Start with logs and metrics, not code. Most production issues reveal themselves through patterns in observability data.
Look for a systematic approach: check logs and monitoring first, reproduce if possible, correlate with recent deployments, isolate the component (database, external service, memory), add temporary instrumentation if needed, fix and verify with tests. Strong candidates mention incident communication and post-mortems.
Key differentiator between junior and senior developers. Juniors jump to code; seniors follow a methodical process and think about blast radius.