Stabilize before you investigate: if the timing correlates with the deploy, roll back or halt the rollout first. Then compare the old and new versions on the same dashboards, check error rate and saturation alongside latency, and establish whether the spike is uniform or isolated to one endpoint, one shard, or one zone. Traces show which hop grew. Root cause analysis happens once users are safe.
Why interviewers ask this
This is the core SRE simulation, and interviewers care far more about your ordering than your hypothesis. They want mitigation before diagnosis, evidence gathered from the top down, and explicit checks against the assumption that the deploy is the cause. Silence about communication and incident roles is a common gap.
How to structure your answer
- Mitigate first: roll back or pause the rollout, then declare the incident.
- Confirm impact against the SLO so severity is grounded in numbers.
- Narrow the blast radius: which endpoint, version, shard, or zone.
- Use traces to find the hop that grew, then correlate with the diff.
- Verify recovery with the user facing SLI before standing down.
Example answer
First thing, I stop the bleeding. If a deploy went out twenty minutes ago and latency tripled, that is a rollback until proven otherwise, and I will happily be wrong about causation while users are fine. In parallel I declare an incident so someone owns comms, because the worst incidents I have been in were the ones where the same three people were debugging and answering questions in five channels. Then I check whether it is uniform. Is it every endpoint or one? All pods or just the new ReplicaSet? One availability zone? That usually collapses the search space immediately. From there I pull an exemplar trace for a slow request and look at where the time actually went. We had one of these where the new build added an innocuous logging call inside a loop that did a DNS lookup per iteration, so the span tree made it obvious in seconds. After rollback I confirm p99 is back under the SLO before I close anything.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- What if rolling back is not possible because of a schema migration?
- How would you tell a deploy induced spike from an organic traffic change?
- What would you check if only one availability zone was affected?
Related site reliability engineer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions