Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Which signal best answers 'which of the 12 services in this request path made it slow'?

   1. AMetrics
   2. BTraces
   3. CLogs
   4. DUptime checks
   Show answer

   B. A trace shows every span in one request with its duration, so the slow hop is visible directly.

   From lesson 01 · Observability fundamentals

2. Q2. What does OpenTelemetry provide?

   1. AA storage backend and UI
   2. BVendor-neutral APIs, SDKs, auto-instrumentation, a Collector and the OTLP protocol for producing and moving telemetry; storage and UIs are separate (Prometheus, Tempo, Loki, Jaeger, vendors…)
   3. COnly a tracing UI
   4. DA Kubernetes distribution
   Show answer

   B. OTel standardises how telemetry is created and shipped, so you can change backends without re-instrumenting.

   From lesson 01 · Observability fundamentals

3. Q3. Why do consistent resource attributes like service.name matter?

   1. AFor billing
   2. BThey're the join keys that let you move from a metric to the matching traces and logs of the same service and pod
   3. CKubernetes requires them
   4. DThey compress data
   Show answer

   B. Correlation (lesson 05) only works when all signals describe the source the same way.

   From lesson 01 · Observability fundamentals

4. Q4. Why should memory_limiter be the first processor in a pipeline?

   1. AIt's alphabetical
   2. BIt refuses data when memory is near the limit, applying back-pressure before later processors buffer more and the Collector gets OOM-killed
   3. CIt compresses data
   4. DIt's required by OTLP
   Show answer

   B. Refusing early lets senders retry, instead of the Collector crashing and losing everything in memory.

   From lesson 02 · OpenTelemetry Collector deep dive

5. Q5. What's the difference between an agent and a gateway Collector?

   1. ANone
   2. BAgents run on each node (DaemonSet) close to apps, adding host/pod metadata; gateways are a central, scalable Deployment for heavy processing (tail sampling, routing, auth) before backends
   3. CAgents are only for logs
   4. DGateways run inside apps
   Show answer

   B. Many setups use both: agents for collection and enrichment, gateways for central policy.

   From lesson 02 · OpenTelemetry Collector deep dive

6. Q6. What does the spanmetrics connector do?

   1. ADeletes spans
   2. BGenerates RED metrics (call counts, errors, duration histograms) from spans in a traces pipeline and feeds them into a metrics pipeline
   3. CSamples logs
   4. DExports to Jaeger
   Show answer

   B. Useful when services are traced but not all expose good metrics.

   From lesson 02 · OpenTelemetry Collector deep dive

7. Q7. How does a trace follow a request from service A to service B?

   1. ABy IP address
   2. BA passes trace context (trace ID + parent span ID) in request headers such as W3C traceparent; B continues the same trace with a child span
   3. CThrough the database
   4. DTraces can't cross services
   Show answer

   B. Context propagation is what turns separate spans into one trace. A service that drops the header breaks the chain.

   From lesson 03 · Distributed tracing

8. Q8. What's the main advantage of tail sampling over head sampling?

   1. AIt's cheaper to run
   2. BThe keep/drop decision is made after the trace is complete, so you can keep all errors and slow traces while sampling routine ones
   3. CIt needs no Collector
   4. DIt works without trace IDs
   Show answer

   B. Head sampling decides at the start (it can't know a trace will fail). Tail sampling costs memory and needs all spans of a trace at one place.

   From lesson 03 · Distributed tracing

9. Q9. Why do Tempo and similar backends keep costs low?

   1. AThey drop most spans
   2. BThey store traces in object storage and look them up mainly by trace ID (with search/TraceQL over blocks), instead of indexing every attribute
   3. CThey run in memory only
   4. DThey compress logs
   Show answer

   B. Cheap object storage makes it affordable to keep a high percentage of traces.

   From lesson 03 · Distributed tracing

10. Q10. How is Loki's design different from Elasticsearch's?

    1. AIt's identical
    2. BLoki indexes only labels (the stream identity) and stores compressed log chunks in object storage; content is scanned at query time, which is cheap to store but needs good label selection
    3. CLoki indexes every word
    4. DLoki stores logs in Prometheus
    Show answer

    B. Small index + object storage = low cost. Queries are fast when labels narrow the streams first.

    From lesson 04 · Structured logging & Loki

11. Q11. Why is `trace_id` a bad Loki label?

    1. AIt's too short
    2. BEvery value creates a new stream; unbounded values explode the number of streams, hurting ingestion and queries
    3. CLoki can't store hex
    4. DGrafana hides it
    Show answer

