Lesson 19 · Senior CI/CD judgment

Mock senior CI/CD interview pack

A retrieval-first mock pack for turning the whole CI/CD course into clear, interview-grade answers you can say under pressure.

Your win: run a realistic senior CI/CD mock interview on yourself, score your answers honestly, and turn weak spots into a focused review plan.

In plain English Plain English: answer out loud before checking the answer points. Recognition is not recall.

Why this mock is really training something important

A lot of people think they know CI/CD because the pages feel familiar when they reread them. But recognition is not the same thing as retrieval. Interviews punish that gap immediately. So this page is not just a recap page. It is the page that forces the course back out of your head in spoken form.

That is why the rule here is simple: answer first, check later. If you peek too early, you train recognition instead of recall.

The format

This page works best if you treat it like a real interview. Answer first. Then check the points. Then answer again more cleanly.

The answer checklist A strong answer should usually include: (1) the mechanism, (2) the main trade-off or weakness, and (3) a repo-grounded consequence or example.

Round 1 · Delivery flow and CI gates

  1. Why is “merge deploys staging” too vague for this repo?
  2. What problem does the `diff` router solve?
  3. Why is `Ok to test` important operationally?
  4. Why does the repo prefer composite actions so heavily?
  5. What makes the deploy chain trunk-based but not immediate?
  6. Why is push-based delivery a real trade-off instead of a default good?
Round 1 · Strong answer points
  1. Truthfulness. Merge creates a tag; a later cron picks it up for staging build/deploy; prod is manual.
  2. Selective CI. The router avoids rebuilding the whole monorepo on every PR while preserving required checks.
  3. Intent gate. `Ok to test` keeps expensive CI from auto-running on every PR state without explicit readiness.
  4. Reuse shape. Step-shaped reuse fits composite actions; cross-workflow chaining happens with dispatch rather than `workflow_call`.
  5. Trunk cadence. Small merges go to one trunk, but deployment is still batched through tags and schedule.
  6. Push-based trade-off. Simpler explicit deploys, but no in-cluster GitOps reconciliation or automatic drift healing.

Round 2 · Security and supply-chain realism

  1. Why is OIDC/WIF a maturity improvement over static keys?
  2. What is the difference between attestation creation and admission enforcement?
  3. Why is audit-only Binary Authorization still worth talking about?
  4. What is the main danger of partial guardrails?
  5. How would you summarize the repo’s CI/CD security posture honestly?
  6. Why isn’t “manual prod deploy” enough to call a pipeline secure?
Round 2 · Strong answer points
  1. Short-lived identity. Jobs exchange identity dynamically instead of storing durable cloud keys.
  2. Proof vs gate. Attestation proves artifact lineage; enforcement decides whether admission is blocked.
  3. Useful partial state. Audit-only still builds process, evidence, and future enforcement readiness — but is not a hard stop.
  4. False confidence. Teams may overestimate what risks are truly prevented.
  5. Honest posture. Keyless auth is strong, supply-chain proof exists, enforcement is partial.
  6. Manual is not security. Human approval may slow release, but it does not replace identity, artifact integrity, or policy enforcement.

Round 3 · Rollback, runners, and review judgment

  1. What is the honest rollback story here?
  2. Why does deploy use `cancel-in-progress: false`?
  3. What makes ARC operationally useful in this repo?
  4. How does the org matrix change blast-radius thinking?
  5. What would you look for when reviewing a CI/CD design?
  6. How would you summarize this repo’s overall delivery philosophy honestly?
Round 3 · Strong answer points
  1. Rollback. Redeploy a known older release tag through the same push-based path; clear but dependent on detection speed.
  2. Do not interrupt rollout. Canceling an in-flight deploy risks a half-updated system.
  3. Runner value. ARC provides autoscaling self-hosted capacity, dynamic sizing, and dind/kind capability for heavy jobs.
  4. Blast radius. Fan-out improves throughput but can widen exposure if issues are not caught early.
  5. Review lens. Ask what is truly guaranteed, what is partial, how recoverable failures are, and how understandable the pipeline remains under pressure.
  6. Delivery philosophy. Practical push-based delivery with real guardrails, real trade-offs, and honest gaps rather than idealized automation claims.

Self-scoring rubric

ScoreMeaning
0I could not explain it without notes.
1I gave fragments, but the answer was incomplete or fuzzy.
2I explained the main idea, but missed the trade-off, weakness, or repo consequence.
3I gave a strong, clear answer with mechanism + trade-off/weakness + repo consequence.
Recovery map — where to go next Missed delivery flow / CI? Revisit Lessons 1–6. Missed supply chain / auth? Revisit Lessons 9–10 plus 14–16. Missed rollback / operations? Revisit Lessons 7–8 and 12 plus 15–17. Missed senior judgment? Revisit Lessons 13–18.

What this mock is really training

It is training answer shape under pressure. Can you start with the mechanism? Can you name the weakness honestly? Can you land the answer in a repo-grounded consequence instead of floating at the level of DevOps slogans? That is the difference between “I studied the topic” and “I can defend the system out loud.”

So do not aim for perfection on the first pass. Aim for honest retrieval, then use the answer points to tighten the structure.

Q1. The main rule of this mock pack is…

Retrieval first is what turns recognition into interview recall.
What are the three ingredients of a strong senior CI/CD answer?
recall, then click to reveal
A clear mechanism, the important trade-off or weakness, and a repo-grounded consequence or example.
If you want, I can now run this as a live mock senior CI/CD interview and grade you answer by answer. Ask me.

Sources. This pack synthesizes the whole course into retrieval practice.