Question 1

What happens when you type a URL in the browser and press Enter?

Accepted Answer

In short: URL parsed → browser/OS caches checked → DNS resolves the host to an IP (resolver → root → TLD → authoritative) → TCP three-way handshake to port 443 (or QUIC for HTTP/3) → TLS handshake validates the certificate and sets up encryption → HTTP request sent with headers/cookies → CDN/load balancer/reverse proxy route it → web server and application handle it (auth, routing, controller, database) → HTTP response with status, headers, body → browser parses HTML into the DOM, loads CSS/JS/images, builds the render tree, lays out and paints the page; further requests reuse the connection.

Question 2

What is DNS and what are A, CNAME and MX records?

Accepted Answer

In short: DNS translates domain names to IP addresses through a hierarchy of servers with caching (TTL). An A record maps a name to an IPv4 address (AAAA for IPv6); a CNAME makes a name an alias of another name (e.g. www → shop.azurewebsites.net ); an MX record lists the mail servers for the domain. TXT records are used for verification and email security (SPF, DKIM, DMARC).

Question 3

What is the difference between HTTP and HTTPS?

Accepted Answer

In short: HTTPS is HTTP over TLS: the connection is encrypted (confidentiality), protected from tampering (integrity), and the server proves its identity with a certificate signed by a trusted certificate authority (authentication). Default ports 80 vs 443. HTTPS is required for modern browser features, SEO and any login or personal data.

Question 4

TCP vs UDP?

Accepted Answer

In short: TCP is connection-oriented and reliable: handshake, acknowledgements, retransmission, ordering, flow and congestion control — used for the web, databases, email. UDP is connectionless with no delivery guarantees but lower latency and overhead — used for DNS, voice/video, games and QUIC (HTTP/3), where the application handles reliability.

Question 5

What are the main HTTP methods and status codes?

Accepted Answer

In short: GET (read), POST (create/action), PUT (replace, idempotent), PATCH (partial update), DELETE (remove, idempotent), OPTIONS/HEAD. Status: 200 OK, 201 Created, 204 No Content, 301/302 redirects, 304 Not Modified, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 409 Conflict, 429 Too Many Requests, 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout.

Question 6

What is a load balancer? What algorithms does it use?

Accepted Answer

In short: A component that distributes incoming traffic across several servers for scalability and availability, using health probes to skip unhealthy instances. Algorithms: round robin, weighted round robin, least connections, IP hash/sticky sessions, least response time. Layer 4 balancers route by IP/port (fast); layer 7 balancers understand HTTP and can route by path, host or header and terminate TLS.

Question 7

What is a CDN and how does it improve performance?

Accepted Answer

In short: A Content Delivery Network caches content at edge servers around the world, so users download from a nearby location: lower latency, less load on the origin, protection against traffic spikes and DDoS, often a WAF and free TLS. Best for static assets with long cache headers and fingerprinted file names; dynamic content can also be accelerated.

Question 8

Forward proxy vs reverse proxy?

Accepted Answer

In short: A forward proxy acts for clients (they connect out through it — corporate filtering, anonymity). A reverse proxy acts for servers (clients connect to it and it forwards to backend servers — TLS termination, load balancing, caching, compression, hiding internal servers). Nginx, IIS ARR, YARP and Azure Application Gateway are reverse proxies.

Question 9

How is an ASP.NET Core app hosted on IIS?

Accepted Answer

In short: Install the .NET Hosting Bundle (runtime + ASP.NET Core Module). IIS receives requests via HTTP.sys and the app pool s w3wp.exe ; the ASP.NET Core Module runs the app in-process (inside w3wp, fastest) or out-of-process (proxying to Kestrel). The app pool uses No Managed Code ; web.config (generated on publish) configures the module; bindings and certificates are set in IIS.

Question 10

Users report your site is down, but it works on your machine. How do you troubleshoot?

Accepted Answer

In short: Check from outside (another network, downforeveryoneorjustme, mobile data). DNS: nslookup from different resolvers — wrong/expired record or propagation. Connectivity: Test-NetConnection host -Port 443 , firewall/NSG, load balancer health probes. TLS: expired certificate or missing intermediate (SSL Labs). Server: app pool/process running, logs (Event Viewer, stdout, Application Insights), 5xx errors, resource limits. Recent changes: deployment, certificate renewal, DNS edits. Your machine may use a cached DNS entry or hosts-file entry.

