Top 30 Intermediate Monitoring & SRE Concepts Quiz

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   What does it signify if an SRE team consistently operates well within its allocated error budget?

   • aThe system design is robust enough to handle future growth without additional investment.
   • bThe team is being overly cautious, potentially sacrificing innovation for unnecessary stability.
   • cThe service's availability target is likely too ambitious for its current operational state.
   • dThe team is effectively minimizing downtime and maximizing user satisfaction.
   Show the answer

   Answer: b · The team is being overly cautious, potentially sacrificing innovation for unnecessary stability.

   The card explicitly states that having too much error budget left over signals being "too conservative and slowing innovation," indicating that resources might be better spent on new features or calculated risks. Option D is tempting but incorrect because the card notes that users often cannot perceive the difference between high and extreme reliability, making excessive investment in stability pointless.

   Read the full bite: Embracing Risk: Reliability Is a Budget, Not a Goal

2. Question 2 of 30

   Which characteristic is most crucial for an effective Service Level Indicator (SLI)?

   • aIt establishes the acceptable threshold for service reliability.
   • bIt specifies the contractual obligations for service uptime.
   • cIt directly reflects the user's experience or perception of service performance.
   • dIt quantifies internal system health metrics like CPU usage.
   Show the answer

   Answer: c · It directly reflects the user's experience or perception of service performance.

   The card explicitly states that an effective SLI measures what matters to the user, focusing on their experience rather than internal system metrics. Option D describes a common pitfall, as system metrics are causes, not symptoms felt by users, and should not be primary SLIs.

   Read the full bite: Service Level Indicators: Measuring What Matters

3. Question 3 of 30

   What is the typical immediate consequence when a service's error budget is exhausted?

   • aThe Service Level Objective (SLO) for the service is automatically revised downwards.
   • bThe development team responsible for the service receives a formal warning or penalty.
   • cAll non-essential feature releases are temporarily halted to prioritize reliability work.
   • dThe service is immediately taken offline to perform a comprehensive system overhaul.
   Show the answer

   Answer: c · All non-essential feature releases are temporarily halted to prioritize reliability work.

   The card states that exhausting the error budget typically triggers a freeze on non-essential releases, redirecting focus to reliability work. The Service Level Objective (SLO) is the target from which the budget is derived; exhausting the budget means the service is failing to meet the SLO, not that the SLO itself should be changed.

   Read the full bite: Error Budgets: Balancing Reliability and Innovation

4. Question 4 of 30

   Which core principle defines the 'blameless' approach in a postmortem?

   • aThe main objective is to identify the individual who made the critical mistake.
   • bHuman errors are symptoms of systemic issues, and everyone involved acted with good intentions.
   • cPostmortems should primarily focus on the speed of incident resolution.
   • dAll incident reports must omit any mention of human actions to avoid assigning fault.
   Show the answer

   Answer: b · Human errors are symptoms of systemic issues, and everyone involved acted with good intentions.

   The card explicitly states that a blameless postmortem 'assumes that everyone involved in an incident acted with good intentions' and 'treats human error not as the cause of failure, but as a symptom of a deeper, systemic issue.' Option A describes a blame-focused approach, which is the antithesis of a blameless postmortem.

   Read the full bite: Blameless Postmortems: Fix Systems, Not Blame

5. Question 5 of 30

   Which statement accurately describes a limitation of the Four Golden Signals?

   • aThey require an excessive number of metrics, making dashboards overly complex.
   • bThey are primarily designed for internal system debugging, not user experience.
   • cThey do not provide sufficient detail for identifying the root cause of an issue.
   • dThey are only applicable to services with HTTP-based communication.
   Show the answer

   Answer: c · They do not provide sufficient detail for identifying the root cause of an issue.

   The card explicitly states that the Golden Signals 'tell you that a problem exists... but not necessarily why,' requiring deeper metrics for root cause analysis. Option B is incorrect because they focus on user experience, and options B and C misrepresent their purpose and applicability.

   Read the full bite: The Four Golden Signals of Service Monitoring

6. Question 6 of 30

   Which scenario most strongly favors implementing a push-based metrics collection system?

