with a 2-minute notification.

What is Infracost?

A FinOps tool that parses Terraform code in CI pull requests to display the exact monthly cost delta of proposed infrastructure changes before deployment.

What is Cloud Custodian?

An open-source rules engine for cloud security and cost management that automatically stops untagged instances, terminates idle databases, and enforces compliance via YAML policies.

What is Kubernetes Right-Sizing?

Adjusting container CPU/memory requests and limits based on historical usage telemetry to eliminate over-provisioning and minimize cloud waste.

What is Scale-to-Zero in serverless and Kubernetes?

Automatically scaling application pod replicas down to 0 when there is no incoming traffic or queue backlog (via KEDA or Knative), saving 100% of compute cost during idle periods.

What is Karpenter Node Consolidation?

An automated optimization feature where Karpenter identifies underutilized worker nodes, computes an optimal single replacement node, drains pods, and terminates empty nodes.

What is a Multi-Tenant Kubernetes Cluster?

A single physical cluster shared across multiple development teams or external customers, isolated via Namespaces, NetworkPolicies, RBAC, and ResourceQuotas.

What is vcluster (Virtual Cluster)?

An open-source tool that runs fully functional, isolated virtual Kubernetes control planes inside namespaces of an underlying host cluster, providing hard multi-tenancy.

What is Zero Trust Network Architecture (ZTNA)?

A security model requiring strict identity verification and encrypted communication (mTLS) for every user, device, and service regardless of whether it resides inside the private VPC.

What is SPIFFE/SPIRE?

Standardized cryptographic workload identity framework that issues short-lived, auto-rotating X.509 certificates to microservices based on kernel and kubelet attestation.

What is Policy as Code (PaC)?

Defining, testing, and enforcing compliance and operational rules using machine-readable code files (Open Policy Agent Rego, Kyverno) across CI/CD and admission controllers.

What is Open Policy Agent (OPA)?

An open-source, general-purpose policy engine that evaluates structured JSON/YAML inputs against declarative logic written in the Rego language.

What is Kyverno?

A Kubernetes-native policy engine written 100% in YAML that validates, mutates, and generates Kubernetes resources and verifies container image signatures.

What is HashiCorp Vault?

A secure secrets management system that provides centralized dynamic secrets generation, PKI certificate authority management, and data encryption as a service.

What is External Secrets Operator (ESO)?

A Kubernetes operator that syncs secrets from external enterprise vaults (AWS Secrets Manager, HashiCorp Vault) into native Kubernetes Secret objects.

What is Keyless Signing with Sigstore Cosign?

Cryptographically signing container images using short-lived OIDC certificates from Fulcio and transparency logs from Rekor, eliminating static PGP private keys.

What is an SBOM (Software Bill of Materials)?

A machine-readable nested inventory of all software packages, libraries, and transitive dependencies bundled inside a software container or binary (e.g., CycloneDX).

What is the SLSA Framework (Supply-chain Levels for Software Artifacts)?

A security framework establishing standards for software build integrity, hermetic build sandboxing, and non-falsifiable build provenance.

What is eBPF (Extended Berkeley Packet Filter)?

A Linux kernel technology allowing sandboxed programs to execute safely inside the kernel without changing kernel source code, used for high-speed networking (Cilium), observability (Hubble), and runtime security (Falco).

What is Falco?

A CNCF runtime security tool that parses Linux kernel system calls via eBPF probes to detect and alert on unauthorized container activities (spawning shells, reading /etc/shadow).

What is Cilium?

An eBPF-based Kubernetes CNI, Service Mesh, and network security plugin providing high-performance Layer 3 to Layer 7 routing and transparent encryption.

What is the Gateway API in Kubernetes?

The modern successor to Kubernetes Ingress providing role-oriented resource separation (GatewayClass, Gateway, HTTPRoute) and native traffic splitting.

What is KEDA (Kubernetes Event-driven Autoscaling)?

An autoscaler that scales Kubernetes workloads from 0 to hundreds based on external event metrics (AWS SQS queue length, Kafka consumer group lag).

What is Istio Ambient Mesh?

A sidecarless service mesh architecture that splits mesh processing into per-node ztunnel daemons (Layer 4 mTLS) and optional per-namespace waypoint proxies (Layer 7 routing).

What is Distributed Consensus (Raft / Paxos)?

Algorithms that enable distributed clusters (etcd, Consul, CockroachDB) to agree on data values and state machine logs across independent nodes despite network partitions.

What is Write-Ahead Logging (WAL)?

A database reliability technique where changes are recorded to append-only disk storage before being applied to memory, guaranteeing durability during crashes.

