Five Whys Scenario

A production server outage occurred during peak business hours.

Available evidence includes:

• memory exhaustion was observed before the outage
• a recent deployment occurred earlier the same day
• alert noise made it harder to identify the most important signals
• a rollback attempt failed
• the runbook was incomplete
• ownership during the incident was unclear

The incident team must determine a plausible underlying cause without assuming that the most recent deployment is automatically responsible.