Operations, Maintenance, and Troubleshooting
This domain tests service management vocabulary, monitoring, root cause analysis, and maintenance planning. Questions often present an outage and ask for the immediate action versus the long-term fix.
Core rules
- Incident management restores service quickly; problem management finds and removes root causes; change management controls modifications. Do not close an incident without considering whether a problem record is needed.
- SLAs are agreements, SLOs are objectives, and SLIs are measured indicators. Alert on user-visible symptoms and on leading indicators such as saturation and error rate.
- Use metrics, logs, and traces together. Metrics show trends, logs give event detail, and traces reveal latency across service boundaries.
- Maintenance types are corrective, preventive, adaptive, and perfective. Plan maintenance windows and rollback.
- Root cause analysis tools include 5 Whys, Ishikawa diagrams, and fault trees. Focus on system conditions, not individual blame.
- Track MTTR and MTBF, and test backup restoration, not just backup creation.
Worked example
Checkout returns intermittent 500 errors at peak. Metrics show database connection pool exhaustion; logs show slow queries; traces show lock contention on an orders table. The immediate incident action is to restore service: increase pool capacity or roll back the recent schema change if safe. The problem action is to add the missing index and a query-latency alert, then update the runbook. Reasoning: mitigation and root-cause removal are separate practices with different success criteria.
Traps
- Stopping at symptom relief and never opening a problem record.
- Skipping the post-incident review that would prevent recurrence.
- Assuming backups are valid without restore testing.
- Making production changes without rollback plans.
- Blaming individuals instead of fixing system conditions.