Critical dependency CVE
At 14:00 a critical CVE (CVSS 9.8, unauthenticated RCE) is published against a popular serialization library. Your dependency dashboard / SBOM scan flags that 14 of your services pin a vulnerable version of it, including the public-facing API gateway and the payments service. There's a proof-of-concept exploit already circulating on social media. No incident yet — but the clock is running. You're the on-call engineer who caught the page. How do you triage, prioritize, and remediate?
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 35 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.