304 questions total · 5pages · All types, answers revealed
A user executes an instant query for a metric without providing a range vector. What type of vector is returned by default?
Correct. Queries without a range selector return instant vectors.
Why this answer
An instant vector evaluates to a single data point per time series at the current evaluation timestamp.
Your application has a short-lived batch job that finishes before the Prometheus server can scrape it. What architectural component should be used?
Pushgateway provides an intermediary for short-lived jobs to push metrics.
Why this answer
The Pushgateway is designed to allow ephemeral and batch jobs to expose their metrics to Prometheus.
You want to ensure that if the Alertmanager cluster loses communication, alerts are still sent. Which configuration helps achieve this?
Clustering ensures Alertmanager instances share state and suppress duplicate notifications.
Why this answer
High Availability (HA) for Alertmanager is achieved by running multiple instances and using the '--cluster.peer' flag to link them.
When configuring Service Discovery in Kubernetes, why might you use relabeling?
Relabeling is the primary tool to strip labels to save TSDB memory.
Why this answer
Relabeling is used to modify, drop, or keep metrics based on label values, which is essential for managing cardinality and filtering unwanted data.
You have two alerts: 'InstanceDown' and 'HighErrorRate'. You want to inhibit 'HighErrorRate' if 'InstanceDown' is firing for the same instance. Where do you configure this logic?
The Alertmanager config manages alert grouping, inhibition, and routing.
Why this answer
Inhibition rules are defined within the 'inhibit_rules' section of the Alertmanager configuration file.
Which operator performs a logical 'not' on a comparison?
unless provides set difference logic.
Why this answer
The 'unless' set operator is used to filter out series that match the right-hand side.
An engineer executes topk(3, http_requests_total). What happens if there are fewer than 3 time series matching the selector?
Correct. topk returns up to k elements if fewer exist.
Why this answer
If an instant vector has fewer elements than $k$, topk returns all available elements in the vector without error.
You are using the 'predict_linear()' function to forecast disk space exhaustion based on the metric 'node_filesystem_free_bytes'. What type of input data does predict_linear require?
predict_linear takes a range vector (e.g., [1h]) and a scalar duration, requiring gauge inputs.
Why this answer
predict_linear predicts the value of a gauge metric 't' seconds into the future based on a range vector using linear regression.
Which TWO of the following are valid aggregation operators in PromQL?
sum is a built-in aggregation.
Why this answer
sum and stddev are standard aggregation operators for reducing vector dimensionality.
Which tool would you use to monitor the availability of a website from various geographic locations?
Blackbox exporter is designed for external probing.
An operator writes a query to calculate error percentage: sum(rate(errors[5m])) / sum(rate(total[5m])) * 100. What happens if the denominator evaluates to zero or has no matching time series?
Correct. Division by zero or empty vectors results in an empty result in PromQL.
Why this answer
Division by zero or division by an empty vector in PromQL results in an empty vector output.
You are monitoring a counter metric 'errors_total' and need to calculate the total number of errors that occurred over the last 1 hour. Which function is most appropriate?
increase() provides the total increase of the counter over the 1-hour window.
Why this answer
The increase() function returns the total increase in the time series over the specified range vector, properly accounting for counter resets.
Which mechanism allows Prometheus to discover targets by reading a list from a file?
file_sd_configs watches files for changes in target definitions.
Why this answer
file_sd_configs is designed to read target lists from JSON or YAML files.
You need to calculate the ratio of successful HTTP requests (status 200) to total HTTP requests. Both metrics are counters named 'http_requests_total'. How do you construct this query to ensure proper label matching between status='200' and total requests?
Using 'ignoring(status)' allows matching time series that differ only in the 'status' label, successfully computing the ratio.
Why this answer
To divide two vectors with different label sets (e.g., status='200' vs all statuses), you must use binary matching modifiers like 'ignoring(status)' or 'on'.
Which THREE of the following are considered part of the 'Four Golden Signals' of monitoring?
A core golden signal.
Why this answer
The four golden signals are Latency, Traffic, Errors, and Saturation.
What is the purpose of the 'rule_files' configuration?
rule_files contain the alerting and recording rule logic.
Why this answer
rule_files point to recording and alerting rules that Prometheus evaluates.
You need to calculate the 99th percentile of request latency across all instances using a Prometheus histogram metric 'http_request_duration_seconds_bucket'. Which function and setup is correct?
histogram_quantile takes the target quantile (0.99) and the per-second rate of bucket counts over a range vector.
