AllSafe IT Software Engineer Interview Guide

The 60-second brief

Candidates describe AllSafe IT as a managed service provider (MSP): it looks after other organisations' IT environments, so the work is client-facing and revolves around keeping those environments running. The Software Engineer title is often scoped as MSP Help Desk Engineering, and candidates also see it called Tier II Help Desk Engineer. In practice that means being the person a client issue escalates to once it needs more than surface-level investigation, working across different client technology stacks, and feeding what you learn back into internal documentation and standard procedures.

This guide is for candidates interviewing for the AllSafe IT Software Engineer position at roughly Tier II level, including those aiming at the Senior Help Desk Engineer variant. It covers the four questions candidates report (an incident story, technical environments and their security, documenting a resolved issue, and an unconventional fix), the evaluation areas candidates describe, the listed stack (Windows and Linux troubleshooting, networking protocols, ticketing systems, PowerShell and Bash scripting), and how to rehearse all of it in a week.

Candidates report a phone screen followed by a final in-person interview, usually wrapped up within a few weeks. No other stage names are reported, and the questions that circulate are experience-based troubleshooting and background questions rather than coding exercises.

Focus areas

• Help desk (Tier II)
• Help desk (Senior Help Desk Engineer)
• Managed Service Provider (MSP) operations

Overview

The title says Software Engineer, but the work candidates describe is escalation-level IT support for client environments. The topics reported for this loop are Tier II help desk work, the Senior Help Desk Engineer variant, MSP operations, IT support troubleshooting and explaining solutions clearly. Preparing algorithm drills would miss the target; preparing a bank of real incidents from your own history, with the commands, logs and reasoning behind each, matches what is reported.

The listed requirements give you the checklist for that bank: advanced troubleshooting of Windows and Linux, a solid grasp of networking protocols, and experience with ticketing systems. PowerShell or Bash automation and prior MSP experience are listed as pluses. For each item you plan to claim, be able to say which tools you used, what the logs showed and why you chose that method over the alternatives. Candidates are also warned that overstating a technology invites follow-ups that find the edge of your knowledge, so rank your skills honestly and lead with the strongest.

Two themes recur in what candidates describe. The first is documentation: updating internal notes and standard procedures after a fix is part of the job, and one reported question asks directly how you document a resolved issue. The second is communication: keeping a client informed while you troubleshoot, and explaining a cause or fix to a non-technical audience. Rehearse both out loud, using STAR (Situation, Task, Action, Result) for stories and a short written example of a resolution note for the documentation answer.

Where to focus your preparation

Candidates report a phone screen and a final in-person interview, with deeper technical scenarios at the in-person stage. Because no further stage names are reported, the single step below covers overall preparation; confirm the exact format with your recruiter.

Preparation focus

Candidates report a phone screen followed by a final in-person interview, and the reported evaluation areas are technical environment expertise (infrastructure management, troubleshooting workflows, security practices) and real-world problem resolution (root cause analysis rather than quick patches). Treat this as one preparation block: before the phone screen, be able to walk through your resume's tools and systems; before the in-person stage, have two or three incidents rehearsed in enough depth to survive follow-up questions about how each technology interacts with the rest of the stack. The reported questions are all about your own past work, so the preparation is selecting, structuring and rehearsing real stories rather than learning new material.

What to demonstrate

• Depth in the tools and infrastructure on your resume, including the constraints you worked within
• Root cause analysis that goes beyond a workaround and prevents the issue returning
• Security practices in the environments you have supported
• Clarity when explaining technical steps and fixes to different audiences

How to prepare

• Write one incident story for the critical system failure question, naming the logs, commands and checks that led you to the cause
• List every technology on your resume and mark how deep your knowledge goes, so you do not overstate any of them
• Write a sample resolution note (symptom, cause, fix, verification) to anchor your answer on documenting a resolved issue
• Ask the recruiter whether the in-person stage includes hands-on troubleshooting, and which systems it assumes

Where candidates lose points

Telling an incident story that ends when service came back, with no root cause or prevention

Structure each story as symptom, scope, containment, proven cause, permanent fix and prevention. Be ready to say what evidence showed the cause was real, since the reported focus is on fixes that last.

