304 questions total · 5pages · All types, answers revealed
Which THREE of the following are required to expose a new metric in an application?
Essential step.
Why this answer
To expose metrics, you need to define a collector, register it with a registry, and serve it via an HTTP endpoint.
Which THREE of the following are valid metric types in Prometheus?
Correct.
Why this answer
The four main metric types supported by Prometheus are Counter, Gauge, Histogram, and Summary.
Which TWO of the following are valid ways to prevent alert flapping?
Extends the firing state to buffer against noise.
Why this answer
The 'for' duration and 'keep_firing_for' are both mechanisms to prevent alerts from toggling state too quickly.
Why does the 'rate()' function in PromQL behave unexpectedly on counter resets?
Prometheus handles monotonic counter resets automatically.
Why this answer
A counter reset (going to 0) would produce a massive negative number if not handled. 'rate()' automatically accounts for this by assuming a reset occurred.
You want to monitor the status of a specific SSL certificate via blackbox_exporter. Which module is designed for this?
The http_2xx module is used to probe TLS certificates.
Which tool allows you to visualize Prometheus alerts directly in a web UI?
The Alertmanager UI specifically lists firing and inhibited alerts.
Why this answer
The Prometheus built-in web UI provides an 'Alerts' tab to view current alert statuses.
Which regular expression matcher selects all time series where the status label begins with the digit 5?
Correct. The regex ^5.* matches any string starting with 5.
Why this answer
The =~ operator combined with a regular expression starting with ^5 matches labels beginning with 5.
Which TWO of the following statements about 'rate' vs 'irate' are correct?
rate() provides a smoother average over time.
Why this answer
rate is better for smooth graphs, irate is for high-precision local spikes.
How does Prometheus handle subqueries embedded within an instant query, such as rate(http_requests_total[5m])[30m:1m]?
Correct. Subqueries allow range vector functions to be applied over historical evaluated points.
Why this answer
A subquery evaluates an instant query expression over a given range with a specified resolution at multiple points in time, returning a range vector.
Which THREE features are provided by Grafana when used with Prometheus?
Primary function.
Why this answer
Visualization, dashboard templating, and alert integration are core Grafana features.
Which THREE built-in functions in PromQL are designed specifically to analyze changes over time for gauge metrics? (Choose three)
delta() calculates the difference between the first and last value of a gauge in a range vector.
Why this answer
Functions like delta(), deriv(), and predict_linear() (as well as idelta) operate on gauges over range vectors.
Which TWO of the following statements regarding PromQL subqueries are correct? (Choose two)
Subqueries bridge the gap by allowing instant query results to be fed into range functions like max_over_time().
Why this answer
Subqueries allow running an instant vector query over a historical time range with a specified resolution and lookback delta.
Which THREE actions are commonly performed during the 'relabeling' phase in Prometheus?
Used for normalization.
Why this answer
Replacing labels, dropping series, and mapping labels are standard relabeling actions.
Which metric type is most appropriate for tracking the current total number of active user sessions?
Gauges track fluctuating values like current sessions.
Why this answer
Since the count of active sessions can rise and fall, a gauge is the correct metric type.
You have a recording rule named 'job:node_cpu:avg_rate_5m'. Where is this metric stored once the rule is executed?
Recording rules result in new metrics being stored in the TSDB.
Why this answer
Recording rules store the result of the expression as a new time series in the Prometheus TSDB.
Which THREE of these are common Prometheus data sources?
Common for fixed targets.
Why this answer
Kubernetes service discovery, static file configs, and Consul are standard discovery methods.
If you have a metric `http_requests_total` and want the increase over 5 minutes, what is the best PromQL syntax?
This returns the count increase.
Why this answer
The `increase()` function is specifically designed to calculate the increase of counter values over a specified range.
Which function would you use to find the maximum value of a gauge metric 'node_cpu_load' over the past 30 minutes?
max_over_time() correctly computes the maximum value over the specified range vector for each time series.
Why this answer
The max_over_time() function calculates the maximum value of all data points in the specified range vector for each time series.
Which THREE of the following are common use cases for the node_exporter?
node_exporter collects memory usage stats.
Why this answer
node_exporter is designed to expose hardware and OS-level metrics such as CPU usage, memory usage, and filesystem occupancy.
A batch job runs for only 30 seconds every hour. How should you expose these metrics to Prometheus?
