Backups are green. Prove an isolated restore to 16:40 UTC yesterday, and show the evidence that establishes both RPO and RTO.
A green backup job proves that a backup job ran. It says nothing about whether the archive is continuous, whether the target time is reachable, or whether the restored database is usable, and interviewers ask this question precisely because those are three separate failures with one reassuring dashboard. The scored parts are the isolation of the restore, the explicitness of the target, and the shape of the validation, which has to prove both that data before the target survived and that data after it is genuinely absent. The second half of the question is quieter: recovery point and recovery time are measurements taken during the drill, not numbers copied from a policy document. This page covers both.
What the interviewer is scoring
Weak answer: names a backup product, restores over production, treats a logical dump as PITR, or uses archiver statistics as proof that a restore works.
In short: A tested restore needs a usable base backup, every required WAL segment and timeline history, an explicit target, and application validation—not a successful backup job.
The spoken answer and the reasoning behind it
- The full 90-second answer, written first person, the way you would actually say it
- How I reason through it: the mechanism, the decision points, and where the claim stops
- Verification steps with a written summary of what a controlled lab run showed, labelled as a summary rather than a transcript.
- Worked responses to the 3 follow-up probes listed above, plus the traps that lose the point
Card required. Cancel before day 7 and you are not charged.
How to reason through it
- Select and identify a base backup whose WAL coverage can reach the requested target.
- Restore to isolated scratch storage, port, and network; configure the restore command and create the recovery signal file.
- Set an explicit-zone recovery target time, a deliberate inclusivity setting, the intended timeline, and normally pause on reaching the target.
- Verify a before-target sentinel is present, an after-target sentinel is absent, and application and integrity checks pass.
- Record the backup identity, target and timeline, the recovered position and time, the start-to-validated-ready duration, and the validation results.
- Fail closed on missing WAL or history, target-not-reached, timezone or timeline error, logical-dump-only input, production destination, or failed validation.
What I would verify
- Confirm archive continuity across the whole window before starting, not after the restore stalls.
- Write the target with an explicit time zone; an ambiguous local time is the most common silent error.
- Pause on reaching the target so the state can be inspected before any promotion.
- Check both directions: a row committed before the target present, a row committed after it absent.
- Time the drill from start to validated-ready, because that duration is the recovery time evidence.
Follow-ups they push on
- What if the restore never reaches the target?
- Is a nightly logical dump good enough?
- How do you state recovery time from a drill?
The probes are open. Pro carries the spoken answer, the reasoning behind it, and the verification steps, including a worked response to each of these.
Concepts tested
Learn it, run it, then say it
Three steps, in order. Nothing here is a detour.
1 · Learn the mechanism
Understand it before you try to say it.
2 · Practise it for real
Run it once so the answer describes something you have seen.
- RunbookRestore to a point in time before the damage →Run the drill end to end and time it, so recovery time is a measurement rather than a policy number.
- RunbookProve your WAL archive can actually restore →Checks archive continuity, which is the failure that turns a green backup into an unreachable target.
3 · Rehearse the next question
Keep going while the mechanism is fresh.
Questions that go with this one
- staff · ProYou must cut a write workload from PostgreSQL 14 to 18 with logical replication. Where is the rollback boundary, and how do you prove the subscriber caught the source stop LSN?The other question where the rollback boundary is the whole answer.
- staff · ProPatroni leadership loss during a DCS partition: prove one writer.What you fall back on when the cluster cannot save itself.