Why this answer
The histogram_quantile() function calculates the $\phi$-quantile from the buckets of a histogram metric. It requires the bucket metric and the quantile as arguments.
Which TWO of the following should be considered when defining metric names?
Correct.
Why this answer
Names should be descriptive and use the unit suffix as per conventions.
What is the behavior of the clamp_max() function when applied to an instant vector?
Correct. Values above the maximum are set to the maximum value.
Why this answer
clamp_max clamps the values of all time series in the vector to a specified maximum upper limit.
When using the Prometheus Go client, what is the difference between a Gauge and a GaugeVec?
GaugeVec is used for metrics that require dimensions (labels).
Why this answer
A Gauge represents a single value, whereas a GaugeVec allows you to have multiple gauges identified by a set of variable labels.
What is the primary language used to query Prometheus data?
PromQL is the standard query language for Prometheus.
Why this answer
PromQL (Prometheus Query Language) is the functional query language for Prometheus.
Which file format is used to define Prometheus alerting rules?
Prometheus rules are defined in YAML files.
Why this answer
Prometheus configuration and rules files use the YAML format.
A Prometheus administrator wants to query the current value of the metric 'http_requests_total'. Which of the following PromQL expressions should be used?
This is an instant vector selector, returning the most recent sample for each time series.
Why this answer
An instant vector selector like 'http_requests_total' queries the current value (instant vector) of a metric. Range vectors require a duration in brackets.
You are joining an instant vector of application metrics with a static configuration instant vector containing target metadata using 'on(instance) group_right'. What does the 'group_right' modifier achieve?
group_right ensures that all series from the right-hand side are kept in the resulting vector, joined with matching left-hand side series.
Why this answer
In a many-to-one or one-to-many match, group_right causes the metric on the right-hand side to be included for every matching left-hand side, keeping all labels from the right side and supplementing them.
A dashboard shows a latency spike that doesn't correlate with CPU usage. What should you investigate next?
These are common non-CPU bottlenecks.
Why this answer
If CPU is not the bottleneck, the issue is likely I/O saturation, network contention, or a downstream dependency delay.
What is the default port that Prometheus listens on?
Prometheus defaults to port 9090.
Why this answer
9090 is the well-known default port for the Prometheus server web interface.
What is the purpose of a 'grouping' configuration in the Alertmanager 'route' block?
Grouping combines alerts sharing specified labels into one notification bundle.
Why this answer
Grouping categorizes multiple alerts into a single notification based on common label sets, reducing alert fatigue.
Which TWO of the following labels are specifically associated with Histograms?
Metric suffix for sums.
Why this answer
Histograms use 'le' for buckets and 'sum'/'count' for total metrics.
If you are using a Histogram, what is the purpose of the '_sum' metric?
This allows calculating averages.
Why this answer
The _sum metric provides the sum of all observed values, which allows calculating the average when combined with the _count metric.
Which THREE of the following are valid Alertmanager routing tree parameters?
Define notification recipient.
Why this answer
Routes can filter by 'match', 'match_re', and define a 'receiver'.
You want to rename a metric during the scrape process. Which configuration block is appropriate?
metric_relabel_configs allows modifying labels of existing metrics.
Why this answer
relabel_configs is the correct way to modify metric labels (including __name__) before they are ingested.
You have a histogram metric tracking request durations. You need to calculate the 99th percentile across all instances in a cluster. Why is this difficult with standard Prometheus metrics?
Precise quantiles cannot be computed after the fact; one must rely on bucket approximations.
Why this answer
Histograms track counts in predefined buckets. Without knowing the exact distribution of values within those buckets, calculating accurate quantiles across multiple instances or time windows is an approximation.
What does the `_count` suffix denote in a summary or histogram?
It tracks how many times the metric has been observed.
Why this answer
The _count suffix represents the total number of observations made for that specific metric.
When running node_exporter, how can you disable specific collectors like 'textfile'?
This is the correct flag to disable the textfile collector.
Why this answer
Collectors can be disabled using the --no-collector.<name> flag.
What is the purpose of a Gauge metric?
Gauges track instantaneous state.
Why this answer
A gauge represents a single numerical value that can arbitrarily go up and down, such as temperature or memory usage.
What label is automatically added by Prometheus to all scraped metrics?
The instance label reflects the target address.
Why this answer
Prometheus automatically attaches the 'instance' label to identify the target source.
You notice your custom exporter is timing out during scraping. What is the most likely cause?
The exporter must respond within the defined timeout window.
