Observability, safe logging, and incident response
Contain a failing route and prove that recovery works.
Reviewed: 2026-10-03
Source-based teaching example · Fictional data
Narration: Microsoft Mark · locally synthesized

00:00:00.000 — What you will learn

Contain a failing route and prove that recovery works.

Visual description:
Contain a failing route and prove that recovery works.

00:00:06.208 — The idea

Protect the affected path before continuing the investigation. Preserve required evidence and its timing. After returning to the earlier release, called rollback, or making a repair, repeat both blocked-access and normal cases.

Visual description:
Protect the affected path before continuing the investigation. Preserve required evidence and its timing. After returning to the earlier release, called rollback, or making a repair, repeat both blocked-access and normal cases.

00:00:24.125 — One useful term

Incident response. The defined process for containing, investigating and recovering from a harmful system event.

Visual description:
The defined process for containing, investigating and recovering from a harmful system event.

00:00:34.833 — A worked example

The training incident adds cross-tenant denial events and worse source support after a release. The operator pauses promotion, contains the route and verifies recovery after rollback.

Visual description:
The training incident adds cross-tenant denial events and worse source support after a release. The operator pauses promotion, contains the route and verifies recovery after rollback.

00:00:49.417 — Your turn to think

Does a service restart prove recovery? Pause and decide before continuing.

Visual description:
Does a service restart prove recovery?
Pause the video if you need more time.

00:01:05.500 — Why this answer works

No. The original failure checks and normal behavior must pass again. Do not rewrite the incident record.

Visual description:
No. The original failure checks and normal behavior must pass again. Do not rewrite the incident record.

00:01:15.917 — Check 1

Contain the affected path.

Visual description:
Contain the affected path.

00:01:20.667 — Check 2

Preserve original evidence and timing.

Visual description:
Preserve original evidence and timing.

00:01:25.917 — Check 3

Add the failure to regression tests.

Visual description:
Add the failure to regression tests.

00:01:31.167 — Now try a different case

Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.

Visual description:
Open the lesson
Try the new case
Check and revise
The full task and its requirements are in the linked lesson.