Claiming a technology (Linux, a firewall, an MSP tool, PowerShell) and then running out of depth on the first follow-up

Rank your skills before the loop and lead with the strongest. For each one, be ready to explain how it interacts with the layers around it, such as DNS, authentication, the network path or the ticketing system, and say plainly where your experience stops.

Listing tools and steps without the reason behind them

For every configuration choice or troubleshooting step in a story, add one sentence on why you chose it over the alternative, for example why you checked logs before restarting a service or why you isolated the network path first.

Answering the documentation question with 'I always write it up' and no detail

Describe the artifact: a ticket resolution note with symptom, cause, fix and verification, plus an update to a knowledge-base article or procedure when the issue could recur. Bring a short sample you can describe.

Explaining a fix in jargon, or skipping the client's perspective entirely

Prepare each story in two versions, one technical and one for a non-technical client, and include what you told the client and when. Technical communication is one of the reported topics.

Questions & practice

Identify the heaviest tenants in a five-minute window under memory pressure

Medium · top-k · heavy hitters · streaming

The edge service handles about 3,000 requests per second across roughly 50,000 tenants, peaking near 9,000. Expose the 50 heaviest tenants by request count over the trailing five minutes so limits can be tightened before one tenant's backfill starves the fleet. You may not retain five minutes of raw records. Give the exact solution and its memory, then the bounded-memory approximation with its error stated as a formula, and say which you would ship and at what tenant cardinality that choice changes.

Approach

1. Do the exact version first, because it is affordable at this cardinality: a ring of 300 one-second counters per tenant, advanced lazily, is 1,200 bytes of counters per tenant and roughly 60 to 90 MB for 50,000 tenants with overhead. Carry a running total and subtract the bucket you overwrite so a window read is O(1) rather than 300 adds.
2. Extract the top 50 with a size-k min-heap over the tenant sums: O(d log k) for d tenants, against O(d log d) to sort them all. Maintaining the heap continuously instead of on query requires a tenant-to-heap-index map, because incrementing a count already inside the heap means sifting from a known position, and without that map you rebuild the heap on every request.
3. State the approximation precisely rather than gesturing at sketches. Misra-Gries with m counters retains every item whose true count exceeds N/(m+1), and each retained count underestimates the truth by at most N/(m+1). With m = 1,000 and N = 900,000 requests in the window the error is roughly 900 requests, which is fine for spotting a tenant sending 50,000 and useless for ranking two tenants 200 apart.
4. Say what breaks when the window slides: Misra-Gries and Space-Saving are insert-only and cannot be decremented as records age out. The workable construction is one summary per sub-window, say ten seconds, with 30 summaries merged at query time, and the merged error is the sum of the per-summary errors, so the bound degrades linearly in the number of sub-windows.

Follow-up

• The heaviest tenant is heavy because of one export job rather than user traffic. Should the limiter treat those as the same tenant?
• Two tenants sit tied at the boundary of the top 50. Does your answer flap, and does the flapping matter?

Find overlapping job attempts and peak concurrency from lease records

Medium · sweep line · intervals · leases

A day of job_run history yields about 50,000,000 attempt records: (job_run_id, job_type, attempt, started_at, finished_at which is NULL when the worker died, lease_expires_at). Leases expire on a clock, so a job that outran its lease ran twice. Produce (a) every job_run_id whose attempts overlapped in wall-clock time and (b) the peak number of simultaneously running attempts per job_type with the minute it occurred. Target O(n log n). State how you treat a NULL finished_at and what clock skew does to your answer.

Approach

1. Define the interval before sorting anything: an attempt occupies [started_at, COALESCE(finished_at, lease_expires_at)). finished_at is observed and lease_expires_at is only a promise, so every attempt without a finish contributes an estimate and the whole result is a lower bound on overlap rather than an exact count.
2. For peak concurrency, sweep: emit 2n endpoints, sort by (timestamp, kind) with ends ordered before starts at equal timestamps, then walk the sequence maintaining a counter per job_type and record each type's maximum with its timestamp. O(n log n) dominated by the sort, O(n) space, or O(1) extra if the sort is external and the walk streams.
3. For overlap detection, do not compare attempts pairwise. A single global sort by (job_run_id, started_at) gives both the grouping and the order; within a group, keep the maximum end seen so far and report an overlap exactly when the next start is less than that running maximum, which is one linear pass after the sort.
4. Half-open intervals matter and are easy to get wrong: with closed intervals an attempt ending at the same millisecond another begins reads as concurrency two, and across 50,000,000 records that artefact swamps the real signal.

