75 of 81 questions · Page 1/2 · Promql · Answers revealed
If you perform 'A / B' where A and B have different sets of labels, what happens?
Without group or matching modifiers, no series will match.
Why this answer
Binary operations require matching labels unless modifiers are used; otherwise, the result is empty.
Which THREE of the following functions can be used with counter metrics to calculate rates or increases? (Choose three)
irate() calculates the instantaneous rate of increase for counters.
Why this answer
Counters can be used with rate(), irate(), and increase() functions (among others like delta() for gauges, though delta is technically for gauges, increase is for counters).
Which TWO of the following statements about PromQL label matchers are correct? (Choose TWO)
Correct. = is exact match.
Why this answer
PromQL supports exact equality (=), negative equality (!=), regular expression matching (=~), and negative regular expression matching (!~).
You need to calculate the per-second rate of increase of http_requests_total over a 1-minute window. Why is using a 1-minute range window generally discouraged in production?
Correct. Short windows capture too few data points to produce stable rates.
Why this answer
Prometheus scrapes most targets every 15 seconds. A 1-minute window only contains about 4 data points, making the rate calculation highly sensitive to small scraping jitters.
Which function should be used to smooth out short-term fluctuations in a gauge metric by calculating the rolling average over a 10-minute window?
Correct. avg_over_time computes the average over a range window for gauges.
Why this answer
The avg_over_time() function calculates the average value of all data points in the specified range vector for each time series.
You are joining two vectors where the left vector has labels {job="api", instance="host1"} and the right vector has labels {job="api", region="us-east"}. You use the query 'vector_a + ignoring(instance, region) vector_b'. What does the 'ignoring' modifier do?
'ignoring' drops the specified labels from the matching calculation so that series with different instance or region values can still match on remaining labels.
Why this answer
The 'ignoring' modifier instructs Prometheus to ignore specified labels when conducting vector matching between two vectors.
What is the primary difference between an instant vector and a range vector in PromQL?
Correct. Instant vectors represent a single point in time, range vectors represent a historical window.
Why this answer
Instant vectors contain a single sample per time series for the given timestamp, whereas range vectors contain a set of data points over a time window.
What is the difference between 'count' and 'count_values'?
count_values creates new time series based on value frequency.
Why this answer
count aggregates by number of series, while count_values counts the number of occurrences of each sample value.
You are troubleshooting a query and notice that label_replace is being used. What is the primary function of label_replace(v, dst_label, replacement, src_label, regex)?
Correct. label_replace modifies or creates labels based on regular expression extractions.
Why this answer
The label_replace function matches the regex against the value of src_label, and if it matches, sets dst_label to the replacement string.
Which THREE of the following are valid set operators in PromQL for combining instant vectors? (Choose THREE)
Correct. 'unless' is the complement set operator.
Why this answer
PromQL supports three set operators: and (intersection), unless (complement), and or (union).
Which function evaluates the predictable linear extrapolation of a gauge metric over time to predict future values?
Correct. predict_linear uses linear regression on a range vector to predict values in the future.
Why this answer
The predict_linear() function predicts the value of a gauge metric 't' seconds into the future based on a range vector using simple linear regression.
When writing a query with arithmetic operators, how does PromQL handle vector matching when both vectors have the exact same label sets?
Correct. Identical label sets match automatically in one-to-one operations.
Why this answer
By default, PromQL performs a one-to-one match when the label sets of both vectors are identical.
Which TWO of the following statements regarding native histograms in Prometheus are correct? (Choose TWO)
Correct. histogram_quantile() supports native histograms seamlessly.
Why this answer
Native histograms store multiple buckets within a single chunk/sample, reducing storage overhead and allowing dynamic bucket resolutions.
You need to perform a binary operation between two vectors where the left vector has labels {job="api", instance="a"} and the right vector has labels {job="api"}. You want to match them using the job label while retaining the instance label from the left side. Which modifier configuration is correct?
Correct. on(job) matches on job, and group_left(instance) pulls the instance label from the left side.
