Technical Support Engineer Interview Questions

A SaaS e-commerce platform reports that checkout transactions are failing for roughly 30% of users, but only during peak hours between 6–9 PM. The error is intermittent and not reproducible in staging. Walk through your end-to-end troubleshooting approach from the first customer report to root cause.

A customer reports that their mobile app stops syncing data after running for about two hours, but restarting the app fixes the issue. The problem is consistent across three different Android devices. How do you approach diagnosing this?

Your company's largest enterprise client — $2M ARR — just opened a P1 ticket at 11 PM claiming their nightly data pipeline has failed, impacting a board-level report due at 8 AM. The on-call engineer suspects the fix will take 4–6 hours. How do you manage communication with the client through this incident?

A frustrated customer sends a long email claiming your product caused them to lose a week of work because of a data export bug. After investigation, you find the bug was in their custom script that called your API incorrectly. How do you write the response?

A fintech customer integrating your payment API reports that webhook delivery is failing about 15% of the time in production. Their engineering team says they are returning HTTP 200 to every webhook, yet your system marks those events as undelivered and retries them, causing double-processing of transactions. Diagnose and resolve this.

A customer building a CRM integration says your REST API returns a 429 error sporadically but their request volume is well below the documented rate limit of 1000 requests per minute. They share their code showing they call the API in a tight loop. What is happening and how do you guide them?

A cloud storage service reports that file uploads larger than 50 MB intermittently fail with a generic 500 error. You have access to Nginx access logs, application logs from a Python Flask service, and AWS S3 transfer logs. Describe your log analysis strategy to find the root cause.

A customer reports a Java microservice crashes every morning around 7 AM with no apparent trigger. You have the application logs but no heap dumps. What patterns do you look for in the logs to build a hypothesis before requesting a heap dump?

A reporting dashboard for a healthcare analytics company shows correct data for most users but returns stale data for one specific hospital tenant. All tenants share the same Postgres database with a `tenant_id` column on every table. The last-updated timestamp in the UI is 48 hours old despite new records existing in the database.

A customer says a support ticket query that used to run in 2 seconds now takes over 3 minutes after their ticket volume grew from 100K to 2 million rows. You have access to the database. How do you diagnose and fix the query performance regression?

A globally distributed SaaS company reports that users in Southeast Asia experience 8–12 second page load times while US users load the same page in under 1 second. The application servers are all hosted in us-east-1. How do you diagnose whether this is a network latency, DNS, or application-level problem?

A customer says they can access your SaaS application from their laptop on corporate WiFi but the same app times out when accessed from their office server. Both devices are on the same corporate network. What do you ask them to check?

You are managing a P1 incident for a healthcare SaaS client where patient scheduling data is not syncing between your platform and their EHR system. The engineering team needs 6 more hours to deploy a fix, but the client's operations director is threatening to pull the contract. How do you manage the escalation?

A customer has been waiting 5 business days for an engineering team response on a bug you escalated. The engineering team says it is in the backlog but unprioritized. Your SLA requires engineering response within 3 days. You do not have direct authority over the engineering team. What do you do?

Your support team resolves 40% of tickets by copying answers from internal Slack threads rather than a formal knowledge base. Ticket deflection via the self-serve portal is under 5%. You are tasked with improving documentation quality and deflection within one quarter. What is your plan?

You have just resolved a complex multi-step bug involving a race condition in a third-party OAuth integration. Engineering says this class of bug will recur whenever customers upgrade to a specific OAuth library version. Write the key elements of the internal runbook you would create.

Your team handles 800 tickets per month across three priority levels: P1 (4-hour response SLA), P2 (24-hour), P3 (72-hour). Your SLA compliance report shows P2 breaches at 22%, mostly on tickets created Friday afternoon. How do you redesign the triage and routing process to address this?

A customer opens five separate tickets for what turns out to be a single configuration error on their account. Your system counts each breach separately, inflating your SLA breach metrics. How do you handle this operationally and prevent it from recurring?

You support a B2B project management SaaS. A customer's VP of Engineering asks why your product's Gantt chart does not account for resource capacity when calculating critical path. They are evaluating switching to a competitor. How do you respond without promising features that do not exist?

A customer asks why their data export from your platform looks different from the data they see in the UI — specifically, totals in a revenue report differ between the CSV export and the dashboard widget showing the same date range.

A Node.js API service is experiencing a gradual memory leak in production. The service restarts every 4–6 hours after the process memory climbs past 2 GB. You cannot reproduce it locally and cannot take the service down for profiling. How do you diagnose this in production without disrupting service?

A customer reports that a REST API call works in Postman but fails with a 401 Unauthorized when made from their Python script. Both use the same API key. How do you help them debug the discrepancy?

Your team closes a P1 incident involving a misconfigured Kubernetes ingress rule that took down a payment processing service for 22 minutes. Engineering wants a lightweight RCA. How do you structure and facilitate the post-mortem to produce a useful document rather than a blame session?

A customer says a bug you fixed in version 3.2 has reappeared in version 3.5. Engineering says the fix is still in the codebase. How do you systematically reproduce and verify whether this is a regression, a different bug with similar symptoms, or a misconfiguration on the customer's side?