Follow-up

• A handler is not idempotent and you have found 400 overlapping jobs. Which of them actually caused damage, and what would you query to find out?
• Peak concurrency for one job_type is 4 against a configured cap of 4. Is the cap working, or is the data hiding attempts that never started?

Track a rolling failure rate per destination for circuit decisions

Easy · sliding window · ring buffer · circuit breaker

The egress service delivers about 1,500 webhooks per second across roughly 40,000 destinations, each call bounded by a 10 second timeout. Maintain, per destination, the failure rate over the trailing 60 seconds so a caller can ask before dispatch whether the circuit should open. Attempts arrive as (destination_id, finished_at_ms, outcome). Requirement: amortised O(1) per attempt, with total memory bounded by the destination count rather than by traffic. Give the structure, its exact memory, and the rule that stops a destination with three attempts from opening a circuit.

Approach

1. Name the exact-deque version and then reject it as the default. Holding timestamps and advancing a tail pointer past anything older than now minus 60 seconds is a correct two-pointer window at amortised O(1) per attempt, but its memory tracks in-window traffic, so one destination in a retry storm holds hundreds of thousands of entries while thousands of quiet destinations hold none.
2. Use a ring of 60 one-second buckets per destination, each bucket a pair of counters for attempts and failures. On an attempt, advance the ring by the elapsed whole seconds, zeroing at most min(elapsed, 60) buckets, then increment the head. That is amortised O(1) with a fixed footprint per destination.
3. State the footprint: 60 buckets times two 4-byte counters is 480 bytes of payload per destination, so 40,000 destinations is roughly 20 to 25 MB with per-entry overhead, bounded by the catalogue rather than by the rate. The cost is granularity, since the oldest bucket ages out in whole seconds, which is far tighter than the decision needs.
4. Require a minimum sample before the circuit may open. A destination with three attempts and three failures reads as 100 percent and is not evidence; a floor of roughly 20 attempts in the window makes the ratio meaningful, and below that floor use a run of consecutive failures as the trigger instead.

Follow-up

• The fleet is 30 instances and each sees roughly a thirtieth of a destination's traffic. Where does the rate actually live, and what does a per-instance answer get wrong?
• A destination answers in 9.5 seconds and succeeds. It is not failing but it is consuming your per-destination concurrency. What signal should open the circuit here?

Keep soft-deleted accounts from blocking re-registration

Easy · soft delete · unique constraints · engine differences

app_user holds user_id, tenant_id, email CITEXT, password_hash (NULL for SSO principals), email_verified_at, auth_version, status ('invited','active','suspended','deactivated'), created_at, updated_at, deleted_at. Two live accounts for one address inside a tenant must be impossible, but an address freed by a soft delete must be reusable, and the same tenant may delete and re-register it repeatedly. Write the uniqueness DDL for PostgreSQL 16, then the equivalent for MySQL 8 where partial indexes do not exist, and say what each permits once three deleted rows already hold that address.

Approach

1. Start from what is actually unique: not (tenant_id, email), but (tenant_id, email) among live rows. PostgreSQL says that directly — CREATE UNIQUE INDEX app_user_live_email ON app_user (tenant_id, email) WHERE deleted_at IS NULL. A full constraint over the same two columns burns the address permanently the first time someone deletes an account.
2. Keep case-insensitivity in the type or the index, never in the application: CITEXT as given, or UNIQUE (tenant_id, lower(email)) as an expression index where the extension is unavailable. A case-sensitive unique column is exactly how two accounts for one human appear.
3. For MySQL 8 the predicate has to move inside the key: add a discriminator column that is a constant 0 while the row is live and is set to user_id on delete, with UNIQUE (tenant_id, email, deleted_marker). Live rows share the constant and still collide; deleted rows differ from each other and stop colliding.
4. State the NULL variant and its dependency: leaving the marker NULL for deleted rows also works, because a unique index treats NULLs as distinct — true in MySQL, and true in PostgreSQL only under the default NULLS DISTINCT, which PostgreSQL 15 lets you reverse. Check the polarity against the three existing deleted rows: constant-on-live is what preserves the collision you want, and reversing it silently admits duplicate live accounts.