Why this answer
To match on a subset of labels while retaining extra labels on the left side during a one-to-many or many-to-one operation, group_left must be used with the on modifier.
Which of the following selectors matches metric names that start with 'http_'?
Using the internal '__name__' label with the '=~' regex operator matches metric names starting with 'http_'.
Why this answer
The regex matcher '=~' is used with regular expressions, and '^' anchors the match to the beginning of the string.
When performing vector matching between two vectors of different cardinalities, which THREE vector matching modifiers can be used? (Choose three)
'on' restricts which labels are used for matching.
Why this answer
PromQL vector matching modifiers include on, ignoring, group_left, and group_right.
A Prometheus selector includes a negative regex match for environment names: 'environment!="staging"'. Which selector operator achieves this using regular expressions instead of exact matching?
The '!~' operator performs a negative regular expression match.
Why this answer
The '!=' operator is for exact inequality, while '!~' is the negative regular expression match operator in PromQL.
You are joining an instant vector of application versions with an instant vector of metrics using a many-to-one relationship. The application version vector has more labels than the metric vector. Which keyword must be appended to the matching modifier to include labels from the 'many' side?
Correct. group_left allows labels from the 'many' side to be included in the result.
Why this answer
In many-to-one or one-to-many matches, group_left or group_right must be provided to specify which side supplies additional labels.
Which TWO of the following are valid data types returned by PromQL queries? (Choose two)
A range vector is a fundamental PromQL result type containing a set of data points over a time range for each time series.
Why this answer
PromQL queries evaluate to one of four types: instant vector, range vector, scalar, or string.
A user executes an instant query for a metric without providing a range vector. What type of vector is returned by default?
Correct. Queries without a range selector return instant vectors.
Why this answer
An instant vector evaluates to a single data point per time series at the current evaluation timestamp.
Which operator performs a logical 'not' on a comparison?
unless provides set difference logic.
Why this answer
The 'unless' set operator is used to filter out series that match the right-hand side.
An engineer executes topk(3, http_requests_total). What happens if there are fewer than 3 time series matching the selector?
Correct. topk returns up to k elements if fewer exist.
Why this answer
If an instant vector has fewer elements than $k$, topk returns all available elements in the vector without error.
You are using the 'predict_linear()' function to forecast disk space exhaustion based on the metric 'node_filesystem_free_bytes'. What type of input data does predict_linear require?
predict_linear takes a range vector (e.g., [1h]) and a scalar duration, requiring gauge inputs.
Why this answer
predict_linear predicts the value of a gauge metric 't' seconds into the future based on a range vector using linear regression.
Which TWO of the following are valid aggregation operators in PromQL?
sum is a built-in aggregation.
Why this answer
sum and stddev are standard aggregation operators for reducing vector dimensionality.
An operator writes a query to calculate error percentage: sum(rate(errors[5m])) / sum(rate(total[5m])) * 100. What happens if the denominator evaluates to zero or has no matching time series?
Correct. Division by zero or empty vectors results in an empty result in PromQL.
Why this answer
Division by zero or division by an empty vector in PromQL results in an empty vector output.
You are monitoring a counter metric 'errors_total' and need to calculate the total number of errors that occurred over the last 1 hour. Which function is most appropriate?
increase() provides the total increase of the counter over the 1-hour window.
Why this answer
The increase() function returns the total increase in the time series over the specified range vector, properly accounting for counter resets.
You need to calculate the ratio of successful HTTP requests (status 200) to total HTTP requests. Both metrics are counters named 'http_requests_total'. How do you construct this query to ensure proper label matching between status='200' and total requests?
Using 'ignoring(status)' allows matching time series that differ only in the 'status' label, successfully computing the ratio.
Why this answer
To divide two vectors with different label sets (e.g., status='200' vs all statuses), you must use binary matching modifiers like 'ignoring(status)' or 'on'.
You need to calculate the 99th percentile of request latency across all instances using a Prometheus histogram metric 'http_request_duration_seconds_bucket'. Which function and setup is correct?
histogram_quantile takes the target quantile (0.99) and the per-second rate of bucket counts over a range vector.
