Operations and Management
Run the estate with evidence, not hope
Operations questions are about repeatable process and honest metrics.
Monitoring. Know the difference between polling (SNMP), event streaming (syslog), and flow data (NetFlow/IPFIX). Baselines matter more than absolute thresholds: an alert is meaningful only against a known normal. Watch for alert fatigue and for monitoring only availability while ignoring utilization trend - capacity problems are predicted by slope, not by a red light. Monitor the management plane too, or you will discover an outage only when users report it.
Backup and recovery. Full, incremental, and differential are distinguished by what must be restored: a full plus every incremental since the last full, versus a full plus the latest differential. Understand the 3-2-1 rule (three copies, two media, one offsite). Learn RTO (tolerable downtime) and RPO (tolerable data loss) and their direction of causality: RPO sets backup frequency, RTO sets the recovery strategy. An untested backup is a hypothesis.
Change and configuration management. Every change has a request, an approval path (CAB where used), a test, a window, and a rollback plan. Maintain a CMDB or at minimum an accurate asset and IP inventory; you cannot patch, monitor, or decommission what you have not recorded. Track MTBF (reliability between failures) and MTTR (recovery speed) separately, and manage SLAs against them.
Worked example
A business states it can lose at most 15 minutes of transactions and must be back within 4 hours. RPO = 15 minutes drives snapshot or log-shipping frequency; RTO = 4 hours drives whether you need hot standby or a restore-from-backup runbook.
Rule of thumb
If it is not documented and tested on a schedule, it is not a process - it is an intention.