CCNA Cloud Native Observability Questions

Kubernetes audit logging records API server requests, capturing details such as the authenticated user, the verb, the resource, and the response status. Enabling audit policies and log backends provides the security team with the requested record of privileged actions. This directly satisfies the requirement to audit who did what in the cluster, making it the correct feature.

The Collector's pipeline receives telemetry via receivers, optionally processes it, then exports through exporters, decoupling applications from backends. This vendor-neutral mediation satisfies the stem's requirement that data be handled independently of any specific monitoring vendor.

histogram_quantile() calculates quantiles from histogram metrics.

Context propagation is the mechanism that passes trace context, including trace ID and span ID, across service boundaries via headers or other carriers. It enables spans created in different services to be linked into a single distributed trace. Without it, each service would create isolated traces, so this concept directly addresses the need to correlate spans across microservices and understand end-to-end latency.

A gauge holds a snapshot value that can rise or fall arbitrarily, matching memory usage sampled at scrape time. Unlike counters, which only increase (or reset), gauges support set, increment and decrement operations, making them the correct type for fluctuating measurements.

The Collector is a vendor-agnostic pipeline component that receives, processes and exports telemetry, satisfying OpenTelemetry's requirement for a decoupled data path between instrumented applications and backends. It ships as a standalone binary or agent, letting you centralise batching, filtering and retries without altering application code.

OpenTelemetry supplies one vendor-neutral instrumentation standard, so traces, metrics and logs are emitted once and exported to any compatible backend. This avoids rewriting instrumentation when changing vendors, which is the core advantage over proprietary libraries.

A Counter is a monotonically increasing metric that only goes up, making it ideal for cumulative totals such as HTTP requests received. Rate or increase functions applied to the counter yield per-second request rates, whereas Gauge and Histogram serve different measurement purposes.

The metrics-server aggregates kubelet-reported resource consumption and exposes it through the Metrics API, letting Horizontal Pod Autoscalers and kubectl top read live CPU and memory figures for pods and nodes. It satisfies the requirement for cluster-wide resource usage visibility, unlike full monitoring stacks that persist historical data.

Counter is a valid Prometheus metric type representing a monotonically increasing cumulative value that only resets on restart. It is one of the four core types alongside gauge, histogram and summary, satisfying the question's requirement for valid metric types.

The OpenTelemetry Collector receives telemetry via receivers, processes it through processors such as batching, then exports it to backends. This satisfies the stem's requirement to handle data from multiple sources, acting as a vendor-neutral pipeline between instrumented services and observability platforms.

Alertmanager receives alerts fired by Prometheus, then deduplicates, groups, and routes them to receivers such as email, Slack, or PagerDuty. It also handles silencing and inhibition, preventing notification floods during outages. This satisfies the stem's requirement to manage, group, and route alerts to notification channels.

Logs are one of the three pillars of observability, alongside metrics and traces. They record discrete, timestamped events with contextual detail, enabling retrospective debugging of why a system behaved as it did, which metrics and traces alone cannot fully explain.

Counters are monotonically increasing metrics that only go up or reset to zero on restart, making them ideal for cumulative counts such as total HTTP requests received. Use rate() or increase() to derive per-second request rates from the counter.

Alerts are a downstream response mechanism built on observability data, not a source of it. The three pillars are logs, metrics, and traces; alerting consumes these signals through rules, so it does not itself constitute a pillar.

Incomplete traces typically arise when trace context is not propagated across service boundaries, so downstream spans are created without the parent trace ID and appear as separate traces rather than linked spans within one trace.

Counters are monotonically increasing values, so each HTTP request increments the total without resetting. This satisfies the stem's requirement to count cumulative requests; the rate() function then derives requests per second from that running total.

Loki indexes only metadata labels rather than full log text, storing compressed chunks in object storage, which satisfies the lightweight, cost-effective constraint. Built by Grafana Labs, it aggregates logs alongside Prometheus-style metrics, making it the purpose-built alternative to traditional full-text indexing systems such as Elasticsearch.

Gauge is a Prometheus metric type representing a value that can arbitrarily increase or decrease, such as current memory usage or temperature. It is one of the four core types alongside counter, histogram and summary.

