PCA Promql — 20 Questions

Question 1

You want to aggregate total memory usage by 'job' using the 'node_memory_Usage_bytes' metric, while keeping the 'instance' label in the output. Which aggregation clause should you use?

Accepted Answer

sum(node_memory_Usage_bytes) by (job, instance). The 'without' clause removes listed labels from the result vector while keeping all other unlisted labels (such as instance). Alternatively, 'by' keeps only the specified labels.

Answer

sum(node_memory_Usage_bytes) drop (instance)

Answer

sum(node_memory_Usage_bytes) by (job)

Answer

sum(node_memory_Usage_bytes) without (instance)

Question 2

Which of the following expressions correctly retrieves an instant vector of all HTTP requests with a 200 status code?

Accepted Answer

http_requests_total{status='200'}. Instant vectors return the most recent sample for each time series matching the selector.

Answer

rate(http_requests_total{status='200'})

Answer

http_requests_total{status='200'}[5m]

Answer

http_requests_total{status='200'} offset 5m

Question 3

You have two metrics: 'up' (a gauge) and 'process_cpu_seconds_total' (a counter). You want to filter 'process_cpu_seconds_total' by instances where 'up == 1'. Which join modifier is required?

Accepted Answer

process_cpu_seconds_total * on(instance) up. The 'on' modifier specifies which labels to match, and 'group_left' or 'group_right' is used for many-to-one joins.

Answer

process_cpu_seconds_total * ignoring(job) up

Answer

process_cpu_seconds_total * group_left up

Answer

process_cpu_seconds_total and on(instance) up

Question 4

How does PromQL handle operator precedence between arithmetic operators like multiplication (*) and addition (+)?

Accepted Answer

Multiplication has higher precedence than addition.. PromQL follows standard mathematical order of operations, where multiplication and division take precedence over addition and subtraction.

Answer

Operators are evaluated strictly from left to right regardless of type.

Answer

Operators are evaluated strictly from right to left.

Answer

Addition has higher precedence than multiplication.

Question 5

Which selector syntax correctly matches all time series where the environment label does NOT equal production?

Accepted Answer

http_requests_total{environment!="production"}. The != operator is the standard negative equality matcher in PromQL label selectors.

Answer

http_requests_total{environment=~"^((?!production).)*$"}

Answer

http_requests_total{environment!~"production"}

Answer

http_requests_total{environment!^"production"}

Question 6

An administrator wants to aggregate CPU usage across all nodes, keeping the instance label while summing the values. Which aggregation clause should be used?

Accepted Answer

sum by (instance) (node_cpu_seconds_total). The by clause specifies the labels that should be preserved in the aggregated result vector.

Answer

sum(node_cpu_seconds_total) keeping (instance)

Answer

sum(node_cpu_seconds_total) group by (instance)

Answer

sum without (instance) (node_cpu_seconds_total)

Question 7

When performing a vector-to-vector binary operation between two instant vectors of different label sets, which modifier allows matching on a subset of common labels?

Accepted Answer

on(...). The on modifier restricts vector matching to a specified list of labels.

Answer

group_left(...)

Answer

ignoring(...)

Answer

matching(...)

Question 8

An operator needs to query the current, un-extrapolated rate of increase per second over the last 5 minutes for a counter metric named http_requests_total. Which function should they use?

Accepted Answer

irate(http_requests_total[5m]). The irate() function calculates the per-second rate of increase of a time series based on the last two data points in the specified range window, making it ideal for volatile, high-frequency counters.

Answer

increase(http_requests_total[5m])

Answer

rate(http_requests_total[5m])

Answer

delta(http_requests_total[5m])

Question 9

A user executes an instant query for a metric without providing a range vector. What type of vector is returned by default?

Accepted Answer

Instant vector. An instant vector evaluates to a single data point per time series at the current evaluation timestamp.

Answer

String

Answer

Range vector

Answer

Scalar

Question 10

You need to calculate the 99th percentile HTTP request latency from a Prometheus histogram named http_request_duration_seconds. Which function is correct?

Accepted Answer

histogram_quantile(0.99, rate(http_request_duration_seconds_bucket[5m])). The histogram_quantile() function calculates the $\phi$-quantile from bucket time series of a histogram.

