FreeExam

Incident response

A site reliability engineer interview on running incidents, alerting well, containing cascading failures, and learning from outages.

These prompts are original practice. They are not questions from a named employer or a live hiring loop.

  1. 1.During a major incident, what is the main job of the incident commander?

  2. 2.A bike-share app is down. The senior engineer acting as incident commander opens a database console and stops answering questions in the incident channel. What is the best move?

  3. 3.In an incident with separate roles, what does the communications lead own?

  4. 4.In a large incident, what does the operations lead usually do?

  5. 5.A county library catalog is failing. Fourteen people are on the bridge call, all suggesting fixes at once. What should the incident commander do?

  6. 6.An incident has run for six hours and the commander is exhausted. What is the right way to change commanders?

  7. 7.Why do incident teams keep a timestamped log of actions and findings during the response?

  8. 8.An on-call engineer at a payroll service sees an odd error pattern and is not sure it counts as an incident. What should they do?

  9. 9.A director joins an incident call and keeps asking responders for technical detail, slowing the work. How should the commander handle it?

  10. 10.Why do teams define incident severity levels before incidents happen?

  11. 11.A payroll run is due at 5 p.m. A bug will delay direct deposit for 3 percent of employees. How should severity be set?

  12. 12.Midway through an incident, it becomes clear the impact is much wider than first thought. What should happen to the severity?

  13. 13.An internal analytics dashboard is slow during business hours. No customers are affected. What response fits?

  14. 14.A clinic scheduler loads fast and returns no errors, but it has been saving some appointment times one hour off. How severe is this?

  15. 15.A team rates nearly every incident as top severity. What is the main risk?

  16. 16.Why do responders aim to mitigate impact before finding the root cause?

  17. 17.Errors on a grain co-op pricing app spike ten minutes after a deploy. Nobody knows why yet. What should you do first?

  18. 18.A deploy included a migration that dropped a database column. Errors start. Why is a plain code rollback risky here?

  19. 19.When is fixing forward a reasonable choice instead of rolling back?

  20. 20.A new recommendation widget on a bookstore site is causing high page latency. It sits behind a feature flag. What is the fastest safe mitigation?

  21. 21.One host in a web pool of twenty is returning errors while the others are healthy. What is the best first step?

  22. 22.A new incident has just been declared. What question usually pays off first?

  23. 23.A routing config change was pushed to every region at once and broke traffic everywhere. Which change would most reduce the blast radius next time?

  24. 24.A mitigation worked and error rates are back to normal. What should the commander do next?

  25. 25.One cloud region hosting a parking meter payment API goes dark. A second region is healthy. What is the best mitigation?

  26. 26.A team rolled back a suspect deploy, but errors kept going at the same rate. What does this most likely mean?

  27. 27.Which of these is a symptom-based alert?

  28. 28.Why do many SRE teams page on symptoms rather than causes?

  29. 29.The on-call engineer for a ferry ticketing service gets about 40 pages a week, and most clear on their own. What is the best fix?

  30. 30.What is the main danger of alert fatigue?

  31. 31.What should every paging alert come with?

  32. 32.A team has many cause-based signals, such as high memory or a full queue. Where do they best belong?

  33. 33.Why alert on how fast the error budget is burning rather than on any short error spike?

  34. 34.An alert keeps firing and clearing every few minutes because the metric hovers near its threshold. What is a good fix?

  35. 35.A dental office booking site went down for an hour, and the team learned of it from customer posts online. What is the best action item?

  36. 36.A small internal service gets few requests at night, so one failed request can push its error rate to 50 percent and page someone. What helps most?

  37. 37.A city parks permit service pages the network team for application errors they cannot fix. What is the best fix?

  38. 38.What makes a runbook useful at 3 a.m.?

  39. 39.A runbook step tells on-call to check a dashboard that was deleted months ago. What is the lesson?

  40. 40.Every week, on-call follows the same runbook to clear a stuck export at a seed catalog company. The steps never vary. What should the team do?

  41. 41.When is the best time to write a runbook for a new alert?

  42. 42.A runbook tells on-call to promote a database replica to primary. What should it say to check before that step?

  43. 43.A new on-call engineer follows a runbook at 3 a.m., and the steps do not fix the problem. What should they do?

  44. 44.What should the first status page update say when the cause is still unknown?

  45. 45.How often should status updates go out during a long incident?

  46. 46.A photo sharing app cannot accept uploads for some users. Which status page message is best?

  47. 47.A company's status page went down during a big outage because it ran on the same cluster as the product. What is the fix?

  48. 48.Support asks for a firm restore time to give customers. The team does not know yet. What is the best reply?

  49. 49.During an outage, sales staff keep messaging individual engineers for news. What should happen?

  50. 50.A school lunch payment site has recovered from an outage. What should the final public update include?

  51. 51.A request passes through six services and is slow. Which tool most directly shows where the time goes?

  52. 52.On a recipe app, 99th percentile latency has tripled but median latency has not moved. What is the most likely explanation?