   • aAn application deployed as a serverless function that executes for a very short duration.
   • bA dynamic environment where new services frequently start and stop, requiring automatic discovery.
   • cA monitoring system that needs to actively verify the health of each monitored application.
   • dAn architecture where the central collector needs to avoid being overwhelmed by simultaneous data streams.
   Show the answer

   Answer: a · An application deployed as a serverless function that executes for a very short duration.

   The card states that push is ideal for "short-lived or ephemeral workloads like serverless functions or batch jobs, as they might terminate before a pull-based scraper can reach them." Option D describes a risk of push systems (the 'thundering herd' problem), not a reason to favor them.

   Read the full bite: Pull vs. Push: How Your Metrics Get to the Collector

7. Question 7 of 30

   What is the primary advantage of using SLO burn rate alerting compared to a simple alert when the error rate exceeds the SLO threshold?

   • aIt provides a more accurate calculation of the total error budget consumed over a month.
   • bIt automatically scales resources to prevent the error rate from exceeding the defined SLO.
   • cIt enables early detection of both rapid service failures and gradual performance degradations.
   • dIt simplifies the process of defining Service Level Objectives for new services.
   Show the answer

   Answer: c · It enables early detection of both rapid service failures and gradual performance degradations.

   SLO burn rate alerting was developed to provide early, actionable warnings for significant events, addressing the limitations of simple threshold alerts which are often too slow for outages and too noisy for minor issues. Option A is incorrect because burn rate monitors consumption rate, it doesn't primarily calculate the total budget. Options C and D describe unrelated functions; burn rate is an alerting mechanism, not an auto-scaler or an SLO definition tool.

   Read the full bite: SLO Burn Rate: Alerting on Budget Consumption

8. Question 8 of 30

   Which scenario, based on an error budget burndown chart, would most clearly signal that an engineering team should prioritize shipping new features?

   • aThe actual error budget burn rate is significantly slower than the ideal linear burn rate.
   • bMore than half of the error budget remains available halfway through the monitoring window.
   • cThe chart indicates a steep downward slope, consuming budget rapidly.
   • dThe team has already breached their Service Level Objective (SLO) for the current period.
   Show the answer

   Answer: b · More than half of the error budget remains available halfway through the monitoring window.

   The card explicitly states, "If you have over 50% of your budget left halfway through the month, it's a green light to ship features." While a slower burn rate (option A) is a positive sign, the card provides the remaining budget condition as the direct trigger for prioritizing new features.

   Read the full bite: Error Budget Burndown: Your Service's Reliability Fuel Gauge

9. Question 9 of 30

   What is the primary benefit of using an OpenTelemetry Collector instead of an application directly exporting telemetry?

   • aIt automatically encrypts all telemetry data before it leaves the application host.
   • bIt centralizes telemetry configuration and processing, allowing applications to be decoupled from backend specifics.
   • cIt eliminates the need for applications to include any OpenTelemetry SDKs.
   • dIt guarantees that all telemetry data will be stored in a single, unified observability platform.
   Show the answer

   Answer: b · It centralizes telemetry configuration and processing, allowing applications to be decoupled from backend specifics.

   The card states the Collector provides "a single, configurable layer to handle data routing, formatting, and enrichment, simplifying both application code and operational overhead" and helps "avoid vendor lock-in" by decoupling applications from specific backend formats and endpoints. While the Collector simplifies application code, applications still typically use OpenTelemetry SDKs to generate the telemetry data that the Collector then processes and exports, making option C incorrect.

   Read the full bite: OpenTelemetry Collector: The Swiss Army Knife for Telemetry Data

10. Question 10 of 30

    When should a developer typically create a new Span in a distributed application?

    • aTo record the overall execution time of an entire request across all services.
    • bTo mark the beginning and end of any I/O operation or significant computation.
    • cFor every single function call to capture granular execution paths.
    • dOnly when an error occurs to pinpoint the exact location of the failure.
    Show the answer

    Answer: b · To mark the beginning and end of any I/O operation or significant computation.

    The card states Spans should be used for "distinct, time-bound operation" such as "network calls" or "significant in-process computations." Option C is incorrect because over-instrumenting trivial operations adds overhead and noise. Option A describes a Trace, which is a collection of Spans, not a single Span.