Answer

rate(histogram_quantile(0.99, http_request_duration_seconds_bucket)[5m])

Answer

quantile_over_time(0.99, http_request_duration_seconds[5m])

Answer

histogram_quantile(http_request_duration_seconds_bucket[5m], 0.99)

Question 11

An engineer needs to determine the total absolute increase in disk space consumed over the last 3 hours using a gauge metric node_disk_bytes_used. Which function is appropriate?

Accepted Answer

delta(node_disk_bytes_used[3h]). The increase() function is designed for counters, but delta() calculates the difference between the first and last value of a range vector, making it suitable for gauges.

Answer

deriv(node_disk_bytes_used[3h])

Answer

increase(node_disk_bytes_used[3h])

Answer

rate(node_disk_bytes_used[3h])

Question 12

Which PromQL aggregator should be used to count the total number of active time series matching a selector?

Accepted Answer

count(up). The count operator counts the number of time series in an instant vector.

Answer

sum(up)

Answer

len(up)

Answer

total(up)

Question 13

Which label matcher operator is used for exact equality in PromQL selectors?

Accepted Answer

=. The = operator is the standard label matcher for exact string equality.

Answer

IS

Answer

:=

Answer

==

Question 14

You are joining an instant vector of application versions with an instant vector of metrics using a many-to-one relationship. The application version vector has more labels than the metric vector. Which keyword must be appended to the matching modifier to include labels from the 'many' side?

Accepted Answer

group_left. In many-to-one or one-to-many matches, group_left or group_right must be provided to specify which side supplies additional labels.

Answer

include_labels

Answer

keep_all

Answer

group_right

Question 15

A Prometheus alert expression uses rate(http_requests_total[5m]) > 10. During a service restart, counter resets occur. How does the rate() function account for these counter resets?

Accepted Answer

It assumes the counter reset to zero and adds the new value to the previous value.. The rate() function automatically detects decreases in counter values (resets) and adjusts the calculation assuming the counter restarted at zero.

Answer

It treats the negative difference as an error and returns 0 for the entire range.

Answer

It adds a fixed offset value configured in Prometheus global settings.

Answer

It drops the samples surrounding the reset, resulting in a null value for that evaluation.

Question 16

Which regular expression matcher selects all time series where the status label begins with the digit 5?

Accepted Answer

http_requests_total{status=~"^5.*"}. The =~ operator combined with a regular expression starting with ^5 matches labels beginning with 5.

Answer

http_requests_total{status=@"5*"}

Answer

http_requests_total{status=^"5"}

Answer

http_requests_total{status=~"5$"}

Question 17

You want to find the maximum value of a gauge metric across all instances over a 1-hour sliding window. Which function accomplishes this?

Accepted Answer

max_over_time(node_memory_usage_bytes[1h]). The max_over_time() function evaluates the maximum value of all data points in a specified range vector for each time series.

Answer

max(node_memory_usage_bytes[1h])

Answer

topk(1, node_memory_usage_bytes[1h])

Answer

max_with_range(node_memory_usage_bytes, 1h)

Question 18

What is the primary difference between an instant vector and a range vector in PromQL?

Accepted Answer

An instant vector contains a single sample per time series, while a range vector contains a set of samples over time.. Instant vectors contain a single sample per time series for the given timestamp, whereas range vectors contain a set of data points over a time window.

Answer

An instant vector includes timestamps from the future, while range vectors are strictly historical.

Answer

An instant vector can only be used with counters, while range vectors can only be used with gauges.

Answer

A range vector evaluates faster because it caches historical calculations.

Question 19

You need to calculate the per-second rate of increase of http_requests_total over a 1-minute window. Why is using a 1-minute range window generally discouraged in production?

Accepted Answer

It is too short relative to typical scrape intervals, leading to high noise and sensitivity to jitter.. Prometheus scrapes most targets every 15 seconds. A 1-minute window only contains about 4 data points, making the rate calculation highly sensitive to small scraping jitters.

Answer

It disables counter reset detection algorithms.

Answer

PromQL automatically rejects any range window shorter than 5 minutes.

Answer

It causes Prometheus to run out of memory due to high sample density.

Question 20

An operator writes the query sum(rate(http_requests_total[5m])) without any aggregation clauses. What is the output format?

Accepted Answer

An instant vector containing a single element with no labels.. Aggregations without a by or without clause aggregate all time series into a single global vector with no labels.

Answer

A range vector spanning 5 minutes.

Answer

An instant vector preserving all original metric labels.

Answer

A scalar value representing the exact floating-point result.