Production is failing for users right now. What do you do in the first 15 minutes?

Handle the first 15 minutes of a production incident

Explains initial incident triage: confirm impact, mitigate, assign roles, preserve evidence, and communicate.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I would first confirm the incident and define user impact: what is broken, who is affected, when it started, and how severe it is. Then I would assign an owner, open a shared channel, and start a timeline. In parallel, I would look for safe mitigation such as rollback, disabling a feature flag, scaling a bottleneck, pausing a job, or routing away from a bad instance.

Full answer below

Practice focus

Impact assessment, mitigation, ownership, communication, evidence preservation, rollback decisions, and incident discipline.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
The first minutes of an incident shape both user impact and the quality of the investigation. Calm ownership, a shared timeline, and controlled mitigation prevent random debugging from making the failure larger.
I would first confirm the incident and define user impact: what is broken, who is affected, when it started, and how severe it is. Then I would assign an owner, open a shared channel, and start a timeline. In parallel, I would look for safe mitigation such as rollback, disabling a feature flag, scaling a bottleneck, pausing a job, or routing away from a bad instance.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would avoid deep root-cause work before stabilizing users. I would check recent deployments, configuration changes, dependency status, traffic spikes, alerts, and error dashboards. If a rollback is safe, I would prefer reducing impact quickly while preserving logs and telemetry. Communication should be factual: current impact, mitigation being attempted, next update time, and what users or support should expect.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Jumping straight into code changes without impact assessment.
Having multiple people make untracked production changes.
Waiting for perfect root cause before mitigating severe impact.
Not communicating update times to support or stakeholders.

Production is failing for users right now. What do you do in the first 15 minutes?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Try a variant

Tech stacks

Skill areas

Suggest an improvement