The Pushgateway allows transient jobs to push metrics to a persistent location.
Why this answer
The Pushgateway is designed specifically for short-lived jobs that cannot be scraped directly.
You need to calculate the 99th percentile HTTP request latency from a Prometheus histogram named http_request_duration_seconds. Which function is correct?
Correct. It takes the quantile, a rate of the bucket metric, and computes the value.
Why this answer
The histogram_quantile() function calculates the $\phi$-quantile from bucket time series of a histogram.
You are seeing 'Alerting rule evaluation error' in your logs. What is the most likely cause?
Syntax errors in the query expression prevent the rule from evaluating.
Why this answer
Syntactic errors in the PromQL query within an alerting rule will cause evaluation failures.
What is the purpose of the instant vector selector syntax http_requests_total{job="api-server"}?
Correct. It filters instant samples based on metric name and label matchers.
Why this answer
It selects the current value of all time series for the metric http_requests_total that have the label job set to api-server.
Which function is best suited for identifying the 'top 5' instances with the highest value for a specific metric?
topk returns the top N elements.
Why this answer
topk() is the designated function for returning the N largest samples from an input vector.
What is the impact of naming a metric starting with an underscore?
These names are reserved by the system.
Why this answer
Metric names starting with underscores are reserved for internal use by Prometheus and should be avoided for user-defined metrics.
Which operator has higher precedence in PromQL: exponential (^), multiplication (*), or addition (+)?
Correct. Exponentiation has the highest operator precedence.
Why this answer
Exponentiation has the highest precedence in PromQL, followed by multiplication/division, and then addition/subtraction.
Which TWO are common types of Prometheus exporters?
Standard host monitoring.
Why this answer
Node Exporter and Blackbox Exporter are the most common official ones.
An operator needs to find the rate of change of a counter using deriv(). Why is this considered a bad practice in Prometheus?
Correct. deriv() treats counters as gauges and fails on resets.
Why this answer
deriv() is designed for linear regression on gauge metrics over range vectors and does not handle counter resets, leading to incorrect downward spikes when counters reset.
Which component allows Prometheus to be scaled horizontally for high availability?
Running multiple identical Prometheus servers is the standard way to achieve HA.
Why this answer
Prometheus instances are typically run in parallel to provide HA; there is no single 'scaling' component.
An engineer observes a massive spike in Prometheus memory usage after introducing a new custom label that includes a unique user ID. Which observability concept is being violated?
Including highly unique values like user IDs in labels creates excessive time series, causing high memory usage.
Why this answer
High cardinality occurs when a metric label has an unbounded number of unique values, which causes Prometheus to create a unique time series for every combination, leading to memory exhaustion.
When instrumenting an application, why is it recommended to use a fixed set of label names?
Label names should be static to keep the number of series manageable.
Why this answer
Dynamically changing label names creates new time series, which can lead to cardinality explosion and storage issues.
A developer wants to expose a metric that represents the current memory usage of a process. Which type is most appropriate?
Gauges are perfect for values that fluctuate over time.
Why this answer
A Gauge represents a numerical value that can arbitrarily go up and down, such as memory usage or temperature.
You observe data gaps in your Prometheus graph after increasing the scrape interval. What is the most likely cause?
If the scrape takes longer than the timeout, the scrape fails, resulting in gaps.
Why this answer
If the scrape interval is too long, the 'scrape_duration' may exceed the interval or cause stale data handling issues.
A developer adds a 'user_id' label to an HTTP request counter. What is the operational risk?
Each user_id will create a separate time series.
Why this answer
Adding a high-cardinality dimension like 'user_id' can explode the number of time series created, crashing the TSDB.
Which THREE of these are recommended practices for an observability strategy?
Logs provide the 'why'.
Why this answer
Alerting on symptoms, monitoring the Golden Signals, and keeping logs for detailed debugging are best practices.
Which action should be avoided when creating labels for custom metrics?
High-cardinality labels cause excessive memory usage and performance degradation.
Why this answer
Adding high-cardinality data (like user IDs or unique request IDs) to labels causes an explosion in the number of time series, which can crash Prometheus.
Which TWO of the following are valid data types in Prometheus?
Standard type.
Why this answer
Prometheus supports Gauges and Counters as primary metric types.
Why would you choose to create a recording rule for a complex PromQL query?