What is Database Connection Pooling?

Reusing a fixed pool of established database connections (via PgBouncer / RDS Proxy) to prevent thousands of client requests from exhausting database memory and thread limits.

What is Sharding in databases?

Horizontally partitioning database rows across multiple independent physical database instances based on a shard key (e.g., user_id % 10).

What is Read-Write Splitting?

Routing write operations (INSERT, UPDATE) to the primary database while directing read queries (SELECT) to asynchronous read replicas.

What is Database Replication Lag?

The delay in time between a transaction being committed on a primary database and that transaction being applied on asynchronous read replicas.

What is Dual-Write Pattern in microservices?

The anti-pattern of an application attempting to write to both a database and a message queue in a single transaction, leading to data inconsistency when one write fails.

What is the Transactional Outbox Pattern?

Saving events to an "Outbox" database table within the same ACID transaction as business data, and using a separate change-data-capture (Debezium) process to publish events to Kafka.

What is the Saga Pattern in distributed transactions?

Managing distributed transactions across microservices via a sequence of local transactions, executing compensating transactions (reversals) if a step fails.

What is Event Sourcing?

An architectural pattern where state changes are stored as an append-only sequence of immutable events rather than overwriting current state values in place.

What is CQRS (Command Query Responsibility Segregation)?

Separating read and write operations into distinct data models and databases optimized specifically for high-throughput writes (Commands) or fast reads (Queries).

What is an Anycast IP Address?

Routing client traffic to the topologically closest server among multiple globally distributed servers sharing the exact same IP address via BGP.

What is a Content Delivery Network (CDN)?

A globally distributed network of proxy caching servers that caches web assets close to users to minimize latency and absorb traffic surges.

What is Head-of-Line (HoL) Blocking?

A performance bottleneck where a single dropped or delayed packet in a FIFO queue blocks all subsequent packets from processing (resolved by HTTP/3 QUIC over UDP).

What is AWS Direct Connect / Azure ExpressRoute?

Dedicated private physical fiber connections between an enterprise on-premise data center and a cloud provider, bypassing public internet routing.

What is AWS Transit Gateway?

A centralized hub-and-spoke router connecting hundreds of VPCs, VPNs, and Direct Connect links through a single managed gateway.

What is AWS PrivateLink (VPC Endpoint)?

Private network interfaces connecting VPC subnets to cloud services or SaaS vendors over cloud backbone networks without public internet transit.

What is Multi-Region Active-Active Architecture?

Deploying fully functional infrastructure across multiple geographical cloud regions simultaneously, routing live users to the closest region with real-time data replication.

What is Disaster Recovery Failover Routing?

DNS routing policies (Route 53) that automatically redirect global user traffic to a backup disaster recovery region when primary health check probes fail.

What is Pilot Light Disaster Recovery?

Replicating critical databases continuously to a secondary region while keeping minimal core infrastructure running, provisioning full compute only during a disaster.

What is Warm Standby Disaster Recovery?

Running a scaled-down, fully functional copy of production infrastructure in a secondary region that can be scaled up instantly upon failover.

What is Cold Start in Serverless?

The latency penalty incurred when an incoming request requires the cloud provider to download the container image, provision a microVM, and initialize the language runtime.

What is AWS Lambda SnapStart?

Caching an encrypted Firecracker microVM snapshot of an initialized JVM runtime during deployment, resuming subsequent cold starts in $< 200\text{ms}$.

What is an API Gateway?

An application-layer reverse proxy that manages incoming API traffic, handling authentication, rate limiting, request validation, and analytics.

What is gRPC vs REST?

REST uses HTTP/1.1 with JSON text payloads; gRPC uses HTTP/2 with binary Protocol Buffers (Protobuf), providing multiplexing, bi-directional streaming, and high throughput.

What is GraphQL vs REST?

REST exposes fixed data endpoints; GraphQL allows clients to request the exact fields they need in a single request, eliminating over-fetching and under-fetching.

What is Webhook Payload Verification (HMAC-SHA256)?

Validating that an incoming webhook originated from an authentic sender by comparing the hash of the request body with a shared secret key.

What is JWT (JSON Web Token) Structure?

Encoded string with three parts separated by dots: Header (algorithm), Payload (claims: sub, exp), and Signature (cryptographic hash).

What is OAuth 2.0 vs OpenID Connect (OIDC)?

OAuth 2.0 is an authorization framework issuing Access Tokens for API permissions; OIDC is an identity layer on top of OAuth 2.0 issuing ID Tokens for user authentication.

What is Role-Based Access Control (RBAC)?

