PCDOE Implementing service monitoring strategies Practice Question

An organization is implementing SLO-based alerting for a critical service. They want to alert when the service has consumed 50% of its error budget over a 30-day window. Considering best practices for alert sensitivity and noise reduction, which alerting approach should they use?

⚠ Common exam trap

Google Cloud often tests the misconception that shorter windows (like 5 minutes) are better for fast detection, but the trap here is that overly short windows increase noise and false positives, whereas a 1-hour window with a high burn rate threshold provides the right balance for a 30-day SLO.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Alert on the burn rate over a 1-hour window with a threshold of 10.

A burn rate of 10 over a 1-hour window indicates that the service is consuming error budget at a rate that would exhaust the entire 30-day budget in 3 days (30 days / 10 = 3 days). Therefore, 50% of the budget would be consumed in 1.5 days, not 1.5 hours. This approach balances sensitivity and noise reduction by using a sufficiently long window (1 hour) to smooth out transient spikes, while the high threshold ensures only significant sustained degradation triggers an alert, aligning with SRE best practices for multi-window, multi-burn-rate alerting.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Alert on the burn rate over a 1-hour window with a threshold of 10.
Why this is correct
A burn rate of 10 over 1 hour means the error budget would be exhausted in 3 hours (30 days / 10 = 3 hours), triggering an alert when 50% is consumed in about 1.5 hours, which is timely.
✗
Alert on the burn rate over a 5-minute window with a threshold of 0.5.
Why it's wrong here
A 5-minute window is too short and may cause noisy alerts due to transient spikes.
✗
Alert on the error budget remaining with a threshold of 50%.
Why it's wrong here
This alerts after 50% is already consumed, missing the opportunity for early intervention.
✗
Alert on the SLI value directly with a threshold of 99.9%.
Why it's wrong here
This measures actual performance, not error budget consumption, and may not directly indicate budget depletion.

Go deeper

PCDOE Implementing service monitoring strategies Practice Question

Why each option matters

Option-by-option breakdown

Related to this question