You find a large cluster running in a production account. It has no tags, no owner, no ticket, and it is generating errors and cost. Do you delete it? Walk me through your thinking.
What they are really testing: They are testing your judgement about irreversible actions under uncertainty, and whether you can find ownership from evidence rather than from a Slack poll.
A real interview question
You find a large cluster running in a production account. It has no tags, no owner, no ticket, and it is generating errors and cost. Do you delete it? Walk me through your thinking.
What most people say
drag me
“It has no owner and it costs money, so I would delete it and if it turns out something needed it, someone will complain and we can rebuild it.”
That is an irreversible action taken on missing information, and in production the thing that complains might be a customer or an auditor rather than a colleague.
The follow-ups they ask next
The creator left the company two years ago. Now what?
Go up the chain: the team that inherited the account, the cost centre on the bill, the repository that holds the IaC, and finally the account owner as the escalation path.
Your manager says the bill is urgent and asks you to just delete it today. How do you answer?
Give them the reversible option instead: stop it now, which captures most of the savings immediately, and delete after the observation window closes.
What the interviewer is listening for
- Distinguishes unowned from unused with real usage evidence
- Uses the audit trail to find the creating principal
- Prefers a reversible stop over an irreversible delete
- Ends with a tag policy so it cannot recur
What sinks the answer
- Deletes production infrastructure on missing information
- Relies only on asking in Slack and moves on when nobody replies
- Takes no snapshot before removal
- Treats it as a one off cleanup with no guardrail
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I have not had to retire an orphaned production resource, but my instinct is that delete is irreversible, so I would prove whether it is in use, find the creator in the audit log, stop it first, and only delete after a waiting period.”
Keep going with troubleshooting
Junior
You get paged at 2am. Checkout latency has gone from 200ms to 4 seconds and it started right after the 11pm deploy. Walk me through what you do.
Junior
It is 3am and you get paged: the primary application server is at 100% disk usage and the app is throwing write errors. You are the only one online. Walk me through exactly what you do.
Junior
You push a new version of a service and within two minutes the pods are all showing CrashLoopBackOff. The team is watching you share your screen. Walk me through exactly what you do.
Junior
A developer pings you: the checkout service cannot reach the payments service, the calls just hang and time out. You have never worked on either service. Walk me through what you do.
Junior
A developer messages you: 'My app suddenly gets Access Denied writing to the S3 bucket. Nothing changed.' It worked yesterday. Walk me through what you do.
Mid
Your load balancer shows 5xx errors jumping from 0.1 percent to 12 percent of requests over ten minutes. There was no deploy. What do you do?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free