I85PREP
⌘ K
IBM Cloud Professional SRE study materials
IBM Cloud Professional SRE study resources

IBM Cloud Professional SRE practice questions

One question at a time. Build your IBM Cloud Professional SRE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Site Reliability Engineering Foundations

In IBM Cloud, which service provides a platform for correlating logs, metrics, and traces from multiple sources to support SRE observability?

  1. IBM Cloud Activity Tracker
  2. IBM Cloud Logs (formerly LogDNA)
  3. IBM Cloud Flow Logs for VPC
  4. IBM Cloud Monitoring with Sysdig Correct answer.

Explanation

IBM Cloud Monitoring with Sysdig collects and correlates metrics, events, and traces across the environment, which is the core of an SRE observability stack. Activity Tracker records account-level audit events rather than providing a metrics correlation platform.

Question 2Site Reliability Engineering Foundations

An SRE team needs a service level objective for an API. Which statement best describes the relationship between an SLI, an SLO, and an SLA?

  1. An SLI is the measured indicator, an SLO is the internal target for that indicator, and an SLA is the contractual commitment. Correct answer.
  2. An SLO is the raw measurement, an SLI is the contractual commitment, and an SLA is the alert threshold.
  3. An SLA is the internal target, an SLO is the external contract, and an SLI is the customer refund policy.
  4. An SLI is the contractual commitment, an SLO is the dashboard, and an SLA is the error budget.

Explanation

The SLI is the quantitative measurement such as request success rate, the SLO is the internal reliability target for that measurement, and the SLA is the contractual promise with consequences. Keeping the SLO stricter than the SLA creates a buffer before contractual penalties apply.

Question 3Site Reliability Engineering Foundations

A service has an SLO of 99.9 percent availability over 30 days. Approximately how much downtime does the error budget allow in that window?

  1. About 4 minutes
  2. About 30 hours
  3. About 43 minutes Correct answer.
  4. About 7 hours

Explanation

An availability target of 99.9 percent permits 0.1 percent unavailability, which over a 30-day window of roughly 43,200 minutes equals about 43 minutes. This error budget is what the team may consume before the SLO is breached.

Question 4Site Reliability Engineering Foundations

Which IBM Cloud capability is designed to record and audit control-plane and account-level API activity for compliance investigations?

  1. IBM Cloud Kubernetes Service autoscaling
  2. IBM Cloud Object Storage lifecycle rules
  3. IBM Cloud Activity Tracker Correct answer.
  4. IBM Cloud Monitoring with Sysdig

Explanation

Activity Tracker captures account-level events such as resource creation, deletion, and configuration changes, which supports audit and compliance investigations. Monitoring covers operational metrics, while autoscaling and lifecycle rules are workload behaviors rather than audit records.

Question 5Site Reliability Engineering Foundations

An SRE wants to reduce toil in a repetitive remediation task. Which approach best aligns with SRE principles?

  1. Document the manual runbook in more detail and require two approvals before each execution.
  2. Increase the on-call rotation size so the manual task is shared more widely.
  3. Automate the remediation and measure the remaining manual effort over time. Correct answer.
  4. Assign the task permanently to a single senior engineer for consistency.

Explanation

SRE treats toil as work that is manual, repetitive, and automatable, and the standard remedy is to automate it and track how much manual effort remains. Documentation, single ownership, and larger rotations preserve the toil rather than eliminating it.

Question 6Site Reliability Engineering Foundations

Which metric type in IBM Cloud Monitoring with Sysdig is most appropriate for tracking the current number of healthy pods in a deployment?

  1. A gauge that can rise and fall Correct answer.
  2. A monotonic cumulative sum
  3. A counter that only increases
  4. A histogram of request latencies

Explanation

A gauge represents a value that can increase or decrease over time, such as the current count of healthy pods. Counters and monotonic cumulative sums only increase, and histograms describe distributions rather than a current count.

Question 7Site Reliability Engineering Foundations

What is the primary purpose of a postmortem in an SRE practice?

  1. To replace the incident timeline with a customer-facing announcement
  2. To satisfy the SLA refund calculation for affected customers
  3. To produce a blameless record of contributing factors and follow-up actions Correct answer.
  4. To assign individual blame for the outage so accountability is clear

Explanation

A blameless postmortem documents what happened, the contributing factors, and concrete follow-up actions so the same failure is less likely to recur. Blame discourages honest reporting, and refund calculation or customer messaging are separate activities.

