Every incident runs on a different architecture. Arrows point from a service to what it depends on. A service fails if it has a fault, or if anything it depends on is failing.
Monitored services alert when they fail. Grey ones have no monitoring, so you can't see their state.
There are one, two or three root causes, and you aren't told how many. Tap a service to act on it.
Check logs takes 2 minutes and tells you whether the service has its own errors, is failing because of a dependency, or is clean.
Fix takes 5 minutes, and failing over a datastore (bottom row) takes 8. Either repairs the service if it has a fault. Otherwise the time is lost.
Every minute, each failing user-facing service (marked USERS) adds a user-minute of downtime. Only actions take time, so think as long as you like.
Par is what the best possible strategy scores on this incident, playing without knowing the answer and treating one, two and three root causes as equally likely. A lucky guess can beat it.