CDM Monitoring, Logging & Incident Response 3

Question 1

What does the term 'cardinality' refer to in the context of time-series monitoring systems like Prometheus?

Accepted Answer

The total number of unique label value combinations for a metric

Answer

The number of active alert rules

Answer

The frequency at which metrics are scraped

Answer

The retention period for metric data

Question 2

In an incident response process, what is the primary purpose of a 'war room'?

Accepted Answer

To bring all key responders together in real time to coordinate resolution

Answer

To conduct blameful post-incident reviews

Answer

To store historical incident data

Answer

To automate runbook execution

Question 3

A team uses structured logging with JSON format instead of plain text. What is the primary operational benefit?

Accepted Answer

Easier machine parsing and querying of specific fields

Answer

Smaller log file sizes

Answer

Encryption of sensitive fields

Answer

Reduced network bandwidth for log shipping

Question 4

Which incident severity level typically requires immediate 24/7 on-call response and represents complete service unavailability?

Accepted Answer

SEV-1

Answer

SEV-3

Answer

SEV-2

Answer

SEV-0

Question 5

What is the key difference between black-box monitoring and white-box monitoring?

Accepted Answer

Black-box tests external behavior without internal visibility; white-box uses internal metrics and logs

Answer

Black-box uses agents; white-box uses agentless collection

Answer

Black-box monitors production; white-box monitors staging

Answer

Black-box is manual; white-box is automated

Question 6

In Grafana, what feature allows you to annotate a dashboard with a vertical marker at the exact time a deployment was made?

Accepted Answer

Event annotations

Answer

Dashboard variables

Answer

Alert annotations

Answer

Panel links

Question 7

Which concept describes automatically reducing non-critical alert noise during a major incident so responders can focus on the primary problem?

Accepted Answer

Alert suppression / inhibition

Answer

Alert deduplication

Answer

Alert flapping detection

Answer

Alert routing