I85PREP
⌘ K
Module 15 study materials
Module 15 study resources

Module 15: Troubleshooting and Governance

Module 15 · Work through your exam, one topic at a time.

All guide sections

Troubleshooting and Governance

This domain tests structured diagnosis under pressure and the controls that keep decisions defensible. Expect incident triage, change correlation, postmortem quality, and governance evidence.

Core rules

  • Troubleshoot by hypotheses and evidence. Define the symptom, scope, and timeline. Check recent changes first. Bisect layers: client, network, application, data, dependency.
  • Mitigate before root cause. Roll back, fail over, or disable a feature flag to stabilize users first.
  • Use logs, metrics, and traces together. A metric spike without a trace is a clue, not a conclusion.
  • Root cause is rarely singular. Separate the trigger, contributing factors, and systemic gaps.
  • A blameless postmortem includes timeline, impact, detection, response, contributing factors, and actions with owner and date.
  • Governance includes policies, standards, a RACI model, segregation of duties, an exception process with expiry, and an audit trail.
  • Evidence must be reproducible: ticket, approval, test result, change record, and monitoring snapshot.
  • Maintain a risk register with likelihood, impact, owner, mitigation, and review date.

Worked example

Users report 500 errors after a deploy. Triage confirms the scope is one region, the change log shows a deploy 10 minutes ago, and traces point to a new code path. Roll back and the service recovers. The postmortem identifies the trigger as the deploy, a contributing factor as a missing canary gate, and a systemic gap as a default configuration value. Actions: add canary analysis, add a policy check, assign owners and dates. Reasoning: mitigation came first; the governance fix prevents recurrence.

Traps

  • Chasing root cause while the outage continues and users are still affected.
  • Recording 'human error' as the final cause and stopping there.
  • Writing a postmortem with actions that have no owner or due date.
  • Granting governance exceptions with no expiry or review.
  • Reconstructing audit evidence after the fact instead of capturing it at decision time.

Key points

  • Stabilize and mitigate before deep root-cause analysis.
  • Check recent changes first and correlate logs, metrics, and traces.
  • Separate trigger, contributing factors, and systemic gaps.
  • Postmortem actions need owners and dates.
  • Governance exceptions must expire and be reviewed.