Observability Alerts Quiz
Related Document: Observability Alerts
Multiple Choice Questions
1. What PromQL expression detects CPU throttling in containers?
- A)
container_cpu_usage_seconds_total - B)
rate(container_cpu_cfs_throttled_seconds_total[5m]) > 0 - C)
container_memory_usage_bytes - D)
kube_pod_status_phase
Show Answer
Answer: B) rate(container_cpu_cfs_throttled_seconds_total[5m]) > 0
Explanation: CPU throttling occurs when a container exceeds its CPU limit. The container_cpu_cfs_throttled_seconds_total metric tracks time spent throttled. A positive rate indicates active throttling that may impact application performance.
2. What is the purpose of Alertmanager's group_by configuration?
- A) To delete alerts
- B) To aggregate alerts with matching labels into single notifications
- C) To increase alert severity
- D) To route alerts to logs
Show Answer
Answer: B) To aggregate alerts with matching labels into single notifications
Explanation:group_by combines multiple firing alerts that share specified label values into a single notification. This reduces alert fatigue during incidents that trigger many similar alerts (e.g., all pods in a deployment failing).
3. Which metric is most important for detecting EKS Auto Mode node termination?
- A)
node_cpu_seconds_total - B)
kube_node_status_conditionwith condition="Ready" - C)
container_memory_usage_bytes - D)
node_filesystem_size_bytes
Show Answer
Answer: B) kube_node_status_condition with condition="Ready"
Explanation: Monitoring kube_node_status_condition for Ready=false detects nodes becoming unavailable. In Auto Mode, this indicates node termination or replacement. Combined with labels, you can track node lifecycle and replacement patterns.
4. What does for duration in a Prometheus alerting rule specify?
- A) How long to keep alerts in history
- B) How long a condition must be true before firing
- C) The alert evaluation interval
- D) Notification timeout
Show Answer
Answer: B) How long a condition must be true before firing
Explanation: The for clause specifies the duration a condition must continuously be true before the alert transitions from "pending" to "firing." This prevents alerts on brief spikes and reduces false positives.
5. How should alert severity levels be defined?
- A) All alerts should be critical
- B) Based on business impact and required response time
- C) Randomly assigned
- D) Based on metric name
Show Answer
Answer: B) Based on business impact and required response time
Explanation: Severity should reflect impact: critical for customer-facing outages requiring immediate response, warning for degradation needing attention within hours, and info for awareness without action. This enables appropriate routing and on-call escalation.
6. What PromQL function calculates the rate of increase over time?
- A)
sum() - B)
rate() - C)
max() - D)
count()
Show Answer
Answer: B) rate()
Explanation:rate() calculates the per-second average rate of increase over a time range. It's designed for counters and handles counter resets. For example, rate(http_requests_total[5m]) gives requests per second averaged over 5 minutes.
7. What is the recommended approach for packet drop alerts?
- A) Alert on any single packet drop
- B) Alert when drop rate exceeds a threshold sustained over time
- C) Never alert on packet drops
- D) Only log packet drops
Show Answer
Answer: B) Alert when drop rate exceeds a threshold sustained over time
Explanation: Occasional packet drops are normal in networks. Alerts should trigger on sustained elevated drop rates that indicate real issues. Using rate() over a window (e.g., 5m) with a threshold prevents alerts on transient spikes.
8. In Alertmanager routing, what does continue: true do?
- A) Stops processing further routes
- B) Allows the alert to match additional routes after the current one
- C) Repeats the alert notification
- D) Silences the alert
Show Answer
Answer: B) Allows the alert to match additional routes after the current one
Explanation: By default, Alertmanager stops at the first matching route. Setting continue: true allows an alert to match multiple routes, enabling scenarios like sending critical alerts to both PagerDuty and Slack simultaneously.
9. What metric indicates network bandwidth exceeded on EKS nodes?
- A)
container_cpu_usage_seconds_total - B)
node_network_transmit_bytes_totalapproaching instance network limits - C)
kube_pod_container_status_running - D)
container_fs_writes_bytes_total
Show Answer
Answer: B) node_network_transmit_bytes_total approaching instance network limits
Explanation:node_network_transmit_bytes_total and node_network_receive_bytes_total track network I/O. Comparing the rate to EC2 instance network bandwidth limits helps identify when workloads are hitting network constraints.
10. What is the purpose of alert inhibition rules in Alertmanager?
- A) To increase alert priority
- B) To suppress dependent alerts when a parent alert is firing
- C) To route alerts to different receivers
- D) To create new alerts
Show Answer
Answer: B) To suppress dependent alerts when a parent alert is firing
Explanation: Inhibition rules prevent alert storms by silencing downstream alerts when a root cause alert fires. For example, when "NodeDown" fires, inhibit all "PodNotReady" alerts for pods on that node since they're symptoms of the same issue.