Cloud Digital Leader Scaling with Google Cloud operations Practice Question
A cloud team receives an alert that a critical production service's error rate has spiked. Following incident response best practices, what is the correct first priority action?
⚠ Common exam trap
Watch out — candidates often confuse 'root cause analysis' with 'first response' — Google Cloud often tests the principle that immediate mitigation (e.g., rollback, scaling) takes precedence over diagnosis, even if the fix is temporary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mitigate user impact immediately (e.g., rollback, traffic rerouting, scaling) while beginning parallel investigation of the root cause
Incident response best practices prioritize reducing user impact first. In Google Cloud, this could involve rolling back a deployment via Cloud Deploy, rerouting traffic with a load balancer, or scaling up instances with Managed Instance Groups, all while a parallel investigation into the root cause begins. This aligns with the SRE principle of 'error budget' and the 'mitigate before diagnose' approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identify and fix the root cause before taking any other action to ensure the fix is complete
Why it's wrong here
Performing root cause analysis (RCA) before any mitigation reflects a misunderstanding of incident response priorities: the primary goal during an incident is to restore service, not to determine the ultimate cause. RCA is a lengthy, investigative process that can take hours or days, while a rollback or traffic reroute can restore service in minutes. Attempting to fix the root cause 'in place' also risks making the system worse without a safe recovery path, especially if the root cause is a complex interaction between multiple services. The correct sequence is to mitigate first (stop the bleeding), then conduct a blameless RCA after service is restored to prevent recurrence.
- ✓
Mitigate user impact immediately (e.g., rollback, traffic rerouting, scaling) while beginning parallel investigation of the root cause
Why this is correct
Mitigation first is the correct incident response approach. Stop the bleeding before diagnosing the cause. If a recent deployment caused the spike, roll back immediately. If it's a capacity issue, scale up. Investigation into root cause runs in parallel but mitigation is prioritized.
- ✗
Wait to understand the full scope of the issue and inform all stakeholders before taking any technical action
Why it's wrong here
Waiting to establish a complete scope assessment and stakeholder briefing before acting delays mitigation and extends user-facing degradation, directly contradicting the 'fail fast, mitigate faster' model. Modern incident response emphasizes 'swarming' and 'sense-making in parallel' — initial mitigation, scope expansion, and stakeholder notification happen concurrently, not sequentially. Even with unknown scope, reversible and idempotent mitigations (e.g., scaling out, rejecting non-critical traffic) can be applied safely while information is still incomplete. Holding all technical action until a full understanding is achieved forfeits the most effective recovery window and creates a rescue-come-later feedback loop, which is why we must act now and close knowledge gaps while triage proceeds.
- ✗
Escalate to senior leadership and wait for their approval before making any production changes
Why it's wrong here
Requiring senior leadership approval before any production change during an active incident creates a bottleneck that extends downtime and violates standard incident command structure. In mature SRE environments, on-call engineers are explicitly empowered to execute pre-approved mitigation runbooks (e.g., rollback, failover, autoscaling) without escalating for permission. Waiting for approval turns a potentially 2-minute rollback into a 20-minute delay, increasing user impact and violating the 'mitigate first' principle of incident response. Leadership oversight is valuable for coordination and communication, but not as a gate for emergency technical actions.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Load balancer
A load balancer is a device or software that distributes incoming network traffic across multiple servers so no single server gets overwhelmed.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.