How to Detect AI Cheating in a DevOps Engineer Live Coding Screen

A DevOps engineer live coding screen — typically a live infrastructure-as-code or scripting exercise over Zoom or Teams — is compromised by AI when a complete, idiomatic Terraform or Kubernetes manifest appears in a single paste instead of the iterative trial-and-error typical of live IaC work, and the candidate can't explain or modify a specific resource, flag, or dependency when challenged on it directly.

Threat Model, Tells, and Evidence to Capture

Threat Model	Observable Tell	Evidence to Capture
AI-generated Terraform or Kubernetes manifest pasted into the editor	Complete, syntactically correct manifest appears with no visible provider-error iteration typical of live IaC authoring	Keystroke-vs-paste ratio; terminal and editor edit-history timeline
Second monitor running an AI chat while sharing only the editor window	Fixed gaze toward a point outside the shared window	Gaze-direction timeline synced to code timestamps; screen-share completeness check
Remote engineer typing over a shared live session	Typing style or command-line habits shift mid-session in a way inconsistent with one person	Session-continuity and typing-style consistency check
Inability to explain or modify a specific resource under live challenge	Candidate stalls or produces another suspiciously clean paste when asked to change one resource	Live-modification response tracked against original submission

Interviewer Script

Ask the candidate to add a new resource with a deliberately tricky dependency live — for example, a resource that must reference an output from a module they haven't touched yet. Genuine DevOps engineers iterate through provider errors and dependency issues out loud; AI-fed candidates often freeze or produce another suspiciously complete paste.
"Why did you use a for_each here instead of count?" A real author has a specific reasoning tied to the resource's behavior; a pasted answer often gets a generic or textbook response.
Interrupt with a scenario change: "assume this now needs to run across two regions for failover." Watch whether the candidate's design actually adapts or stays structurally identical.
Ask the candidate to share their full desktop rather than just the editor window before the exercise starts, to rule out a second screen running an AI assistant.

FAQs

Isn't referencing documentation or examples normal for infrastructure work? Yes, and looking things up is expected. The flag is a complete manifest appearing via paste with no visible iteration, combined with an inability to explain or extend it live — not the act of looking something up itself.

How is this different from a software engineer live coding screen? The underlying detection signals (paste ratio, gaze, live-modification ability) are the same, but the benchmark for "normal iteration" is different — IaC work typically involves visible provider-error cycles that plain application code doesn't always show.

What if the candidate genuinely has memorized common Terraform patterns from real experience? Genuinely experienced engineers can still explain and modify a memorized pattern instantly and specifically; the AI-cheating tell is the combination of a clean paste and an inability to defend or extend it under a live challenge.

How common is AI-assisted cheating in technical interviews generally? Karat found that 80% of candidates use LLMs during banned code tests, and infrastructure-as-code exercises share the same live, screen-shared format that makes this kind of assistance easy to hide without instrumentation.

Should full desktop sharing be required for every DevOps technical screen? It's a reasonable default for exercises involving live coding or IaC work specifically, since it directly rules out the most common hiding spot for a second AI-assisted screen.

Related Guides

Get the Evidence Before You Extend an Offer

A live IaC exercise is supposed to show how someone actually debugs infrastructure code under pressure, not how well an AI tool can generate a clean manifest. Neuroxa AI Meeting Proctor tracks gaze, screen-share completeness, and paste patterns during the call, flagging sessions that need a live-modification follow-up before you move forward.