HOT & TRENDING 🔥
CIDR & Subnetting Speed Challenge
Test your IPv4 subnetting speed! Solve masks, network IDs, broadcast addresses, and usable hosts under 60-second time trials with interactive 32-bit bit-flipping.
- 60s Speed Blitz & 10-Question Sprint
- Interactive 32-bit Binary Flipper
- AWS 3-Tier Multi-AZ VPC Architect Mode
- Audio Synthesizer & Combo Streaks
INTERACTIVE QUIZ
Kubernetes Mastery Diagnostic Quiz
Assess your container orchestration expertise across Pod lifecycles, RBAC, Services, Ingress controllers, and CNI networking.
- Comprehensive multi-tier scoring
- CKA & CKAD exam scenario questions
- Instant answer rationales & architecture tips
950+ DRILLS
DevOps & SRE Production Drills
Practice 950+ production incident scenarios: CrashLoopBackOff, memory leaks, high latency, Terraform drift, and CI/CD pipeline recovery.
- Live active recall flashcard UI
- Real production outage triage drills
- Linux kernel & networking debugging
COMING NEXT
Linux Permissions & Docker Drill
Master octal permissions (chmod 755 vs 644), setuid, Dockerfile layer caching, and multi-stage container optimization under the clock.
- Interactive octal-to-symbolic converter
- Dockerfile layer ordering puzzle
- Speedrun CLI flags quiz
📚 Frequently Asked Questions
In-depth explanations, formulas, and technical answers for DevOps, SRE, and Cloud Engineering interview scenarios.
⚡ 1. CIDR & IPv4 Subnetting Challenge FAQs
How do you calculate subnet masks and CIDR notation fast during DevOps interviews?
The fastest mental method is using the Magic Number formula:
For instance, with a
Magic Number = 256 - Interesting Octet Mask.For instance, with a
/27 subnet:
- The 4th octet has 3 network bits (128 + 64 + 32 = 224), giving mask
255.255.255.224. - Subtract 224 from 256:
256 - 224 = 32(The Magic Number). - Subnet boundaries increment cleanly by 32:
.0,.32,.64,.96,.128...
192.168.1.45/27 instantly belongs to network 192.168.1.32, with broadcast 192.168.1.63, and usable range .33 to .62 (30 usable hosts).
Why does AWS reserve 5 IP addresses in every VPC subnet instead of 2?
Standard RFC 1918 networking reserves 2 addresses: the Network ID (.0) and the Broadcast Address (.255). AWS reserves 3 additional IP addresses inside every VPC subnet for internal AWS networking infrastructure:
10.0.0.0: Network address.10.0.0.1: Reserved by AWS for the VPC router.10.0.0.2: Reserved by AWS for the Amazon-provided DNS (Route 53 Resolver).10.0.0.3: Reserved by AWS for future internal capability.10.0.0.255: Network broadcast address (AWS does not support broadcast, but reserves it).
/28 subnet (16 total IPs), you only get 16 - 5 = 11 usable IPs! Sizing EKS or ECS clusters without factoring this leads to immediate IP exhaustion.
What is the difference between /24 and /28 CIDR blocks in Kubernetes CNI networking?
In Kubernetes CNI plugins (such as AWS VPC CNI, Calico, or Cilium), Pods are assigned real routable IP addresses:
- A
/24subnet gives 256 total IPs (251 usable in AWS). This provides sufficient room for multiple high-density nodes running 30–50 pods each without exhausting secondary ENI allocations. - A
/28subnet gives only 16 total IPs (11 usable in AWS). If a node hosts 10 microservice pods and 3 daemonsets, it immediately triggersFailedCreatePodSandBoxerrors due toAddress already in use / No available IP addresses in subnet.
☸️ 2. Kubernetes Mastery Diagnostic Quiz FAQs
How do you troubleshoot a Kubernetes Pod stuck in CrashLoopBackOff or OOMKilled?
Follow this systematic 4-step production runbook:
- Inspect Last State & Exit Code: Run
kubectl describe pod <pod-name> -n <namespace>.- Exit Code 137: Container was terminated by the Linux Out-Of-Memory (OOM) killer because memory exceeded
resources.limits.memory. - Exit Code 1 / 2: Application runtime panic, missing configuration file, or database handshake failure.
- Exit Code 143: Container received SIGTERM from Kubernetes (liveness probe failed or graceful shutdown).
- Exit Code 137: Container was terminated by the Linux Out-Of-Memory (OOM) killer because memory exceeded
- Check Pre-Crash Logs: Run
kubectl logs <pod-name> --previousto read the exact stack trace printed right before the container restarted. - Verify Configuration Mounts: Confirm referenced
ConfigMaporSecretkeys exist and match the environment variable names expected by the binary. - Adjust Probes: If the app takes 45 seconds to warm up and the liveness probe begins probing at 10 seconds, increase
initialDelaySecondsor configure astartupProbe.
What is the real difference between a Deployment and a StatefulSet in Kubernetes?
