TL;DR: Use a real incident to explain your decisions, the evidence available at the time and the effect on users. Include a discarded hypothesis if one actually occurred. Ownership can include requesting help early, coordinating mitigation and following through on the preventive work.
How to approach it
Pick an incident where you can explain your own contribution, whether you led coordination, diagnosed a fault or executed an important mitigation. Ninety seconds of setup at most, then spend the time on what you decided and why. Have the numbers ready: duration, blast radius, and what changed afterwards.
A strong answer
Structure it as five beats.
The setup, in two sentences. What the system does, what broke, who was affected. Not the org chart, not the history. "Checkout latency went from 200 milliseconds to eight seconds for about 40 percent of traffic on a Friday evening" is a complete setup.
The mitigation, before the diagnosis. Say what you did to reduce customer impact while you still did not know the cause. Rolling back the last deploy, shedding load, failing over, disabling a feature flag. Interviewers weight this heavily because it is the difference between someone who protects users and someone who protects their curiosity. If you root-caused first while customers were down, say so and say what you would do differently, which is a stronger answer than pretending otherwise.
If there was a wrong turn, name the hypothesis and the evidence that changed your assessment. For example: "Rolling back did not restore latency, so we checked whether the release had changed persistent state before ruling it out." A failed rollback does not prove the deployment was unrelated. If your first hypothesis was right, explain how you verified it.
The actual cause and the fix, briefly. Enough detail to be checkable, not a full postmortem. If you are asked for depth you will be asked.
What changed afterwards. Not "we added monitoring", which is what everyone says. Something specific and verifiable: an alert on the signal that would have caught it 20 minutes earlier, a limit that now fails closed, a runbook step deleted because it was wrong. If the answer is that nothing changed, say that too and say why, because an honest no is better than a fabricated action item.
On the numbers: have duration, percentage of traffic or users affected, and time to mitigate. You do not need revenue impact, and inventing one is worse than not having it. If you cannot share specifics for confidentiality reasons, say so and give the shape rather than refusing.
For an Amazon loop, map the same story deliberately: Ownership can include escalating to the right specialist while retaining coordination and follow-through; Dive Deep is the evidence you checked; Bias for Action is a defensible mitigation under uncertainty. One story can serve two principles, but do not stretch one story across three rounds, because the interviewers compare notes and reuse is visible.
What interviewers probe next
"What would you do differently?" Answer with a decision, not a tool. "I would have rolled back nine minutes earlier instead of trying to confirm the cause first" beats "we would have had better dashboards".
"How did you communicate during it?" Who you told, how often, and what you said before you knew anything. Regular updates with no new information are still updates, and stakeholders who hear nothing assume the worst.
"Whose fault was it?" The correct answer names a systemic cause, not a person. If a single individual could take production down with one command and no guard, the guard is the defect.
Common mistakes
Adding a wrong turn that never happened. The purpose is to explain your judgment honestly, including a correct initial diagnosis.
Being the narrator rather than the actor. If every sentence is "the team decided", the interviewer cannot score you.
No numbers. Duration and blast radius take one sentence and change how the whole story lands.
Reusing one incident across three rounds. Prepare six stories, and know which two you would use for ownership and which two for conflict.