You support a platform that ingests log files from 200 customer servers daily. Each server drops a gzipped log file in an S3 bucket under `logs/{customer_id}/{date}/server.log.gz`. A customer reports missing data for a specific date range. Write a shell script strategy to identify which customers have missing log files for a given date range.

A customer needs to batch-update 500 user records via your REST API. They have a CSV with columns user_id and new_email. Write a Python script approach that handles rate limiting and partial failures gracefully.

Engineering closed a customer bug as 'working as designed' but the customer has a legitimate business case that the current behavior blocks their workflow. You believe the design needs reconsideration. How do you escalate this without damaging your relationship with the engineering team?

The sales team promised a customer a feature your product does not have, and the customer opens a support ticket requesting help setting it up. How do you handle the customer interaction and the internal situation?

An IoT platform company reports that device telemetry from exactly one AWS region (ap-southeast-2) stopped ingesting at 14:23 UTC. Devices in all other regions are fine. The cloud infrastructure team says no changes were deployed. How do you triage this with limited access to the customer's AWS environment?

You are about to send an automated maintenance notification to 5,000 customers about a 4-hour weekend downtime window. Your marketing team wants to use it as an opportunity to promote new features. How do you push back and write an appropriate communication?

A logistics company's warehouse management system sends order updates to your platform via a custom XML-to-REST adapter. Orders arrive duplicated in your system — the same order appears 2–3 times. The adapter team claims they send each order exactly once. How do you determine where duplication is occurring?

A media streaming company reports that 4K streams buffer excessively for premium subscribers but SD streams on the same accounts are smooth. Your CDN provider says all systems are nominal. You have access to CDN access logs and video player analytics. Describe your log analysis approach.

A retail company runs a monthly cohort retention analysis on their Postgres database with 10 million customer records. The query was written by an analyst and takes 45 minutes to run, blocking the analytics team. You are asked to optimize it without changing the business logic.

A customer says they configured your webhook endpoint in their system but it never fires. They can make successful API GET requests to your platform from the same server. What do you check to diagnose the outbound webhook delivery failure?

Three separate enterprise customers have independently reported the same data inconsistency bug in the past two weeks. Engineering triaged each ticket as P3 (low priority) because no single customer's impact is severe. You believe the aggregate risk is P1-level. How do you make the case and get it reprioritized?

A customer says your API documentation shows a field called `account_status` but the API actually returns `accountStatus` in camelCase. They spent half a day debugging this. How do you handle this and improve your documentation process?

A long-running ticket has been open for 45 days because it is waiting on a customer to provide additional logs. Your SLA clock is still running. How do you handle this operationally?

A customer asks your support team to help them migrate 50,000 records from your platform to a competitor's platform. They have decided to leave but are within their contractual data portability window. How do you handle this request?

A Go microservice handling high-frequency trading order submissions is experiencing intermittent latency spikes from a median of 2ms to 400ms, occurring roughly 50 times per day. No errors are logged during the spikes. How do you instrument this service to find the cause?

A customer's automated test suite catches a data corruption issue in your platform only when it runs on Tuesdays. The test manipulates time-sensitive billing cycle records. Your QA team cannot reproduce it on demand. How do you design a systematic reproduction strategy?

You need to build a nightly health check script that calls 30 different API endpoints across three microservices, logs the response times and status codes, alerts on any endpoint exceeding a 2-second response time or returning a non-200 status, and emails a summary report. Describe the design.

A customer support manager needs a daily report of tickets opened, closed, and breached by SLA per agent from your Zendesk instance. The Zendesk API rate limit is 700 requests per minute. Write the approach for pulling and aggregating this data.

Your support team is the first to learn about a critical security vulnerability in your product from a customer report. Engineering is in the middle of a major release freeze. How do you coordinate the response across support, security, engineering, and communications?

The product team releases a major UI redesign without notifying the support team in advance. Customers flood support with confusion about features they cannot find. How do you handle the immediate volume spike and prevent this from happening again?

A customer's integration with your platform stops working after they upgraded their SSL/TLS library. They get a TLS handshake failure but only when connecting to your production endpoint, not staging. Both environments have the same server certificate. What do you check?

A customer building a mobile app reports that your OAuth token refresh flow works in development but returns a 400 Bad Request in production. The error message is 'invalid_grant'. Both environments use the same client credentials. What is the systematic diagnosis path?

A microservices platform customer reports that a specific service returns HTTP 503 sporadically. Looking at the logs you see the pattern: 503s happen in clusters of 3–5 within a 10-second window, then resolve for 5–10 minutes. What does this pattern tell you and how do you investigate?

A customer needs to know how many of their active users performed a specific action more than three times in the last 30 days. They have table `user_events` with columns `user_id`, `event_type`, and `created_at`. Write the query and explain each part.

A customer escalates directly to your CEO via LinkedIn claiming your support team ignored them for 2 weeks on a billing dispute. You check the ticket and find the customer never provided the bank reference number your team requested 3 days after the original ticket — there was no 2-week silence. How do you handle this?

