Incident Psychology¶
16 cards — 🟢 3 easy | 🟡 4 medium | 🔴 3 hard
🟢 Easy (3)¶
1. What does the Yerkes-Dodson stress-performance curve show about decision-making during incidents?
Show answer
Performance peaks at optimal stress, then degrades. At 3 AM after 2 hours of debugging, you are past optimal — decisions get worse. Effects include tunnel vision, shrinking working memory, defaulting to familiar patterns, time distortion, and degraded communication. This is when escalation saves the incident.2. What is anchoring bias during an outage and how do you counter it?
Show answer
The first piece of information (e.g., "I think it's the database") becomes an anchor that distorts all subsequent analysis. Counter-measure: write down three hypotheses before investigating any. Set a 15-minute timer and re-evaluate: "Are we still pursuing the right theory? What evidence do we have against it?"3. Why is the "just reboot it" impulse dangerous during incidents?
Show answer
Rebooting destroys evidence (process state, memory contents, connection state), masks the root cause (it will come back), may not help if the cause is external, and may make things worse if state is corrupted. The rule: capture state FIRST (logs, thread dumps, connection state, core dumps), then reboot if needed. A restart that fixes something temporarily is a clue, not a solution.🟡 Medium (4)¶
1. What is confirmation bias during incident response and how do you counter it?
Show answer
You search for evidence supporting your theory while unconsciously ignoring contradicting evidence.Example: finding one error near deploy time confirms your "deploy broke it" theory while ignoring that errors started 10 minutes before the deploy. Counter: actively try to disprove your theory by asking "What evidence would prove me WRONG?" and "What else should I see if this theory is correct?"
2. What is the HiPPO effect in war rooms and how do you counter it?
Show answer
HiPPO (Highest Paid Person's Opinion): when a senior person states a theory, nobody contradicts them even when they're wrong, and the investigation follows their direction regardless of evidence. Counter: the Incident Commander runs the investigation, not the highest-ranking person. The VP's role is to provide resources and remove blockers, not direct technical investigation.3. Why must an Incident Commander immediately shut down blame language during an active incident?
Show answer
Blame language ("Who pushed this code?") causes people to stop sharing information for self-protection, the person who caused the issue hides relevant context, and investigation stalls as people defend rather than diagnose. The IC should redirect: "We're focused on fixing this, not finding fault. We'll do a blameless postmortem after resolution."4. How does the sunk cost fallacy manifest during incident response?
Show answer
After investing 45 minutes investigating one theory, abandoning it feels like wasting that time, so you keep going even without supporting evidence. Counter: time-box investigations with a hard 15-minute rule. After 15 minutes ask "What have I learned? Is this still the best path?" Past time spent is irrelevant to the correct next action.🔴 Hard (3)¶
1. Why is psychological safety critical for incident response and how do you build it?
Show answer
The person who caused the incident often has the most context. If they are afraid to speak up, you lose critical information. Build safety by: leaders sharing their own mistakes publicly, thanking people for bad news, consistently running blameless postmortems, celebrating near-miss reports, and never punishing someone for causing an incident if they followed the process (fix the process, not the person).2. What is decision fatigue during incidents and how should IC handoffs work?
Show answer
After 2+ hours of continuous decision-making, quality degrades — defaulting to easiest options, avoiding decisions, repeating checks, getting irritable. Rotate the IC role every 2 hours. The handoff must be explicit: current state, hypotheses tested, next steps, what hasn't been checked. The outgoing IC takes a real break — not "I'll keep watching."3. What emotional processing should happen after a major incident?