704.3 Log Management and Analysis (weight: 2) DEVOPS-TOOLS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team uses Fluentd to collect logs from various services and forward them to Elasticsearch. They notice that some logs are dropped during high load. What should they do to prevent log loss?

   • AAdd buffering and retry mechanisms to Fluentd to handle temporary failures and backpressure.
   • BSwitch to a different log format to reduce size.
   • CDisable TLS to reduce overhead and improve throughput.
   • DIncrease the log level to debug to generate more logs, hoping some get through.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of centralized log management in a DevOps environment?

   • ATo automatically fix errors detected in application logs
   • BTo provide a single, searchable location for logs from multiple systems and services
   • CTo store logs exclusively on each individual server for security
   • DTo replace the need for application performance monitoring tools
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A DevOps team wants to set up an alert for when the number of failed SSH login attempts exceeds 10 in 5 minutes. They have centralized logs. However, they also receive logs from non-SSH services that contain the word 'failed'. What is the best way to ensure the alert only triggers on SSH failures?

   • ASearch for the word 'failed' in all logs and alert if it appears more than 10 times.
   • BUse a query that filters for the SSH service and the specific event type for authentication failure.
   • CAlert on any log message from the SSH service.
   • DIncrease the threshold to 20 to reduce false positives.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A DevOps team operates a fleet of ephemeral containers that run batch jobs for a few minutes each. They need to retain logs for 90 days for compliance, but the containers are destroyed after each job. Which approach should they use to ensure logs are preserved?

   • AStore logs on the container's local filesystem and rely on the container image to persist them across restarts.
   • BEnable Docker's default json-file logging driver and periodically copy logs from stopped containers to a backup server.
   • CConfigure a log shipper inside each container to forward logs to a centralized log management service as they are generated.
   • DUse a sidecar container that writes logs to a shared volume mounted from the host, and hope the host retains the volume.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which tool is commonly used to create dashboards and visualizations from log data?

   • AFilebeat
   • BFluentd
   • CKibana
   • DLogstash
   Reveal Solution Discussion Select an answer first