    Read the full bite: Span: The Building Block of a Distributed Trace

11. Question 11 of 30

    What is the primary problem OpenTelemetry Semantic Conventions are designed to solve in a distributed system?

    • aReducing the performance overhead of telemetry data collection.
    • bAutomatically generating complex dashboards and alerts without manual configuration.
    • cProviding a unified and consistent way to name telemetry attributes across different services and technologies.
    • dEnsuring all services use the same programming language for instrumentation.
    Show the answer

    Answer: c · Providing a unified and consistent way to name telemetry attributes across different services and technologies.

    The card states that Semantic Conventions solve the "chaos" of different services reporting status using "different naming conventions" by creating a "single, shared standard" for attributes. While conventions enable powerful features like automatic dashboards, their core purpose is to standardize the data's meaning, not to directly generate visualizations or reduce collection overhead.

    Read the full bite: OpenTelemetry Semantic Conventions: A Shared Vocabulary

12. Question 12 of 30

    What is the primary advantage of using OpenTelemetry Protocol (OTLP) in an observability ecosystem?

    • aIt directly translates proprietary telemetry formats into a single, universal format for any legacy system.
    • bIt enables automatic instrumentation of applications without manual code changes.
    • cIt serves as a complete, open-source observability backend for data storage and analysis.
    • dIt provides a unified, vendor-neutral standard for transmitting traces, metrics, and logs.
    Show the answer

    Answer: d · It provides a unified, vendor-neutral standard for transmitting traces, metrics, and logs.

    OTLP's core purpose is to provide a standardized, vendor-neutral wire protocol for transmitting all types of telemetry data (traces, metrics, logs), solving vendor lock-in. Option A is incorrect because OTLP defines a new standard for transmission, rather than directly translating existing proprietary formats; that translation is typically handled by an OpenTelemetry Collector.

    Read the full bite: OpenTelemetry Protocol (OTLP): The Universal Adapter for Telemetry

13. Question 13 of 30

    What is the primary benefit of using an OpenTelemetry Resource in a distributed system?

    • aIt provides a unique identifier for each individual trace or log record.
    • bIt establishes a stable, common context for all telemetry from a specific service instance.
    • cIt automatically filters out high-cardinality data from being sent to the observability backend.
    • dIt allows for dynamic modification of telemetry attributes during runtime.
    Show the answer

    Answer: b · It establishes a stable, common context for all telemetry from a specific service instance.

    The correct answer is C because a Resource provides a stable, consistent "return address" for all telemetry from a service instance, enabling correlation and filtering. Option D is incorrect as Resource attributes are immutable for the process lifetime, not dynamically modifiable.

    Read the full bite: OpenTelemetry Resource: The 'Who' of Your Telemetry

14. Question 14 of 30

    When is Elasticsearch the most appropriate choice compared to a traditional relational database?

    • aFor rapid, full-text searching and analysis of vast, semi-structured datasets.
    • bTo serve as the primary, source-of-truth storage for critical application data.
    • cFor managing highly structured data requiring complex, multi-table joins.
    • dWhen strong transactional consistency is paramount for financial operations.
    Show the answer

    Answer: a · For rapid, full-text searching and analysis of vast, semi-structured datasets.

    Elasticsearch is designed for fast, complex searching over large volumes of semi-structured data, as highlighted in the card. It is explicitly stated not to be a replacement for transactional databases that provide strong guarantees for financial transactions or primary data storage.

    Read the full bite: Elasticsearch: The Search Engine in the ELK Stack

15. Question 15 of 30

    For which scenario is downsampling time series data most beneficial?

    • aWhen you need to reduce the immediate storage cost of newly ingested, high-resolution metrics.
    • bWhen maintaining the highest possible data fidelity for all historical data is a strict requirement.
    • cWhen optimizing the speed of queries over long historical time ranges where exact, second-by-second precision is no longer critical.
    • dWhen ensuring real-time dashboards always display the most granular, up-to-the-second data available.
    Show the answer

    Answer: c · When optimizing the speed of queries over long historical time ranges where exact, second-by-second precision is no longer critical.

