Showing posts with label GitHub Actions. Show all posts

Terraform and DevOps Interview Questions for Beginners | IaC, Jenkins, Git & DevSecOps

Terraform and DevOps Interview Questions for Beginners

Starting your career in Terraform, DevOps, Cloud or DevSecOps? Understanding the basic concepts is more important than memorizing tool definitions.

This beginner-friendly guide covers important interview questions from Infrastructure as Code (IaC), Terraform, Git, Jenkins, SonarQube, Artifactory, Aqua/Trivy and GitHub Actions.

Learning Approach:
Learn the concept → Understand the architecture → Practice → Explain it in an interview.

1. What is Infrastructure as Code (IaC)?

Infrastructure as Code means managing infrastructure using configuration files instead of creating cloud resources manually.

Example:

Terraform Code → Provider → Cloud Resources

Common benefits of IaC include:

Automation
Repeatability
Version control
Consistent environments
Reduced manual configuration

2. What is Terraform?

Terraform is an Infrastructure as Code tool used to define, provision and manage infrastructure through configuration files.

A simple Terraform workflow is:

terraform init → terraform plan → terraform apply

3. What is HCL?

HCL stands for HashiCorp Configuration Language. Terraform commonly uses HCL to describe infrastructure.

resource "azurerm_resource_group" "demo" { name = "rg-demo" location = "East US" }

4. What is a Terraform Provider?

A Terraform provider allows Terraform to communicate with an external platform or service through its APIs.

Examples include:

AzureRM Provider for Microsoft Azure
AWS Provider for Amazon Web Services
Google Provider for Google Cloud
Kubernetes Provider for Kubernetes resources

5. What is a Terraform Resource?

A resource represents an infrastructure object that Terraform manages.

Examples include:

Resource Group
Virtual Network
Virtual Machine
Storage Account
Key Vault

6. Important Terraform Commands

Command	Purpose
`terraform init`	Initializes the Terraform working directory
`terraform plan`	Shows the changes Terraform plans to make
`terraform apply`	Applies the planned infrastructure changes
`terraform destroy`	Destroys infrastructure managed by the configuration

7. What is Terraform State?

Terraform state helps Terraform keep track of the infrastructure it manages and compare the configuration with the current known state.

A common local state file is:

terraform.tfstate

In team and production environments, remote state is commonly used so that teams can manage state centrally with appropriate access control and concurrency protection.

8. What is a Terraform Variable?

Variables make Terraform configurations reusable by allowing values to be supplied instead of hard-coded.

variable "location" { type = string default = "East US" }

The same Terraform code can then be adapted for different environments such as development, testing and production.

9. What is DevOps?

DevOps is a combination of practices, collaboration and automation that helps development and operations teams build, test, release and operate software more efficiently.

Plan → Code → Build → Test → Release → Deploy → Monitor

10. What is Git?

Git is a distributed version control system used to track source-code changes and support collaboration between developers and engineering teams.

A basic Git workflow is:

Clone → Branch → Code → Commit → Push → Pull Request → Merge

11. What is Jenkins?

Jenkins is an automation server commonly used to create and execute CI/CD pipelines.

A typical pipeline may look like:

Git → Jenkins → Build → Test → Security Scan → Artifact → Deploy

12. What is SonarQube?

SonarQube is used for automated code quality and code security analysis.

It can identify areas such as:

Bugs
Vulnerabilities
Code smells
Duplicated code

A CI/CD pipeline can use a SonarQube quality gate before allowing a build to continue.

13. What is Artifactory?

Artifactory is an artifact repository used to store and manage software packages and build artifacts.

Examples include:

JAR and WAR files
Docker images
npm packages
Python packages

A common DevOps approach is:

Build Once → Store Artifact → Promote Through Environments

14. What is Aqua Security / Trivy?

Aqua Security and Trivy are associated with cloud-native security and vulnerability scanning. Trivy can scan container images and other supported targets for vulnerabilities, secrets and configuration issues.

A simplified DevSecOps flow is:

Build Image → Security Scan → Security Gate → Deploy

Organizations can configure their CI/CD pipeline to stop or require review when findings meet defined security thresholds.

15. What is GitHub Actions?

GitHub Actions is a GitHub automation and CI/CD service that can execute workflows based on events such as code pushes and pull requests.

Git Push → GitHub Actions → Build → Test → Scan → Deploy

16. How Do These Tools Work Together?

This is one of the most useful concepts to understand for a beginner DevOps interview.

