PCA Promql Practice Test 5 — 15 Questions

Question 1

You are using the 'predict_linear()' function to forecast disk space exhaustion based on the metric 'node_filesystem_free_bytes'. What type of input data does predict_linear require?

Accepted Answer

A range vector of gauge values and a time duration scalar.. predict_linear() requires a range vector of gauge values (e.g., node_filesystem_free_bytes[1h]) and a scalar representing the number of seconds into the future to predict. It uses linear regression over the range to forecast the value at the future time.

Answer

An instant vector representing current disk space.

Answer

Two instant vectors joined via an 'on' clause.

Answer

A counter range vector wrapped in a rate() function.

Question 2

You want to find the top 3 jobs with the highest CPU usage using the metric 'process_cpu_seconds_total'. Which PromQL query structure is correct?

Accepted Answer

topk(3, rate(process_cpu_seconds_total[5m])). The correct PromQL structure is topk(3, rate(process_cpu_seconds_total[5m])). topk takes the instant-vector result of rate() over a 5-minute range vector and returns the 3 series with the highest values. The rate() function is required because process_cpu_seconds_total is a counter, and raw counter values would rank by total lifetime CPU rather than current usage.

Answer

bottomk(3, rate(process_cpu_seconds_total[5m]))

Answer

topk(3, process_cpu_seconds_total[5m])

Answer

topk(rate(process_cpu_seconds_total[5m]), 3)

Question 3

Which TWO of the following are valid data types returned by PromQL queries? (Choose two)

Accepted Answer

Range vector. PromQL, the query language used by Prometheus, defines exactly four expression data types: instant vector, range vector, scalar, and string. Option B (Range vector) is correct because a range vector is a set of time series containing a range of data points over time for each series, produced by appending a duration selector like [5m] to a selector (e.g., http_requests_total[5m]). Option D (Instant vector) is correct because it is the most common PromQL result type: a set of time series containing a single sample for each series at a given timestamp, returned by expressions such as http_requests_total. The unmarked options do not belong: 'Histogram matrix' (A) is not a PromQL type—histograms are exposed as instant or range vectors of bucket series, and 'matrix' is not a PromQL data type name; 'Log stream' (C) is a Loki concept, not PromQL; and 'Distributed trace' (E) is a tracing data type (e.g., from Tempo/Jaeger), not a PromQL return type.

Answer

Histogram matrix

Answer

Log stream

Answer

Distributed trace

Question 4

Which TWO of the following label matching operators are supported in Prometheus label selectors? (Choose two)

Accepted Answer

= (exact equality). Prometheus label selectors support the exact equality operator =, as in http_requests_total{job="api"}, which matches series whose label value is exactly the given string, so option A is correct. They also support the regular expression match operator =~, as in http_requests_total{job=~"api|web"}, which matches series whose label value matches the anchored RE2 regular expression, so option B is correct. The remaining operators are not part of PromQL selector syntax: #= is not a wildcard operator, == is a comparison operator used in expressions rather than label matching, and := is not a Prometheus label matching operator at all.

Answer

#= (wildcard match)

Answer

== (boolean equality comparison)

Answer

:= (assignment and match)

Question 5

Which THREE of the following functions can be used with counter metrics to calculate rates or increases? (Choose three)

Accepted Answer

irate(). The three correct functions are irate(), rate(), and increase(). irate() (B) computes the per-second instant rate of increase of a counter over the last two samples, making it suitable for volatile counter metrics. rate() (D) calculates the average per-second rate of increase of a counter over a specified time range, which is the standard way to derive rates from counters. increase() (E) returns the total increase of a counter over a given time range, effectively rate() multiplied by the range duration, and is designed specifically for counter metrics. predict_linear() (A) performs linear regression to extrapolate future values and is not a rate/increase function for counters, while deriv() (C) estimates the per-second derivative using linear regression on gauges, not counters.

Answer

predict_linear()

Answer

deriv()

Question 6

When performing vector matching between two vectors of different cardinalities, which THREE vector matching modifiers can be used? (Choose three)

Accepted Answer

on. In PromQL, when performing binary operations between two instant vectors that have different label sets or cardinalities, the on modifier restricts matching to an explicitly specified set of labels, which is essential for one-to-one matching across differing label dimensions. The group_left modifier allows a many-to-one or one-to-many match by permitting the left vector to have multiple series matching a single series on the right, which is exactly how different cardinalities are reconciled. The ignoring modifier excludes specified labels from the matching process, enabling matches between vectors whose label sets differ by the ignored labels. group_by is not a valid PromQL vector matching modifier (it is not a keyword in binary operations), and match_any is not a PromQL modifier at all, so neither belongs here.

Answer

group_by

Answer

match_any

Question 7

Which THREE built-in functions in PromQL are designed specifically to analyze changes over time for gauge metrics? (Choose three)

Accepted Answer

delta(). delta() is correct because it computes the difference between the first and last sample values of a gauge over a specified range, directly measuring change over time. deriv() is correct because it calculates the per-second derivative of a gauge using simple linear regression, quantifying the rate of change of the gauge's value. predict_linear() is correct because it applies linear regression over a gauge's range to extrapolate future values, which is inherently a time-based change analysis for gauges. rate() and increase() are not correct here because they are designed for counters, not gauges — rate() computes the per-second average rate of increase of a counter, and increase() computes the total counter increase over a range, both of which assume monotonically increasing counter semantics.