    Downsampling is designed to make long-range historical queries faster and more cost-effective by summarizing old data when high precision is no longer needed. Option B is incorrect because downsampling explicitly trades high fidelity for speed and reduced storage for older data.

    Read the full bite: Downsampling: Trading Granularity for Speed in Time Series Data

16. Question 16 of 30

    What is the fundamental problem that telemetry correlation addresses in a distributed system?

    • aOptimizing network traffic by compressing telemetry data before it is transmitted between services.
    • bEnsuring that all services involved in a request process their tasks in a strictly sequential and synchronized manner.
    • cPreventing data loss when telemetry agents fail to send data to a central collector.
    • dProviding a unified view of a single user request's execution path and associated events across disparate services.
    Show the answer

    Answer: d · Providing a unified view of a single user request's execution path and associated events across disparate services.

    Telemetry correlation's core purpose is to link all related logs, metrics, and traces from a single user request across multiple services, creating a coherent narrative for debugging. It does not enforce execution order or address data transmission reliability or efficiency.

    Read the full bite: Telemetry Correlation: Connecting Dots in Distributed Systems

17. Question 17 of 30

    A consistently increasing Mean Time to Acknowledge (MTTA) for an on-call team most directly suggests an issue with which of the following?

    • aThe precision of the monitoring tools in identifying genuine issues.
    • bThe inherent difficulty or scope of the incidents being generated.
    • cThe efficiency of the initial alert delivery and human response mechanisms.
    • dThe team's ability to quickly diagnose and fix problems.
    Show the answer

    Answer: c · The efficiency of the initial alert delivery and human response mechanisms.

    Option C is correct because the card states a rising MTTA signals problems like alert fatigue, ineffective notification channels, or confusing on-call schedules, all related to initial alert delivery and human response. Option D describes Mean Time to Resolve (MTTR), which measures the time to fix an issue, not just acknowledge it.

    Read the full bite: Mean Time to Acknowledge (MTTA): Your First Response Clock

18. Question 18 of 30

    Which of the following durations is specifically measured by Mean Time To Repair (MTTR)?

    • aThe duration spent waiting for necessary parts or administrative approvals to resolve an incident.
    • bThe period from when active repair efforts begin until the system's functionality is restored.
    • cThe total time from when a system fails until it is fully operational again for users.
    • dThe time it takes for an alert to be triggered and acknowledged by the operations team.
    Show the answer

    Answer: b · The period from when active repair efforts begin until the system's functionality is restored.

    MTTR measures the 'wrench time' or the active repair process, from when work begins until the system is fixed. It explicitly excludes the total outage duration (Option C), detection time (Option D), and logistical delays like waiting for parts (Option A).

    Read the full bite: Mean Time To Repair (MTTR): Measuring Your Fix Velocity

19. Question 19 of 30

    What is the defining characteristic of an Incident Commander's (IC) role during a significant incident?

    • aThe IC acts as the sole point of contact for all external communications, shielding the technical team.
    • bThe IC's primary responsibility is to identify the root cause of the problem.
    • cThe IC orchestrates the overall response, delegating technical tasks and managing communication without directly performing hands-on repairs.
    • dThe IC is the most senior engineer, personally debugging and implementing fixes.
    Show the answer

    Answer: c · The IC orchestrates the overall response, delegating technical tasks and managing communication without directly performing hands-on repairs.

    The Incident Commander's role is to direct and coordinate the response, delegating technical work to experts, rather than performing the hands-on debugging or fixing themselves. Option D is a common misconception, as the IC is a conductor, not a soloist, and does not directly fix the bug.

    Read the full bite: The Incident Commander: Direct the Response, Don't Debug

20. Question 20 of 30

    Which of the following best describes a core advantage of using ChatOps?

    • aIt centralizes all complex, multi-stage deployment processes into a single chat interface.
    • bIt completely removes the need for engineers to use traditional command-line interfaces.
    • cIt enhances transparency and auditability by making operational commands visible to the team.
    • dIt guarantees a highly secure and isolated environment for executing sensitive infrastructure changes.
    Show the answer

    Answer: c · It enhances transparency and auditability by making operational commands visible to the team.

