Describe a production incident you were involved in. How did you diagnose it and what did you change afterwards?

Tell it as a timeline, and resist the urge to make yourself the hero.

• Detection. What alerted you — error rate, latency, memory, or a customer? If it was a customer, say so; that itself was a finding.
• Triage. What you did to stop the bleeding before you understood the cause. Rolling back, scaling out, disabling a feature flag, or shedding load are all legitimate first moves.
• Diagnosis. The evidence you used: structured logs with a correlation id, a heap snapshot, event loop lag metrics, or a flame graph from --prof.
• The fix, and then the real fix. The immediate patch, and the systemic change — a timeout that was missing, a circuit breaker, a bounded queue, or a health check that actually checked something.

Note: Mention the blameless postmortem if your team ran one. Interviewers read that as maturity, and it lets you describe a failure without it sounding like someone was at fault.