Including the trace ID and span ID in log entries allows logs to be directly linked to the corresponding trace. When investigating a slow trace, the engineer can search logs for that trace ID and see all related log lines across services. This is a standard practice in cloud native observability and is supported by OpenTelemetry's logging integration, enabling efficient root cause analysis.

Metrics are numerical measurements aggregated over time, forming one of observability's three pillars alongside logs and traces. They satisfy the stem's requirement by enabling efficient, low-cost monitoring of system health and alerting on thresholds, since pre-aggregated time-series data scales far better than inspecting individual events.

The OpenTelemetry Collector is a vendor-neutral agent that receives telemetry in various formats, processes it, and exports it to one or more backends. It supports OTLP natively and can batch, filter, and transform data before export. In this scenario, it acts as the intermediary that takes the SDK's OTLP output and delivers it to the backend, making it the correct component for receiving, processing, and exporting telemetry.

Fluent Bit is a CNCF-hosted, C-based log processor and forwarder built for containerised environments, with a far smaller memory and CPU footprint than Fluentd. That lightweight design makes it the common Kubernetes alternative to Fluentd for node-level log collection.

Prometheus scrapes time-series metrics from instrumented targets and stores them in its local TSDB, directly fulfilling observability's metrics pillar. This satisfies the stem's requirement for the primary purpose: pulling and retaining numeric measurements for querying and alerting, rather than handling logs or distributed traces.

A 99.9% SLO permits 0.1% of requests to breach the 500ms latency threshold. With 10 million monthly requests, that error budget equals 10,000,000 × 0.001 = 10,000 requests. This satisfies the 30-day rolling window constraint exactly, leaving no headroom beyond the defined tolerance.

The OpenTelemetry API provides the interfaces and data types for instrumenting code to generate telemetry. It defines how to create spans, metrics, and logs, and is implemented by SDKs. It is a fundamental building block, as it allows developers to instrument their applications in a vendor-neutral way. Without the API, there would be no standard way to emit telemetry.

Structured logging plus sampling debug output slashes stored log volume, directly cutting storage cost, while retaining error logs in full preserves searchability for specific error patterns. This balances the cost constraint against the required troubleshooting capability.

Fluent Bit is a lightweight, low-footprint log processor and forwarder designed for constrained environments, typically deployed as a DaemonSet so one pod runs per node. It tails node and container logs and ships them to central storage, matching the aggregation requirement.

Grafana queries Prometheus directly through its native data source, rendering the time-series metrics as dashboards without altering the stored data. This satisfies the stem's requirement to visualise Prometheus metrics, since Grafana is purpose-built for dashboarding while Prometheus itself only offers basic expression-browser graphs.

Provider billing APIs expose actual spend per cluster and namespace, while utilisation data attributes that cost to workloads, revealing idle or over-provisioned resources. Correlating the two axes is what enables meaningful cost monitoring rather than raw invoice totals alone.

Jaeger provides distributed tracing by propagating context across service boundaries, letting you visualise request flows and pinpoint latency in microservices. It satisfies the CNCF graduated constraint, unlike Prometheus (metrics) or Fluentd (logs), making it the tool specifically designed for tracing in cloud-native environments.

The OpenTelemetry Collector receives telemetry from instrumented applications via OTLP receivers, then processes it through configurable processors before exporting to backends. This satisfies the stem's requirement for a component that both receives and processes data, unlike SDKs, which only generate and emit telemetry from within the application process itself.

Zipkin satisfies the distributed tracing requirement by collecting and correlating span data across microservices, using trace and span IDs propagated through request headers to reconstruct end-to-end request flows. Its lightweight, vendor-neutral design suits cloud-native architectures, where it commonly pairs with instrumentation libraries to visualise latency across service boundaries.

rate() computes the per-second average rate of increase of a counter over the given range window, automatically handling counter resets. It directly satisfies the stem's requirement to derive per-second increase from a monotonically increasing counter, unlike irate() or increase().

The Collector is a vendor-agnostic pipeline that receives telemetry via OTLP or other receivers, processes it through processors such as batching and filtering, then exports it to backends. This receive-process-export flow satisfies the stem's requirement for a central telemetry handling component.

An SLI is the quantitative measurement itself — for example request latency or error rate — expressed as a number, which is then compared against an SLO target. It measures a specific reliability aspect of the service rather than defining a threshold or agreement.

Correlation IDs help trace requests across microservices.

