You are on the platform operations team. It is 09:10. A monitoring alert has been open since the early hours, and it reaches you with a diagnosis and a fix already proposed.
"web-03 has been at load average forty since the early hours and checkout is timing out. top shows a kworker eating every core: looks like a kernel bug or a stuck driver. Can you have a look? Can we just kill it, or reboot?"
You are judged on three things. Accuracy: did you work out what was really wrong and deal with it. Economy: how directly you got there, in the incident’s own minutes. Integrity: what you preserved, who you told, and whether you claimed anything you had not established. The third is the one people fail.
Finish it, with any outcome, and its interview pack unlocks: 4 questions with weak, good and strong answers, the follow-up, and the trap.
Choose one
Incident log
Everything you do, in order. This is what a real handover is written from.
Nothing has happened yet.
How bad is it
Wrong moves push this up. Containing the problem pushes it back down.
What you have established
Facts you have actually observed, not guesses.
Nothing yet.