Question 11

After moving the site to a new server, some users still reach the old server for hours. Why?

Accepted Answer

In short: DNS caching: resolvers and clients cache the old A record until its TTL expires (and some ignore TTLs). Next time lower the TTL (e.g. to 300 s) a day before the move, then change the record, keep the old server running (or redirecting) until traffic drains, and raise the TTL afterwards.

Question 12

What is IIS and what can it host?

Accepted Answer

In short: Microsoft s Windows web server. It hosts static sites, ASP.NET Framework apps (Web Forms, MVC 5, Web API 2, WCF), ASP.NET Core apps via the ASP.NET Core Module, and through modules/ARR can proxy to Node.js, Next.js or other servers. It provides bindings, HTTPS, authentication (including Windows auth), compression, caching, URL rewriting and logging.

Question 13

What is an application pool and why is it used?

Accepted Answer

In short: A group of one or more applications served by the same worker process ( w3wp.exe ) with shared settings: .NET CLR version, pipeline mode, identity, recycling and limits. Pools isolate applications — a crash, memory leak or recycle in one pool doesn t affect apps in other pools — and define the security identity the app runs as.

Question 14

What is w3wp.exe?

Accepted Answer

In short: The IIS worker process. Each application pool runs in its own w3wp.exe (or several in a web garden); it hosts the IIS pipeline, modules and your application code (including in-process ASP.NET Core apps). You attach the Visual Studio debugger to w3wp.exe to debug IIS-hosted apps and see it in Task Manager with the pool identity as the user.

Question 15

How do you deploy an ASP.NET Core app to IIS?

Accepted Answer

In short: Install the .NET Hosting Bundle on the server, dotnet publish -c Release , create an app pool with No Managed Code , create a site pointing to the publish folder with bindings and a certificate, grant the pool identity read permissions (write for logs/uploads), set environment variables (ASPNETCORE_ENVIRONMENT, connection strings) and browse. The published web.config configures the ASP.NET Core Module (in-process by default).

Question 16

In-process vs out-of-process hosting for ASP.NET Core in IIS?

Accepted Answer

In short: In-process runs the app inside the IIS worker process using IIS s HTTP server — no extra network hop, best performance, but only one ASP.NET Core app per pool. Out-of-process runs the app as a separate Kestrel process with IIS (ANCM) forwarding requests over loopback — slower, but multiple apps per pool and Kestrel-specific features. Configured with hostingModel in web.config / AspNetCoreHostingModel in the project.

Question 17

What is app pool recycling and what are its effects?

Accepted Answer

In short: IIS periodically (default every 29 hours), on configuration changes, memory/request limits or on demand starts a new worker process and shuts down the old one. It frees leaked memory and refreshes the app, but in-memory state is lost (InProc session, MemoryCache, static data) and the first request after startup may be slow. Schedule recycles off-peak, use out-of-process state and warm-up (Application Initialization).

Question 18

What is ApplicationPoolIdentity and how do you give it permissions?

Accepted Answer

In short: A per-pool virtual account ( IIS AppPool\ PoolName ) created automatically, with minimal privileges. Grant it NTFS rights on the site folders ( icacls ... /grant IIS AppPool\ShopPool :RX ), and for SQL Server with Windows authentication create a login for it locally or for the computer account ( DOMAIN\SERVER$ ) when SQL is remote — or use a dedicated domain service account.

Question 19

How do you troubleshoot a 500.30 / 502.5 error with ASP.NET Core on IIS?

Accepted Answer

In short: The app failed to start. Check Event Viewer (Application log) for the ANCM and app exceptions, enable stdoutLogEnabled with a writable logs folder, run dotnet YourApp.dll from the publish folder on the server to see errors, verify the Hosting Bundle/runtime version and bitness, the app pool No Managed Code , file permissions, environment-specific configuration (missing connection string, Key Vault access) and database connectivity at startup.

Question 20

After deployment the site returns 503 Service Unavailable. What do you check?

Accepted Answer

In short: The application pool is likely stopped: open IIS Manager → Application Pools; check Event Viewer System log for WAS errors — rapid-fail protection after repeated crashes, wrong or expired password for a custom identity, missing .NET version, or a crash at startup. Fix the cause and start the pool. Also check the request queue limit and that the binding/host name is correct.

