Tell me about an incident you were part of. What was your role, and what changed afterwards?

What the interviewer is looking for

• This question tests ownership. Owns services end to end including on-call, follows incidents through to prevention, and improves things beyond the ticket.
• What to bring out: Calm mitigation, clear communication, a blameless review, a real root cause, and follow-up actions they personally drove to completion.
• Expect a follow-up like: Which follow-up action made the biggest difference?

Another way it may be asked: Think of a time production broke while you were involved. What did you do, and what did the team improve after?

A structure to follow: STAR, with the weight on Action and Result

1. Step 1

   Situation

   One or two sentences: where, when and what was at stake. Pick a real example you were close to.

2. Step 2

   Task

   What you personally were responsible for. Say "I", not only "we", so the ownership you showed is visible.

3. Step 3

   Action

   The two or three things you did and why you chose them over the alternatives. This should be about half your answer.

4. Step 4

   Result

   What changed, in your own measure of it, and what you would do differently. Only use numbers you can stand behind.

This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.

Common slips

• Describing what the team did without saying what you did.
• Choosing an example with no clear outcome, or one you cannot answer detailed questions about.
• Ending on the action and skipping the result and what you learned.

How to practise it

Write two bullet points for each STAR letter, then say the answer aloud in about two minutes.

Related questions

• If you were building an API for a simple to-do app, what endpoints would you create, and how would you handle errors?
• What is a database index, and how would you decide whether a column needs one?
• How do you protect a web application from someone sending malicious input, such as an SQL injection attack?
• Tell me about a time you changed a database schema on a live system. How did you do it without downtime?
• An endpoint starts timing out in production at peak hours. How would you investigate, and what would you look at first?

Browse all questions