Why this answer
The histogram_quantile() function calculates the $\phi$-quantile from the buckets of a histogram metric. It requires the bucket metric and the quantile as arguments.
What is the behavior of the clamp_max() function when applied to an instant vector?
Correct. Values above the maximum are set to the maximum value.
Why this answer
clamp_max clamps the values of all time series in the vector to a specified maximum upper limit.
A Prometheus administrator wants to query the current value of the metric 'http_requests_total'. Which of the following PromQL expressions should be used?
This is an instant vector selector, returning the most recent sample for each time series.
Why this answer
An instant vector selector like 'http_requests_total' queries the current value (instant vector) of a metric. Range vectors require a duration in brackets.
You are joining an instant vector of application metrics with a static configuration instant vector containing target metadata using 'on(instance) group_right'. What does the 'group_right' modifier achieve?
group_right ensures that all series from the right-hand side are kept in the resulting vector, joined with matching left-hand side series.
Why this answer
In a many-to-one or one-to-many match, group_right causes the metric on the right-hand side to be included for every matching left-hand side, keeping all labels from the right side and supplementing them.
When should you use the 'absent()' function?
absent() is standard for 'missing metric' alerts.
Why this answer
absent() returns a time series if the input vector is empty, useful for alerting on missing metrics.
Which label matcher operator is used for exact equality in PromQL selectors?
Correct. The = operator matches labels that are exact matches to the provided string.
Why this answer
The = operator is the standard label matcher for exact string equality.
When evaluating a PromQL query involving arithmetic operators, such as 'vector1 + vector2 * vector3', which operator has the highest precedence?
Multiplication has higher precedence and is evaluated before addition.
Why this answer
Multiplication (*) and division (/) have higher precedence than addition (+) and subtraction (-) in PromQL.
Which TWO of the following label matching operators are supported in Prometheus label selectors? (Choose two)
The '=' operator matches labels equal to the provided string exactly.
Why this answer
Prometheus supports '=' (exact match), '!=' (exact mismatch), '=~' (regex match), and '!~' (regex mismatch).
Which THREE of the following are valid time-range units in PromQL?
Minutes is a valid unit.
Why this answer
s, m, h, d, w, y are all valid Prometheus duration units.
Which THREE of the following modifiers or keywords are used in PromQL binary vector matching? (Choose THREE)
Correct. 'group_left' handles many-to-one joins.
Why this answer
Binary vector matching modifiers include on, ignoring, group_left, and group_right.
A Prometheus alert expression uses rate(http_requests_total[5m]) > 10. During a service restart, counter resets occur. How does the rate() function account for these counter resets?
Correct. rate() detects drops and handles them by assuming a reset to 0.
Why this answer
The rate() function automatically detects decreases in counter values (resets) and adjusts the calculation assuming the counter restarted at zero.
Which THREE aggregation operators in PromQL support the 'by' and 'without' clause modifiers? (Choose three)
sum supports grouping via 'by' and 'without'.
Why this answer
Most PromQL aggregators support grouping clauses. Examples include sum, avg, min, max, count, stddev, stdvar, bottomk, topk, quantile.
Which PromQL function is specifically designed to calculate the per-second average rate of increase of a time series over a given range vector?
rate() calculates the per-second average rate of increase of counter time series.
Why this answer
The rate() function is designed for counters to calculate the per-second average rate of increase, handling counter resets automatically.
When using 'irate', what is the impact of choosing a range vector that is too small (e.g., [10s])?
irate is sensitive to small fluctuations between the two most recent points.
Why this answer
irate only looks at the last two data points in the range; if the range is too small, it might miss changes.
When evaluating a rule with offset, such as http_requests_total offset 1h, what exact time does Prometheus query?
Correct. offset shifts the evaluation window into the past.
Why this answer
The offset modifier shifts the evaluation time backward by the specified duration relative to the evaluation timestamp.
Which TWO of the following are valid ways to modify or add labels to time series in PromQL? (Choose two)
label_replace allows matching and replacing regex patterns in label values.
Why this answer
PromQL provides label_replace and label_join to modify and construct labels dynamically.