Question 21

An intranet ASP.NET app on IIS must use Windows login and query SQL Server as the user. How do you configure it?

Accepted Answer

Enable Windows Authentication (disable Anonymous) on the site, [Authorize] in the app, and either connect to SQL Server with the app pool identity (simplest — grant that account the needed DB permissions and use User.Identity.Name for auditing) or, if SQL must see the end user, configure Kerberos constrained delegation (SPNs for the service account, delegation to the SQL service) and impersonation — more complex, so usually avoided.

Question 22

What is Git and how is it different from SVN/TFVC?

Accepted Answer

In short: Git is a distributed version control system: every clone has the full history, so commits, branches, diffs and logs work offline and are fast; you sync with remotes by push/pull. SVN and TFVC are centralised: history lives on one server, many operations need the server, and branching is heavier. Git s cheap branching enables feature branches and pull-request workflows.

Question 23

What is the difference between git fetch and git pull?

Accepted Answer

In short: git fetch downloads new commits and updates remote-tracking branches ( origin/main ) without touching your working branch — safe to run anytime. git pull = fetch + integrate (merge by default, or rebase with --rebase / pull.rebase=true ) into your current branch, which can cause conflicts.

Question 24

What is the staging area?

Accepted Answer

In short: The index between your working tree and the repository. git add puts selected changes into it and git commit records exactly what is staged. It lets you build clean, focused commits from a messy working tree ( git add -p to stage parts of a file).

Question 25

How do you resolve a merge conflict?

Accepted Answer

In short: Run git status to see conflicted files, open each, decide the correct code between the , ======= , markers (keep one side, both, or rewrite), remove the markers, build and test, then git add the files and git commit (or git rebase --continue ). Use git merge --abort to back out. Prevent conflicts with small, frequent merges.

Question 26

Merge vs rebase — differences and when to use each?

Accepted Answer

In short: Merge joins histories with a merge commit, keeps the true history and never rewrites commits — safe for shared branches. Rebase replays your commits on top of another branch, giving a linear history but new commit ids — use it for local/private branches to update with main or clean up before a PR. Never rebase commits others already have.

Question 27

git reset vs git revert?

Accepted Answer

In short: reset moves the current branch pointer back (soft keeps changes staged, mixed keeps them unstaged, hard discards them) — it rewrites history, so only for unpushed commits. revert creates a new commit that undoes a previous commit — the safe way to undo something already pushed to a shared branch.

Question 28

Which branching strategy have you used? Explain it.

Accepted Answer

In short: Describe yours concretely, e.g. GitFlow-like: main = production, develop for integration, feature/* per story with PRs into develop, release/* cut for UAT, hotfix/* from main merged back to both — or trunk-based: short-lived branches merged to main daily behind feature flags, every merge deploys to dev . Mention branch policies (reviewers, CI checks) and how releases are tagged.

Question 29

What is a pull request and what do you check in a code review?

Accepted Answer

In short: A request to merge a branch, where teammates review the diff and CI validates it before merge. Check: does it meet the requirement, tests, edge cases and error handling, security (secrets, injection, authorization), performance (N+1, missing indexes), naming and readability, consistency with architecture, and that the PR is small and focused.

Question 30

You committed a password and pushed it to GitHub. What do you do?

Accepted Answer

In short: First rotate/revoke the secret immediately — assume it is compromised (bots scan GitHub within minutes). Then remove it from the code (move to Key Vault/user secrets/environment variables), and purge it from history with git filter-repo or BFG, force-push and ask everyone to re-clone; on GitHub contact support to clear cached views. Prevent it next time: .gitignore , pre-commit secret scanning (gitleaks), GitHub push protection / secret scanning.

Question 31

You made three commits on main by mistake instead of a feature branch (not pushed). Fix it.

Accepted Answer

In short: git branch feature/x (new branch points at your commits) → git reset --hard origin/main (move main back to the remote state) → git switch feature/x and continue. Nothing is lost; if anything goes wrong, git reflog shows the old position.

Question 32

A bad commit is already deployed from main. How do you undo it without rewriting history?