Recording rules improve performance for expensive queries.
Why this answer
Recording rules pre-calculate complex queries, making dashboards load faster by querying the pre-computed series instead of re-calculating the entire expression.
Which TWO of the following can be configured globally?
Global default.
Why this answer
Global configuration includes scrape interval and evaluation interval.
What is the benefit of the 'service discovery' feature in Prometheus?
Auto-scaling environments require dynamic discovery.
Why this answer
It automatically updates the list of targets to scrape, eliminating manual updates when infrastructure scales.
You need to expose metrics from a legacy application that only logs to a file. What should you do?
This collector reads metrics from files on disk.
Why this answer
The node_exporter textfile collector is designed to read metrics from a specific directory where you can drop files containing Prometheus-formatted data.
Why are traces considered distinct from metrics in observability?
This is the fundamental definition of distributed tracing.
Why this answer
Traces provide context on a single request's path through a distributed system, whereas metrics provide aggregated health status.
A developer wants to track the total number of requests received by a web service. Which metric type is most appropriate for this requirement?
Counters are the correct metric type for tracking total increments like request counts.
Why this answer
Counters are cumulative metrics that represent a single monotonically increasing counter whose value can only increase or be reset to zero on restart. This is ideal for request counts.
When using the Pushgateway, what happens if you push a metric with the same name and labels as an existing one?
Pushgateway updates the metric group based on the provided set.
Why this answer
The Pushgateway overwrites the existing metric with the new value provided in the push request.
Which THREE of the following are valid approaches to instrumenting an application?
Correct.
Why this answer
Common approaches are using official libraries, custom HTTP exporters, or batch job pushing.
Which operator has the highest precedence in PromQL?
Exponentiation is the highest precedence operator in PromQL.
Why this answer
PromQL operator precedence follows standard mathematical rules: ^ > *, /, %, +, -.
You are creating a recording rule to calculate the rate of requests over 5 minutes. Why would you prefer a recording rule over a direct dashboard query?
Precomputing expensive queries improves dashboard performance significantly.
Why this answer
Recording rules precompute expensive queries, reducing the load on Prometheus and speeding up dashboard loading times.
What is the default port used by node_exporter?
9100 is the registered default port for node_exporter.
Why this answer
The standard Prometheus convention for node_exporter is port 9100.
When configuring Alertmanager to send notifications to Slack, which block defines the routing tree?
The route block is the root of the alerting decision tree.
Why this answer
The 'route' block defines the top-level tree for incoming alerts.
You have a metric that is a gauge and fluctuates. What happens if you use the 'rate()' function on a gauge?
The rate() function requires a counter and will error on gauges.
Why this answer
rate() is specifically designed for counters; it will not behave as expected on gauges and usually returns an error or empty result.
An operator needs to query the current, un-extrapolated rate of increase per second over the last 5 minutes for a counter metric named http_requests_total. Which function should they use?
Correct because irate calculates the per-second instant rate based on the last two points.
Why this answer
The irate() function calculates the per-second rate of increase of a time series based on the last two data points in the specified range window, making it ideal for volatile, high-frequency counters.
Why are metric names required to follow a specific character set (e.g., alphanumeric and colons)?
The language syntax requires strictly formatted names.
Why this answer
Prometheus metric names must match a regex to ensure they are compatible with the query language and internal storage format.
What is the purpose of the 'keep_firing_for' field in an alerting rule?
It extends the firing state to smooth out minor fluctuations.
Why this answer
It keeps an alert in the firing state for a specified duration after the underlying expression is no longer true, which helps prevent flapping.
Which THREE factors influence Prometheus memory usage?
Alert evaluation consumes memory.
Why this answer
Memory is consumed by the number of series, the size of the WAL, and the number of active alerts.
Which file format does Prometheus use for its main configuration?
Prometheus uses YAML for its primary configuration file.
Why this answer
Prometheus configuration is strictly defined in YAML format.
Which metric type is best for reporting the number of requests received by a service?
Counters track cumulative events.
Why this answer
Counters are monotonic; they only go up, which is perfect for request counts.
What is the result of applying a range selector like [5m] to a gauge metric?
Range vectors capture the history of samples for each series.
Why this answer
A range selector converts an instant vector into a range vector, containing all samples in that window.
Which THREE labels are often considered part of the default Prometheus ecosystem metrics?