A span represents one logical operation within a trace, carrying its own operation name, start and end timestamps, duration, and parent-child relationships. This granular unit lets you break a distributed request into discrete steps, satisfying the stem's requirement for the building block that composes a trace.

metrics-server collects resource metrics from kubelets on each node, aggregates them, and serves them through the metrics API, which Horizontal Pod Autoscalers and kubectl top consume. It satisfies the requirement for node metric aggregation and API exposure.

The three pillars are metrics, logs and traces, which together describe system state and behaviour. Security is a separate discipline applied across those signals, not a pillar itself, so it is the correct exclusion. This satisfies the question's NOT requirement.

An SLO only matters if it reflects what users and the business actually care about, so targets must trace to business impact rather than arbitrary infrastructure metrics. This alignment ensures reliability investment addresses genuine customer-facing risk instead of technical vanity measures.

The histogram_quantile function calculates quantiles from histogram buckets. Using rate on the bucket metric over a 5-minute window accounts for counter resets and provides per-second rate of increase. This is the standard way to compute latency percentiles from histograms. The 0.99 quantile gives the 99th percentile, and the 5-minute window aligns with the alerting requirement.

A span represents one logical operation inside a service, bounded by start and end timestamps, and carries trace context linking it to parent and child spans. This satisfies the stem's distributed-tracing definition, distinct from a trace, which is the whole request path.

Context propagation is the mechanism that carries trace context, specifically the trace ID and span ID, across service boundaries. Each downstream service continues the same trace rather than starting a new one, which is what makes a distributed trace reconstructable end to end.

Structured logging emits events as key-value pairs, typically JSON, so fields like timestamp, level and service are parsed programmatically without regex. This consistent, machine-readable schema satisfies the stem's requirement for easier automated processing, filtering and aggregation across distributed systems.

Jaeger is a CNCF distributed tracing system that records and visualises request flows across microservices, using spans and trace context propagation. This makes it the primary tool for diagnosing latency and dependency issues in cloud native environments.

Structured logs store fields as discrete key-value pairs rather than free text, so queries can filter on specific attributes without regex parsing. This directly satisfies the stem's benefit of easier querying and filtering across large log volumes.

Alertmanager receives alerts fired by Prometheus, then deduplicates, groups, and routes them to receivers such as email, Slack, or PagerDuty. It also handles silencing and inhibition, controlling notification delivery rather than evaluating alert rules or storing metrics.

OpenTelemetry ships language-specific instrumentation libraries that generate telemetry for common frameworks without manual coding, satisfying the stem's requirement for project responsibilities. These libraries emit spans, metrics and logs via the OpenTelemetry API, complementing the specification and collector rather than replacing them.

Unique request IDs let a single transaction be followed across distributed services, satisfying the stem's cloud-native observability requirement for end-to-end tracing. Because each request carries its own identifier, logs from separate pods and microservices can be correlated without relying on hostnames or timestamps, which are unreliable in ephemeral, dynamically scheduled workloads.

The kubelet exposes cAdvisor metrics on its /metrics endpoint, which includes node-level and container-level CPU and memory usage. Prometheus can scrape this endpoint on each node without deploying an additional exporter. This directly meets the requirement because the kubelet is already present on every node and surfaces the needed resource metrics through its built-in cAdvisor integration.

`kube_deployment_status_replicas_ready` exposes the count of ready replicas directly from the Deployment's status, satisfying the requirement to compare ready against desired replicas. Pairing it with `kube_deployment_spec_replicas` gives the desired count, enabling an alert when readiness diverges from the specification.

The hostmetrics receiver is designed to collect host-level metrics such as CPU, memory, disk, and network usage from the node where the Collector runs. Since the Collector is deployed as a DaemonSet, one instance runs on each node, allowing hostmetrics to gather node-level metrics without any application instrumentation or code changes, exactly matching the requirement.

An SLO is a measurable reliability target, such as 99.9% of requests completing within 500ms over 30 days, that a service aims to achieve. This satisfies the stem's latency and availability threshold, whereas an SLA is a contractual commitment and an SLI is the raw measurement.

Prometheus actively initiates scrapes against configured HTTP endpoints, retrieving metrics at fixed intervals. This pull architecture satisfies the stem's requirement by having the server discover and fetch data itself, rather than passively receiving pushed measurements. Targets expose a `/metrics` path that Prometheus polls, giving it control over collection timing and target health.

