You are the incident commander for a major outage affecting all customers. Describe how you run the incident from first page to postmortem.

Question

RED SAG · Accepted Answer

First I declare the incident and its severity, open a dedicated channel and video bridge, and page the right owners. I assign roles: I stay incident commander and coordinate rather than debug; an operations lead drives the technical work; and a communications lead posts updates to the status page and internal stakeholders on a fixed schedule, such as every 30 minutes. Our first goal is to stop customer impact, not to find the root cause, so we look at recent changes and use the quickest safe mitigation: roll back, fail over to another region, disable a feature flag or shed load. I keep the team focused, avoid many people changing production at once, and make sure every action is announced and logged in a timeline. After recovery we confirm metrics are healthy. Within a few days we hold a blameless postmortem covering impact, timeline, contributing factors and detection gaps, with action items that have owners and due dates.

You are the incident commander for a major outage affecting all customers. Describe how you run the incident from first page to postmortem.

What the interviewer wants to hear

Model answer

More hard DevOps Engineer questions