Intermediate
Incident Response
#runbook
#on-call
Runbook Execution Language
4 exercises — narrate runbook steps clearly during an active incident, flag mismatches, escalate when the runbook is exhausted, and confirm high-risk actions.
0 / 34 completed
1 / 34
You are following a runbook step: "Step 3: Run `kubectl rollout restart deployment/api`. Confirm pods reach Ready state before proceeding." Which is the correct way to narrate this step to the war room?
Runbook execution narration should state the step number, the action being taken, and the condition being waited for before proceeding. This lets the rest of the incident channel track progress without interrupting to ask "what are you doing?"
Formula:
Narrating each step in real time also creates a natural incident timeline for the post-mortem, and lets a second engineer catch a mistake before it compounds.
Formula:
"Executing step [N]: [action]. Waiting for [expected outcome] before [next step]."Narrating each step in real time also creates a natural incident timeline for the post-mortem, and lets a second engineer catch a mistake before it compounds.
2 / 34
You reach a runbook step whose described symptom doesn't match what you're seeing in production. What is the correct language to use?
When reality diverges from the runbook, the correct move is to state the mismatch explicitly and pause for input rather than either blindly following stale instructions or silently improvising.
Formula:
This is a critical incident-response skill: runbooks age, systems change, and a step that was correct six months ago may now be dangerous. Flagging the mismatch surfaces the gap for the post-mortem action items too ("update runbook step 3").
Formula:
"The runbook expects [X], but I'm observing [Y] — pausing before I continue. Does anyone have context?"This is a critical incident-response skill: runbooks age, systems change, and a step that was correct six months ago may now be dangerous. Flagging the mismatch surfaces the gap for the post-mortem action items too ("update runbook step 3").
3 / 34
You've completed all runbook steps for "database failover" but the symptom (elevated latency) hasn't improved. What is the correct way to communicate this to the incident commander?
When a runbook is fully executed but the symptom persists, say so explicitly — "the runbook is exhausted" — and name the next escalation step. This prevents the team from assuming the runbook is still "in progress" when it has actually failed to resolve the issue.
Formula:
"Runbook exhausted" is standard SRE terminology for "we followed the documented steps and they did not resolve the problem" — it's a clear, blameless way to signal that human judgement is now required.
Formula:
"I've completed [runbook name]. [Symptom] persists — the runbook is exhausted. Escalating to [team/person].""Runbook exhausted" is standard SRE terminology for "we followed the documented steps and they did not resolve the problem" — it's a clear, blameless way to signal that human judgement is now required.
4 / 34
A runbook step involves a risky, irreversible action: "Step 5: Drop and recreate the search index (data loss risk)." What is the correct language before executing it under pressure?
For any runbook step flagged as irreversible or high-risk, get explicit sign-off from the incident commander before executing, even under time pressure. Never silently execute risky steps, and never silently skip them either.
Formula:
This two-person-rule pattern for irreversible actions is standard in SRE practice (similar to a pilot's checklist confirmation) — it catches mistakes made under stress and distributes accountability for high-stakes decisions.
Formula:
"Step [N] is irreversible — [action]. Confirming with [IC/owner] before I proceed: are we go for this?"This two-person-rule pattern for irreversible actions is standard in SRE practice (similar to a pilot's checklist confirmation) — it catches mistakes made under stress and distributes accountability for high-stakes decisions.
5 / 34
Alice from the DevSecOps team reports: "The runbook says to 'Rollback Feature X'. I'm not sure what that *exactly* means in terms of code changes. Should I just revert the last commit?"This question tests understanding that runbook terminology like 'rollback' can be ambiguous. The correct answer acknowledges the lack of detail and highlights that a rollback usually involves restoring to a previous release, not just reverting individual commits. The other options misinterpret the likely scope of a feature rollback.
6 / 34
You're investigating a failing API endpoint and see this response from the service: `{"status": "502", "message": "Bad Gateway"}`. You need to update the on-call engineer via Slack. What's the best approach?