  53. 53.Errors rose sharply on a moving company's quote service. What is the fastest way to narrow the problem?

  54. 54.During a canary rollout, errors rise only on the hosts running the new version. What should you conclude and do?

  55. 55.Why do services pass a request ID along to every downstream call?

  56. 56.Under pressure, what is a good way to debug an unclear incident?

  57. 57.A shipping label service's work queue grows steadily while worker CPU stays low. What is the most likely cause?

  58. 58.During an incident, the log search shows nothing at all from the failing service. What should you check first?

  59. 59.Errors on a volunteer scheduling app start at 09:02. The only deploy that day went out at 09:15. What does this suggest?

  60. 60.What is a cascading failure?

  61. 61.A food delivery app has three service layers, and each retries a failed call three times. The bottom service slows down. In the worst case, how much load can reach it per user request?

  62. 62.What is the best way to keep retries from causing a storm?

  63. 63.Why is random jitter added to retry backoff?

  64. 64.A popular cache key on a sports scores site expires at exactly midnight, and the database spikes to full load at that moment. What is happening?

  65. 65.On a weather app, one hot cache key expires and thousands of requests rebuild it from the database at once. How can this stampede be prevented?

  66. 66.What does a circuit breaker do in a service client?

  67. 67.Service A calls service B with no timeout. B starts hanging on every request. What happens to A?

  68. 68.A web front end times out after 2 seconds, but its backend waits up to 5 seconds on the database. What is the problem?

  69. 69.After an outage, a ticket booking service comes back and falls over again within a minute as clients rush in. What is the best approach?

  70. 70.Every instance of an API checks the shared database in its liveness probe. The database gets slow, and all instances are killed and restarted at once. What is the lesson?

  71. 71.A ride-hail dispatch queue has built up a 20 minute backlog. Requests that old are useless because riders have given up. What should the workers do?

  72. 72.What is load shedding?

  73. 73.A concert ticket site is overloaded during a big sale. Which requests should be shed first?

  74. 74.The recommendations service behind a hardware store's product page is down. How should the product page behave?

  75. 75.Why is it better to shed load as early as possible, such as at the edge?

  76. 76.When an overloaded API rejects a request, what is the best response?

  77. 77.A local news site gets ten times normal traffic from one breaking story. What is a good degradation plan?

  78. 78.What does a per-instance concurrency limit protect against?

  79. 79.A service runs in three zones, each at 70 percent of capacity at peak. If one zone fails at peak, what happens?

  80. 80.A tax filing app expects its biggest day on the filing deadline. How should the team prepare capacity?

  81. 81.Why can autoscaling fail to save a service during a sudden traffic spike?

  82. 82.For a product launch, a team triples its web servers but leaves the database as is. What is the likely result at peak?

  83. 83.Why do teams avoid running servers at 95 percent CPU during normal peak?

  84. 84.A load test that hits only the health check endpoint shows a service can handle huge traffic. What is wrong with the test?

  85. 85.What makes a dependency soft rather than hard?

  86. 86.A gym signup flow sends a welcome text message inside the signup request. The text provider goes down and signups fail. What is the best fix?

  87. 87.A request must call four dependencies in series, and each is available 99.9 percent of the time. Ignoring other failures, what is the best availability the request can have?

  88. 88.A third-party address lookup service your checkout uses is having an outage you cannot fix. What should your team do?

  89. 89.A pet adoption site's login fails whenever its analytics service is down. What is the best long-term fix?

  90. 90.A TLS certificate expired overnight and every API call to a florist's ordering service failed. Which action item best prevents a repeat?

  91. 91.What does a blameless postmortem focus on?

  92. 92.Why do teams keep postmortems blameless?

  93. 93.An engineer ran a delete command on production while meaning to target staging. Which action item best prevents a repeat?

  94. 94.What makes a postmortem action item likely to get done?

  95. 95.A team writes root cause: human error and closes the review. What is wrong with this?

  96. 96.Postmortems at a property management firm produce about 25 action items each, and most never get done. What is the best change?

  97. 97.What should happen with a finished postmortem?

  98. 98.A backup job at a credit union nearly filled a database disk, but an engineer noticed and fixed it before any impact. Is it worth a review?

  99. 99.What is toil in SRE terms?

  100. 100.On-call at a library ebook service restarts the same failing sync job by hand every day. What should the team do?

  101. 101.An on-call engineer has been paged five times a night for a week. What should the team do?

  102. 102.A team of three runs round-the-clock on-call, rotating one week each. What is the main risk?

  103. 103.A script removes unhealthy hosts from service. One night a bad health check marks every host unhealthy, and the script removes them all. What is the main lesson?

  104. 104.What is the main purpose of a game day?

  105. 105.A team wants to start chaos testing a payments service. How should they begin?

  106. 106.Which is a well-formed chaos experiment hypothesis?

  107. 107.During a chaos test, the user error rate passes the agreed abort threshold. What should the team do?

  108. 108.A game day shows that restoring a key database from backup takes nine hours, but the recovery target is one hour. What should the team do?

  109. 109.What is a tabletop incident exercise?