Top 50 IT Operations Interview Questions and Answers (With an Outage Scenario)

Key takeaways

• Know incident versus problem versus change, and priority as impact times urgency.
• Learn RTO, RPO, MTTR, SLA and runbook, and explain them simply.
• For outages: assess, escalate, check recent changes, restore, communicate, review.
• Prepare real stories rather than recited definitions.

These are 50 questions grouped by theme, with answers short enough to say aloud. Use them to find your gaps, then practise the answer in your own words.

Fundamentals and service management

What is IT operations?

It is the day-to-day running of an organisation's IT: keeping servers, networks, applications and end-user services available, secure and performing, and fixing them when they fail.

What does an IT operations engineer do daily?

Monitors dashboards and alerts, handles incidents and service requests, applies patches in agreed windows, checks backups, manages access, updates documentation and works with other teams on changes.

What is the difference between IT operations and DevOps?

IT operations is the function that runs systems. DevOps is a way of working that joins development and operations through automation, shared ownership and fast feedback. Many ops roles now use DevOps practices.

What is ITIL?

ITIL is a set of best-practice guidance for IT service management. Its current version, ITIL 4, describes practices such as incident management, problem management and change enablement, and a service value system.

What is a service desk and what is its role?

It is the single point of contact for users. It logs, categorises and prioritises tickets, solves what it can at first contact, and escalates the rest to the right team.

What is an SLA, an OLA and an underpinning contract?

An SLA is the agreement with the customer on service levels. An OLA is an internal agreement between teams that supports the SLA. An underpinning contract is the same idea with an external supplier.

What are L1, L2 and L3 support?

L1 handles first contact and known fixes. L2 does deeper technical troubleshooting. L3 is specialist or engineering level, often with vendor or developer involvement. Escalation rules should be written down.

Incident and problem management

Incident, problem and change: what is the difference?

An incident is an unplanned interruption or degradation. A problem is the underlying cause of one or more incidents. A change is any planned modification to the environment. Restore service first, find the cause second.

How is priority decided?

Priority usually combines impact (how many users or how much business is affected) and urgency (how quickly it must be fixed). A single user's cosmetic issue is low. A payment system down for everyone is the highest.

What is a major incident?

A high-impact incident that needs a coordinated response outside the normal queue. It usually has an incident manager, a communications lead, a bridge call and regular updates to stakeholders.

What are MTTR and MTBF?

MTTR is the average time to restore service after a failure. MTBF is the average time between failures. Lower MTTR and higher MTBF both indicate healthier operations.

What is a root cause analysis?

A structured investigation into why an incident happened, such as the five whys or a timeline review. The goal is a fix that stops it recurring, not someone to blame.

What is a post-incident review?

A meeting after a significant incident to record the timeline, causes, what worked, what did not and the follow-up actions with owners. A blameless format encourages honest answers.

What is a runbook?

A documented, tested set of steps for a known task or fault, such as restarting a service safely or failing over a database. It lets any trained engineer respond consistently.

What is a known error database?

A record of problems whose cause is understood, with workarounds, so the service desk can resolve repeat incidents quickly.

Change, configuration and patching

What is change enablement (change management)?

The practice of making sure changes are assessed for risk, approved at the right level, scheduled and reviewed. ITIL 4 uses the name change enablement; many organisations still say change management.

What are standard, normal and emergency changes?

A standard change is low risk, pre-approved and repeatable. A normal change goes through assessment and approval. An emergency change is urgent, to fix a serious problem, and gets expedited approval and a review afterwards.

What is a CAB?

A change advisory board reviews higher-risk changes. Modern teams often keep it small and rely on automated checks and peer review for routine changes.

What should a change request include?

What is changing and why, risk and impact, test evidence, implementation steps, a rollback plan, the time window and who is on call.

What is a rollback plan and why does it matter?

It is the tested way to return to the previous good state if the change fails. Without it, a failed change becomes an outage.

What is a CMDB?

A configuration management database holds information about configuration items such as servers, applications and their relationships. It helps with impact analysis, but only if it is kept accurate.

What is patch management?

Identifying, testing, scheduling and deploying updates for operating systems and applications. Prioritise by severity and exposure, test in a staging group first, and keep a record of what was patched.

Monitoring, backup and availability

What should you monitor?

At minimum: availability, CPU, memory, disk, network, key application metrics, logs and certificate expiry. Alert on symptoms users feel, not every metric.

What is the difference between monitoring and observability?

Monitoring checks known conditions against thresholds. Observability is the ability to ask new questions about system behaviour using metrics, logs and traces.

How do you reduce alert fatigue?

Remove alerts nobody acts on, set thresholds from real baselines, group related alerts, route by severity and review alert quality regularly.

What is capacity planning?

Forecasting future demand for compute, storage and network from current trends and planned projects, so resources are added before performance suffers.

