CDM Monitoring, Logging & Incident Response 5 — Questions and Answers
Question 1: Which log severity level in the syslog/RFC 5424 standard indicates a system is unusable and represents the highest urgency?
- CRITICAL
- ALERT
- EMERGENCY (Correct answer)
- ERROR
Correct answer: EMERGENCY
EMERGENCY (severity 0) is the highest syslog level, indicating the system is completely unusable and requiring immediate action.
Question 2: A team is implementing the USE method for system performance monitoring. What do the letters U, S, and E stand for?
- Uptime, Speed, Errors
- Utilization, Saturation, Errors (Correct answer)
- Usage, Stability, Efficiency
- Uptime, Saturation, Elasticity
Correct answer: Utilization, Saturation, Errors
The USE method (by Brendan Gregg) analyzes Utilization, Saturation, and Errors for every resource to systematically identify performance bottlenecks.
Question 3: In a blameless postmortem, what is the primary goal of the 'five whys' technique?
- To assign responsibility to the engineer who made the error
- To iteratively ask 'why' to trace from symptoms to root systemic causes (Correct answer)
- To document the timeline of the incident
- To calculate the financial impact of the outage
Correct answer: To iteratively ask 'why' to trace from symptoms to root systemic causes
The five whys technique drills past surface symptoms by repeatedly asking 'why' until the underlying systemic or process failure is identified.
Question 4: Which Prometheus query function calculates the per-second rate of increase of a counter metric over a specified time range?
- increase()
- delta()
- rate() (Correct answer)
- irate()
Correct answer: rate()
`rate()` computes the per-second average rate of increase of a counter over a time window, smoothing out spikes and handling counter resets.
Question 5: What is 'log sampling' and when is it most appropriate to use in a high-throughput system?
- Encrypting a random subset of logs for security testing
- Recording only a fraction of log events to reduce storage and processing costs at very high volume (Correct answer)
- Aggregating logs by hour instead of by event
- Replaying historical logs to reproduce incidents
Correct answer: Recording only a fraction of log events to reduce storage and processing costs at very high volume
Log sampling records a representative subset of events (e.g., 1 in 100) to manage cost and volume in systems generating millions of events per second.
Question 6: In incident communication, what is the purpose of a status page (e.g., Statuspage.io) during an active outage?
- To trigger automated rollbacks of deployments
- To provide transparent, real-time incident updates to external customers and stakeholders (Correct answer)
- To route alerts to the correct on-call team
- To store detailed internal postmortem data
Correct answer: To provide transparent, real-time incident updates to external customers and stakeholders
A status page gives customers visibility into ongoing incidents and current service health, reducing inbound support volume and maintaining trust.
Question 7: Which approach to on-call scheduling rotates responsibility weekly so that every team member shares the operational burden equally over time?
- Follow-the-sun scheduling
- Round-robin rotation (Correct answer)
- Tiered escalation scheduling
- Shadow on-call scheduling
Correct answer: Round-robin rotation
Round-robin rotation cycles on-call duty through all team members in a fixed sequence, distributing the operational burden equitably.
CDM Monitoring, Logging & Incident Response 5
Which log severity level in the syslog/RFC 5424 standard indicates a system is unusable and represents the highest urgency?