Accepted Answer

In short: git revert sha (for a merge commit git revert -m 1 merge-sha ), push through the normal PR/pipeline so the revert is reviewed and deployed. Don t reset + force-push a shared branch — it breaks everyone s clones and the audit trail.

Question 33

What is Docker and why use it?

Accepted Answer

In short: Docker is a platform to build, ship and run applications in containers. A container packages the app with its runtime and dependencies, so it runs identically everywhere ( works on my machine disappears). Benefits: consistent environments across dev/test/prod, fast startup, high density, isolation between apps, easy scaling, and a standard artifact for CI/CD and orchestrators like Kubernetes.

Question 34

What is the difference between a container and a virtual machine?

Accepted Answer

In short: A VM virtualises hardware and runs a full guest OS with its own kernel on a hypervisor — strong isolation, GBs in size, minutes to boot. A container virtualises at the OS level: isolated processes sharing the host kernel using namespaces (isolation) and cgroups (resource limits) — MBs in size, starts in seconds, much higher density. Containers can run inside VMs (as in most clouds).

Question 35

What is the difference between an image and a container?

Accepted Answer

In short: An image is a read-only, layered template (filesystem + metadata) built from a Dockerfile. A container is a running (or stopped) instance of an image with its own writable layer, network and process. One image can start many containers, just like a class and its objects.

Question 36

Explain the common Dockerfile instructions. CMD vs ENTRYPOINT? COPY vs ADD?

Accepted Answer

In short: FROM (base image), WORKDIR, COPY/ADD, RUN (build-time command), ENV/ARG, EXPOSE, USER, HEALTHCHECK, ENTRYPOINT and CMD. ENTRYPOINT defines the executable that always runs; CMD supplies default arguments (or a default command) that docker run arguments override. COPY copies local files; ADD also auto-extracts local tar archives and can download URLs — prefer COPY for clarity and security.

Question 37

What is a multi-stage build and why use it?

Accepted Answer

In short: A Dockerfile with several FROM stages: an early stage (e.g. .NET SDK) compiles and publishes the app; the final stage starts from a small runtime image and copies only the build output with COPY --from=build . Result: much smaller images without compilers or source code, faster deployments, smaller attack surface — all in one Dockerfile.

Question 38

What is Docker Compose and when would you use it?

Accepted Answer

In short: A tool for defining and running multi-container applications with a YAML file ( compose.yaml ): services, images/builds, ports, environment, volumes, networks, dependencies and health checks. docker compose up starts everything. Used for local development environments (API + SQL Server + Redis + RabbitMQ), integration tests and simple single-host deployments. For production clusters, use Kubernetes or Azure Container Apps.

Question 39

How do containers in Docker communicate with each other?

Accepted Answer

In short: Through Docker networks. On a user-defined bridge network (or Compose s default network), containers resolve each other by container/service name via Docker s embedded DNS ( http://api:8080 , Server=sql ). The default bridge network doesn t provide name resolution. Published ports ( -p ) are only needed for access from the host or outside, not between containers.

Question 40

How do you reduce Docker image size?

Accepted Answer

In short: Use multi-stage builds; small base images (aspnet runtime instead of SDK, chiseled/Alpine variants, runtime-deps with self-contained/AOT); a .dockerignore ; combine RUN commands and remove caches in the same layer; don t install unnecessary tools; publish trimmed/AOT apps where suitable. Check layers with docker history or Dive.

Question 41

How do you handle secrets with Docker?

Accepted Answer

In short: Never bake secrets into images (ENV, ARG, or copied files persist in layers and history). Supply them at runtime: environment variables from a secure source, mounted secret files (Docker/Compose secrets, Kubernetes Secrets), or fetch from Azure Key Vault using managed identity. For build-time secrets (private NuGet feed tokens), use BuildKit RUN --mount=type=secret . Keep .env files out of Git.

Question 42

Your ASP.NET Core container starts but you get "connection refused" on http://localhost:8080. What do you check?

Accepted Answer

In short: Is the port published ( -p 8080:8080 )? Which port does the app listen on — .NET 8+ images default to 8080 ( ASPNETCORE_HTTP_PORTS ), older ones to 80. Is the app bound to 0.0.0.0 / + rather than localhost inside the container? Did the container crash ( docker ps -a , docker logs )? Is HTTPS redirection forcing 443 without a certificate? On Windows, is another process using the port? Check docker inspect for port bindings and health status.