Why this answer
If the exporter is overloaded or generating a massive amount of data, the scrape_timeout value in Prometheus might be too low.
Which component is responsible for receiving alerts from Prometheus and managing notification delivery?
Alertmanager handles the full lifecycle of alerts.
Why this answer
Alertmanager is the dedicated component for deduplicating, grouping, and routing alerts.
You are seeing 'NaN' values in your gauge metrics. What does this indicate?
NaN is a valid floating point representation for gauge states.
Why this answer
NaN (Not a Number) is a valid value for gauges in Prometheus, often indicating that a value is currently undefined or not applicable.
Which monitoring philosophy is core to the Prometheus architecture?
Prometheus pulls metrics from targets at controlled intervals.
Why this answer
Prometheus favors the pull model, where the server controls the scrape rate and frequency, providing better control over the load on the monitoring system.
What is the primary drawback of using the Pushgateway for long-running services?
Prometheus won't know if the source process is actually dead.
Why this answer
Using the Pushgateway removes the 'up' status check that Prometheus performs on targets, and it can become a bottleneck or single point of failure.
Which TWO of the following are true regarding Prometheus Histograms?
Correct.
Why this answer
Histograms consist of cumulative counters and allow for server-side quantile calculation.
What is the primary goal of observability?
This is the definition of observability.
Why this answer
Observability aims to answer 'why' a system is in its current state by understanding its internal state through outputs (metrics, logs, traces).
You have a recording rule that uses 'sum() by (instance)'. Why might this be inefficient for large clusters?
Each unique instance label combination creates a new time series.
Why this answer
High cardinality labels, if not handled correctly, can lead to a massive number of time series, consuming excessive memory and storage.
When should you use the 'absent()' function?
absent() is standard for 'missing metric' alerts.
Why this answer
absent() returns a time series if the input vector is empty, useful for alerting on missing metrics.
How do you apply a global notification delay in Alertmanager?
group_wait provides the initial delay for grouping alerts.
Why this answer
The 'group_wait' parameter at the root route level defines the time to wait before sending an initial notification for a new alert group.
You are designing a monitoring architecture for an ephemeral, auto-scaling microservices environment. Why is the Prometheus 'pull' model generally preferred over a 'push' model in this scenario?
Prometheus handles the discovery process, ensuring new targets are scraped automatically without client-side configuration.
Why this answer
Pull models allow the monitoring system to handle service discovery and target management centrally, preventing issues with configuration drift when instances are added or removed dynamically.
When a Prometheus server is restarted, how does it recover the in-memory data?
The WAL stores data that hasn't been flushed to disk blocks yet.
Why this answer
It replays the Write-Ahead Log (WAL) to reconstruct the in-memory head block.
You are creating a Grafana dashboard and need to display a gauge showing the current CPU usage percentage from a Prometheus data source. Which function is most appropriate?
Queries like 'node_cpu_seconds_total' provide the instantaneous current value suitable for a gauge.
Why this answer
For a current value, you do not need an aggregation over time; you just query the metric directly.
You are instrumenting a Go application. What is the standard way to register a metric?
This is the standard registration method in the Go client library.
Why this answer
The prometheus.MustRegister() function is the standard way to register custom metrics with the default registry.
When evaluating the 'Traffic' golden signal, what is the best metric to watch for a web service?
This measures traffic volume.
Why this answer
Request rate (requests per second) is the standard way to measure traffic volume.
You need to send critical alerts to a specific Slack channel while warning alerts go to email. Where should this routing logic be defined?
The route tree evaluates alerts against matchers to assign them to the correct receiver.
Why this answer
The Alertmanager 'routes' configuration tree uses matchers to determine which receiver handles specific alerts based on labels.
Which label matcher operator is used for exact equality in PromQL selectors?
Correct. The = operator matches labels that are exact matches to the provided string.
Why this answer
The = operator is the standard label matcher for exact string equality.
When evaluating a PromQL query involving arithmetic operators, such as 'vector1 + vector2 * vector3', which operator has the highest precedence?
Multiplication has higher precedence and is evaluated before addition.
Why this answer
Multiplication (*) and division (/) have higher precedence than addition (+) and subtraction (-) in PromQL.
Which TWO of the following are common reasons to use the Pushgateway?
Correct.
Why this answer
Pushgateway is used for batch jobs that finish quickly and for processes that are behind a firewall.
What is the benefit of using recording rules?
Precomputing results avoids recalculating them on every query.
Why this answer
Recording rules precompute expensive queries and store them as new series, improving performance.