A PHP application serving a B2B portal returns blank white pages intermittently under load. There are no PHP error logs. How do you find the cause?

A customer reports their CSV export contains null values for a field that shows correctly in the UI. The field is a calculated column showing days since last activity. How do you structure the reproduction case?

A financial services customer reports their on-premises trading system connects to your cloud platform with sub-10ms latency in off-peak hours but latency degrades to 150ms during market open (9:30 AM EST). Your cloud infrastructure shows no congestion. How do you investigate the network path?

You discover that three different KB articles give contradictory troubleshooting instructions for the same type of SSL error. Customers are following different articles and getting inconsistent results. How do you fix this systematically and prevent future contradictions?

Your support team is measuring mean time to resolution (MTTR) at 48 hours, but customer satisfaction scores are at 72/100 and declining. Leadership wants to improve CSAT without adding headcount. How do you diagnose what is actually driving poor CSAT and design a targeted intervention?

A senior DevOps engineer at a Fortune 500 company calls in frustrated because your CI/CD platform's Kubernetes deployment plugin fails silently when the target namespace does not exist. They have been debugging for 3 hours. How do you handle the technical support call and the product feedback?

A large e-commerce platform reports checkout failures affecting 15% of orders during a flash sale. Your monitoring shows no server errors, database is healthy, and CDN reports normal. Payment gateway team says their systems are fine. Walk through how you'd isolate the failure within the first 30 minutes.

A SaaS customer reports their nightly data export job, which ran fine for six months, failed last night with a generic 'export timed out' message. No code was deployed. How do you begin diagnosing the issue without access to their environment?

You've just confirmed a data breach affecting a Fortune 500 banking client's test environment. No production data was exposed, but the client's CISO is demanding a call in 20 minutes and wants a full incident report within two hours. You have partial information. How do you handle the communication?

A mid-market customer submits a ticket with the subject 'Your product is broken and we're going live tomorrow.' The body is two sentences of frustrated venting with no technical details. Write out how you respond and what you do next.

A fintech customer's webhook integration was receiving events reliably for three months. After they migrated to a new cloud provider and changed their receiving endpoint IP, they now receive only about 60% of webhooks. Their endpoint returns 200 for every request it receives. Diagnose the gap.

A developer calls saying their OAuth 2.0 token request keeps returning 401 Unauthorized despite following your documentation exactly. They share their curl command — it looks syntactically correct. What do you check first?

You have a 2 GB application log file from a Java microservice that experienced an OOM crash in production at 3:47 AM. The heap dump is unavailable. How do you extract actionable signal from the log alone in under 20 minutes?

A customer sends a screenshot of an error: 'NullPointerException at com.company.billing.InvoiceService.generate(InvoiceService.java:247)'. They say it started yesterday and affects about 30% of invoices. What do you do with this information?

A healthcare SaaS customer reports their patient report dashboard takes 45 seconds to load instead of the usual 3 seconds. The table has 8 million rows and was performing fine last month. No schema changes were made. Diagnose and resolve using SQL.

A customer asks you to help them write a SQL query to find all users who signed up in the last 30 days but have never logged in. Their schema has a users table with created_at and last_login columns. last_login is NULL if the user has never logged in.

A customer's on-premise integration server is intermittently failing to connect to your SaaS API endpoints. The failures are random, last 30-90 seconds, and then recover. Their network team says everything looks fine. How do you approach this?

A new customer says they can ping your server's IP but cannot connect to your HTTPS application on port 443. Their browser shows 'Connection refused.' What are the likely causes and how do you walk them through diagnosing it?

You are the Senior Support Engineer on a P1 incident. The engineering team has been investigating for 90 minutes, identified the cause, and is preparing a fix. The enterprise customer's CTO is calling every 20 minutes demanding updates. How do you manage this without disrupting the engineers?

You've been working a ticket for two days. The fix requires a backend code change that engineering says will take two weeks. The customer has already threatened to cancel. How do you handle the ticket and the relationship right now?

You notice that 40% of your team's P2 tickets in the last quarter were resolved using the same three undocumented workarounds. How do you convert this institutional knowledge into durable assets that reduce ticket volume?

You've just resolved a complex, three-day incident involving a race condition in our webhook delivery system. Write out what a good internal incident post-mortem document should contain and why each section matters.

Your team has an SLA of 4-hour first response for P2 tickets. Analysis shows you're meeting it 72% of the time. You have the same headcount as six months ago when you met it 95% of the time. Diagnose why SLA compliance dropped and propose a fix.

A P1 ticket comes in at 4:45 PM on a Friday. Your SLA requires acknowledgment in 30 minutes and resolution in 4 hours. The on-call engineer is unavailable and your shift ends at 5 PM. What do you do?

A prospect's solution architect asks whether your platform can handle 50,000 webhook events per second sustained for 30 minutes during their batch processing window. You don't know the answer off the top of your head. How do you respond and what do you do next?

A customer asks whether they can use the platform's API to bulk-delete 200,000 records without triggering their account's rate limits. You support 3-4 products and aren't certain of the exact limit for this specific API endpoint. How do you handle this?