Question 43

The image is 2.1 GB and deploys slowly. How do you shrink it?

Accepted Answer

In short: Inspect with docker history /Dive. Typical fixes: switch to a multi-stage build so the SDK and source aren t in the final image; use mcr.microsoft.com/dotnet/aspnet (or chiseled) as the final base; add .dockerignore (bin/obj/.git/node_modules); remove build tools and caches in the same RUN layer; don t copy test projects; consider trimming/AOT. Target size: ~100–250 MB for a typical ASP.NET Core API.

Question 44

What is Kubernetes and what problems does it solve?

Accepted Answer

In short: Kubernetes is an open-source container orchestrator (from Google, now CNCF). It automates deploying, scaling and operating containers across a cluster: scheduling pods onto nodes, self-healing (restarting/rescheduling failed containers), service discovery and load balancing, rolling updates and rollbacks, horizontal autoscaling, configuration and secret management, and storage orchestration — all driven by declarative desired state.

Question 45

Explain the Kubernetes architecture.

Accepted Answer

In short: Control plane: kube-apiserver (API front end), etcd (cluster state store), kube-scheduler (places pods on nodes), kube-controller-manager (reconciliation loops), cloud-controller-manager (cloud integration). Worker nodes: kubelet (runs and monitors pods), kube-proxy (service networking rules), and a container runtime (containerd/CRI-O). In AKS, Azure manages the control plane; you manage node pools and workloads.

Question 46

What is a Pod? Why not run containers directly?

Accepted Answer

In short: A Pod is the smallest deployable unit: one or more tightly coupled containers sharing an IP address, port space and volumes, scheduled together on one node (e.g. app + sidecar). Pods are ephemeral and replaceable, so you manage them through higher-level controllers (Deployments, StatefulSets, Jobs) that recreate and scale them, instead of running bare containers or bare pods.

Question 47

What is the difference between a Deployment, a ReplicaSet and a StatefulSet?

Accepted Answer

In short: A ReplicaSet keeps a set number of identical pod replicas running. A Deployment manages ReplicaSets to provide declarative updates, rolling updates, rollbacks and revision history for stateless apps — you normally use Deployments, not ReplicaSets directly. A StatefulSet is for stateful apps: pods get stable names ( app-0 , app-1 ), stable network identities via a headless Service, ordered start/stop, and their own persistent volumes.

Question 48

What are the Service types in Kubernetes?

Accepted Answer

In short: ClusterIP (default; stable internal IP/DNS for pod-to-pod traffic), NodePort (exposes a port on each node), LoadBalancer (provisions a cloud load balancer with an external IP), ExternalName (DNS alias to an external name). A headless Service ( clusterIP: None ) returns pod IPs directly. Services select pods by labels and load-balance to ready endpoints.

Question 49

What is the difference between ConfigMap and Secret?

Accepted Answer

In short: Both inject configuration into pods as environment variables or mounted files. ConfigMaps hold non-sensitive data. Secrets hold sensitive data (passwords, keys, certificates); they re base64-encoded (not encrypted by default), can be encrypted at rest in etcd, have tighter RBAC, and are mounted on tmpfs. In production, source secrets from Azure Key Vault (Secrets Store CSI driver / External Secrets) with Workload Identity.

Question 50

Explain liveness, readiness and startup probes.

Accepted Answer

In short: Liveness checks whether the container is alive; failing it causes a restart (use for deadlocks/hangs; don t include dependency checks). Readiness checks whether it can serve traffic; failing removes the pod from Service endpoints without restarting (use for warm-up and dependency availability). Startup probes protect slow-starting apps — liveness and readiness don t run until the startup probe succeeds.

Question 51

What is the difference between resource requests and limits? What happens when exceeded?

Accepted Answer

In short: Requests are the guaranteed amount used by the scheduler to place pods. Limits are the maximum a container may use. Exceeding the CPU limit causes throttling (slower, not killed); exceeding the memory limit gets the container OOMKilled. Requests/limits determine QoS (Guaranteed, Burstable, BestEffort), which affects eviction order under node pressure. Set requests based on observed usage; many teams set memory limits but avoid CPU limits to prevent throttling.

Question 52

How does a rolling update work? How do you roll back?