The key here is communicating effectively under pressure. A clear, concise description of the problem (502 Bad Gateway) and a suggestion for investigation ('upstream issues') is crucial. Simply stating 'the API is down' lacks context and doesn't guide the next steps. Restarting without understanding the root cause is also premature.
7 / 34
During a production incident involving a degraded service, you are drafting a pull request to implement a fix. What's the most appropriate description for your code?
A good PR description provides crucial context for reviewers. This answer emphasizes that it should clearly state *why* the code was written (workaround for database issues) and tie it back to the specific incident. Vague descriptions like 'fixed a bug' don't help anyone understand the impact or potential future problems.
8 / 34
The standup update is in progress.
Ben reports: "I ran the 'Scale Compute' runbook step. The servers are now running at full capacity."
What's the best way to respond as a team lead?Even if a runbook step appears successful, it's vital to monitor for potential issues. This response acknowledges the update but immediately flags the need for continued observation and performance monitoring. It proactively addresses a key concern – sustained performance after scaling.
9 / 34
The runbook dictates: "Step 7: Purge all data from the staging database." You're under pressure to execute this quickly. What's the most appropriate statement to make?
This scenario highlights the importance of acknowledging risk when executing potentially destructive actions. The correct response communicates that data loss is acknowledged and that a rollback plan is prepared – demonstrating preparedness and accountability. A reckless 'just do it' approach is unacceptable in incident response.
10 / 34
Alice from the DevSecOps team reports: "The runbook says to 'Rollback Feature X'. I'm not sure what that *exactly* means in terms of code changes. Should I just revert the last commit?"This question tests understanding that runbook terminology like 'rollback' can be ambiguous. The correct answer acknowledges the lack of detail and highlights that a rollback usually involves restoring to a previous release, not just reverting individual commits. The other options misinterpret the likely scope of a feature rollback.
11 / 34
You're investigating a failing API endpoint and see this response from the service: `{"status": "502", "message": "Bad Gateway"}`. You need to update the on-call engineer via Slack. What's the best approach?
The key here is communicating effectively under pressure. A clear, concise description of the problem (502 Bad Gateway) and a suggestion for investigation ('upstream issues') is crucial. Simply stating 'the API is down' lacks context and doesn't guide the next steps. Restarting without understanding the root cause is also premature.
12 / 34
During a production incident involving a degraded service, you are drafting a pull request to implement a fix. What's the most appropriate description for your code?
A good PR description provides crucial context for reviewers. This answer emphasizes that it should clearly state *why* the code was written (workaround for database issues) and tie it back to the specific incident. Vague descriptions like 'fixed a bug' don't help anyone understand the impact or potential future problems.
13 / 34
The standup update is in progress.
Ben reports: "I ran the 'Scale Compute' runbook step. The servers are now running at full capacity."
What's the best way to respond as a team lead?Even if a runbook step appears successful, it's vital to monitor for potential issues. This response acknowledges the update but immediately flags the need for continued observation and performance monitoring. It proactively addresses a key concern – sustained performance after scaling.
14 / 34
The runbook dictates: "Step 7: Purge all data from the staging database." You're under pressure to execute this quickly. What's the most appropriate statement to make?
This scenario highlights the importance of acknowledging risk when executing potentially destructive actions. The correct response communicates that data loss is acknowledged and that a rollback plan is prepared – demonstrating preparedness and accountability. A reckless 'just do it' approach is unacceptable in incident response.
15 / 34
Alice from the DevSecOps team reports: "The runbook says to 'Rollback Feature X'. I'm not sure what that *exactly* means in terms of code changes. Should I just revert the last commit?"This question tests understanding that runbook terminology like 'rollback' can be ambiguous. The correct answer acknowledges the lack of detail and highlights that a rollback usually involves restoring to a previous release, not just reverting individual commits. The other options misinterpret the likely scope of a feature rollback.
