SRE Observability & Logging 3 — Questions and Answers
Question 1: Which sampling strategy for distributed tracing captures 100% of traces only when an error or high latency is detected?
- Head-based sampling
- Tail-based sampling (Correct answer)
- Reservoir sampling
- Probabilistic sampling
Correct answer: Tail-based sampling
Tail-based sampling makes the keep/drop decision after the full trace is complete, allowing it to retain traces with errors or high latency.
Question 2: A team implements structured logging in JSON format. What is the primary operational benefit?
- Smaller log file sizes compared to plain text
- Machine-parseable fields that enable consistent filtering and alerting (Correct answer)
- Faster write throughput to disk
- Automatic encryption of sensitive fields
Correct answer: Machine-parseable fields that enable consistent filtering and alerting
Structured JSON logs expose consistent, typed fields that log aggregation tools can index and query without fragile regex parsing.
Question 3: What is the role of a 'context propagation' mechanism in distributed tracing?
- Encrypting trace data in transit
- Passing trace and span identifiers across service boundaries in request headers (Correct answer)
- Aggregating span data at a central collector
- Sampling traces before they are exported
Correct answer: Passing trace and span identifiers across service boundaries in request headers
Context propagation carries trace context (trace ID, span ID, flags) in request headers so downstream services can join the same trace.
Question 4: Which metric type is most appropriate for tracking the total number of HTTP requests received since service start?
- Gauge
- Histogram
- Counter (Correct answer)
- Summary
Correct answer: Counter
A counter is a monotonically increasing value ideal for cumulative counts like total requests, errors, or bytes.
Question 5: An SRE needs to detect when a downstream service begins dropping connections silently. Which observability signal is most directly useful?
- CPU utilization of the upstream service
- Error rate and timeout metrics instrumented in the client (Correct answer)
- Disk I/O metrics on the downstream host
- Log volume of the upstream service
Correct answer: Error rate and timeout metrics instrumented in the client
Client-side error rate and timeout metrics capture dropped connections from the caller's perspective, where silent failures are most visible.
Question 6: What is 'log sampling' and when is it appropriate to use?
- Encrypting a fraction of logs for security audits
- Storing only a percentage of log lines to reduce volume while preserving statistical trends (Correct answer)
- Copying logs to a secondary region for redundancy
- Parsing logs at query time rather than ingestion time
Correct answer: Storing only a percentage of log lines to reduce volume while preserving statistical trends
Log sampling retains a representative fraction of log events to control storage costs when full fidelity is not required for high-volume debug logs.
Question 7: In Prometheus, what does the `rate()` function compute?
- The current value of a gauge metric
- The per-second average increase of a counter over a specified time range (Correct answer)
- The 95th percentile latency over a time window
- The sum of all metric values across all instances
Correct answer: The per-second average increase of a counter over a specified time range
`rate()` calculates the per-second average rate of increase for a counter metric over the given range, accounting for counter resets.
SRE Observability & Logging 3
Which sampling strategy for distributed tracing captures 100% of traces only when an error or high latency is detected?