You are in the middle of a P1 outage and everything is on fire. How do you prioritize? Give me a real example.
Show the answer
Say this first
Use your own real story. A model answer, STAR shaped: a firewall pair failed over on a Saturday and the standby lacked a NAT rule for the payment gateway, so card payments failed in 40 stores while hundreds of alerts fired. I asked for an incident commander, triaged by business impact (payments first), ignored alerts outside that path, and restored service by failing back to the recovered primary before chasing root cause. Payments were back in 35 minutes; the review found config sync had been failing silently, and we added sync monitoring and monthly failover tests.
Go deeper
What the interviewer is testing
Calm under pressure, triage by business impact, restore first and diagnose second, clear communication, and not trying to do everything alone.
The model, step by step
- Situation: Saturday morning, the primary firewall crashed and rebooted, the standby took over but was missing a recent NAT rule. Card payments failed across 40 stores. Monitoring showed hundreds of alerts and managers were calling.
- Task: I was on call and became the technical lead.
- Action:
- Asked for an incident commander and a single bridge, so I could work while someone else handled updates and callers.
- Ranked by business impact: payments first, everything else waits.
- Filtered the alert storm to the payment path only.
- Looked for the fastest safe restore: the primary was healthy again after its reboot, so I failed back to it after checking its state.
- Gave a short update every 15 minutes through the incident commander, and kept a timeline.
- Result: payments restored 35 minutes after the first alert. The review found configuration sync between the pair had been failing for weeks. We added monitoring for sync state and a monthly failover test.
Principles to say out loud
Stop the bleeding before finding the root cause. One person coordinates, one person types. Fixed update intervals beat constant interruptions. Write the timeline as you go.
Traps
- Describing heroic solo work with no coordination or communication.
- Chasing the root cause while the business is still down.