16 / 34
You're investigating a failing API endpoint and see this response from the service: `{"status": "502", "message": "Bad Gateway"}`. You need to update the on-call engineer via Slack. What's the best approach?
The key here is communicating effectively under pressure. A clear, concise description of the problem (502 Bad Gateway) and a suggestion for investigation ('upstream issues') is crucial. Simply stating 'the API is down' lacks context and doesn't guide the next steps. Restarting without understanding the root cause is also premature.
17 / 34
During a production incident involving a degraded service, you are drafting a pull request to implement a fix. What's the most appropriate description for your code?
A good PR description provides crucial context for reviewers. This answer emphasizes that it should clearly state *why* the code was written (workaround for database issues) and tie it back to the specific incident. Vague descriptions like 'fixed a bug' don't help anyone understand the impact or potential future problems.
18 / 34
The standup update is in progress.
Ben reports: "I ran the 'Scale Compute' runbook step. The servers are now running at full capacity."
What's the best way to respond as a team lead?Even if a runbook step appears successful, it's vital to monitor for potential issues. This response acknowledges the update but immediately flags the need for continued observation and performance monitoring. It proactively addresses a key concern – sustained performance after scaling.
19 / 34
The runbook dictates: "Step 7: Purge all data from the staging database." You're under pressure to execute this quickly. What's the most appropriate statement to make?
This scenario highlights the importance of acknowledging risk when executing potentially destructive actions. The correct response communicates that data loss is acknowledged and that a rollback plan is prepared – demonstrating preparedness and accountability. A reckless 'just do it' approach is unacceptable in incident response.
20 / 34
Alice from the DevSecOps team reports: "The runbook says to 'Rollback Feature X'. I'm not sure what that *exactly* means in terms of code changes. Should I just revert the last commit?"This question tests understanding that runbook terminology like 'rollback' can be ambiguous. The correct answer acknowledges the lack of detail and highlights that a rollback usually involves restoring to a previous release, not just reverting individual commits. The other options misinterpret the likely scope of a feature rollback.
21 / 34
You're investigating a failing API endpoint and see this response from the service: `{"status": "502", "message": "Bad Gateway"}`. You need to update the on-call engineer via Slack. What's the best approach?
The key here is communicating effectively under pressure. A clear, concise description of the problem (502 Bad Gateway) and a suggestion for investigation ('upstream issues') is crucial. Simply stating 'the API is down' lacks context and doesn't guide the next steps. Restarting without understanding the root cause is also premature.
22 / 34
During a production incident involving a degraded service, you are drafting a pull request to implement a fix. What's the most appropriate description for your code?
A good PR description provides crucial context for reviewers. This answer emphasizes that it should clearly state *why* the code was written (workaround for database issues) and tie it back to the specific incident. Vague descriptions like 'fixed a bug' don't help anyone understand the impact or potential future problems.
23 / 34
The standup update is in progress.
Ben reports: "I ran the 'Scale Compute' runbook step. The servers are now running at full capacity."
What's the best way to respond as a team lead?Even if a runbook step appears successful, it's vital to monitor for potential issues. This response acknowledges the update but immediately flags the need for continued observation and performance monitoring. It proactively addresses a key concern – sustained performance after scaling.
24 / 34
The runbook dictates: "Step 7: Purge all data from the staging database." You're under pressure to execute this quickly. What's the most appropriate statement to make?
This scenario highlights the importance of acknowledging risk when executing potentially destructive actions. The correct response communicates that data loss is acknowledged and that a rollback plan is prepared – demonstrating preparedness and accountability. A reckless 'just do it' approach is unacceptable in incident response.
25 / 34
Alice from the DevSecOps team reports: "The runbook says to 'Rollback Feature X'. I'm not sure what that *exactly* means in terms of code changes. Should I just revert the last commit?"This question tests understanding that runbook terminology like 'rollback' can be ambiguous. The correct answer acknowledges the lack of detail and highlights that a rollback usually involves restoring to a previous release, not just reverting individual commits. The other options misinterpret the likely scope of a feature rollback.