Follow-up

• A deleted account re-registers with the same address the next day. Do the old resource rows follow the new user_id, and how does the API keep the two principals apart?
• How do you honour an erasure request while resource_revision.actor_user_id still references this table?

Stop tag and share joins from fanning out a page

Medium · join fan-out · semi-joins · many-to-many

resource_tag is (resource_id, tag_id) with PK (resource_id, tag_id); resource_share is (resource_id, shared_with_user_id, permission). The tagged-and-shared listing inner-joins resource to both, filters tenant_id, tag_id = ANY($2) and shared_with_user_id = $3, orders by updated_at DESC and takes 50. Pages come back with fewer than 50 distinct resources and the total in the header is far too high. Explain the row multiplication, rewrite both the page query and the count query so each is correct, and name the index each one needs. PostgreSQL 16.

Approach

1. Do the arithmetic against the predicates that are actually there. An inner join emits one row per matching child row, and both joins are filtered: tag_id = ANY($2) admits only the requested tags, shared_with_user_id = $3 admits one user's share rows. So a resource holding three of the requested tags and shared with $3 once yields three rows, not one — the multiplier is its count of matching tags times its share rows for that single user, and that second factor is 1 unless the table admits duplicate (resource_id, shared_with_user_id) pairs. LIMIT 50 then limits rows rather than resources, and COUNT(*) counts pairs — the header is the product, not the population.
2. Reject DISTINCT as the fix. It deduplicates after the product has been built, so the planner must materialise and sort the fanned-out set before the LIMIT can apply, and it leaves any SUM or AVG in the same select list wrong.
3. Rewrite both filters as semi-joins, keeping resource as the only row source: AND EXISTS (SELECT 1 FROM resource_tag rt WHERE rt.resource_id = r.resource_id AND rt.tag_id = ANY($2)) and the same shape against resource_share. A semi-join stops at the first match per resource and preserves the driving index order, so ORDER BY updated_at DESC, resource_id DESC LIMIT 50 still stops after 50 rows.
4. Count with the same predicates and no join at all: SELECT count(*) FROM resource r WHERE r.tenant_id = $1 AND r.status = 'active' AND EXISTS (...) AND EXISTS (...). Nothing multiplies a resource, so the number is the population.

Follow-up

• The filter changes from 'any of these tags' to 'all of these tags'. Rewrite it and state what it costs relative to the ANY form.
• A resource can be shared with the same user twice under different permissions. Does your count change, and should it?

Choose what to break when replication lag reaches forty seconds

Hard · replication lag · read-after-write · consistency vs availability

Reads are served from two replicas: 14k requests/second, about 85% absorbed by cache, so roughly 2.1k reads/second reach the database. Writes go to the primary at 1.2k/second. A tenant's backfill drives replication lag from under 100 ms to 40 seconds and it is still climbing. Sessions that have just written are pinned to the primary. Decide, endpoint class by endpoint class, whether to serve stale, fail, or route to the primary, and justify each choice with the load it adds to the primary. Then state what you would have built beforehand.

