Practice

Fictional sample answer written by JoRoute to show the shape of a strong answer. Do not copy it: replace every detail with what is true for you.

First I would confirm the outage on the status dashboard and post in the incident channel, because people need to know it is being handled. Then I would check what changed last: if a release went out in the past hour, I would roll it back to limit the damage. Next I would call the on-call lead and keep a written timeline. Incident response is about ownership of the first steps, so I would not wait for permission to start, and I would write the follow-up review the next day. In my last on-call rotation in Austin I handled six incidents like this in a year, and rolling back first cut our average outage from 40 to 15 minutes.