Developer

↓

Git / GitHub

↓

CI/CD Pipeline

↓

Build → Test → SonarQube → Security Scan

↓

Artifact Repository

↓

Deployment

↓

Cloud / Application Environment

↓

Monitoring

17. How Does Terraform Fit Into DevOps?

Terraform can be used to automate the infrastructure required by applications and DevOps platforms.

Git → CI/CD → Terraform Plan → Review/Approval → Terraform Apply → Cloud Infrastructure

For example, Terraform can provision resources such as virtual networks, resource groups, storage accounts, virtual machines and other supported cloud services.

18. Interview Scenario: Explain a Complete DevOps Flow

Question:

A developer pushes new code. Explain what happens from source code to deployment.

Sample answer:

Developer pushes code to Git. A CI/CD pipeline starts the build and test process. Code quality is checked using SonarQube and security scanning can be performed on dependencies or container images. The approved build artifact is stored in an artifact repository and then promoted through the required environments. Infrastructure changes can be managed using Terraform. Finally, monitoring tools are used to observe the deployed application and infrastructure.

19. Top Terraform Interview Questions

What is Infrastructure as Code?
What is Terraform?
What is HCL?
What is a Terraform provider?
What is a Terraform resource?
What is Terraform state?
What is the difference between local and remote state?
What is the difference between terraform plan and terraform apply?
What are Terraform variables?
What is the purpose of Terraform modules?

20. Top DevOps Interview Questions

What is DevOps?
What is CI/CD?
What is Git?
What is a Git branch?
What is Jenkins?
What is a Jenkins pipeline?
What is SonarQube?
What is a quality gate?
What is an artifact repository?
Why is container security scanning important?
What is Aqua Security / Trivy?
What is GitHub Actions?

21. The DevOps Flow to Remember

Git
↓
CI/CD
↓
Build & Test
↓
Code Quality
↓
Security Scan
↓
Artifact
↓
Deploy
↓
Monitor

Final Takeaway

For a beginner DevOps interview, don't focus only on memorizing definitions. Understand how the tools connect and why each tool is used.

The key idea is:

Code → Quality → Security → Artifact → Infrastructure → Deployment → Monitoring

Once you understand this flow, Terraform, Git, Jenkins, SonarQube, Artifactory, Aqua/Trivy and GitHub Actions become much easier to explain during technical interviews.

Learn with EduArn

EduArn focuses on practical learning across AI, Cloud, DevOps, programming and career preparation, with hands-on labs and interview-focused learning.

Explore the EduArn learning programs and practical technology curriculum to continue your learning journey.

Explore EduArn Training

Frequently Asked Questions

Is Terraform a DevOps tool?

Terraform is primarily an Infrastructure as Code tool. It is widely used within DevOps workflows to automate and manage infrastructure.

Is Jenkins the only CI/CD tool?

No. Jenkins is one CI/CD automation option. Other platforms include GitHub Actions, GitLab CI/CD and Azure Pipelines.

Why is SonarQube used in DevOps?

SonarQube provides automated code quality and security analysis and can be integrated into CI/CD pipelines.

Why do we scan Docker images?

Container image scanning helps identify known vulnerabilities and other security issues before images are promoted to deployment environments.

EduArn — Learn Today. Lead Tomorrow.

SecureBank Open Banking API: Python, FastAPI, API Security & DevSecOps

SecureBank Open Banking API: Building a Secure API with Python, FastAPI and DevSecOps

What if a banking API could do more than move money — what if it could also protect sensitive financial data from common API attacks?

SecureBank Open Banking API is a practical learning project that demonstrates how modern backend development, API security, automated testing, containers, cloud infrastructure, and DevSecOps can work together.

What Is the SecureBank Open Banking API?

SecureBank is a training-focused banking API designed to demonstrate secure application development practices. Users can authenticate, access accounts, view balances, and create transactions through REST API endpoints.

The project combines Python, FastAPI, OAuth2, JWT, Pydantic, SQLAlchemy, Docker, AWS, automated testing, security scanning, and CI/CD.

Core idea: Security should be part of application development from the beginning, not something added just before deployment.