Assigning system permissions to roles rather than individual users, granting users permissions based on role memberships.

What is Attribute-Based Access Control (ABAC)?

Evaluating context attributes (user department, resource tags, time of day, IP address) to determine real-time access authorization.

What is CloudTrail vs CloudWatch?

CloudTrail records every API call made in an AWS account for auditing; CloudWatch monitors operational performance metrics and aggregates logs.

What is Amazon GuardDuty?

Intelligent threat detection analyzing CloudTrail, VPC Flow Logs, and EKS audit logs via machine learning to detect compromised instances.

What is AWS Security Hub?

A centralized dashboard aggregating compliance posture (CIS, PCI-DSS) and security findings across AWS accounts.

What is Amazon Inspector?

Automated vulnerability management scanning EC2 instances, ECR container images, and Lambda functions for software vulnerabilities.

What is AWS KMS (Key Management Service)?

Managed service for creating and controlling cryptographic encryption keys used across cloud storage and applications.

What is Envelope Encryption?

Encrypting high-volume plaintext data with a Data Encryption Key (DEK), and encrypting the DEK with a root KMS Key.

What is AWS Secrets Manager vs Parameter Store?

Secrets Manager supports automated secret rotation and cross-account access; Parameter Store is a simpler, hierarchical key-value configuration store.

What is Infrastructure Drift Detection?

Automatically comparing running cloud resources against IaC state files to detect and alert on unauthorized manual modifications.

What is Terratest?

A Go library for writing automated integration tests that provision real cloud infrastructure via Terraform, validate endpoints, and tear down resources.

What is Checkov?

A static code analysis tool for Infrastructure as Code that scans Terraform, CloudFormation, and Kubernetes manifests for security misconfigurations.

What is OpenTofu?

An open-source, community-governed fork of Terraform (MPL 2.0) maintained by the Linux Foundation.

What is Prometheus PromQL?

A powerful read-only query language for filtering, aggregating, and computing mathematical functions over Prometheus time-series metrics.

What is Grafana Loki LogQL?

A Prometheus-inspired query language for filtering log streams and generating real-time metrics from raw log text.

What is Grafana Tempo?

A distributed tracing backend that stores raw spans directly in cheap cloud object storage without needing Elasticsearch.

What is OpenTelemetry (OTel) Collector?

A proxy pipeline component that receives, processes (batches, redacts, samples), and exports telemetry to multiple backend storage engines.

What is eBPF Hubble?

An observability platform running on eBPF to visualize service-to-service communication dependency graphs and network latency.

What is Chaos Mesh?

A Kubernetes-native chaos engineering operator that injects faults via CRDs to test system resiliency.

What is DAST (Dynamic Application Security Testing)?

Attacking running web applications from the outside to discover runtime misconfigurations, XSS, and SQL injection flaws.

What is SAST (Static Application Security Testing)?

Analyzing uncompiled source code to detect security vulnerabilities, syntax errors, and coding flaws.

What is SCA (Software Composition Analysis)?

Scanning open-source third-party dependencies against national vulnerability databases for known CVEs.

What is a Container Escape?

An exploit where an attacker running code inside a container escapes isolation boundaries to gain control over the host operating system.

What is Rootless Docker / Podman?

Running container daemons and processes inside unprivileged user namespaces, preventing host root compromise during breakouts.

What is Pod Security Admission (PSA)?

Kubernetes built-in admission controller enforcing Privileged, Baseline, or Restricted security standards per namespace.

What is a Kubernetes Pod Disruption Budget (PDB)?

A policy limiting how many pods of a replicated service can be down simultaneously during voluntary disruptions (node drains).

What is Kubernetes Horizontal Pod Autoscaler (HPA)?

Automatically adjusting the number of pod replicas based on observed CPU, memory, or custom external metrics.

What is Kubernetes Vertical Pod Autoscaler (VPA)?

Automatically right-sizing container CPU and memory resource requests/limits based on historical usage analysis.

What is NodeLocal DNSCache?

A DaemonSet caching DNS queries locally on worker nodes to eliminate CoreDNS network bottlenecks and glibc ndots:5 latency storms.

What is GitOps Reconciliation Loop?

A continuous background process where a GitOps operator compares desired state in Git against live cluster state and automatically auto-heals drift.

What is Progressive Delivery?

An evolution of Continuous Delivery that combines canary deployments, automated metric analysis, and feature flags to roll out features with minimal blast radius.

What is an SRE Blameless Post-Mortem Creed?

The guiding philosophy that human error is the starting point of an incident investigation, not the conclusion, focusing on improving systemic safeguards.