Answer

rate()

Answer

increase()

Question 8

Which THREE aggregation operators in PromQL support the 'by' and 'without' clause modifiers? (Choose three)

Accepted Answer

sum. The three correct answers are A (sum), C (avg), and E (count). These are all PromQL aggregation operators, and every aggregation operator in PromQL — including sum, avg, count, min, max, stddev, stdvar, topk, bottomk, quantile, count_values, and group — accepts the by and without clause modifiers to control how the input vector is grouped before aggregation. For example, sum by (job) (http_requests_total) aggregates per job, while sum without (instance) (http_requests_total) aggregates across all labels except instance. Option B (histogram_quantile) is a function, not an aggregation operator, and it does not take by/without clauses; it operates on buckets produced by an aggregation such as sum by (le) (rate(...)). Option D (label_replace) is a label-manipulation function that rewrites label values and likewise does not support by/without grouping modifiers.

Answer

histogram_quantile

Answer

label_replace

Question 9

Which TWO of the following statements regarding PromQL subqueries are correct? (Choose two)

Accepted Answer

Subqueries allow instant vector queries to be passed as range vector inputs to functions like max_over_time().. Option B is correct because a PromQL subquery wraps an instant vector expression and evaluates it over a time range, producing a range vector that can be fed into range-vector functions such as max_over_time(), avg_over_time(), or rate(). Option C is correct because the subquery syntax is exactly [:], for example max_over_time(rate(http_requests_total[5m])[1h:1m]). Option A is wrong because subqueries do not bypass the storage engine; they still query TSDB data and typically add overhead by evaluating the inner expression at each resolution step. Option D is wrong because subqueries operate on instant vector expressions (the inner expression must return an instant vector), not exclusively on range vectors. Option E is wrong because the resolution parameter is optional; when omitted, Prometheus uses the global evaluation_interval as the default step.

Answer

Subqueries execute faster than standard instant queries because they bypass the storage engine.

Answer

Subqueries can only be executed against range vectors, never instant vectors.

Answer

The resolution parameter in a subquery is mandatory.

Question 10

Which TWO of the following are valid ways to modify or add labels to time series in PromQL? (Choose two)

Accepted Answer

label_replace(). label_replace() (A) is a valid PromQL function that creates or modifies a label on each time series by matching a regex against a source label and writing a replacement value into a destination label, so it can both add and modify labels. label_join() (B) is also a valid PromQL function that concatenates values from multiple source labels into a single destination label, effectively adding or overwriting that label on each series. The remaining options are not real PromQL functions: label_update() (C), label_drop() (D), and label_add() (E) do not exist in the PromQL function set, so they cannot be used to modify or add labels.

Answer

label_update()

Answer

label_drop()

Answer

label_add()

Question 11

What is the result of applying a range selector like [5m] to a gauge metric?

Accepted Answer

A range vector containing all data points from the last 5 minutes.. Applying a range selector like [5m] to a gauge metric in PromQL returns a range vector containing all samples for that metric over the last 5 minutes. Range vectors are the input required by functions like rate(), increase(), and avg_over_time(). The selector does not aggregate or reduce the data — it simply collects the time series samples in the window.

Answer

A scalar value representing the sum.

Answer

An instant vector of the average over 5 minutes.

Answer

An error, because gauges are not time-series.

Question 12

You need to calculate the per-second rate of increase for a counter metric over the last 10 minutes. Which function is most appropriate?

Accepted Answer

rate(metric[10m]). rate() is the standard function for calculating the per-second rate of increase over a range vector.

Answer

increase(metric[10m])

Answer

irate(metric[10m])

Answer

delta(metric[10m])

Question 13

Which operator has the highest precedence in PromQL?

Accepted Answer

Exponentiation (^). In PromQL, the exponentiation operator (^) has the highest precedence among binary operators, higher than multiplicative, additive, comparison, and logical operators. This means expressions like 2 ^ 3 * 4 are parsed as (2 ^ 3) * 4. Knowing precedence is essential for writing correct PromQL without excessive parentheses.

Answer

Logical OR (or)

Answer

Addition (+)

Answer

Equality (==)

Question 14

What is the purpose of the 'offset' modifier in a PromQL query?

Accepted Answer

To change the time range of a query to a point in the past.. The 'offset' modifier allows querying data from the past relative to the current time.

Answer

To remove specific label dimensions.

Answer

To filter out noise from the last 5 minutes.

Answer

To increase the precision of a rate calculation.

Question 15

Which aggregation operator would you use to calculate the total sum of a metric across all instances?

Accepted Answer

sum(). The sum() aggregation operator in PromQL takes an instant vector and aggregates all matching time series into a single value by summing their current sample values. When applied across all instances of a metric (e.g., sum(node_cpu_seconds_total)), it produces the total across every series returned by the selector. This is exactly the semantics needed to compute a fleet-wide total of a metric.

Answer

avg_over_time()

Answer

total()

Answer

count()