SRE Monitoring & Incident Response 2

Question 1

During a major incident, team members are proposing fixes simultaneously in a group chat, leading to conflicting changes in production. Which incident management structure BEST prevents this?

Accepted Answer

Designate a single Incident Commander who coordinates all actions and approves changes during the incident

Answer

An Incident Commander (IC) is the single point of coordination during an incident. The IC approves changes, delegates tasks, and prevents conflicting parallel actions — a core principle from ICS and SRE incident management.

Question 2

An alert fires at 3 AM but the on-call engineer determines the issue self-healed before they could investigate. This happens frequently. What is the MOST appropriate action?

Accepted Answer

Adjust the alert threshold or add a sustained duration requirement to reduce false positives

Answer

Alerts that consistently fire for self-healing issues represent false positives that contribute to alert fatigue. Adjusting thresholds or requiring the condition to persist before alerting reduces noise while still catching real incidents.

Question 3

What is the PRIMARY purpose of a 'communications lead' role during a major incident?

Accepted Answer

To handle all stakeholder updates, status page posts, and external communications so the technical responders can focus on remediation

Answer

The communications lead shields the technical team from interruptions by managing stakeholder updates, status page postings, and customer communications, allowing engineers to focus on resolving the incident.

Question 4

A monitoring system sends 500 alerts in a single day during a major outage, most of which are symptoms of one root cause. What monitoring design pattern would BEST reduce this alert storm?

Accepted Answer

Alert on symptoms that matter to users (e.g., elevated error rate) rather than on every downstream effect and system metric

Answer

Symptom-based alerting (alert on high user-visible error rates) rather than cause-based alerting (alert on every internal metric deviation) dramatically reduces alert storms by targeting the root signal rather than all downstream effects.

Question 5

Which of the following best describes the 'five whys' technique in a postmortem?

Accepted Answer

Iteratively asking 'why' about each cause until a systemic root cause is identified, typically requiring around five iterations

Answer

The five whys is a root cause analysis technique: start with the failure, ask why it happened, then ask why that cause happened, repeating until a fundamental systemic cause is uncovered — typically taking about five iterations.

(SRE) Site Reliability Engineering Foundation Certification Practice Test

(SRE) Site Reliability Engineering Foundation Certification Practice Test

SRE Monitoring & Incident Response 2