Question 8Site Reliability Engineering Foundations

A team defines an SLO based on the proportion of successful requests measured at the load balancer. Which SLI specification issue is most important to address?

  1. The SLI must define precisely which requests count as valid and successful. Correct answer.
  2. The SLI should be measured only during business hours to reduce noise.
  3. The SLI must be expressed as a count rather than a ratio.
  4. The SLI should be replaced by the mean response time of all requests.

Explanation

A well-formed SLI states the population of valid events and the criteria for a good event, otherwise the ratio is ambiguous and inconsistent. Restricting measurement windows or swapping in mean latency changes the meaning rather than clarifying it.

Question 9Site Reliability Engineering Foundations

In IBM Cloud Kubernetes Service, which object is the standard mechanism for exposing an application to external traffic with a stable public endpoint?

  1. A PersistentVolumeClaim
  2. A ConfigMap
  3. A Kubernetes Service of type LoadBalancer Correct answer.
  4. A NetworkPolicy

Explanation

A Service of type LoadBalancer requests an IBM Cloud load balancer that provides a stable external endpoint for the application. ConfigMaps hold configuration, PersistentVolumeClaims request storage, and NetworkPolicies restrict traffic.

Question 10Site Reliability Engineering Foundations

An SRE observes that a service's error budget is nearly exhausted mid-quarter. Which action is most consistent with error budget policy?

  1. Extend the measurement window to hide the recent failures
  2. Disable alerting until the next measurement window begins
  3. Freeze risky feature releases and prioritize reliability work until the budget recovers Correct answer.
  4. Raise the SLO target so the remaining budget appears larger

Explanation

An error budget policy typically slows or halts risky changes and redirects effort to reliability when the budget nears exhaustion. Adjusting the target, suppressing alerts, or stretching the window manipulates the measurement instead of addressing reliability.

Question 11Site Reliability Engineering Foundations

Which IBM Cloud Logs capability helps an SRE find the log lines associated with a single failing request across microservices?

  1. Automatic deletion of logs older than one hour
  2. Full-text search combined with a shared correlation identifier in log records Correct answer.
  3. Routing all logs to a single severity level
  4. Encryption of logs at rest with customer-managed keys

Explanation

Searching on a correlation or trace identifier that each service writes into its log records lets an SRE reconstruct a single request across services. Retention, encryption, and severity normalization are useful but do not provide cross-service correlation.

Question 12Site Reliability Engineering Foundations

What distinguishes a symptom-based alert from a cause-based alert in SRE monitoring?

  1. Symptom-based alerts rely on logs, while cause-based alerts rely only on traces
  2. Symptom-based alerts are always more expensive to operate than cause-based alerts
  3. Cause-based alerts always page a human, while symptom-based alerts never do
  4. Symptom-based alerts fire on user-visible impact, while cause-based alerts fire on internal conditions Correct answer.

Explanation

Symptom-based alerting pages on what users actually experience, such as elevated error rate or latency, while cause-based alerting watches internal conditions like CPU saturation. Symptom-based alerts tend to be more actionable because they reflect real impact.

Question 13Site Reliability Engineering Foundations

A service runs on IBM Cloud Kubernetes Service and must survive the loss of a single zone. Which design choice best supports this?

  1. Spread worker nodes and replicas across multiple zones in the region Correct answer.
  2. Run all replicas in one zone to keep latency low
  3. Use a single worker node with a large vertical size
  4. Pin the application to a single node pool with one node

Explanation

Spreading nodes and replicas across zones ensures that losing one zone leaves capacity available in others. Single-zone or single-node designs concentrate failure and cannot tolerate a zone outage.

Question 14Site Reliability Engineering Foundations

Which practice best describes chaos engineering as applied by an SRE team?

  1. Running controlled experiments that inject realistic failures to validate resilience Correct answer.
  2. Randomly deleting production data to test backup restores
  3. Increasing monitoring thresholds until alerts stop firing
  4. Performing load tests only after a production incident

Explanation

Chaos engineering uses controlled, hypothesis-driven experiments that inject realistic failure conditions to verify that the system behaves as expected. Random destructive actions and threshold changes are not controlled experiments.