Technology Stack

Python – Backend programming
FastAPI – REST API framework
OAuth2 + JWT – Authentication
Pydantic – Input and data validation
SQLAlchemy – Database access and ORM
SQLite – Demo banking database
Docker & Docker Compose – Containerization
pytest – Automated testing
Semgrep – Static security analysis
Trivy – Vulnerability and container scanning
OWASP ZAP – Dynamic application security testing
Checkov – Infrastructure-as-Code security scanning
GitHub Actions – CI/CD automation
Terraform – Infrastructure as Code
AWS API Gateway – Cloud API gateway extension

Authentication vs Authorization

One of the most important concepts demonstrated by SecureBank is the difference between authentication and authorization.

Authentication answers: “Who are you?”

Authorization answers: “What are you allowed to access?”

SecureBank uses an OAuth2-based authentication flow with JWT tokens. After authentication, authorization rules determine which accounts and resources a user can access.

Preventing BOLA Attacks

BOLA (Broken Object Level Authorization) is a major API security risk.

Imagine Alice owns account 1 and Bob owns account 2. If Alice changes an API request from:

/api/v1/accounts/1

to:

/api/v1/accounts/2

a vulnerable application might return Bob's information.

SecureBank demonstrates ownership validation so that users cannot access resources belonging to other users. Unauthorized access is rejected rather than simply trusting the object ID supplied by the client.

Input Validation with Pydantic

APIs should never blindly trust data received from clients. SecureBank uses Pydantic models to validate incoming requests.

For example, a transaction containing an invalid or negative amount should be rejected by the backend.

Security principle: Frontend validation is useful for user experience, but backend validation is mandatory because attackers can call APIs directly.

Database Security

Database security is another important part of API development. Unsafe dynamic SQL can expose applications to SQL injection attacks.

SecureBank demonstrates safer database access using SQLAlchemy filtering and parameterized queries. This helps developers understand the difference between unsafe database operations and secure data-access patterns.

Security Testing with OWASP ZAP

OWASP ZAP (Zed Attack Proxy) is used as part of the application's dynamic security testing approach. It can interact with a running application and help identify potential web and API security weaknesses.

This complements static analysis and automated application tests by testing the application from an external perspective.

DevSecOps Security Pipeline

Security checks are integrated into the development workflow using GitHub Actions.

Semgrep – analyzes source code for security patterns
Trivy – scans filesystems and container images
OWASP ZAP – performs dynamic security testing
Checkov – scans Terraform infrastructure
pytest – executes automated application tests
GitHub Actions – automates the overall workflow

Build → Test → Secure → Scan → Deploy → Improve

Docker and Cloud Deployment

The application can be run locally using Docker Compose. Developers can authenticate, call API endpoints, test authorization, and execute security scans in a repeatable environment.

An AWS extension demonstrates how API Gateway and Terraform can be incorporated into a cloud architecture.

This Is a Training Project — Not a Production Banking System

SecureBank is designed for learning and demonstration. Real production banking systems require significantly more controls, including comprehensive compliance, monitoring, secrets management, encryption, key management, fraud detection, resilience, operational controls, threat modeling, and extensive security reviews.

Important: Do not use this training project as-is for real financial transactions or production banking workloads.

Who Should Study This Project?

Python developers
Backend engineers
Cybersecurity students
DevSecOps practitioners
Cloud learners
Software architects
QA and automation engineers
Graduates building technology portfolios

Instead of simply saying “I know Python”, a project like this can demonstrate practical experience in building, testing, securing, containerizing, scanning, and deploying an API.

The Concepts Go Beyond Banking

These security principles are not limited to financial applications. The same concepts apply to healthcare, e-commerce, SaaS, payments, government systems, enterprise applications, and other API-driven platforms.

If an application has users, it needs authentication and authorization. If it accepts input, it needs validation. If it communicates with a database, it needs secure queries. If it is deployed in containers or cloud infrastructure, security must extend to those layers as well.

Don't Just Learn. Build.

The best way to learn modern application security is to build projects and understand why each security control exists.

Clone projects. Run them. Test them. Break them in a controlled environment. Secure them. Scan them. Deploy them. Learn from the results.

Watch the Full SecureBank Project

Watch the complete walkthrough of the SecureBank Open Banking API:

▶ Watch the Full Video

Learn with EduArn.com

At EduArn.com, we focus on practical technology learning across AI, software architecture, application development, cloud, cybersecurity, DevSecOps, DevSecTestOps, and modern engineering practices.

Our approach is simple:

Learn. Build. Secure. Test. Deploy.

EduArn – Online & Offline Training with Free LMS for Python, AI, Cloud & More