CDM Monitoring, Logging & Incident Response 4 — Questions and Answers
Question 1: A Kubernetes pod is restarting repeatedly. Which kubectl command provides the most direct view of recent container log output and previous crash logs?
- kubectl describe pod <name>
- kubectl logs <name> --previous (Correct answer)
- kubectl get events
- kubectl exec <name> -- journalctl
Correct answer: kubectl logs <name> --previous
`kubectl logs --previous` retrieves logs from the last terminated container instance, essential for diagnosing crash-loop causes.
Question 2: Which OpenTelemetry signal type is best suited for recording a discrete event that occurred at a specific instant, such as an exception being thrown?
- Metric
- Trace span
- Log (Correct answer)
- Baggage
Correct answer: Log
Logs in OpenTelemetry represent timestamped records of discrete events, making them ideal for capturing exceptions and state changes.
Question 3: What is the purpose of a 'runbook' in incident response operations?
- A real-time chat transcript of an incident
- Step-by-step documented procedures for diagnosing and resolving known incident types (Correct answer)
- An automated test suite for infrastructure
- A report generated after an incident is resolved
Correct answer: Step-by-step documented procedures for diagnosing and resolving known incident types
Runbooks provide on-call engineers with pre-defined, step-by-step instructions for handling specific alert conditions or failure scenarios.
Question 4: In PagerDuty or Opsgenie, what feature ensures that if the primary on-call engineer does not acknowledge an alert within a set time, it automatically notifies the next person?
- Alert grouping
- Escalation policy (Correct answer)
- Deduplication rule
- Suppression window
Correct answer: Escalation policy
An escalation policy defines the ordered chain of responders and timeouts so unacknowledged alerts automatically escalate to backup on-call personnel.
Question 5: Which statistical metric is most useful for understanding the worst-case latency experienced by a small percentage of users, such as the slowest 1% of requests?
- Mean (average) latency
- Median (P50) latency
- P99 latency (Correct answer)
- Standard deviation
Correct answer: P99 latency
P99 latency captures the 99th percentile response time, revealing tail latency that affects 1% of users — often the most impacted or VIP segment.
Question 6: A DevOps team wants to detect when a cron job has silently stopped running. Which alerting pattern is designed specifically for this scenario?
- Threshold alert
- Dead man's switch (heartbeat alert) (Correct answer)
- Anomaly detection alert
- Composite alert
Correct answer: Dead man's switch (heartbeat alert)
A dead man's switch fires an alert if it stops receiving an expected periodic signal, detecting silent failures like a cron job that simply never runs.
Question 7: What does MTTD stand for in SRE and incident management contexts?
- Mean Time to Deploy
- Mean Time to Detect (Correct answer)
- Maximum Tolerable Time to Downtime
- Mean Time to Decommission
Correct answer: Mean Time to Detect
MTTD (Mean Time to Detect) measures the average time between when an incident begins and when the team first becomes aware of it.
CDM Monitoring, Logging & Incident Response 4
A Kubernetes pod is restarting repeatedly.
Which kubectl command provides the most direct view of recent container log output and previous crash logs?