While both manage pods, their operational semantics are fundamentally different:
- Deployment: Designed for stateless applications (web APIs, workers). Pods have random alphanumeric hash names (e.g.,
api-7d9f8b-x4z2p). Pods can terminate and replace each other in any arbitrary order, and all replicas share the same PersistentVolume or stateless backend. - StatefulSet: Designed for stateful clustered systems (PostgreSQL, Kafka, Elasticsearch, Cassandra). Provides:
- Stable Network Identity: Deterministic ordinal names (
kafka-0,kafka-1) and headless service DNS (kafka-0.kafka-service.default.svc.cluster.local). - Dedicated Storage: Uses
volumeClaimTemplatesto provision an independent, persistent PV for every ordinal replica that re-attaches to the exact same pod during node restarts. - Ordered Operations: Deploys, scales, and updates sequentially from index 0 to N-1 (or N-1 to 0 on scale down).
- Stable Network Identity: Deterministic ordinal names (
What actually happens when a Kubernetes worker node enters NotReady status?
When a worker node stops communicating with the Control Plane:
- Grace Period (40s): Kubelet fails to send heartbeats. After
node-monitor-grace-period(default 40s), the controller manager marks the node asNotReady. - Toleration Taints: Kubernetes automatically applies
node.kubernetes.io/unreachable:NoExecutetaint to the node. - Pod Eviction Timeout (300s): If the node remains unreachable beyond
pod-eviction-timeout(5 minutes), the eviction controller marks pods on that node for deletion and schedules replacements on healthy worker nodes. - StatefulSet Storage Locks: StatefulSet pods with ReadWriteOnce volumes will NOT be automatically force-deleted to prevent data corruption ("split-brain") until the storage attachment is cleanly detached.
🛠️ 3. DevOps & SRE Production Drills FAQs
How do you diagnose and resolve a 504 Gateway Timeout in production microservices?
A
504 Gateway Timeout means an edge proxy (AWS ALB, CloudFront, Nginx, or Kong) closed the client connection because the upstream container failed to send a response within the timeout limit (default 60s):
- Identify the Origin: Check the ALB access logs: if
target_status_code = -andtarget_processing_time > 60.0, the upstream application is hanging. - Check Database Connection Pool: The #1 cause of upstream 504s is database connection pool starvation. If all DB connections are blocked by unindexed queries or locked rows, new HTTP requests queue indefinitely.
- Inspect CPU Throttling: Check container cgroup CPU throttling (
container_cpu_cfs_throttled_periods_total). If CPU limits are too aggressive, thread processing halts. - Use Distributed Tracing: Inspect OpenTelemetry/Jaeger spans to isolate whether downstream microservices or third-party payment gateways are timing out.
How do you resolve Terraform state lock errors and infrastructure drift?
Terraform uses distributed locks (e.g., AWS DynamoDB with S3 backend) to prevent concurrent writes:
- State Lock Release: If a CI/CD runner crashed mid-apply, Terraform errors with
Error acquiring the state lock: ConditionalCheckFailedException. Retrieve theLock IDfrom the terminal and run:terraform force-unlock <LOCK_ID> - Detecting Drift: Run
terraform plan -detailed-exitcodein a scheduled cron pipeline. Return code2indicates out-of-band changes exist between your HCL files and actual cloud infrastructure. - Reconciling Drift: If manual changes are valid, update your HCL code and run
terraform refresh. If manual changes were unauthorized, runningterraform applywill cleanly restore the desired declarative state.
🐳 4. Linux & Docker Container Drill FAQs
What is the difference between chmod 755 and chmod 644 in Linux?
Linux file permissions are represented as 3 octal digits corresponding to User (Owner), Group, and Others (World) where
r=4, w=2, x=1:
chmod 755(rwxr-xr-x):- Owner:
4 + 2 + 1 = 7(Read, Write, Execute). - Group:
4 + 0 + 1 = 5(Read, Execute). - Others:
4 + 0 + 1 = 5(Read, Execute). - Standard use: Executable shell scripts, binaries, and directories (execute permission is required to
cdinto a directory).
- Owner:
chmod 644(rw-r--r--):- Owner:
4 + 2 + 0 = 6(Read, Write). - Group:
4 + 0 + 0 = 4(Read only). - Others:
4 + 0 + 0 = 4(Read only). - Standard use: Regular web documents (HTML, CSS), application source code, and configuration files to prevent arbitrary execution vulnerabilities.
- Owner:
How do you optimize Dockerfile layer caching for ultra-fast CI/CD builds?
Docker caches each build step as an immutable image layer. If a layer changes, all subsequent layers are invalidated:
- Separate Dependencies from Code: Copy dependency files (
package.json,go.mod,requirements.txt) and run install commands BEFORE copying application code:COPY package*.json ./RUN npm ci --only=productionCOPY . .
This ensures dependencies are cached and only rebuilt when packages change, not on every commit! - Multi-Stage Builds: Use a heavyweight build image (e.g.,
golang:1.24-alpine) to compile binaries, then copy only the static binary intoscratchorgcr.io/distroless/static. This reduces final image sizes from 1 GB+ to under 25 MB and eliminates CVE vulnerabilities. - Chain Commands: Combine
RUN apt-get update && apt-get install -y ... && rm -rf /var/lib/apt/lists/*in a single layer to avoid bloating image history.