Your Prometheus server is hitting high memory usage due to high cardinality. Which action is most effective at reducing memory pressure?
Dropping labels prevents high-cardinality metrics from being stored in TSDB.
Why this answer
Reducing label cardinality (e.g., removing unique user IDs) is the primary way to reduce TSDB index size and memory usage.
What is the purpose of 'tombstones' in the TSDB?
Tombstones record that certain data should be ignored.
Why this answer
Tombstones track data points that have been deleted, allowing them to be ignored during queries until they are compacted.
Which THREE of the following are common sources of high cardinality?
High variety of unique strings.
Why this answer
High cardinality often comes from user-provided IDs, timestamps in labels, or dynamic URL parameters.
Which TWO of the following label matching operators are supported in Prometheus label selectors? (Choose two)
The '=' operator matches labels equal to the provided string exactly.
Why this answer
Prometheus supports '=' (exact match), '!=' (exact mismatch), '=~' (regex match), and '!~' (regex mismatch).
Your team is defining Service Level Objectives (SLOs) for a web application. Which metric is most indicative of the 'Traffic' golden signal?
Request rate is the standard definition of traffic in the golden signals framework.
Why this answer
Traffic is a measure of demand on the system, typically represented by request rate per second.
How does the 'stale marker' work in Prometheus?
This prevents 'trailing' lines on graphs.
Why this answer
When a target stops responding, Prometheus writes a stale marker to the TSDB so that graphs stop at the last known value rather than showing an infinite line or incorrect data.
Which tool would you pair with Prometheus to visualize the collected data?
Grafana provides the UI/dashboards.
Why this answer
Grafana is the standard visualization tool that integrates deeply with Prometheus as a data source.
Which THREE of the following are valid time-range units in PromQL?
Minutes is a valid unit.
Why this answer
s, m, h, d, w, y are all valid Prometheus duration units.
What is the primary difference between a metric and a log?
This is the classic distinction between the two.
Why this answer
Metrics are aggregated, numeric data points over time, while logs are timestamped records of specific events.
Which of the following best describes the function of the 'continue: true' setting within an Alertmanager route?
By default, routing stops at the first match; 'continue: true' enables further matching.
Why this answer
Setting 'continue: true' allows an alert to match multiple routes, ensuring it can be sent to multiple destinations if desired.
Which THREE of the following modifiers or keywords are used in PromQL binary vector matching? (Choose THREE)
Correct. 'group_left' handles many-to-one joins.
Why this answer
Binary vector matching modifiers include on, ignoring, group_left, and group_right.
A Prometheus alert expression uses rate(http_requests_total[5m]) > 10. During a service restart, counter resets occur. How does the rate() function account for these counter resets?
Correct. rate() detects drops and handles them by assuming a reset to 0.
Why this answer
The rate() function automatically detects decreases in counter values (resets) and adjusts the calculation assuming the counter restarted at zero.
Which component is strictly required to monitor batch jobs in a Prometheus ecosystem?
Pushgateway acts as a metrics buffer for transient jobs.
Why this answer
The Pushgateway is specifically designed to allow ephemeral batch jobs to push metrics, which Prometheus then pulls.
Which golden signal would you monitor to detect if a specific API endpoint is returning 404s?
Error rates are the primary source for identifying 4xx/5xx issues.
Why this answer
The 'Errors' signal tracks the rate of failed requests, including HTTP 4xx and 5xx codes.
In Alertmanager, what is the role of the 'continue' field in a route?
It allows an alert to match multiple routes, enabling multi-destination routing.
Why this answer
If 'continue' is set to true, Alertmanager will match the alert against subsequent sibling routes instead of stopping at the first match.
A team is transitioning from a traditional logging system to a metrics-based monitoring approach. Which category of observability data should the team prioritize to specifically identify the 'Latency' golden signal?
Metrics are the standard for measuring the four golden signals, including latency.
Why this answer
Latency measures the time it takes to service a request, which is best captured via time-series metrics rather than unstructured logs or traces.
Which TWO of the following are true about the Blackbox exporter?
Correct.
Why this answer
It is used for active probing and supports multiple modules for different protocols.
Which TWO of the following can be modified in 'relabel_configs'?
Standard usage.
Why this answer
Relabeling can modify any label, including the address or metric name.
What does the 'firing' state mean for an alert?
The condition met the threshold and the duration requirement.
Why this answer
An alert enters the 'firing' state when its condition expression evaluates to true for the specified 'for' duration.
Practice PCA by domain
Target a specific domain to shore up weak areas.