Search the practice set
126 questions, 454 terms and 400 topics in 20 areas.
35 results for “Incident Management”
Incident Command
Assigning explicit roles during an incident — commander, operations lead, communications lead, scribe — so coordination does not compete with diagnosis.
Blameless Postmortem
An incident review that seeks the systemic conditions that made a failure possible, explicitly excluding individual fault.
Severity Levels
A predefined scale of incident impact that determines who is woken, how fast, and what process applies.
Application Portfolio Management
Maintaining an inventory of every application with its owner, cost, business value and technical health, and using it to decide what to invest in, replace or retire.
Consent Management
Capturing, storing, honouring and evidencing a data subject's permissions for specific processing purposes, including withdrawal.
Global Traffic Management
The layer that decides which region a given user reaches, using DNS, anycast or an edge network, and that performs regional failover.
Identity and Access Management
The system of record for principals, credentials and permissions, and the policy engine that decides what each principal may do.
Offset Management
How a consumer records its position in a stream, and the decision that determines whether processing is at-least-once or at-most-once.
Secrets Management
Storing, distributing, rotating and auditing credentials so that they never live in code, images or configuration files.
Chaos Engineering
Deliberately injecting failure into a system to discover, before an incident does, which of your resilience assumptions are false.
Containment vs Eradication
Stopping an attacker's ongoing access versus removing their foothold entirely — sequential phases with different urgency and different risks of doing them wrong.
Dwell Time
The period between an attacker gaining access and being detected — the metric that determines how much damage an intrusion can do.
Dynamic Secrets
Credentials generated on demand for a specific consumer with a short lease, rather than stored, shared and rotated periodically.
Envelope Encryption
Encrypting data with a locally-generated data key, then encrypting that key with a master key held in a key management service, and storing the wrapped key alongside the ciphertext.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Key Rotation
Periodically replacing a cryptographic key with a new one while retaining the old for decrypting existing data, so exposure from any single key is bounded.
Permission Boundary
A policy limiting the maximum permissions an identity can have, used so that the ability to create roles does not become the ability to grant unlimited privilege.
Prompt Registry
A versioned store of production prompts with their model bindings, parameters and evaluation results, so a prompt change is a reviewable, traceable, reversible deployment.
Secret Zero
The credential a workload needs in order to authenticate to the secret manager — the one secret that cannot itself be stored in the secret manager.
Workload Identity
Giving a running workload a cryptographically verifiable identity issued by the platform, so it obtains short-lived credentials without a stored secret.
A 43-second network partition caused GitHub over 24 hours of degraded service in 2018. How does a 43-second event become a day-long incident?
The case, as publicly reported On 21 October 2018, routine maintenance replacing failing optical equipment caused a 43 second loss of connectivity between GitHu
A service becomes unresponsive during an incident in a dependency it barely uses. Investigation finds the client had no read timeout. Explain the full mechanism.
The mechanism, step by step 1. The dependency slows. It has not failed — it accepts connections and eventually responds, just very slowly. This is the important
An LLM feature that worked last week now gives worse answers. Nothing was deployed. How do you find out what changed, and what should have been in place?
What the interviewer is testing Whether you treat an AI feature as a system with configuration and dependencies, or as a black box that mysteriously drifts. Wha
An estate has database passwords in environment variables across 200 services. Design the migration to a secrets manager.
Sequence it by risk, not by convenience Phase 0 — stop the bleeding. Secret scanning in CI and on the existing repositories, blocking new commits containing cre
Anomalous access to a customer database is detected. Walk me through the first day, and say what determines whether you can answer the regulator.
The first hours Declare an incident and assign command. Named commander who does not debug, operations lead, communications lead, scribe. Security incidents add
Equifax was breached in 2017 through a vulnerability with a patch available two months earlier. Beyond "patch faster", what architectural and governance failures does that imply?
The case, as publicly reported Apache Struts vulnerability CVE 2017 5638 was disclosed in March 2017 with a patch available. An internet facing dispute portal a
Incident Management
Command roles, severity levels and mitigation before diagnosis.
AI Cost Management
Token accounting, routing, caching and the context-window budget.
Application Portfolio Management
Inventory, ownership, cost and health for every application.
Identity & Access Management
Workload identity, roles, permission boundaries and usage-based review.
Key Management
Rotation, separation of duty, envelope encryption and crypto-shredding.
Log Management
Aggregation, retention tiering, search and the cost of keeping everything.
Prompt & Version Management
Prompts as reviewed, versioned, evaluated production configuration.
Secrets Management
Runtime injection, dynamic credentials and rotation applications survive.
Security Incident Response
Detection, scoping, containment and notification clocks.