Integrating Logging, Monitoring, and Alerting DSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · medium

   A team is designing monitoring for a distributed system. They need to identify the root cause of a slow response that spans multiple services. They have access to logs and metrics, but the problem is intermittent and hard to reproduce. What should they add to their observability stack?

   • AA synthetic monitoring tool that runs test transactions every minute.
   • BAdditional metrics for each service's CPU and memory usage.
   • CMore detailed logging in each service, including debug-level messages.
   • DDistributed tracing with correlation IDs to follow a request across services.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which monitoring approach is most useful for understanding the flow of a single request across multiple microservices?

   • ALogs
   • BTraces
   • CMetrics
   • DAlerts
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which practice best exemplifies using monitoring feedback to improve security posture?

   • AIncreasing alert thresholds to reduce noise
   • BDisabling monitoring during peak hours to reduce overhead
   • CStoring logs for a shorter period to save costs
   • DReviewing security logs after an incident to update detection rules and patch vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An organization has a policy that all security alerts must be acknowledged within 15 minutes. However, the current alerting system pages the on-call engineer for every medium-severity security event, leading to many false alarms and desensitization. As a result, a critical alert was ignored for over an hour. How should the team restructure their alerting to improve response?

   • APage the on-call engineer only for critical alerts, and route medium-severity alerts to a dashboard for review during business hours.
   • BContinue paging for all alerts but increase the frequency of pages to ensure attention.
   • CDisable all medium-severity alerts entirely.
   • DRequire the on-call engineer to acknowledge every alert within 5 minutes.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An e-commerce platform experiences periodic traffic spikes during flash sales. The operations team is receiving too many alerts from a static CPU threshold, causing alert fatigue. They want to reduce noise while still detecting genuine anomalies. What should they configure?

   • ARaise the CPU threshold to a high value so alerts only fire during severe outages.
   • BSet a fixed threshold based on the highest CPU usage observed during the last flash sale.
   • CDisable CPU alerts entirely and rely on application-level error logs reviewed after each sale.
   • DUse an anomaly-detection algorithm that learns the normal traffic pattern and alerts only when CPU deviates from the expected baseline.
   Reveal Solution Discussion Select an answer first