SLIs, SLOs and error budgets, incident command, on-call design, and blameless postmortems.
7 questions in DevOps & Cloud.
An SLO defines the reliability users should experience, and the error budget is the allowed gap between that target and perfection. Use burn rate to decide when reliability work must outrank feature delivery.
Declare it, take the incident commander role explicitly, and mitigate before you diagnose - roll back or shed load first, understand later. Keep one channel as the record, publish updates on a fixed cadence, hand over rather than push through, and let the review produce owned actions instead of narrative.
A single threshold on a single window cannot separate a real outage from a brief spike, so it either pages on noise or misses slow burns. Replace it with multi-window multi-burn-rate alerting: a fast rule that pages and a slow rule that files a ticket, each gated by a short window so a spike that already stopped does not keep paging.
Recovery time is set by how much state diverged, not by how long the fault lasted, so seconds of dual writes can take a day to reconcile. The prevention is a single writer enforced by quorum and fencing; the mitigation is designing the write path so repair is mechanical rather than forensic.
Analyse the leader's approach to blameless post-mortems, identifying root causes over symptoms, and driving accountability for remediation. Use this engineering leadership answer to show the decision, trade-off, and evidence rather than a memorised definition. It also connects incident management to the point an interviewer is testing.
Turn it into an experiment: a steady state you can measure in under a minute, a blast radius you chose, an abort that is one command with a named person who can call it, and written approval from whoever owns the revenue. Tuesday afternoon is the right time because everyone who understands the system is awake, and the announcement goes to the channel your own alerts land in.
Evaluate the candidate's crisis management and technical recovery skills in a high-stakes scenario involving a total compromise of Kubernetes administrative control. Use this security answer to show the decision, trade-off, and evidence rather than a memorised definition. It also connects incident response to the point an interviewer is testing.