CDM Monitoring, Logging & Incident Response 3 — Questions and Answers
Question 1: What does the term 'cardinality' refer to in the context of time-series monitoring systems like Prometheus?
- The number of active alert rules
- The total number of unique label value combinations for a metric (Correct answer)
- The frequency at which metrics are scraped
- The retention period for metric data
Correct answer: The total number of unique label value combinations for a metric
Cardinality refers to the number of unique time series created by combining all label values for a metric; high cardinality can cause memory and performance issues.
Question 2: In an incident response process, what is the primary purpose of a 'war room'?
- To conduct blameful post-incident reviews
- To bring all key responders together in real time to coordinate resolution (Correct answer)
- To store historical incident data
- To automate runbook execution
Correct answer: To bring all key responders together in real time to coordinate resolution
A war room (physical or virtual) centralizes communication and decision-making during a major incident to speed up resolution.
Question 3: A team uses structured logging with JSON format instead of plain text. What is the primary operational benefit?
- Smaller log file sizes
- Easier machine parsing and querying of specific fields (Correct answer)
- Encryption of sensitive fields
- Reduced network bandwidth for log shipping
Correct answer: Easier machine parsing and querying of specific fields
Structured JSON logs allow log aggregation systems to index and query specific fields efficiently without complex regex parsing.
Question 4: Which incident severity level typically requires immediate 24/7 on-call response and represents complete service unavailability?
- SEV-3
- SEV-2
- SEV-1 (Correct answer)
- SEV-0
Correct answer: SEV-1
SEV-1 (or P1) is the highest severity for complete outages, requiring immediate escalation and all-hands response around the clock.
Question 5: What is the key difference between black-box monitoring and white-box monitoring?
- Black-box uses agents; white-box uses agentless collection
- Black-box tests external behavior without internal visibility; white-box uses internal metrics and logs (Correct answer)
- Black-box monitors production; white-box monitors staging
- Black-box is manual; white-box is automated
Correct answer: Black-box tests external behavior without internal visibility; white-box uses internal metrics and logs
Black-box monitoring simulates user experience from outside the system, while white-box monitoring uses internal telemetry like metrics, logs, and traces.
Question 6: In Grafana, what feature allows you to annotate a dashboard with a vertical marker at the exact time a deployment was made?
- Dashboard variables
- Alert annotations
- Event annotations (Correct answer)
- Panel links
Correct answer: Event annotations
Grafana annotations create visual markers on dashboards tied to specific timestamps, commonly used to correlate deployments with metric changes.
Question 7: Which concept describes automatically reducing non-critical alert noise during a major incident so responders can focus on the primary problem?
- Alert deduplication
- Alert suppression / inhibition (Correct answer)
- Alert flapping detection
- Alert routing
Correct answer: Alert suppression / inhibition
Alert inhibition (supported by Alertmanager) suppresses dependent or downstream alerts when a parent critical alert is already firing.
CDM Monitoring, Logging & Incident Response 3
What does the term 'cardinality' refer to in the context of time-series monitoring systems like Prometheus?