Slowloris connection-exhaustion attack
Your web tier starts refusing connections and health checks fail, but CPU, memory, and bandwidth are all low — nothing looks busy. The connection-count dashboard shows worker/connection pools maxed out: thousands of open connections each sending HTTP headers extremely slowly (a byte every few seconds) and never completing the request. Traffic volume in bytes/sec is tiny. It comes from a few hundred IPs. There was no deploy. How do you triage and mitigate this low-bandwidth connection-exhaustion attack?
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 35 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.