A customer reports a React application integrated with your SDK is throwing intermittent 'Cannot read properties of undefined' errors in production but not in their staging environment. They've provided a minified stack trace. How do you debug this with them?

You need to verify that a customer's environment is correctly sending TLS 1.2 requests to your API and not falling back to TLS 1.0. They don't have access to their server's config. What tool do you give them to self-diagnose this?

A customer claims your platform double-billed them 47 times last month. Billing records show only 47 legitimate charges. The customer insists their bank statements show 94 charges. How do you establish ground truth and conduct RCA?

A customer reports that a filter on their reporting dashboard shows wrong results — it returns records from outside the selected date range. You cannot reproduce it on your test account. What steps do you take to reproduce it before writing an RCA?

A customer needs to migrate 500,000 records from their legacy CRM into your platform via REST API. Their engineering team is unavailable for two weeks. They ask if you can provide a migration script. Describe how you'd approach building and delivering it.

A support team member asks you to write a quick bash script to parse your error log file and output a count of each unique HTTP status code returned in the last hour. The log format is: timestamp | method | path | status | response_time.

Engineering says a bug you've been telling customers will be fixed 'next sprint' has been deprioritized for two months. You have 12 open tickets waiting on it. How do you handle the relationship with engineering and your customers simultaneously?

A customer reports that data they entered in your platform yesterday appears to have been deleted. Engineering confirms a maintenance script ran last night that accidentally dropped records matching a certain pattern. How do you coordinate the response across support, engineering, and the customer?

A media streaming customer reports video playback stutters every 8-12 seconds precisely for users in Southeast Asia, while European users experience no issues. The CDN provider says their edge nodes are healthy. How do you isolate this?

Your platform's iOS SDK crashes in production for 0.3% of users during app launch. The crash rate is consistent across 4 SDK versions. Crash reports show the same stack trace but no obvious reproduction steps. How do you find the root cause?

A logistics company integrates your platform's tracking API via a third-party middleware vendor. API calls are failing with 403 Forbidden. The middleware vendor blames your platform; your platform team says the credentials are valid. How do you determine who is right?

You're 10 minutes into a screen-share debugging session with an enterprise customer when you realize the root cause is a configuration error they made six months ago. They have a team of 8 engineers who set this up. How do you communicate this finding?

A retail analytics customer reports that their revenue summary query returns different totals depending on which database read replica they hit. The replication lag monitoring shows <1 second. How do you investigate and explain this?

A B2B customer behind a corporate proxy reports that API calls from their CI/CD pipeline succeed but the same calls from their developer laptops fail with SSL certificate errors. Both use the same API key. How do you diagnose this?

You escalate a critical data integrity issue to engineering, but the assigned engineer responds that the issue is expected behavior per a design decision made 18 months ago. Your customer insists their contract specifies different behavior. How do you navigate this?

Your team uses centralized log aggregation (Elasticsearch/Kibana). A customer reports intermittent 500 errors that appear in their app but you can see no corresponding 500s in your application logs. How do you explain this discrepancy and find the source?

A new support engineer on your team spent three hours debugging an issue that you resolved in 10 minutes because you knew an undocumented API quirk. How do you prevent this from happening again for the next person?

Your support queue has 200 open tickets. A new critical security vulnerability is disclosed that affects your platform. You need to triage all existing tickets and respond to the new vulnerability simultaneously with a team of 5 engineers. How do you manage this?

A customer asks whether your platform's real-time event streaming feature can be used as a replacement for their existing message queue (Apache Kafka) for processing 50,000 events per second with guaranteed at-least-once delivery and consumer group support. How do you answer?

A Python data pipeline built on your platform runs correctly locally but times out in production every night around 2 AM. It processes 500,000 records. How do you use profiling tools to identify the bottleneck without access to their production environment?

You need to write a script that monitors your platform's public status API endpoint every 60 seconds and sends a Slack alert if the response time exceeds 2 seconds or the response code is not 200. Describe your approach and the script structure.

You've resolved a customer's issue and closed the ticket, but they reply the next day saying the problem is back and they're frustrated that you closed the ticket prematurely. How do you handle this?

Your platform's sales team promises a new enterprise customer that a feature the customer needs is 'available now.' The feature is actually in private beta and requires onboarding by the product team, which has a 3-week waitlist. You learn this the day the customer is supposed to start using it. How do you manage this?

A customer says 'the search feature is broken.' That's the entire ticket description. It's a P2. You have 4 hours to first response. How do you triage this ticket efficiently?

A customer's integration sends API requests with a valid API key but receives 429 Too Many Requests errors. They claim they're only sending 10 requests per minute, well below the documented limit of 100. How do you investigate this?

A customer submits a ticket at 4:55 PM on a Friday with a false severity label of P1 to get faster response. You can tell from the description it's actually a P2 or P3. What do you do?

A customer says their Node.js application is leaking memory and suspects it's related to your SDK's event listener handling. They're seeing heap usage grow 50MB every 30 minutes. How do you guide them through diagnosing the leak?

