Datadog Fundamentals study plan
Datadog Fundamentals · Give each week a clear focus.
8 weeks · About 6 hours per week
Infrastructure Monitoring
Install and configure the Datadog Agent on at least one Linux host and one container, and verify reported metrics in the platform
Explain how the Agent collects, aggregates, and forwards host metrics, and describe the difference between the Agent and Agentless integrations
Apply a consistent tagging strategy (env, service, version, team) and use tags to slice the Host Map and a metrics dashboard
Build one dashboard with at least four widget types and save a template variable that filters by tag
Identify the standard host-level metrics used for CPU, memory, disk, and network saturation, and state what each one signals
Your checkpoint
A working Agent on two hosts plus a published dashboard that is filterable by env and service tags, saved with a short written note listing the metric each panel watches and why
Infrastructure Monitoring & Application Performance Monitoring
Configure at least two Datadog integrations and confirm the collected metrics and default dashboards appear
Define monitors for a metric, an integration check, and a composite condition, and tune thresholds to reduce noise
Enable APM on a sample application and confirm traces reach the platform
Describe how trace data is generated, sampled, and retained, and distinguish trace metrics from span-level data
Your checkpoint
Four live monitors (one metric, one integration check, one composite, one anomaly or forecast) documented with the rationale for each threshold, plus a screenshot-free written summary confirming traces from the sample app appear in the service list
Application Performance Monitoring
Instrument a service end to end so that spans capture inbound requests, outbound calls, and database queries
Read a flame graph and a service map to locate the slowest span in a request path and explain the contributing latency
Use trace search and retention filters to keep the traces that matter and articulate how sampling decisions affect cost and coverage
Configure a trace-based monitor or an APM metric monitor and validate it fires against induced error traffic
Your checkpoint
A written latency investigation: one trace with the bottleneck span identified, the query used to find it, and the monitor configuration that would catch the regression in production
Log Management
Ship logs from an application into Datadog and confirm they are parsed with the correct log pipeline
Build custom pipelines and processors to parse a non-standard log format into structured attributes
Explain how indexes, exclusion filters, and retention settings control which logs are searchable and for how long
Use log search syntax, facets, and log patterns to group and summarize a large volume of events
Your checkpoint
A custom pipeline that parses a non-standard log format with at least three extracted attributes, plus a saved search and a written cost-control plan covering index filters and retention
Log Management & Service Management and Platform Capabilities
Generate log-based metrics and use them in a dashboard and a monitor
Apply sensitive data scrubbing rules and hash or redact fields at ingestion
Configure log archives to object storage and describe how rehydration works
Use the Datadog API to create or update a dashboard or monitor programmatically and explain how the API keys differ in purpose
Map the components of the platform (dashboards, notebooks, monitors, API, integrations) to the tasks each is suited for
Your checkpoint
One log-based metric feeding a monitor, plus a scrubbing rule demonstrated on a test log, plus a script or command history showing a monitor created through the API
Digital Experience Monitoring
Enable Real User Monitoring on a web application and capture session, view, and user-action data with the correct tags
Trace a front-end error from a RUM view through to the corresponding backend APM trace
Create a browser synthetic test with a multi-step journey and one API synthetic test, and assert on response content
Configure an alert on a synthetic test failure and describe how test locations and frequency affect detection time
Your checkpoint
Two running synthetic tests (one browser journey, one API test) with alerting configured, plus a written walkthrough connecting a RUM session to its backend trace
Security & Service Management and Platform Capabilities
Differentiate the security products by the signals they consume and the threats each is designed to surface
Enable a detection rule and generate a test signal to confirm the rule produces a finding
Investigate a finding, triage it, and record the severity and response decision
Apply the principle of least privilege to an API key or application key used for automation
Explain how service ownership and service definitions support on-call routing and incident response
Your checkpoint
A written triage report for one induced finding: the rule that fired, the evidence reviewed, the severity assigned, and the recommended response, plus a documented key-permission change
Infrastructure Monitoring & Application Performance Monitoring & Log Management & Digital Experience Monitoring & Security & Service Management and Platform Capabilities
Re-score performance in each domain against the exam weighting and rank the two weakest domains
Re-teach the two weakest domains using notes, hands-on repetition, and targeted practice questions
Re-take a timed practice set covering all six domains and review every missed question for root cause
Consolidate a one-page reference sheet of facts you repeatedly get wrong
Your checkpoint
A scored full-length practice attempt with a written remediation list mapping each missed item to a domain and a concrete follow-up action
Milestones
Week 2: Agent, tagging, dashboards, and alerting are working in your own environment and APM traces from a sample service are visible
Week 4: All of Infrastructure Monitoring, APM, and Log Management have been studied once, and you can score above your baseline on a mixed set drawn only from those three domains
Week 6: Log Management is complete end to end (pipeline, metric, index, archive) and Digital Experience Monitoring is operational with at least two synthetic tests alerting
Week 8: Full-length timed practice completed with a per-domain score breakdown, and no domain remains below the threshold you set for a safe pass