    The card states ChatOps was created to make operations "more transparent, collaborative, and auditable" by performing actions in a shared channel. Option B is incorrect because the card advises engineers should still understand underlying tools. Option A is incorrect as it advises against complex, multi-stage workflows. Option D is incorrect because security is highlighted as a "footgun" requiring robust permissioning, not an inherent guarantee.

    Read the full bite: ChatOps: Your CLI Inside Your Chat Room

21. Question 21 of 30

    What is identified as the primary "footgun" or critical challenge in the Follow-the-Sun work model?

    • aThe potential for lost context during task handoffs between shifts.
    • bThe high operational cost associated with maintaining multiple global teams.
    • cThe inherent difficulty in coordinating across diverse cultural work environments.
    • dThe necessity for team members to work disruptive overnight shifts.
    Show the answer

    Answer: a · The potential for lost context during task handoffs between shifts.

    The card explicitly states, "The footgun is a poor handoff, where lost context erases all the time savings." This highlights that inefficient context transfer is the primary risk that undermines the model's benefits. Option B, while true that it's a high-overhead model, is not identified as the specific "footgun" that negates the time savings.

    Read the full bite: Follow-the-Sun: A Global Relay Race for Work

22. Question 22 of 30

    Which scenario is NOT an appropriate use case for a public status page?

    • aNotifying customers about a planned system upgrade requiring downtime.
    • bDocumenting the step-by-step technical resolution process for an internal engineering team.
    • cCentralizing communication during a major service disruption impacting all users.
    • dInforming users about a partial outage affecting a specific component like the database.
    Show the answer

    Answer: b · Documenting the step-by-step technical resolution process for an internal engineering team.

    The card states that a public status page is not a replacement for detailed internal incident management tools or private postmortems, and granular technical details belong in internal systems. Its primary purpose is one-to-many external communication, not internal documentation of resolution processes.

    Read the full bite: Public Status Page: Your System's Voice During an Outage

23. Question 23 of 30

    For which scenario is the 5 Whys technique generally considered least appropriate?

    • aIdentifying process flaws contributing to frequent deployment errors.
    • bConducting a postmortem for a moderately complex service degradation.
    • cInvestigating a recurring software bug with an unknown origin.
    • dAnalyzing a system outage caused by several interdependent component failures.
    Show the answer

    Answer: d · Analyzing a system outage caused by several interdependent component failures.

    The card explicitly states that 5 Whys is "too simplistic" for "highly complex problems with multiple interacting causes" as it follows a single track of inquiry. Option D describes such a complex scenario, making it the least appropriate use. The other options represent suitable applications of the technique.

    Read the full bite: 5 Whys: Find the Root Cause, Not Just the Symptom

24. Question 24 of 30

    In an incident where a junior engineer's commit brought down production, what would be considered a contributing factor?

    • aThe lack of a dedicated incident response team.
    • bThe absence of automated tests for that specific failure mode in the CI/CD pipeline.
    • cThe engineer's action of pushing the commit.
    • dThe immediate system downtime caused by the change.
    Show the answer

    Answer: b · The absence of automated tests for that specific failure mode in the CI/CD pipeline.

    The card defines contributing factors as systemic issues enabling the proximate cause. The absence of automated tests is explicitly cited as a contributing factor, a systemic vulnerability. The engineer's commit is the proximate cause, the direct trigger.

    Read the full bite: Beyond 'Root Cause': Proximate vs. Contributing Factors

25. Question 25 of 30

    What does the Swiss Cheese Model primarily illustrate about how major system failures occur?

    • aExternal, unpredictable threats are the most significant factor in system vulnerabilities.
    • bSystems inevitably fail over time due to the accumulation of minor, unaddressed bugs and issues.
    • cA single, critical flaw in the system's foundational layer is the root cause of most incidents.
    • dMajor incidents result from the simultaneous alignment of multiple, independent weaknesses across various defense mechanisms.
    Show the answer

    Answer: d · Major incidents result from the simultaneous alignment of multiple, independent weaknesses across various defense mechanisms.

    The Swiss Cheese Model explains that major failures occur when multiple, independent weaknesses (holes) in different defense layers align, allowing a threat to pass through. It explicitly moves beyond attributing failure to a single root cause, which makes option C incorrect.