You find a bug that affects a specific subset of customers and needs to be fixed by the engineering team. When you file the Jira ticket, the assigned engineer says 'that's working as designed' and closes it. You disagree and have customer evidence. What do you do?

A customer reports that after uploading a CSV file to your platform, some rows are missing from the imported data. The file has 10,000 rows; only 9,847 appear after import. How do you find the 153 missing rows?

You need to check whether 50 customer domains are properly pointing to your platform's DNS records. You have a list of domains in a text file. Write a bash script to automate the check and report which domains are misconfigured.

You're writing a public status page update during an active incident. The service has been degraded for 45 minutes and you don't have an ETA yet. Write out what the status page update should say and what it should not say.

A customer says API responses have been slow for the past two days — average 8 seconds instead of the usual 200ms. They're in Australia; your servers are in US East. How do you isolate whether this is a network latency issue or an application performance issue?

A customer needs to export all records where the updated_at timestamp is in the current month. Their database has 2 million records and their current query using MONTH() and YEAR() functions is extremely slow. How do you help them optimize it?

A customer has been asking for the same feature request for 18 months. They file a ticket each month. Each time you promise to pass it along. How do you handle this month's ticket and what do you do differently going forward?

A customer shares a Java application log that shows a ConcurrentModificationException in their integration code. They say it only happens under load. What does this error tell you and how do you help them fix it?

You're tasked with reducing the time a new support engineer takes to handle their first solo ticket from 3 weeks to 1 week. You have one month. What documentation and training artifacts do you build?

A healthcare SaaS client reports that their HL7 message processing pipeline has silently dropped roughly 300 lab results over the past 6 hours. No alerts fired. Walk through your end-to-end troubleshooting approach, including how you confirm scope and prevent further data loss.

A frustrated e-commerce enterprise client calls at 11 PM claiming your payment gateway integration caused $80,000 in failed transactions during their Black Friday sale. They demand a written root-cause analysis within 2 hours. How do you handle the communication and set realistic expectations?

A fintech partner reports that webhook events from your platform arrive out of order roughly 5% of the time on their end, causing double-charges in their ledger. They have retried with exponential backoff. Describe how you diagnose whether the ordering problem originates on your side or theirs.

A logistics SaaS client's nightly batch job has started failing at exactly 02:17 AM every night for three consecutive nights. The job log shows 'Connection reset by peer' on a PostgreSQL query, but the database team says the DB was healthy. How do you investigate this discrepancy?

A retail analytics client says a dashboard query that used to return in under 2 seconds now takes 45 seconds. The table has grown from 10 million to 80 million rows over six months. You have access to the query and the database. What is your diagnostic and remediation path?

A client running your on-premise data connector reports intermittent 'SSL handshake timeout' errors connecting to your cloud API. The errors occur only between 9 AM and 11 AM. Their IT team says no firewall changes were made. Walk through how you isolate the root cause.

You have been working a Sev-1 ticket for a manufacturing ERP client for 4 hours. Engineering says the root cause is a race condition that will take 2 days to fix properly. The client's VP of Operations is threatening to invoke the SLA breach penalty clause. How do you manage this escalation?

After resolving a complex Kafka consumer lag incident for the third time in six months, you realize there is no runbook for it. Your team keeps rediscovering the same fix. How do you build a runbook that actually gets used rather than one that gets written and forgotten?

You are reviewing your team's Zendesk queue on a Monday morning and notice 12 tickets are within 1 hour of breaching their 24-hour SLA response commitment. You have 3 engineers available. How do you prioritize and prevent the breaches?

A client asks why your platform's real-time event streaming feature has higher end-to-end latency than a competitor's. They have benchmarks showing 850ms versus the competitor's 120ms. You need to give a technically credible explanation and a path to improvement without disparaging the competitor.

A Java microservice running in Kubernetes suddenly spikes to 99% CPU for 5-minute intervals every 30 minutes, then recovers. No exceptions appear in logs. You have kubectl, Java Flight Recorder, and a profiler available. Describe your diagnostic sequence.

A client in the insurance sector reports a data corruption bug where policy records occasionally get overwritten with another client's data. They can reproduce it 'sometimes' during concurrent data imports. You cannot reproduce it in staging. How do you approach getting a reliable reproduction?

Your team manually checks 40 client-facing API endpoints every morning to verify they return 200 OK and correct JSON structure. This takes 45 minutes daily. Write or describe a shell script that automates this check and posts failures to a Slack channel.

Engineering has just shipped a breaking change to a REST API without updating the changelog or notifying your support team. Three enterprise clients hit errors simultaneously and are calling you. You have no technical context. How do you manage the immediate crisis and prevent recurrence?

A startup client says their mobile app cannot connect to your backend API in India but works perfectly for users in the US. No code changes were made in the past week. How do you narrow down whether this is DNS, routing, TLS, or your API itself?

A large banking client's technical lead sends you a 3-page email with 17 distinct complaints about your platform, mixing critical bugs with cosmetic UI issues and feature requests. How do you respond in a way that is thorough, professional, and actionable without creating 17 separate tickets?

A B2B SaaS client's integration with your OAuth 2.0 API has worked for 8 months but suddenly returns 401 errors after their developer rotated the client secret. The developer insists the new secret was updated in their config. Walk through how you diagnose this.