Approach

1. Establish blast radius before cause, because mitigation and diagnosis have different deadlines. The decisive arithmetic is what happens if the database reads move to the primary: 2.1k reads/second on top of 1.2k writes/second roughly triples its operation count, on the node already absorbing the backfill that caused this. Reads and writes are not equal in cost, so treat that as an argument against a blanket move rather than as a capacity model - but it is enough to rule out routing everything to the primary.
2. Classify endpoints by what staleness costs, not by how important they feel. Reads whose staleness is invisible - listings, search, counters - stay on the replica and return the watermark so the client can tell. Reads that immediately follow that same session's write keep their primary pin, which is a small bounded slice of traffic rather than the whole 2.1k/second. Reads that feed a decision with a side effect - authorisation, quota, the read half of a read-modify-write - must not be stale at all, because a 40-second-old permission row is the stale-permission failure wearing a different costume; those go to the primary or fail.
3. Shed instead of queueing. If the must-be-fresh class alone exceeds the primary's headroom, refuse its lowest-value slice with 503 and a retry-after. A request queued behind a saturated primary holds a connection for a client that has already given up, and the retry storm that follows is what turns degradation into an outage. Bound the connection pool per role so the read fallback cannot consume the write path's connections - that bulkhead is the single decision that determines whether writes survive the next ten minutes.
4. Attack the cause in parallel, since it is the one thing that can be stopped. The backfill is the load generator. A backfill that reads replication lag as its throttle signal and pauses above a threshold would have made this a non-event, with batch sizes small enough that each batch's write volume is a fraction of what a replica can apply per second. That is most of the answer to what should have existed beforehand.

Follow-up

• Lag returns to normal in nine minutes. Which mitigation do you remove first, and which one stays permanently?
• A user reports their change did not save, and the write committed. Trace the path that produces that report and name the signal that would have shown it before the report arrived.

Make resource creation safe for a client that retried a timeout

Medium · idempotency · retries · race conditions

POST /v1/resources creates a resource row and, in the same transaction, a resource_revision and an outbox_event. A partner's HTTP client times out at 2 seconds and retries twice; under load the first request is still executing when the retry arrives, and duplicate resources are appearing. Using idempotency_key (tenant_id, idempotency_key, request_fingerprint, state, response_status, response_body, resource_id, locked_until, expires_at), specify the whole contract: first call, concurrent retry, retry after completion, a key reused with a different body, and what the client does with each response.

Approach

1. Name why the plain REST shape fails here. POST is not idempotent, a timeout leaves the client unable to distinguish a lost request from a lost response, so it must retry - and the retry is a second create. Checking whether the key exists and then inserting it is check-then-act: under exactly the concurrency that caused the timeout, both attempts look, both see nothing, both proceed.
2. Let the unique constraint arbitrate instead. INSERT the key row with state 'in_flight' and locked_until set to now plus the request deadline, and commit that reservation on its own before any work is attempted - an uncommitted row is invisible to the concurrent retry, which is the entire point of writing it first. One caller wins the insert and proceeds; the other takes the unique violation and reads the row rather than falling through to the work.
3. Branch the loser on what it found. 'succeeded' replays response_status and response_body verbatim, with a header marking it a replay. 'in_flight' with locked_until in the future returns 409 and a Retry-After - do not park a request thread waiting on another request, that is how a concurrency bound is consumed by retries. 'in_flight' past locked_until is reclaimable by a conditional UPDATE predicated on the old locked_until, so exactly one reclaimer wins. A fingerprint mismatch is 422 and never the stored response: a different body under the same key is a client defect, and serving the old response hides it forever.
4. Commit the effect and the key's completion together - resource insert, revision row, outbox row, and the UPDATE of the reserved key to 'succeeded' with the stored response, in one transaction. That makes a crash binary: either all of it is durable and the key reads 'succeeded', or the transaction rolls back and the only durable trace is the reservation row, still 'in_flight', with no resource behind it. The reclaim branch finishes that case - once locked_until passes, one retry takes the row by conditional UPDATE and runs the work for the first time. Splitting the two commits is what creates the window with no recovery: the effect durable, the key still 'in_flight', and a reclaimer that cannot distinguish that from work never started, so it creates a second resource.

Follow-up

• Response bodies are pruned at 24 hours but resource_id is kept. What do you return to a replay that arrives after pruning?
• The endpoint now also sends a welcome email. Which part of this contract prevents a second send, and which part cannot?

What are the most common technical environments you have worked with, and how do you manage their unique secur

Medium · Technical Proficiency and Troubleshootin

What are the most common technical environments you have worked with, and how do you manage their unique security requirements?