Accepted Answer

In short: When the pod template changes (e.g. new image), the Deployment creates a new ReplicaSet and gradually scales it up while scaling the old one down, respecting maxSurge (extra pods allowed) and maxUnavailable , and waiting for readiness. If the new version is bad: kubectl rollout undo deployment/name (or --to-revision ), or helm rollback . Check with kubectl rollout status/history .

Question 53

What is an Ingress? How is it different from a LoadBalancer Service?

Accepted Answer

In short: A LoadBalancer Service exposes one service with its own cloud load balancer at layer 4. An Ingress is a layer-7 (HTTP/HTTPS) routing rule set — host and path based routing, TLS termination — handled by an ingress controller behind a single load balancer for many services. The Gateway API is the newer, more powerful successor.

Question 54

How do you secure a Kubernetes cluster?

Accepted Answer

In short: Entra ID integration and least-privilege RBAC; separate namespaces; NetworkPolicies (default deny); Pod Security Standards (non-root, read-only FS, no privilege escalation); private registry with image scanning and admission policies (Azure Policy/Gatekeeper/Kyverno); secrets in Key Vault via CSI + Workload Identity; etcd encryption; private cluster/API server authorised IP ranges; keep Kubernetes and node images patched; Defender for Containers; audit logs; limit cluster-admin .

Question 55

A pod is stuck in CrashLoopBackOff. How do you troubleshoot?

Accepted Answer

In short: kubectl describe pod (events, last state, exit code, probe failures); kubectl logs pod --previous to see why the last run died. Common causes: unhandled exception at startup (bad connection string, missing env var/secret key), wrong command/entrypoint, liveness probe failing too early (add a startup probe/initialDelay), permission errors (non-root), OOMKilled (exit 137). Reproduce locally with the same image and env; fix config and redeploy.

Question 56

After deploying a new version, users get errors for a few seconds on every release. How do you get true zero-downtime deployments?

Accepted Answer

In short: Ensure readiness probes reflect real readiness so traffic only reaches ready pods; set maxUnavailable: 0 and maxSurge: 1+ ; handle SIGTERM gracefully (ASP.NET Core does — finish in-flight requests) and add a short preStop sleep so endpoints are removed from load balancers before shutdown; set an adequate terminationGracePeriodSeconds ; run ≥ 2–3 replicas with a PodDisruptionBudget; keep API and DB changes backward compatible (expand-contract) because old and new versions overlap.

Question 57

Pods are Pending with "0/3 nodes are available: insufficient memory". What do you do?

Accepted Answer

In short: Pod requests exceed free allocatable memory on all nodes. Options: check whether requests are oversized (right-size them using actual usage), scale the node pool or enable the cluster autoscaler/node auto-provisioning, add a node pool with larger VMs, remove unused workloads, check ResourceQuotas and taints/node selectors preventing placement. Verify with kubectl describe nodes (Allocated resources) and kubectl top nodes .

Question 58

What is DevOps? What are CI and CD?

Accepted Answer

In short: DevOps combines development and operations culture, practices and tools to deliver value faster and more reliably: automation, collaboration, small batches, fast feedback and monitoring. CI (Continuous Integration): developers merge frequently, and every change is automatically built and tested. CD: Continuous Delivery keeps every build releasable and deploys to production with a manual approval; Continuous Deployment deploys every passing change to production automatically.

Question 59

What services does Azure DevOps provide?

Accepted Answer

In short: Azure Boards (work tracking, Kanban, sprints), Azure Repos (Git repos, PRs, branch policies), Azure Pipelines (CI/CD for any platform/cloud), Azure Test Plans (manual/exploratory testing), Azure Artifacts (package feeds). Available as Azure DevOps Services (cloud) and Azure DevOps Server (on-prem, formerly TFS).

Question 60

Explain the structure of a YAML pipeline.

Accepted Answer

In short: A pipeline has triggers, optional variables/parameters/resources, and stages (e.g. Build, DeployDev, DeployProd); each stage contains jobs that run on an agent; each job has steps — tasks (prebuilt, like DotNetCoreCLI@2 , AzureWebApp@1 ) or scripts. Deployment jobs target environments with approvals. Artifacts pass outputs between stages.

DevOps / Cloud Engineer — Interview Questions