What are RTO and RPO?

Recovery time objective is how quickly a service must be back. Recovery point objective is how much data loss, measured in time, is acceptable. They drive backup and disaster recovery design.

What is the 3-2-1 backup rule?

Keep three copies of data, on two different media types, with one copy off-site or offline. Test restores regularly because an untested backup is only a hope.

What is disaster recovery versus business continuity?

Disaster recovery restores IT systems after a major failure. Business continuity is the wider plan for keeping the organisation operating, including people, premises and processes.

What is high availability?

Designing so that a single component failure does not stop the service, using redundancy, load balancing and automatic failover.

Troubleshooting and tools

How do you troubleshoot a user who cannot connect to the network?

Work up the layers: link light and cable or Wi-Fi, IP address (DHCP), default gateway reachable, DNS resolution, then the application. ipconfig or ip a, ping the gateway, ping an IP, then nslookup narrow it down fast.

A website is slow. What do you check?

Is it everyone or some users? Check server CPU, memory and disk, database and application logs, network latency, recent changes and any dependencies such as DNS or a third-party API.

What is DNS and how do you troubleshoot it?

DNS maps names to IP addresses. Use nslookup or dig against specific servers, check the record and TTL, and compare results from inside and outside the network.

What is DHCP and what happens if it fails?

DHCP hands out IP settings automatically. If it fails, new devices get a link-local address (169.254.x.x on Windows) and cannot reach the network. Check the service, scope exhaustion and relay configuration.

How do you check disk, CPU and memory on Linux and Windows?

Linux: df -h, top or htop, free -h, vmstat. Windows: Task Manager, Resource Monitor, Performance Monitor, or PowerShell Get-Counter and Get-Process.

What is the difference between a virtual machine and a container?

A VM includes a full guest operating system on a hypervisor. A container shares the host kernel and packages only the application and its dependencies, so it is lighter and starts faster.

What is automation used for in operations?

Repetitive and error-prone work: provisioning, patching, user onboarding, backups, config drift detection and standard fixes. Tools include shell, PowerShell, Ansible and scheduled pipelines.

What is infrastructure as code?

Defining servers, networks and settings in version-controlled files so environments are repeatable and reviewable. Terraform and Ansible are common examples.

Security, people and behaviour

How do you manage user access?

Grant least privilege through roles and groups, require approval for access requests, review access periodically, use multi-factor authentication, and remove access promptly when people leave.

What is the principle of least privilege?

Give users and systems only the access they need for their job and no more, which limits the damage from mistakes and compromised accounts.

How do you handle a suspected security incident as an operations engineer?

Report it through the agreed channel, preserve evidence (do not wipe or reboot unless instructed), contain the affected system as directed, and support the security team with logs and timelines.

What is vendor management in IT operations?

Tracking contracts, support levels, renewals and performance of suppliers, and knowing how to escalate when a vendor misses its service level.

How do you prioritise when several tasks arrive at once?

Use impact and urgency, check for active outages first, communicate honestly about timelines and ask for a decision from the owner when priorities genuinely conflict.

How do you communicate during an outage?

Give short, regular updates with what is known, what is being done and the next update time. Do not speculate on cause, and tell stakeholders when service is restored.

What KPIs does IT operations track?

Availability, MTTR, incident volume and repeat rate, first-contact resolution, SLA compliance, change success rate and backup success rate.

Why do you want to work in IT operations?

Link your answer to something real: you like keeping systems reliable, solving problems under pressure and automating repetitive work. Avoid generic lines and mention a specific skill you have practised.

Scenario: a production application goes down at 2 a.m.

Interviewers often ask for a walk-through. A strong answer has a clear order.

1. Acknowledge and assess. Confirm the alert is real, check how many users are affected and set the priority.
2. Escalate and communicate. Page the on-call owner for the service, open a bridge if it is a major incident, and send the first update.
3. Look for the recent change. Deployments, patches, certificate expiry and config edits cause a large share of outages. Rolling back may be the fastest fix.
4. Restore service first. Use the runbook, failover or rollback. Keep logs and screenshots before restarting anything.
5. Confirm and close. Verify with users or synthetic checks, send the all-clear and record the timeline.
6. Follow up. Run a blameless post-incident review and raise a problem record for the root cause.

How to prepare

• Learn the ITIL vocabulary but explain it in plain words. Free Windows and Azure administration material is available on Microsoft Learn.
• Be able to name one monitoring tool, one ticketing tool and one automation tool you have actually used.
• Practise troubleshooting out loud, layer by layer.
• Prepare two real stories from your own work or lab practice: one fault you fixed and one process you improved.

Next steps

To build the Linux skills that most operations roles expect, see the Linux course, and for dashboards and alerting see Grafana monitoring tools. Related reading: cloud operations engineer interview questions.