CDM Monitoring, Logging & Incident Response 2 — Questions and Answers
Question 1: Which metric type in Prometheus represents a value that can only increase over time, such as total HTTP requests served?
- Gauge
- Counter (Correct answer)
- Histogram
- Summary
Correct answer: Counter
A Counter in Prometheus is a cumulative metric that only increases, used for values like total request counts or errors.
Question 2: In the ELK stack, which component is primarily responsible for parsing, filtering, and enriching log data before sending it to Elasticsearch?
- Elasticsearch
- Kibana
- Logstash (Correct answer)
- Beats
Correct answer: Logstash
Logstash is the data processing pipeline that ingests, transforms, and routes log data before it reaches Elasticsearch.
Question 3: An SRE team wants to define an acceptable error rate over a rolling 30-day window for a critical API. Which SRE concept does this describe?
- Mean Time to Recovery (MTTR)
- Error Budget (Correct answer)
- Apdex Score
- P99 Latency
Correct answer: Error Budget
An error budget is the allowable amount of downtime or errors derived from an SLO, representing acceptable unreliability over a period.
Question 4: Which alerting strategy fires a notification only when a condition has been true continuously for a specified duration, reducing false positives?
- Threshold alerting
- Anomaly alerting
- For-duration alerting (Correct answer)
- Dead man's switch
Correct answer: For-duration alerting
For-duration (or pending) alerts only trigger after the condition persists for a defined window, avoiding alerts on transient spikes.
Question 5: A distributed tracing system assigns the same value to all spans within a single user request across multiple microservices. What is this value called?
- Span ID
- Trace ID (Correct answer)
- Baggage
- Correlation token
Correct answer: Trace ID
The Trace ID is a globally unique identifier shared by every span in the same distributed transaction, enabling end-to-end tracing.
Question 6: During an incident postmortem, a team identifies that an engineer accidentally deleted a config file that caused the outage. What type of cause is this classified as?
- Root cause
- Proximate cause (Correct answer)
- Contributing factor
- Latent condition
Correct answer: Proximate cause
The proximate cause is the immediate, direct action or event that triggered the incident, distinct from the deeper root cause or systemic issues.
Question 7: Which AWS service provides a centralized, fully managed log aggregation and monitoring solution that supports log groups and metric filters?
- AWS X-Ray
- Amazon CloudWatch Logs (Correct answer)
- AWS Config
- Amazon Kinesis Data Firehose
Correct answer: Amazon CloudWatch Logs
Amazon CloudWatch Logs collects, stores, and monitors log data from AWS resources, with support for metric filters, alarms, and log insights queries.
CDM Monitoring, Logging & Incident Response 2
Which metric type in Prometheus represents a value that can only increase over time, such as total HTTP requests served?