A client reports random 500 errors on a Node.js API. You are given a 50 MB application log file. Describe exactly how you extract the relevant errors, identify patterns, and determine if there is a common cause without reading the entire file.

A data engineering client reports that a critical daily ETL job failed with 'duplicate key violates unique constraint' after a schema migration added a new composite unique index. The source data itself has no duplicates. What is your investigation and fix path?

A financial services client running a high-frequency trading application reports that TCP latency between their co-location servers and your exchange API fluctuates between 0.3ms and 12ms unpredictably. They have confirmed network hardware is healthy. What are the software and OS-level causes you investigate?

A ticket has been sitting in the engineering queue for 11 days with no update. The client is a mid-market account sending their third follow-up email. Engineering says they are backlogged. You have no authority to force engineering to reprioritize. How do you manage this?

Your company is migrating its knowledge base from Confluence to Notion. You have 400 articles, many outdated. You need to migrate, prune, and structure them in 3 weeks with a team of 2. How do you approach this without losing institutional knowledge or business continuity?

Your team's average resolution time for Sev-2 tickets has crept from 4 hours to 11 hours over the past quarter despite headcount staying constant. Your director asks for a data-driven root cause and improvement plan. How do you investigate and present your findings?

A client asks you to explain the difference between your platform's standard webhook delivery and its guaranteed-delivery mode, and when they should use each. You need to give a technically accurate answer without access to the documentation right now.

A Python Django API returns correct responses for most users but intermittently returns stale data for about 2% of requests. The team suspects a caching issue. You have access to the server, Redis CLI, and Django debug toolbar. How do you confirm and locate the caching bug?

A client reports that PDF export from your SaaS platform fails for documents containing more than 50 pages. They have submitted 3 tickets over 2 months, each time your team could not reproduce it in testing. How do you finally get a reliable reproduction?

You need to build an automated script that monitors your company's SLA compliance across 500 enterprise clients by querying Zendesk's API, computing first-response and resolution times, and generating a weekly CSV report emailed to each account manager. Describe the architecture and key implementation decisions.

A globally distributed SaaS product has a checkout flow that fails for users in Brazil but works for all other regions. The failure started 48 hours ago with no deployment. The error message is 'Payment method not supported' but the payment method IS supported in Brazil. Describe your structured investigation.

A client sends a passive-aggressive email saying 'Once again, your platform has failed us' about an outage that lasted 22 minutes and was caused entirely by their misconfigured firewall. You have evidence of this. How do you respond?

A client is using your REST API to sync product catalog data. Their sync job processes 50,000 products every night and is now hitting HTTP 429 rate limit errors around the 40,000 product mark. They say they implemented exponential backoff. What do you investigate and what do you recommend?

A production Go microservice handling IoT sensor data has been emitting a 'context deadline exceeded' error for roughly 1 in 200 sensor reads. The errors appear in both CloudWatch logs and the application log, but they do not correlate with high CPU or memory. How do you trace this to root cause?

A client asks you to write a query to find all users who purchased Product A but never purchased Product B, to use in a targeted marketing campaign. The database has a users table and an orders table with a product_id column. Write the query and explain your approach.

A client's internal application server cannot reach your cloud API over HTTPS. They can ping your IP address successfully. They cannot telnet to port 443. Their IT team says the firewall is open. What is your step-by-step troubleshooting path?

During a Sev-1 incident call with a healthcare client, the client's CTO begins demanding that your engineering team revert a deployment that happened 6 hours ago. Your engineering team is 80% certain the deployment is not the cause. How do you manage this conflict in real time?

A new support engineer joined your team 2 weeks ago and is taking 3x longer to resolve tickets than the rest of the team. Your manager asks you to identify what knowledge gaps exist and create targeted documentation to close them. How do you approach this?

A client submits a Sev-3 ticket on Friday at 4:45 PM. Your SLA for Sev-3 is first response within 24 business hours. Your team has a weekend coverage policy that does not include Sev-3. The client follows up Saturday morning saying it is now urgent. How do you handle this?

A client's security team raises a concern that your platform stores API tokens in JWT format and asks whether an attacker who intercepts a token can decode it to extract sensitive claims. How do you explain JWT security properties accurately without oversimplifying?

A Ruby on Rails e-commerce application has a memory leak that causes pods to restart every 6 hours. The leak was introduced 3 weeks ago but no major gems were updated. You have access to the running pod, a Ruby memory profiler gem, and Kubernetes resource metrics. Describe your approach.

A client in the media industry reports that video upload occasionally returns a successful 200 response but the video never appears in their content library. This has happened 15 times in 2 months across different users. How do you build a reliable reproduction and root-cause this?

You have a directory of 200 customer-exported CSV files with inconsistent date formats (MM/DD/YYYY, DD-MM-YYYY, YYYY-MM-DD all mixed). You need to normalize all dates to ISO 8601 and produce a single merged output file. Describe the Python script you would write.