You want to find the maximum value of a gauge metric across all instances over a 1-hour sliding window. Which function accomplishes this?
Correct. max_over_time finds the maximum value across the range vector.
Why this answer
The max_over_time() function evaluates the maximum value of all data points in a specified range vector for each time series.
An administrator wants to aggregate CPU usage across all nodes, keeping the instance label while summing the values. Which aggregation clause should be used?
Correct. The 'by' clause keeps the specified list of labels and drops all others.
Why this answer
The by clause specifies the labels that should be preserved in the aggregated result vector.
You want to find the top 3 jobs with the highest CPU usage using the metric 'process_cpu_seconds_total'. Which PromQL query structure is correct?
topk correctly takes k=3 and an instant vector derived from rate().
Why this answer
The topk() function takes an integer 'k' and an instant vector (typically wrapped in rate()), returning the top k time series with the highest values.
When evaluating a histogram metric, what does the special pseudo-label le represent in bucket time series?
Correct. 'le' stands for less than or equal to, defining bucket boundaries.
Why this answer
The le (less than or equal to) label represents the upper bound of a histogram bucket.
Which aggregation operator would you use to calculate the total sum of a metric across all instances?
sum() aggregates values across all series.
Why this answer
sum() is the standard operator for calculating totals across dimensions.
What is the purpose of the 'offset' modifier in a PromQL query?
Offset shifts the time window for the instant or range vector.
Why this answer
The 'offset' modifier allows querying data from the past relative to the current time.
Which PromQL aggregator should be used to count the total number of active time series matching a selector?
Correct. count returns the number of series in the vector.
Why this answer
The count operator counts the number of time series in an instant vector.
When calculating the 95th percentile from a histogram, why is histogram_quantile(0.95, sum(rate(http_duration_seconds_bucket[5m])) by (le)) the recommended pattern?
Summing by the 'le' label merges distributions while preserving the necessary bucket structure.
Why this answer
Aggregation must occur before the quantile calculation to ensure all buckets are summed across labels.
When writing a PromQL query involving a vector and a scalar, such as 'node_memory_free_bytes / (1024 * 1024)', how does Prometheus handle label matching?
A scalar operation applies to every time series in the instant vector without altering or matching labels.
Why this answer
Operations between an instant vector and a scalar are performed on each data point of the vector. Labels are unaffected.
Which TWO of the following are true regarding instant vectors?
By definition, instant vectors are a single point in time.
Why this answer
Instant vectors contain a single sample per time series, typically the most recent.
Which TWO of the following conditions will cause the rate() function to return NaN or empty results? (Choose TWO)
Correct. Zero samples in the range window result in no output.
Why this answer
rate() requires range vectors with sufficient data points and valid counter metrics. Stale series or ranges with zero samples yield empty or NaN results.
You need to calculate the per-second rate of increase for a counter metric over the last 10 minutes. Which function is most appropriate?
rate() divides the total increase by the number of seconds in the range.
Why this answer
rate() is the standard function for calculating the per-second rate of increase over a range vector.
Which THREE of the following are valid ways to modify a binary operation join?
group_right is a valid join modifier.
Why this answer
on, ignoring, group_left, and group_right are the valid modifiers for binary joins.
Which selector syntax correctly matches all time series where the environment label does NOT equal production?
Correct. The != operator matches time series where the label does not match the given string.
Why this answer
The != operator is the standard negative equality matcher in PromQL label selectors.
Which THREE of the following functions are specifically designed to be used with range vectors? (Choose THREE)
Correct. delta() takes a range vector.
Why this answer
Functions like rate(), increase(), and delta() require range vectors as arguments, whereas sum() and max() operate on instant vectors.
Which TWO of the following are valid metric types natively supported by Prometheus? (Choose TWO)
Correct. Gauge represents a single numerical value that can go up and down.
Why this answer
Prometheus natively supports four core metric types: Counter, Gauge, Histogram, and Summary.
How does PromQL handle operator precedence between arithmetic operators like multiplication (*) and addition (+)?
Correct. Multiplication evaluates before addition.