Routes in Alertmanager match incoming alerts by label and direct them to the appropriate receiver, while grouping and deduplication happen within that routing tree. Configuring a route therefore satisfies the requirement to deduplicate, group and deliver the alert to the correct team.

The cluster-wide scrape of every pod creates excessive active time series and concurrent target load, which drives memory usage and scrape deadline errors. Dropping unneeded targets and metrics through relabeling lowers cardinality, while sharding distributes scrape work across multiple Prometheus instances so no single server is overwhelmed, preserving observability for the metrics that matter.

A trace represents the entire journey of a request through a distributed system, composed of multiple spans that share a common trace ID. It allows developers to see the full path and timing of a request across services. This is exactly what is needed to correlate operations from different services and a database call under a single logical unit.

Fluent Bit is a lightweight log processor and forwarder commonly used as a DaemonSet in Kubernetes to collect logs from nodes and pods. Elasticsearch provides scalable storage and search capabilities, while Kibana offers visualization and querying. This combination, often called the EFK stack, is a standard solution for centralized logging in cloud native environments, directly addressing the requirements.

Context propagation transmits trace context (trace ID, span ID, sampling flags) across service boundaries via protocols such as W3C Trace Context headers. This satisfies the stem's requirement to correlate spans from separate microservices across network calls, letting each downstream service join the same distributed trace rather than starting an unrelated one.

`kubectl logs` streams stdout and stderr captured by the container runtime for a specific container in a pod, satisfying the stem's request for container-level output. It reads from the node's log files rather than cluster events or API audit records, so it returns application output only.

Fluent Bit is a CNCF log processor and forwarder written in C with a small memory and CPU footprint, designed for constrained environments. It collects container logs and ships them to backends, satisfying the lightweight log aggregation requirement in Kubernetes.

Logs are one of observability's pillars, recording discrete timestamped events that reveal what happened within a system. This satisfies the stem's requirement by providing the detailed, high-cardinality event data that metrics and traces alone cannot capture for debugging specific failures.

OpenTelemetry is the CNCF project supplying vendor-neutral APIs, SDKs and specifications for metrics, logs and traces together, so it satisfies the stem's requirement for one unified standard covering all three telemetry signals rather than separate per-signal agents.

Distributed tracing records spans across service calls, letting teams reconstruct which services invoke which, including latency and error propagation. That reconstructed call graph directly reveals the dependency graph between microservices, a core tracing use case.

SLA denotes Service Level Agreement, a documented commitment defining expected service levels such as availability, latency and error budgets. In service reliability it formalises the target against which reliability is measured and error budgets are derived.

JSON output gives each log entry discrete, machine-parseable fields rather than an opaque string, so aggregators such as Loki, Elasticsearch or Cloud Logging can index and query individual attributes. This satisfies the observability requirement by enabling filtering, correlation and alerting without brittle regex parsing.

The -c flag selects a specific container within a multi-container pod, so kubectl logs app-pod -c sidecar returns only the sidecar container's output. Without it, kubectl logs on a multi-container pod fails or prompts for a container name, so this syntax satisfies the requirement precisely.

Processors in the OpenTelemetry Collector operate on telemetry data between receivers and exporters. They can modify, filter, or drop attributes. For example, the attributes processor can delete or hash sensitive fields like credit card numbers. This makes processors the correct component to sanitize data before it leaves the cluster, ensuring compliance and privacy.

Distributed tracing tracks request flow and identifies slow components.

The OpenTelemetry API defines vendor-neutral interfaces for instrumenting code to emit traces, metrics and logs, decoupling telemetry generation from any backend. It satisfies the stem's requirement for a genuine project component, sitting alongside the SDK and Collector as one of OpenTelemetry's core building blocks.

Prometheus's kubernetes_sd_configs allows it to query the Kubernetes API server to discover targets such as pods, services, and endpoints. This enables automatic scraping of new pods as they appear, without manual configuration. It is the standard method for dynamic service discovery in Kubernetes environments, making it the correct choice for this scenario.

Headers like traceparent are used to propagate trace context across HTTP calls.

A Counter is a cumulative Prometheus metric that only increases or resets to zero on restart, suitable for totals such as requests served. PromQL's rate() and increase() functions operate on counters, distinguishing them from gauges, histograms, and summaries.