Approach

1. Organise the answer by environment, not as a list of tools: for example a Windows domain (Active Directory, Group Policy), Linux servers, and the network edge (firewall, VPN, VLANs). For each one, say what you administered, for how many users or hosts, and which parts you owned yourself.
2. Give the concrete controls for each environment. Windows: separate admin accounts, MFA, patching through WSUS or Intune, BitLocker. Linux: key-only SSH (PasswordAuthentication no, PermitRootLogin no), unattended-upgrades or dnf-automatic, and a host firewall such as nftables or ufw. Network: segmentation and no RDP or SSH open to the internet.
3. Add the multi-client angle that MSP work brings: separate credentials for each client kept in a password vault, RMM or remote access limited to the clients a technician serves, and no local admin password shared across machines (Windows LAPS rotates a unique one on each device).
4. Explain how you check that a control actually works: gpresult /r for applied policy, sshd -T for the SSH config in effect, Security log events 4625 (failed logon) and 4740 (account lockout), vulnerability scans, and an offboarding checklist that removes every access path.
5. If a client fell under a framework such as HIPAA or PCI DSS, name what changed in practice (encryption at rest, log retention, access reviews). Only mention frameworks you actually worked under, because each one you name invites a follow-up question.

Follow-up

• A vendor needs RDP access to a client server. How do you give it without exposing port 3389 to the internet?
• An employee leaves a client company today. Walk through every account and access path you would revoke, and in what order.
• How do you roll out a security patch across several clients without breaking a line-of-business application?

How do you approach the documentation of a technical issue once it has been resolved?

Medium · Technical Proficiency and Troubleshootin

Approach

1. Write the resolution note so another engineer could repeat it without asking you: the symptom as reported (exact error text, affected users and devices), the environment (OS build, application version), the root cause, the exact change made (commands, settings, GPO or registry paths) and how you verified the fix.
2. Record the workaround and the root cause separately. If the ticket closed on a workaround, say so in the note and open a follow-up problem record for the permanent fix, so the cause does not get lost once the ticket is closed.
3. Turn recurring issues into a knowledge-base article or runbook: give it a searchable title that includes the error message, list the steps and the rollback, and link the tickets it came from. Update the client's configuration documentation (changed IPs, GPOs, rotated credentials) at the same time.
4. Never paste passwords or keys into a ticket or article. Point to the vault entry instead. Write a short plain-language summary for the client contact that is separate from the technical note, and confirm with the user that the issue is gone before closing.
5. Keep documentation trustworthy: put an owner and a last-verified date on each article, fix or retire any article you find to be wrong while working a ticket, and avoid duplicates that disagree with each other.

Follow-up

• The fix involved a temporary change, such as disabling a firewall rule. How do you document it so it gets reverted?
• You find a client's existing documentation is wrong in the middle of an incident. What do you do then, and what do you do afterwards?
• How do you decide whether an issue deserves a knowledge-base article rather than just a ticket note?

Can you walk us through a specific technical problem you solved that required an unconventional approach?

Medium · Technical Proficiency and Troubleshootin

Approach

1. Choose a story where the standard steps (restart, reinstall, the vendor's knowledge-base fix) were tried and failed, and say exactly what each one ruled out. That is what makes the next step unconventional rather than random.
2. Name the technique concretely. Examples: a packet capture with Wireshark or tcpdump that showed VPN traffic being dropped for an MTU or fragmentation reason (confirmed with ping -f -l 1472 on Windows or ping -M do -s 1472 on Linux); Process Monitor showing an ACCESS DENIED on a registry key; a PowerShell script that correlated event logs across many machines; or isolating a Group Policy by moving a test machine into an OU with inheritance blocked.
3. Explain why the evidence pointed there and how you limited the risk: tested on one machine or one user first, took a backup or snapshot, had a rollback ready and got change approval for client systems.
4. Close with a measurable result and how you made it permanent: tickets that stopped recurring, the number of users affected, time saved, and the script pushed through RMM or the runbook you wrote so the next engineer would not have to rediscover it.
5. Avoid a story whose 'unconventional' fix was really a risky shortcut, such as turning off antivirus or a firewall, or editing production with no backup. Also avoid one where you never proved the cause and the symptom simply went away.