26 / 34
You're investigating a failing API endpoint and see this response from the service: `{"status": "502", "message": "Bad Gateway"}`. You need to update the on-call engineer via Slack. What's the best approach?
The key here is communicating effectively under pressure. A clear, concise description of the problem (502 Bad Gateway) and a suggestion for investigation ('upstream issues') is crucial. Simply stating 'the API is down' lacks context and doesn't guide the next steps. Restarting without understanding the root cause is also premature.
27 / 34
During a production incident involving a degraded service, you are drafting a pull request to implement a fix. What's the most appropriate description for your code?
A good PR description provides crucial context for reviewers. This answer emphasizes that it should clearly state *why* the code was written (workaround for database issues) and tie it back to the specific incident. Vague descriptions like 'fixed a bug' don't help anyone understand the impact or potential future problems.
28 / 34
The standup update is in progress.
Ben reports: "I ran the 'Scale Compute' runbook step. The servers are now running at full capacity."
What's the best way to respond as a team lead?Even if a runbook step appears successful, it's vital to monitor for potential issues. This response acknowledges the update but immediately flags the need for continued observation and performance monitoring. It proactively addresses a key concern – sustained performance after scaling.
29 / 34
The runbook dictates: "Step 7: Purge all data from the staging database." You're under pressure to execute this quickly. What's the most appropriate statement to make?
This scenario highlights the importance of acknowledging risk when executing potentially destructive actions. The correct response communicates that data loss is acknowledged and that a rollback plan is prepared – demonstrating preparedness and accountability. A reckless 'just do it' approach is unacceptable in incident response.
30 / 34
Alice from the DevSecOps team reports: "The runbook says to 'Rollback Feature X'. I'm not sure what that *exactly* means in terms of code changes. Should I just revert the last commit?"This question tests understanding that runbook terminology like 'rollback' can be ambiguous. The correct answer acknowledges the lack of detail and highlights that a rollback usually involves restoring to a previous release, not just reverting individual commits. The other options misinterpret the likely scope of a feature rollback.
31 / 34
You're investigating a failing API endpoint and see this response from the service: `{"status": "502", "message": "Bad Gateway"}`. You need to update the on-call engineer via Slack. What's the best approach?
The key here is communicating effectively under pressure. A clear, concise description of the problem (502 Bad Gateway) and a suggestion for investigation ('upstream issues') is crucial. Simply stating 'the API is down' lacks context and doesn't guide the next steps. Restarting without understanding the root cause is also premature.
32 / 34
During a production incident involving a degraded service, you are drafting a pull request to implement a fix. What's the most appropriate description for your code?
A good PR description provides crucial context for reviewers. This answer emphasizes that it should clearly state *why* the code was written (workaround for database issues) and tie it back to the specific incident. Vague descriptions like 'fixed a bug' don't help anyone understand the impact or potential future problems.
33 / 34
The standup update is in progress.
Ben reports: "I ran the 'Scale Compute' runbook step. The servers are now running at full capacity."
What's the best way to respond as a team lead?Even if a runbook step appears successful, it's vital to monitor for potential issues. This response acknowledges the update but immediately flags the need for continued observation and performance monitoring. It proactively addresses a key concern – sustained performance after scaling.
34 / 34
The runbook dictates: "Step 7: Purge all data from the staging database." You're under pressure to execute this quickly. What's the most appropriate statement to make?
This scenario highlights the importance of acknowledging risk when executing potentially destructive actions. The correct response communicates that data loss is acknowledged and that a rollback plan is prepared – demonstrating preparedness and accountability. A reckless 'just do it' approach is unacceptable in incident response.
Frequently Asked Questions
What will I practise in "Runbook Execution Language — Incident Response English Exercise"?
Practise narrating runbook steps under pressure, flagging mismatches, escalating when a runbook is exhausted, and confirming irreversible actions. 4 exercises.
How many exercises are in this module?
This module has 34 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Incident Response exercises?
Browse the full Incident Response hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.