Compliance requires that every production change is approved and auditable. How do you keep deploying daily?
What they are really testing: Whether you can satisfy a control without destroying flow. The weak path is accepting a manual change board, the strong path is meeting the control intent through automation.
A real interview question
Compliance requires that every production change is approved and auditable. How do you keep deploying daily?
What most people say
drag me
“Add a change advisory board meeting before each production release.”
It satisfies a literal reading and destroys the delivery model, batching changes into weekly releases that are riskier. Research consistently finds heavyweight approval processes correlate with worse stability, not better.
The follow-ups they ask next
Emergency fix at 3am with nobody to review. What is the process?
A documented break-glass path: allowed, heavily logged, alerts the security channel, and requires retrospective review within a fixed window. Suppressing the need for it just moves it off the record.
How do you prove separation of duties when one person wrote and merged?
Branch protection preventing self-approval, enforced by the platform rather than by policy, so the evidence is that the system made it impossible, not that someone promised.
What the interviewer is listening for
- Separates control intent from ritual
- Makes the pipeline emit audit evidence
- Engages the auditor early
What sinks the answer
- Accepts a change board without challenge
- No break-glass path
- Treats compliance as paperwork after the fact
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“The control intent is [separation of duties and an audit trail], which [a reviewed pull request on a protected branch] satisfies. I make [the pipeline emit immutable evidence: commit, approver, tests, scans, artifact digest] and [encode compliance rules as automated gates]. And [agree the evidence format with the auditor up front], since [a change board batches releases and makes them riskier].”
Keep going with security
Junior
Your pipeline needs credentials to deploy to production. How do you handle that safely?
Mid
Your vulnerability scanner reports 200 CVEs in a production image. How do you handle it?
Mid
How would you rotate a database password used by 12 running services with no downtime?
Mid
Your deploy role has full administrator access because narrowing it kept breaking things. How do you fix that properly?
Senior
How would you protect your build pipeline from a supply chain attack?
Senior
Design a CI/CD system for 15 microservices owned by 4 teams deploying several times a day.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free