Your product team wants to sunset a legacy API endpoint that your support team knows is still used by at least 8 enterprise clients. The product team has set a deprecation date 60 days out. You need to advocate for clients without blocking the product team's roadmap. How do you navigate this?

A client running your platform on AWS reports that their nightly data sync job worked fine for months but started failing last Tuesday. No application code changed. The error is a generic timeout. What systematic steps do you take to isolate the root cause?

You are writing a public status page post-mortem for a 47-minute database outage that affected all paid customers. The CEO wants to say 'a rare infrastructure anomaly' caused it. You know it was caused by a missing index that was overlooked during a schema migration review. How do you write an honest post-mortem?

A client's developer says your GraphQL API is returning the correct data but their frontend is showing stale data from 20 minutes ago. They are using Apollo Client. What do you investigate on their side and yours?

An application is throwing 'OOMKilled' errors in Kubernetes, but the developers say the application itself uses only 200MB of memory. The pod's memory limit is set to 512MB. How do you analyze this discrepancy?

A client reports that a report showing year-over-year revenue comparison is displaying incorrect figures. Revenue for Q3 2023 appears in the Q3 2024 column. The query joins on fiscal quarter. Diagnose what is likely wrong with the query and propose a fix.

A client hosting a multi-tenant SaaS application on AWS reports that one tenant's heavy API usage is causing latency increases for other tenants on the same EC2 instance. They have not implemented traffic isolation. What networking and infrastructure measures do you recommend?

You receive a Sev-2 ticket at 3 PM Friday about a non-critical report export being slow. At 5 PM the client escalates by calling the support line claiming it is now business critical because an executive presentation is Monday morning. How do you handle this re-escalation?

Your company has no formal process for capturing lessons from resolved Sev-1 incidents. Your director asks you to design a post-mortem culture from scratch, not just a template but a process that becomes self-sustaining. Describe the design.

Your support team's CSAT score dropped from 4.6 to 3.8 over the past quarter despite maintaining SLA compliance metrics. Your director asks you to diagnose the disconnect and present a remediation plan. How do you approach this?

A client asks what the difference is between your platform's 'at-least-once' and 'exactly-once' message delivery guarantees, and when each is appropriate. Give a technically accurate explanation they can share with their engineering team.

A client's .NET Core API is intermittently returning incorrect calculation results for a financial interest computation. The incorrect results account for 0.3% of requests. You have access to the application logs but no attached debugger. Describe how you isolate the bug.

A client reports that their user authentication fails when the username contains special characters like accented vowels (é, ü, ñ). Standard ASCII usernames work fine. You cannot reproduce it in your local environment. What steps do you take to get a reliable reproduction?

You need to write a script that queries your monitoring system's API every 5 minutes, detects when error rates on any endpoint exceed 1% of traffic, and sends a PagerDuty alert with the affected endpoint, current error rate, and a comparison to the 24-hour baseline. Describe the design.

A client is experiencing a bug that requires both your support team and the client's internal IT team to make changes simultaneously. The client's IT team is in a different timezone and has a 48-hour change approval process. How do you coordinate the fix across all parties?

A SaaS analytics platform client reports that their data pipeline shows a 15-minute delay on all real-time dashboards starting from this morning. The pipeline uses Kafka → Flink → ClickHouse. No deployments occurred. How do you systematically diagnose where the delay was introduced?

A Golang service handling 50,000 goroutines is experiencing unpredictable latency spikes every few minutes. A goroutine leak is suspected. You have access to pprof and runtime debug endpoints. Walk through your diagnosis.

You notice that the same class of database performance issues keeps recurring across multiple client tickets, but each ticket is being solved independently without sharing the solution. Engineering says it is not their problem because clients are not following best practices. How do you bridge this gap?

Your team receives a batch of 500 support tickets daily via email. Many are duplicates from the same issue. Write or describe a Python script that clusters similar tickets using basic NLP and outputs a report showing the top 10 duplicate clusters with representative examples.

A payment gateway integration at a fintech client silently drops 3-5% of transactions during peak hours. No errors appear in the application logs. The gateway vendor claims their API is healthy. Walk through your systematic investigation approach to isolate the fault.

A mid-market SaaS customer's CEO emails your VP at 2 AM saying their reporting dashboard has been blank for six hours and they have a board presentation in four hours. You are the on-call engineer. How do you manage the communication and set expectations while actively troubleshooting?

An enterprise customer reports that their webhook receiver is getting duplicate event deliveries from your platform — sometimes the same order-created event arrives 3-4 times within 10 seconds. They have built no deduplication logic. How do you diagnose the root cause and advise on both sides?

You receive a Splunk alert at 3 AM showing a 40x spike in NullPointerException stack traces on a Java microservice. The service is still responding but P95 latency has climbed from 120ms to 1,400ms. Describe exactly how you triage from the alert to root cause.

A customer reports that the 'total revenue' figure shown in your SaaS analytics module is $240,000 lower than what their own finance team calculated from the same date range. Both use the same date filter. How do you investigate and reconcile the discrepancy?

A customer's on-premise integration agent cannot reach your cloud API endpoint on port 443. Their IT team says all firewall rules are open. The curl command from the agent server returns 'Connection timed out' after 30 seconds. Walk through your diagnostic steps.

