Final Incident Simulation
Use this page live: reveal the incident one clue at a time and let the class choose the next investigation step.
Production incident
“Our website hosted on a Windows Plesk server is very slow and occasionally unavailable. The problem started yesterday.”
Reveal one clue at a time
Clue 1
CPU is 95%.
Identify the process responsible before taking action.
Clue 2
RAM is 96%.
Identify memory consumers and correlate with application/service behavior.
Clue 3
Resources now look normal.
Move to services, logs, IIS, Plesk, application and recent changes.
Clue 4
IIS returns 503.
Inspect IIS and the Application Pool.
Clue 5
Application Pool is stopped.
Ask why it stopped. Use Event Viewer, IIS/Plesk/application logs, resource symptoms and recent changes.
Trainer evaluation
Evidence
Did they collect facts before changing anything?
Layering
Did they move logically through the stack?
Safety
Did they avoid blind restart/kill/delete actions?
Verification
Did they verify and document?