Why this answer
PromQL follows standard mathematical order of operations, where multiplication and division take precedence over addition and subtraction.
Which THREE of the following are valid aggregation operators in PromQL? (Choose THREE)
Correct. stddev is a valid aggregator.
Why this answer
PromQL provides numerous aggregation operators including sum, min, max, avg, stddev, stdvar, count, count_values, bottomk, topk, and quantile.
Which regular expression matcher selects all time series where the status label begins with the digit 5?
Correct. The regex ^5.* matches any string starting with 5.
Why this answer
The =~ operator combined with a regular expression starting with ^5 matches labels beginning with 5.
Which TWO of the following statements about 'rate' vs 'irate' are correct?
rate() provides a smoother average over time.
Why this answer
rate is better for smooth graphs, irate is for high-precision local spikes.
How does Prometheus handle subqueries embedded within an instant query, such as rate(http_requests_total[5m])[30m:1m]?
Correct. Subqueries allow range vector functions to be applied over historical evaluated points.
Why this answer
A subquery evaluates an instant query expression over a given range with a specified resolution at multiple points in time, returning a range vector.
Which THREE built-in functions in PromQL are designed specifically to analyze changes over time for gauge metrics? (Choose three)
delta() calculates the difference between the first and last value of a gauge in a range vector.
Why this answer
Functions like delta(), deriv(), and predict_linear() (as well as idelta) operate on gauges over range vectors.
Which TWO of the following statements regarding PromQL subqueries are correct? (Choose two)
Subqueries bridge the gap by allowing instant query results to be fed into range functions like max_over_time().
Why this answer
Subqueries allow running an instant vector query over a historical time range with a specified resolution and lookback delta.
Which function would you use to find the maximum value of a gauge metric 'node_cpu_load' over the past 30 minutes?
max_over_time() correctly computes the maximum value over the specified range vector for each time series.
Why this answer
The max_over_time() function calculates the maximum value of all data points in the specified range vector for each time series.
You need to calculate the 99th percentile HTTP request latency from a Prometheus histogram named http_request_duration_seconds. Which function is correct?
Correct. It takes the quantile, a rate of the bucket metric, and computes the value.
Why this answer
The histogram_quantile() function calculates the $\phi$-quantile from bucket time series of a histogram.
What is the purpose of the instant vector selector syntax http_requests_total{job="api-server"}?
Correct. It filters instant samples based on metric name and label matchers.
Why this answer
It selects the current value of all time series for the metric http_requests_total that have the label job set to api-server.
Which function is best suited for identifying the 'top 5' instances with the highest value for a specific metric?
topk returns the top N elements.
Why this answer
topk() is the designated function for returning the N largest samples from an input vector.
Which operator has higher precedence in PromQL: exponential (^), multiplication (*), or addition (+)?
Correct. Exponentiation has the highest operator precedence.
Why this answer
Exponentiation has the highest precedence in PromQL, followed by multiplication/division, and then addition/subtraction.
An operator needs to find the rate of change of a counter using deriv(). Why is this considered a bad practice in Prometheus?
Correct. deriv() treats counters as gauges and fails on resets.
Why this answer
deriv() is designed for linear regression on gauge metrics over range vectors and does not handle counter resets, leading to incorrect downward spikes when counters reset.
Which operator has the highest precedence in PromQL?
Exponentiation is the highest precedence operator in PromQL.
Why this answer
PromQL operator precedence follows standard mathematical rules: ^ > *, /, %, +, -.
An operator needs to query the current, un-extrapolated rate of increase per second over the last 5 minutes for a counter metric named http_requests_total. Which function should they use?
Correct because irate calculates the per-second instant rate based on the last two points.
Why this answer
The irate() function calculates the per-second rate of increase of a time series based on the last two data points in the specified range window, making it ideal for volatile, high-frequency counters.
What is the result of applying a range selector like [5m] to a gauge metric?
Range vectors capture the history of samples for each series.
Why this answer
A range selector converts an instant vector into a range vector, containing all samples in that window.
Ready to test yourself?
Try a timed practice session using only Promql questions.