A Tier-2 engineer escalates a ticket to you at 11 PM claiming a Fortune 500 customer's production import pipeline has been failing for two hours. The Tier-2 engineer has attached logs but no reproduction steps and the customer account manager is already messaging you. How do you handle this escalation?

Your team handles the same 'OAuth 2.0 PKCE flow fails with invalid_grant on token exchange' error about eight times per month. Each engineer resolves it differently with no shared runbook. How do you build a knowledge base article that actually prevents recurrence?

Your team's SLA dashboard shows 34% of P2 tickets breach the 4-hour first-response SLA on Friday afternoons. It is Monday morning and your manager has asked you to diagnose and fix this before next Friday. What is your plan?

A customer is confused about why their API usage shows 1,200 calls in your billing dashboard but they believe they made only 400 calls in their application. They suspect a billing error. How do you investigate and explain the discrepancy?

A Node.js microservice running on Kubernetes begins exhibiting a memory leak — heap usage climbs from 150 MB to 1.8 GB over 48 hours before the OOMKilled event. Describe the tooling and procedure you would use to identify the leaking code path.

A customer insists that your mobile SDK crashes on their Samsung Galaxy S22 running Android 13 when the user uploads an image larger than 8 MB. Your QA team cannot reproduce it on three different S22 units with the same OS. How do you close the reproduction gap?

You need to generate a daily report that pulls all tickets closed in the last 24 hours from your REST-based ticketing API, calculates average resolution time per category, and emails the result to your team lead. Write a concise Python approach and describe the key decisions.

Engineering has deployed a hotfix at 4 PM that they say resolves a data-sync bug, but you have three open customer tickets reporting the same sync failure that were opened after the hotfix deployed. Engineering says it is working in their test environment. How do you mediate this conflict and drive to resolution?

A customer in Australia reports that your SaaS platform is 'very slow' every weekday morning between 9 AM and 10 AM AEST. No other regions report issues. You have no APM alerts firing. How do you start your investigation?

Your company made a change to the API rate-limiting policy that was announced in a developer newsletter three weeks ago. A customer's production integration broke because they missed the announcement and hit the new stricter limits. They are furious. How do you handle the conversation?

A customer integrating your REST API reports that GET /orders?status=pending returns a 200 with an empty array even though they can see 47 pending orders in your web UI. The same API token works for other endpoints. Describe your diagnostic process.

Your monitoring system alerts on a sudden burst of 504 Gateway Timeout errors from an nginx reverse proxy. The backend service logs show no corresponding errors. How do you determine whether the problem is in nginx, the backend, or the network between them?

A data-heavy SaaS customer reports that a query powering their weekly KPI report now takes 4 minutes to run, whereas it completed in 12 seconds three months ago. The schema has not changed. How do you diagnose and resolve the performance regression?

A customer reports intermittent TLS handshake failures when connecting to your API from their corporate network, but the same requests succeed from a developer's laptop on home WiFi. The errors appear as 'SSL_ERROR_RX_RECORD_TOO_LONG' in their application logs. What does this error mean and how do you resolve it?

You have spent 90 minutes on a customer's data export failure and are 60% sure the root cause is a bug in your platform's CSV generation library, but you cannot reproduce it reliably. Your shift ends in 30 minutes. How do you handle the handoff and escalation?

After a major platform outage, you are asked to write the public post-mortem that will be shared with all affected customers. The root cause involves a database migration that caused a 47-minute full outage. Draft the key elements and principles you would follow.

A customer submits a ticket classified as P3 (8-hour response SLA) but writes in the body that their production system is down for 500 users. Your triage policy assigns priority based on the form-selected severity, not ticket body text. How do you handle this?

A customer asks why your platform's 'real-time sync' feature introduces a consistent 8-12 second delay despite the product page claiming 'near real-time.' They are evaluating whether to renew their contract. How do you respond?

A customer's Python application calling your SDK intermittently raises a ConnectionResetError with no useful traceback. The errors occur roughly once every 500 requests. How do you use Python's built-in and system-level debugging tools to identify the cause?

A customer reports that their scheduled report fails with 'Internal Server Error' every Sunday at 2 AM but passes if they run it manually at any other time. Your logs show no entry for the Sunday 2 AM run. How do you approach reproducing and diagnosing this?

You need to write a Bash script that monitors a log file in real time, counts occurrences of 'ERROR' per 5-minute window, and sends a Slack webhook alert if the count exceeds 20 in any window. Describe your approach, edge cases, and failure modes.

A customer reports a feature that your product team says is 'working as designed' but the customer expected different behavior based on a demo they received six months ago. The sales engineer who ran the demo has since left the company. How do you resolve this?

Two unrelated customers in the same AWS region report intermittent 500 errors from your platform starting at 14:23 UTC today. Your infrastructure team says all services are green. You have 15 minutes before a customer call. What do you do?

A customer leaves a harsh public review on G2 saying your support team took 5 days to resolve a critical issue that 'anyone competent' would have solved in an hour. The issue was genuinely complex and required engineering involvement. How do you respond publicly?