    Read the full bite: Swiss Cheese Model: Layered Defenses Against Failure

26. Question 26 of 30

    What is the most significant negative impact of hindsight bias during a postmortem review?

    • aIt discourages engineers from participating in future incident response.
    • bIt overemphasizes the role of external factors in causing the failure.
    • cIt makes it difficult to accurately document the timeline of events.
    • dIt shifts focus from systemic improvements to individual accountability.
    Show the answer

    Answer: d · It shifts focus from systemic improvements to individual accountability.

    Hindsight bias leads to blaming individuals for not seeing what's now clear, which prevents addressing the underlying systemic issues. While it distorts perception, it doesn't inherently prevent factual timeline documentation, making that a less direct impact.

    Read the full bite: Hindsight Bias: The 'Knew-It-All-Along' Postmortem Trap

27. Question 27 of 30

    What is the fundamental approach Configuration Management uses to ensure system consistency and prevent 'configuration drift'?

    • aIt continuously compares the actual system state against a codified desired state and corrects discrepancies.
    • bIt logs all system changes and provides alerts when unauthorized modifications occur.
    • cIt generates unique, immutable server images for every new deployment or update.
    • dIt establishes a strict manual change control process for all system modifications.
    Show the answer

    Answer: a · It continuously compares the actual system state against a codified desired state and corrects discrepancies.

    The card explains that Configuration Management defines a 'desired state of a system as code' and then a CM tool 'continuously works to build and maintain your systems to match it, correcting any deviations it finds.' This active enforcement and remediation of discrepancies is its core function. Option B describes monitoring, which is related but does not include the active correction of state that CM provides.

    Read the full bite: Configuration Management: Enforcing Desired State

28. Question 28 of 30

    Under which circumstance would it be most inappropriate to implement an executable runbook?

    • aFor a diagnostic process that requires subjective interpretation of multiple system states.
    • bFor a common incident response procedure like a 'disk full' alert.
    • cFor a routine maintenance task such as certificate rotation.
    • dFor a critical deployment rollback that needs to be executed quickly and consistently.
    Show the answer

    Answer: a · For a diagnostic process that requires subjective interpretation of multiple system states.

    The card advises against automating procedures that require nuanced human judgment or are not fully understood, as scripting them could lead to dangerous actions based on false premises. The other options represent scenarios where executable runbooks are explicitly recommended due to their frequent, high-stakes, and well-understood nature.

    Read the full bite: Executable Runbooks: Code, Not Just Checklists

29. Question 29 of 30

    What is the fundamental characteristic of a software system operating under Continuous Delivery (CD)?

    • aThe software artifact is consistently maintained in a state ready for reliable deployment to production at any time.
    • bAll software development is structured into very short, iterative cycles to maximize code output.
    • cNew code changes are automatically pushed to production environments immediately after passing tests.
    • dThe entire release process, from code commit to production, is fully automated without any human intervention.
    Show the answer

    Answer: a · The software artifact is consistently maintained in a state ready for reliable deployment to production at any time.

    Continuous Delivery ensures the software is always in a deployable state, making releases a routine business decision that can happen at any moment. Option C describes Continuous Deployment, which is a common misconception explicitly mentioned in the card as different from Continuous Delivery.

    Read the full bite: Continuous Delivery: Ship Reliably, Anytime

30. Question 30 of 30

    What is the primary problem that feature flags were designed to solve in software development?

    • aThe challenge of conducting A/B tests and canary releases without complex infrastructure.
    • bThe risk of immediately exposing new, potentially buggy code to all users upon deployment.
    • cThe difficulty of merging long-lived feature branches back into the main codebase.
    • dThe tight coupling between deploying new code to production and making new features available to users.
    Show the answer

    Answer: d · The tight coupling between deploying new code to production and making new features available to users.

    The card explicitly states, "The core problem feature flags solve is the tight coupling between deploying code and releasing a feature." This decoupling allows teams to deploy code safely without immediately exposing it to users. Option B describes a risk that arises from this coupling, but not the coupling itself.

    Read the full bite: Feature Flags: Ship Code Now, Release It Later