Follow-up

• How did you confirm that your change fixed the cause rather than coinciding with the symptom going away?
• Would you take the same approach on a client system with no maintenance window? What would you change?
• Looking back, which conventional step should have found this problem sooner, and why did it miss?

Suggested practice checklist

The plan follows the reported topics: Tier II troubleshooting, MSP operations and ticketing, security in client environments, documentation and clear communication. Each day produces a written artifact you reuse in the interview.

Day 1 — Inventory your stack and pick your stories

• List every technology on your resume that matches the listed requirements: Windows, Linux, networking protocols, ticketing systems, PowerShell, Bash, MSP tools
• Mark each as strong, working or shallow, and choose the five you will lead with
• Pick three incidents from your own history, one for each of the troubleshooting, documentation and unconventional-fix questions

Deliverable: A one-page skills ranking and a list of three chosen incidents with one line each.

Day 2 — Build the critical system failure story

• Write the incident as STAR, then add the evidence trail: which logs, commands and checks led you to the cause
• Add the containment step, the permanent fix and what you changed to prevent a repeat
• Say it aloud once and cut anything that describes the team instead of your decisions, then compare its shape with the practice story about narrating an outage from page to postmortem

Deliverable: A written STAR story with the diagnosis sequence and the prevention step, plus a spoken run-through.

Day 3 — Technical environments and their security

• For your three strongest environments, write what you managed, its security requirements and the controls you applied (access, patching, logging, backup)
• Prepare how each environment interacts with its neighbours, such as authentication, DNS and the network path, since a mentioned technology can lead to questions about the rest of the stack
• Write one honest sentence on where your depth ends for each

Deliverable: A one-page environment sheet answering the question on common technical environments and security requirements.

Day 4 — Troubleshooting method by layer

• Write a layered checklist for a client issue escalated to you: scope, recent changes, connectivity and DNS, services and logs on Windows or Linux, then authentication
• List the exact commands or tools you would use at each layer, naming PowerShell or Bash where you would script the check
• Walk through one real ticket using the checklist and note where you would verify the fix

Deliverable: A layered troubleshooting checklist with commands, applied to one real ticket.

Day 5 — Documentation and the unconventional fix

• Write a sample resolution note (symptom, cause, fix, verification) for the incident from day 2, and sketch the knowledge-base or procedure update it would trigger
• Prepare the unconventional-approach story: what the standard fix was, why it did not work, what you did instead and how you confirmed it
• Rehearse both aloud, naming what you would document afterwards

Deliverable: One sample resolution note and one STAR story for the unconventional approach.

Day 6 — MSP operations, escalation and client communication

• Describe how you work a ticket from intake to closure in a ticketing system, including priority, escalation handoff notes and client updates
• Write two explanations of one technical cause, one for an engineer and one for a non-technical client
• Prepare a story about arguing a design call and committing to the outcome anyway, using the practice story on that theme as a model for the structure

Deliverable: A ticket-handling walkthrough and two versions of one explanation.

Day 7 — Full mock and questions to ask

• Run a full mock of the reported questions, answering aloud in order and recording yourself
• Review the recording for stories that end at the workaround and for any technology claim you could not defend
• Write two questions for the interviewers about the client environments, the escalation process or the documentation practice

Deliverable: A recorded mock with notes on fixes, and two questions to ask.

Behavioural preparation

The reported questions ask about your own past work: how you found a root cause, how you manage the security of the environments you support, how you document a resolution and how you solved a problem the standard way would not. Candidates describe STAR as the structure to use and 'why' as the part to emphasise. Prepare real incidents, with the reasoning behind each choice, rather than general statements about your method.

1. Walk through a specific technical problem you solved that required an unconventional approach.
2. How do you approach the documentation of a technical issue once it has been resolved?
3. Tell me about a time you explained a technical problem to a client who was not technical, and how you kept them informed while you worked.
4. Describe an escalated ticket you took over: what did the handoff contain, and what was missing that you had to rediscover?

Describe a time you encountered a critical system failure; how did you identify the root cause?

