←

# sre & observability

// [38] real interview questions. Answers and sources live in the practice app.

practice this topic
  1. Your service has a 99.9% SLO but has actually delivered 99.999% for a year. Product is happy. Why might this be a problem, and what did Google do about it with Chubby?(mid)
  2. You are defining SLIs for a new user-facing API. How do you decide which indicators to pick, and how many SLOs should you end up with?(mid)
  3. Why should latency SLIs and alerts use percentiles instead of averages?(mid)
  4. It is week 8 of the quarter and your service has burned its entire error budget. Product wants to ship a big feature this week. As SRE, how does the error budget framework resolve this?(mid)
  5. What is an error budget, and what decision is it actually for?(junior)
  6. You are setting the very first SLO targets for an existing service. What are the classic mistakes, and what does Google recommend instead?(senior)
  7. You inherit an oncall rotation receiving ~100 alerts a week; most get acknowledged and ignored. How do you dig out of this?(mid)
  8. A teammate proposes a new paging alert. What questions do you ask before approving it?(mid)
  9. Why is 'page when error rate exceeds the SLO threshold over the last 10 minutes' a bad alerting rule, even though it looks like it enforces the SLO?(senior)
  10. Describe Google's recommended multiwindow, multi-burn-rate alert configuration, with the actual numbers.(senior)
  11. What exactly is a burn rate, and what does burn rate 1 mean for a 99.9% monthly SLO?(mid)
  12. Should you page on symptoms or on causes? Where do black-box and white-box monitoring fit into this?(mid)
  13. You can only monitor four things on a user-facing service. What are the four golden signals, and what is the classic trap inside each?(junior)
  14. Metrics, logs, or traces — how do you choose which signal to reach for when debugging a production issue?(mid)
  15. Your HTTP 5xx rate is 0% but users are complaining about broken results. What kinds of 'errors' does a naive error-rate metric miss?(mid)
  16. What two questions must a monitoring system answer, and why does the distinction matter during an outage?(junior)
  17. When would you build a dashboard around the USE method versus the RED method?(mid)
  18. A developer adds a user_id label to a request-counter metric. Two days later Prometheus is eating all its RAM and queries time out. What happened, and what is the fix?(mid)
  19. What is the practical rule of thumb for Prometheus label cardinality, and how should you approach adding labels to a new metric?(mid)
  20. Product wants per-customer latency breakdowns for 50,000 customers. The team proposes a customer label on the latency histogram in Prometheus. What do you say?(senior)
  21. Head sampling versus tail sampling for distributed traces — what are the real operational tradeoffs, and when do you need tail sampling?(senior)
  22. Should you sample traces at all? What signals tell you yes, and when is sampling the wrong call?(mid)
  23. A major outage hits; five engineers jump in, each trying fixes, one deploys a change nobody asked for, and management keeps pinging everyone for status. What structure fixes this, and what are the roles?(mid)
  24. When should you formally declare an incident instead of just quietly fixing the problem?(junior)
  25. You are Incident Commander on a long-running incident. What artifacts and protocols keep the response coherent across hours and handoffs?(mid)
  26. What makes a postmortem 'blameless', and why is blamelessness a reliability requirement rather than just kindness?(mid)
  27. What events should trigger a postmortem, and what separates a good postmortem from a compliance exercise?(mid)
  28. You are reviewing a postmortem draft that reads: 'The outage occurred because Deniz pushed a config without testing it. Deniz has been reminded to be careful.' What is wrong, and how do you rewrite it?(senior)
  29. How many engineers do you need to run a sane 24/7 oncall rotation, and where do Google's numbers come from?(mid)
  30. Your oncall regularly handles 5-6 incidents per 12-hour shift and people are burning out. Why is this quantitatively broken, and what levers do you have?(senior)
  31. Why do different services demand different pager response times, and what do those response times cost?(junior)
  32. What belongs in a good runbook (playbook) entry for an alert, and what is the paradox at the heart of runbook design?(mid)
  33. Why is 'we alert at 100% CPU' a broken capacity strategy, and how does the saturation signal drive capacity planning instead?(mid)
  34. When does deliberately injecting failure into production make sense, and what must be true before you start?(senior)
  35. p99 latency has tripled since noon but average latency and all 'green' dashboards look normal. Walk through how you would debug this.(senior)
  36. What are the classic cognitive traps during production troubleshooting, according to the SRE book?(mid)
  37. Your Grafana instance has 400 dashboards and nobody can find anything during incidents. What anti-patterns produced this, and how do you clean it up?(mid)
  38. You are building the first dashboard for a new microservice. What structure do you give it so it is useful during an incident, not just pretty?(junior)