All 42 questions

  1. How would you deploy Conjur to provide secrets to CI/CD pipelines and application workloads?

    Asked in 2 of 231 interviews · last asked May 25 · Scenario · Senior

    Other ways it was asked
    • “How would you implement Conjur in an existing subscription and DevOps environment to secure credentials for processes, non-human identities, APIs, or certificates?”

  2. In GitHub Actions, what are the practical differences between GITHUB_TOKEN permissions on pull_request versus pull_request_target, and what risks do you watch for with untrusted forks?

    Asked in 2 of 231 interviews · last asked Oct 13 · Concept · Senior

    Other ways it was asked
    • “In GitHub Actions YAML, what's the practical difference between pull_request and pull_request_target, and what's the biggest security pitfall when using pull_request_target?”

  3. How would you implement secrets management for a CI/CD pipeline using CyberArk?

    Asked once · last asked Jul 22 · Scenario · Senior

  4. What would you recommend to a regulated bank to manage the path from AI-assisted software development to production?

    Asked once · last asked Oct 22 · Scenario · Senior

  5. How do you manage secrets in Azure DevOps?

    Asked once · last asked Feb 9 · Tooling · Mid-level

  6. If a feature branch must follow a particular process, how would you enforce that through an Azure DevOps pipeline so the process cannot be bypassed?

    Asked once · last asked Feb 9 · Scenario · Senior

  7. How would you add or change security tooling in a CI/CD pipeline?

    Asked once · last asked Apr 6 · Behavioral · Mid-level

    Other ways it was asked
    • “Can you give a concrete example of a time you added or changed security tooling in a CI/CD pipeline and walk me through what you did?”

  8. How can code scanning be enforced through branch policies?

    Asked once · last asked Apr 14 · Tooling · Mid-level

  9. How do you integrate Checkmarx into a project?

    Asked once · last asked Apr 14 · Tooling · Mid-level

  10. Which tools would you use to manage production deployments and secure those activities?

    Asked once · last asked Apr 16 · Scenario · Senior

  11. How do you configure API-key authentication and token properties for CyberArk in Jenkins across plugin versions?

    Asked once · last asked Apr 30 · Tooling · Senior

    Other ways it was asked
    • “How do you configure token properties and authentication when integrating CyberArk with Jenkins, and how do plugin versions affect the setup?”
    • “Where do you configure the token property in the Jenkins console when using API-key authentication?”
    • “How do you handle JWT claims when integrating Jenkins with CyberArk across plugin versions 1.x and 2.x?”

  12. In a Jenkins integration with Conjur, which endpoint should an application use to store or retrieve secrets in its pipelines: the leader, standby, or follower?

    Asked once · last asked Apr 30 · Tooling · Senior

  13. What governance processes do you use? Do you conduct code reviews and quality checks, and what are your quality gates?

    Asked once · last asked May 5 · Scenario · Senior

  14. In a healthcare application environment, a stakeholder asks you to deploy a hotfix on Friday afternoon. How would you respond?

    Asked once · last asked May 12 · Scenario · Mid-level

  15. What change and release process would you use to deploy AI agents to production, including CI/CD pipelines and required approvals?

    Asked once · last asked May 13 · Scenario · Senior

  16. How can missing guardrails or explicit release processes contribute to a production failure?

    Asked once · last asked May 22 · Scenario · Senior

  17. If an open-source library or Python package were compromised, what controls and detections would you use?

    Asked once · last asked Jun 5 · Scenario · Senior

  18. How would you control applications that automatically pull the latest package versions during a build?

    Asked once · last asked Jun 5 · Scenario · Senior

  19. In a large environment, such as one with 50,000 employees, would version-locking dependencies be sufficient, or are you aware of other security controls?

    Asked once · last asked Jun 5 · Scenario · Senior

  20. How do you manage different credentials and external dependencies when promoting the same Docker image across environments?

    Asked once · last asked Aug 4 · Scenario · Mid-level

  21. Can you tell me how you assess DevSecOps pipelines from a security perspective?

    Asked once · last asked Aug 21 · Scenario · Senior

  22. How should credentials be handled inside CI/CD?

    Asked once · last asked Aug 30 · Scenario · Mid-level

  23. How would you integrate Prisma Cloud into a Terraform CI/CD pipeline?

    Asked once · last asked Sep 2 · Tooling · Senior

  24. What are secret variables in GitLab CI/CD, and what are they used for?

    Asked once · last asked Sep 8 · Concept · Mid-level

  25. Do you know what service principals are, and how would you use service principals in a CI/CD pipeline?

    Asked once · last asked Sep 10 · Concept · Mid-level

  26. How would you retrieve secrets, passwords, and tokens from Azure Key Vault in a live pipeline?

    Asked once · last asked Sep 10 · Tooling · Mid-level

    Other ways it was asked
    • “Have you used Key Vault? How would you pull secrets, passwords, and tokens in a live pipeline?”

  27. How would you design a CI/CD pipeline for a Git repository that securely uses AWS secrets?

    Asked once · last asked Sep 17 · Design · Senior

  28. As an architect, where would you keep secrets used by the deployment pipeline?

    Asked once · last asked Sep 17 · Scenario · Senior

  29. How would you proceed with cloud deployment if a security scan flags credentials in a property file?

    Asked once · last asked Sep 17 · Scenario · Senior

  30. How would you mitigate against a supply chain attack where a trusted tool like Trivy has been compromised?

    Asked once · last asked Sep 25 · Scenario · Senior

  31. When a workflow passes on main but fails only on a pull request, what are the most common differences in GitHub token permissions and secret availability that you check first?

    Asked once · last asked Sep 28 · Scenario · Mid-level

  32. If a PR from a fork needs an integration test that requires secrets, how would you redesign the workflow to run safely without exposing those secrets?

    Asked once · last asked Sep 28 · Scenario · Senior

  33. When a workflow fails with "resource not accessible by integration," what specific GitHub Actions permission or event/context issues do you investigate first?

    Asked once · last asked Sep 28 · Scenario · Mid-level

  34. In a GitHub Actions workflow, how do you set least-privilege permissions, and what's your process to determine the minimal scopes needed for a specific step?

    Asked once · last asked Sep 28 · Tooling · Senior

  35. How would you implement security in CI/CD pipelines?

    Asked once · last asked Oct 1 · Scenario · Mid-level

    Other ways it was asked
    • “How have you implemented security in your CI/CD pipelines?”

  36. A developer complains about a new SAST security gate in the GitLab pipeline. An emergency hotfix deployment is scheduled for tonight, and they want to bypass the gate. What do you do?

    Asked once · last asked Oct 12 · Scenario · Senior

  37. For a GitHub Actions workflow, what permission changes would you make for pull requests versus pushes to main, and where would you scope them?

    Asked once · last asked Oct 13 · Scenario · Senior

  38. How can you detect hard-coded credentials in source code repositories, and how should pipelines and applications authenticate to CyberArk Conjur?

    Asked once · last asked Oct 21 · Tooling · Senior

  39. How would you manage the path from software build to production in a regulated bank?

    Asked once · last asked Oct 22 · Scenario · Senior

  40. How do you manage code signing, provisioning, and release automation for iOS at scale?

    Asked once · last asked Oct 23 · Tooling · Senior

  41. How is code approval handled in a software development pipeline?

    Asked once · last asked May 26 · Concept · Mid-level

  42. Why might a team institute a code freeze ahead of a high-traffic event?

    Asked once · last asked Jul 27 · Concept · Mid-level

More CI/CD interview questions

How this list is made

Every question here was asked by a real interviewer in a real job interview that a candidate ran MeetAssist in. After the call, the interviewer's questions are pulled from the transcript. Practice sessions, tests, exams and anything that was not a job interview are dropped.

Questions are rewritten so they make sense on their own: names of people, employers and clients are removed, and speech-to-text mistakes are fixed. Small talk, logistics and questions about one candidate's own résumé are left out. Rephrasings of the same question are merged, and the count is the number of different interviews it came up in.

The interviews come from candidates who use MeetAssist, so they lean towards software, data and AI roles: the shares describe these interviews, not every CI/CD interview. Answers to the most asked questions are written and checked by an editor; a "common mistake" is shown only when reviews of real answers in these interviews show it, with the count.

231 interviews, 150 candidates, Nov 2025 to Oct 2026. Updated every month with new interviews.