Medium · Technical Proficiency and Troubleshootin

Approach

1. Choose an incident you personally diagnosed, ideally on Windows, Linux or the network layer you know best, and open with the symptom as the client or monitoring reported it in one or two sentences. Spend most of your time on the diagnosis, since the question asks how you identified the root cause.
2. Show a method, not a hunch: scope first (one user, one site or everyone), then ask what changed recently, then read the evidence. Name the real sources, such as Event Viewer or journalctl and syslog, service status, DNS and connectivity checks, monitoring graphs, and the ticket history for similar cases. Say which hypotheses you ruled out and what ruled each out.
3. Separate restoring service from finding the cause. State what you did to stop the impact (failover, rollback, restart, workaround), then how you proved the actual root cause, for example by reproducing it or showing the evidence disappear after the fix. A story that ends at 'it worked again' is a band-aid story.
4. Close the loop: the permanent fix, what you changed so it would not recur (monitoring, a patch process, a procedure), and the documentation you updated. Mention how you kept the client or your team informed during the outage, since client communication is part of the role.
5. Quantify with what you can honestly measure, such as users or devices affected, time to restore and time to the real fix, and do not invent figures. The mistake that sinks this answer is describing what the team did; use 'I' for your decisions and name who did what.

Follow-up

• How did you confirm that was the root cause rather than a coincidence or a side effect of your first fix?
• What did you tell the client while it was still down, and how did you decide when to escalate?
• What would you do differently, and what did you change afterwards so it could not happen again?

Narrate an outage you owned from page to postmortem

Hard · incident response · blast radius · postmortems

Pick an incident you personally drove, ideally one where writes were affected rather than reads. In six to eight minutes: state the symptom as it first appeared on a dashboard, the blast radius you established before you knew the cause, the mitigation you applied and when, the mechanism you eventually proved, and the follow-up that would prevent a repeat. Bring numbers: error rate, tenants affected, minutes to mitigate, minutes to resolve. If you cannot name what you measured, choose a different incident.

Approach

1. Open on the signal rather than the cause: which metric at which percentile moved, on which service, at what time, so the listener follows the same evidence you had rather than a conclusion you already reached.
2. Separate mitigation from diagnosis out loud. State what you did to stop the bleeding (flag off, shed traffic, drain a lease, roll back a deploy) and say plainly that you did it before the mechanism was known, because those are two jobs with different deadlines.
3. Establish blast radius in countable terms: how many tenants, how many writes, and crucially whether the effect was loss or only delay. An append-only revision table or a pending outbox row means the change survived and the projection was merely behind, which is a repair rather than a data-loss incident.
4. Prove the mechanism instead of asserting it. Name the trace span that grew, the plan that flipped to a sequential scan, the lease that expired, plus one alternative you ruled out and the signal that stayed flat while you ruled it out.

Follow-up

• What would you do differently in the first five minutes, given the same dashboard and no more information?
• Which follow-up action did you deliberately not take, and why was dropping it the right call?

Argue against a design, lose, and commit anyway

Medium · disagreement · service boundaries · decision records

Describe a design you argued against and lost. State the failure you predicted as a named mechanism, not a feeling about complexity: two services that would need one transaction, a projection with no rebuild path, a write path with no idempotency key. Say what evidence you brought, what the decision maker weighed instead, and what you did after the decision was made: what you instrumented, what you wrote down, and whether the prediction came true. Five minutes.

Approach

1. State the prediction in falsifiable form up front: the mechanism, the condition that triggers it, and the observable outcome. A prediction that cannot be checked also cannot be credited to you later.
2. Show the evidence you had at the time and label each piece honestly as measured, analogous, or intuition. Keeping the intuition is fine; disguising it as data is the thing that erodes your standing in the next argument.
3. Represent the opposing case at full strength, including the constraint you did not control: a fixed date, a team boundary, or the fact that the decision was cheap to reverse and yours was not.
4. Make disagree-and-commit concrete. Name the artefact you left behind so the prediction could be settled without you: the alert and its threshold, the counter on the dashboard, the decision note that recorded the trade-off and the condition that would revisit it.

Follow-up

• What threshold on that alert would have proved you right, and did anyone ever look at it?
• If the same proposal arrived tomorrow with the same deadline, would you argue it the same way?