A drift alert has just fired on several key inputs. What belongs first in the incident runbook?
Show answer and explanation
Answer: C
The first runbook step is to confirm the alert reflects real change, since a monitoring configuration edit or a bad baseline can trigger false drift. The next step is to quantify the effect on business KPIs, which determines whether urgency justifies rollback or whether a scheduled retrain on fresh data is the better response. Rolling back blindly can discard a good model, muting the alert hides real problems, and deleting the job removes the very detection that is needed.
Why the other options are wrong
- A. Immediate rollback without checking the alert can throw away a sound model and does nothing if the alert was a false positive from a configuration change.
- B. Silencing the alert keeps the model serving while the underlying shift goes unaddressed, which trades visibility for a hidden production risk.
- D. Deleting the monitoring job removes future detection and leaves the team blind to the same kind of problem recurring.