Standard for histograms.
Why this answer
While 'job' and 'instance' are standard, 'group' is not a standard automatic label.
An operator writes the query sum(rate(http_requests_total[5m])) without any aggregation clauses. What is the output format?
Correct. Global aggregation drops all labels and returns a single time series.
Why this answer
Aggregations without a by or without clause aggregate all time series into a single global vector with no labels.
When performing a vector-to-vector binary operation between two instant vectors of different label sets, which modifier allows matching on a subset of common labels?
Correct. The 'on' modifier restricts matching to the listed labels.
Why this answer
The on modifier restricts vector matching to a specified list of labels.
Which annotation is commonly used to provide a human-readable description in an alert?
The 'description' annotation is used to provide details about the alert.
Why this answer
The 'summary' or 'description' annotations are standard practices for providing context in alert notifications.
Which THREE of the following are components of a Prometheus alert state?
Normal state.
Why this answer
Alerts transition through inactive, pending, and firing states.
You need to ensure that an alert remains 'firing' for 5 minutes before the Alertmanager is notified. Which field in the Prometheus alerting rule should you configure?
The 'for' field allows a duration to be specified before an alert is considered firing.
Why this answer
The 'for' field in a Prometheus alerting rule specifies the duration for which a condition must be true before the alert transitions from 'pending' to 'firing'.
An engineer needs to determine the total absolute increase in disk space consumed over the last 3 hours using a gauge metric node_disk_bytes_used. Which function is appropriate?
Correct. delta calculates the difference between start and end values of a range vector for gauges.
Why this answer
The increase() function is designed for counters, but delta() calculates the difference between the first and last value of a range vector, making it suitable for gauges.
An SRE team is transitioning from traditional logs to metrics for performance monitoring. Which scenario best justifies using metrics over logs?
Metrics are designed for calculating rates and aggregates over time.
Why this answer
Metrics are numerical representations of data measured over time, making them efficient for time-series analysis and alerting, whereas logs are better for debugging specific events.
Which THREE of the following are valid label matchers?
Regex not match matcher.
Why this answer
Prometheus supports =, !=, =~, and !~.
You need to prevent an alert from firing if a maintenance window is active. How should you approach this in Alertmanager?
Silences allow you to mute specific alerts based on label matchers for a set time.
Why this answer
Silences are the standard way to prevent specific alerts from firing during a known maintenance period.
Which THREE of the following are valid Prometheus TSDB file types?
Stores compressed time series data.
Why this answer
The TSDB architecture includes chunks, index, and WAL files.
What is the purpose of the 'up' metric?
The 'up' metric reflects scrape success status.
Why this answer
The 'up' metric is 1 if the target was successfully scraped and 0 otherwise.
You have a recording rule that references a metric that doesn't exist. What is the impact?
If the expression finds no series, it simply does not create a new metric.
Why this answer
The recording rule will be evaluated, but because the expression returns no data, no new time series will be created for that rule.
When executing a subquery in PromQL, such as 'max_over_time(rate(http_request_total[5m])[30m:1m])', what does the resolution parameter ('1m') specify?
The step parameter defines the resolution at which the inner expression is evaluated over the historical window.
Why this answer
The resolution inside subquery brackets specifies the evaluation step size at which the inner expression is evaluated within the subquery range.
When implementing a custom exporter, what format must the output follow to be correctly scraped by Prometheus?
The Prometheus text exposition format is the standard for custom exporters.
Why this answer
Prometheus requires a text-based format where each metric is represented by lines, including name, labels, and values.
Which TWO of the following are valid Alertmanager configuration blocks?
Defines the alerting tree.
Why this answer
Alertmanager config includes global settings, route definitions, and receivers.
What is the primary role of the 'Alertmanager'?
Alertmanager handles the alert lifecycle.
Why this answer
Alertmanager is responsible for grouping, silencing, and routing alerts to external systems like PagerDuty or email.
You are monitoring server hardware metrics using node_exporter. You observe that the metrics are not showing up in Prometheus. Which initial troubleshooting step is most effective?
Connectivity to the exporter endpoint is the first requirement for successful scraping.
Why this answer
The node_exporter must be running and listening on the expected port (9100 by default) for the Prometheus server to scrape it. Verifying the port ensures the endpoint is reachable.
Practice PCA by domain
Target a specific domain to shore up weak areas.