    B. Keep high-cardinality values in the log line or in structured metadata, and filter on them at query time.

    From lesson 04 · Structured logging & Loki

12. Q12. What does `sum by (app) (rate({namespace="shop"} |= "error" [5m]))` return?

    1. AThe error log lines
    2. BA metric: per-app rate of log lines containing 'error' over 5-minute windows
    3. CThe number of apps
    4. DLabel names
    Show answer

    B. LogQL metric queries turn logs into time series for dashboards and alerts.

    From lesson 04 · Structured logging & Loki

13. Q13. What is an exemplar?

    1. AA sample dashboard
    2. BA trace ID (with labels and a value) attached to a metric sample, so a point on a latency graph links to one real request that contributed to it
    3. CA log template
    4. DAn alert rule
    Show answer

    B. Exemplars bridge the aggregated world (metrics) and the individual world (traces).

    From lesson 05 · Signal correlation

14. Q14. Your logs have no trace IDs. What breaks?

    1. ANothing
    2. BYou can't jump from a trace to exactly its log lines, or from an error log line to its trace; you fall back to guessing by time and pod
    3. CLoki stops working
    4. DTraces are deleted
    Show answer

    B. Trace IDs in logs are the most valuable single field for correlation.

    From lesson 05 · Signal correlation

15. Q15. Why must resource attributes be consistent across signals?

    1. AFor compression
    2. BLinks between data sources filter by them (service, namespace, pod); if metrics call it 'cart' and traces 'cart-svc', the jump lands on nothing
    3. CGrafana requires uppercase
    4. DThey set retention
    Show answer

    B. Set service.name and Kubernetes attributes once (SDK env vars + k8sattributes) so every signal agrees.

    From lesson 05 · Signal correlation

16. Q16. A service has a 99.9% availability SLO over 30 days. What's the error budget in time if it were fully down?

    1. A4.3 minutes
    2. BAbout 43 minutes
    3. C7.2 hours
    4. D3.6 days
    Show answer

    B. 0.1% of 30 days = 0.001 × 43,200 minutes = 43.2 minutes.

    From lesson 06 · SLOs, SLIs & burn-rate alerting

17. Q17. Why alert on burn rate rather than 'error rate > 1%'?

    1. AIt's simpler
    2. BBurn rate ties alerts to the SLO: fast burns page quickly, slow burns open tickets, and brief blips that don't threaten the budget don't wake anyone
    3. CIt uses less storage
    4. DStatic thresholds are not supported
    Show answer

    B. Alerts then mean 'users are being hurt at a rate that matters', which is why people trust them.

    From lesson 06 · SLOs, SLIs & burn-rate alerting

18. Q18. Why do burn-rate alerts use two windows (e.g. 1h and 5m)?

    1. ARedundancy
    2. BThe long window proves the burn is significant; the short window makes the alert stop soon after the problem is fixed
    3. CGrafana needs two
    4. DTo double the alerts
    Show answer

    B. Long window alone keeps firing long after recovery; short window alone is too noisy.

    From lesson 06 · SLOs, SLIs & burn-rate alerting

19. Q19. Which is usually the biggest lever on metrics cost?

    1. AScrape interval only
    2. BCardinality: the number of active series, driven by label values; dropping unbounded labels and unused metrics
    3. CDashboard count
    4. DGrafana version
    Show answer

    B. Each unique label combination is a series with memory and storage cost. One bad label can multiply series by thousands.

    From lesson 07 · Production observability patterns

20. Q20. How do Loki, Tempo and Mimir separate tenants?

    1. ASeparate clusters only
    2. BEvery write and query carries a tenant ID (X-Scope-OrgID header, usually set by a gateway), with per-tenant limits and retention
    3. CBy namespace name automatically
    4. DThey don't support tenants
    Show answer

    B. The gateway authenticates the caller and sets the tenant, so teams can't read or flood each other's data.

    From lesson 07 · Production observability patterns

21. Q21. Where should personal data (emails, tokens) be removed from telemetry?

    1. AIn Grafana
    2. BAs early as possible: in the application, and as a safety net in the Collector pipeline before data is stored
    3. CNever
    4. DAfter a year
    Show answer

    B. Once stored and replicated, sensitive data is hard to delete. Redact at the source and in the Collector.

    From lesson 07 · Production observability patterns