AWS Site Reliability Engineer Interview Questions

I would compare the new version against the previous one and identify whether the errors are limited to a specific endpoint, region, or dependency. If the issue is severe, I would consider rollback or feature disablement while I continue investigating. The reason I choose this approach is that deployment-related regressions are often caused by one behavior change that can be reversed quickly. I would also inspect logs, traces, and any changed query or code path. If the interviewer wants more detail, I would talk about canary analysis and post-deploy validation.

I would first determine whether the issue is local to one host, one region, or the full network path. Then I would inspect DNS, routing, MTU, retransmissions, resets, and any recent infrastructure changes. The reason I choose this approach is that network problems often show up as symptoms in multiple layers, so I want evidence before making a guess. I would also think about load-related causes, hardware issues, and whether a deploy changed network behavior. If needed, I would explain how I would use tracing or packet captures to narrow it down.

I would start by understanding traffic patterns, peak usage, growth trends, and resource consumption per request. Then I would estimate the headroom the system needs and whether scaling is limited by CPU, memory, storage, or network. The reason I choose this approach is that good capacity planning prevents emergencies instead of reacting to them. I would also think about seasonality, failover capacity, and whether the service can autoscale safely. If needed, I would describe how I would review capacity regularly instead of treating it as a one-time task.

I would page when the issue affects users, violates an SLO, or needs immediate human action to reduce impact. If the issue is minor, self-healing, or informational, logging or creating a ticket may be enough. The reason I choose this distinction is that paging should be reserved for urgent problems so people stay responsive to real incidents. I would also think about severity levels and whether automation can handle part of the response before involving a person. If the interviewer wants more detail, I would discuss alert tuning and incident ownership.

I would first verify whether the alert reflects a real user-facing issue or just a noisy internal metric. Then I would tune the threshold, update the signal, or remove the alert if it is not actionable. The reason I choose this approach is that noisy alerts reduce trust and make people slower to respond when a real incident happens. I would also think about whether the metric should be a page, a warning, or just a dashboard item. If the interviewer wants more detail, I would explain how I would test the alert against past incidents.