Question 15Site Reliability Engineering Foundations

An SRE is defining an availability SLI for a batch processing pipeline. Which measurement is most meaningful?

  1. The number of pods currently running in the cluster
  2. The percentage of scheduled jobs that complete successfully within their deadline Correct answer.
  3. The total bytes written to object storage
  4. The average CPU utilization of the worker nodes

Explanation

For a batch pipeline, the user-relevant outcome is whether jobs complete successfully and on time, so the SLI should express that proportion. Resource utilization and raw counters describe internal state rather than delivered reliability.

Question 16Site Reliability Engineering Foundations

What is the role of an incident commander during a major outage?

  1. To write the customer-facing SLA refund calculation
  2. To coordinate response, communication, and role assignment while others investigate Correct answer.
  3. To personally debug the root cause in the production environment
  4. To approve every code change made during the incident

Explanation

The incident commander coordinates the response, assigns roles, and manages communication so responders can focus on diagnosis and mitigation. The commander does not need to be the deepest debugger and should avoid becoming absorbed in hands-on work.

Question 17Site Reliability Engineering Foundations

A dashboard shows a spike in 5xx responses at the edge while backend services report normal error rates. Which explanation is most plausible?

  1. The backend services are returning errors that the edge correctly reports
  2. The edge layer itself is failing or misrouting requests before reaching the backend Correct answer.
  3. The backend error metric is under-reporting because of sampling
  4. The error budget has already been exhausted

Explanation

Errors observed at the edge while backends appear healthy point to a problem in the edge layer, such as a failing proxy or routing misconfiguration. If backends were the source, their own error metrics would normally rise as well.

Question 18Site Reliability Engineering Foundations

Which IBM Cloud feature allows an SRE to define alerting policies on metrics collected by IBM Cloud Monitoring?

  1. IBM Cloud DNS records
  2. IBM Cloud IAM access groups
  3. IBM Cloud Object Storage bucket policies
  4. IBM Cloud Monitoring alert definitions scoped to a metric and threshold Correct answer.

Explanation

IBM Cloud Monitoring lets teams create alert definitions that evaluate a metric against a threshold and notify on breach. IAM groups, bucket policies, and DNS records govern access, storage, and naming rather than metric alerting.

Question 19Site Reliability Engineering Foundations

An SRE team wants to compare the reliability of two releases over the same period. Which approach gives the most defensible comparison?

  1. Compare the number of alerts each release generated
  2. Compare the average CPU usage of each release
  3. Compare the SLI computed with the same definition and window for both releases Correct answer.
  4. Compare the peak error rate observed on each release

Explanation

A fair comparison uses the same SLI definition and measurement window for both releases so the result reflects reliability rather than measurement differences. Peak values, alert counts, and resource usage are noisy proxies that can mislead.

Question 20Site Reliability Engineering Foundations

What is the main SRE rationale for limiting the number of services a single on-call engineer is responsible for?

  1. It keeps operational load within a level that allows sustainable response and improvement work Correct answer.
  2. It removes the need for runbooks
  3. It reduces the cost of monitoring licenses
  4. It guarantees that no incident will ever occur

Explanation

SRE treats operational load as a resource to be managed, and limiting on-call scope keeps the load sustainable so engineers can respond well and still do engineering work. It does not eliminate incidents or remove the value of runbooks.

Question 21Site Reliability Engineering Foundations

A team wants to detect slow degradation in a service before users notice. Which signal is most useful?

  1. A single alert on instantaneous CPU above 90 percent
  2. A weekly count of deployed pods
  3. A trend alert on rising p99 latency relative to its historical baseline Correct answer.
  4. A daily report of total requests served

Explanation

Comparing a latency percentile against its historical baseline reveals gradual degradation that a fixed instantaneous threshold would miss. Raw request counts and pod counts do not indicate user-perceived slowness.

Question 22Site Reliability Engineering Foundations

Which statement correctly describes how IBM Cloud IAM supports least-privilege access for SRE tooling?

  1. IAM policies apply only to object storage buckets
  2. IAM automatically grants administrator access to every account member
  3. IAM policies bind subjects to roles on resources, and access groups bundle policies for many users Correct answer.
  4. IAM roles are assigned per pod and cannot be scoped to resources

Explanation

IBM Cloud IAM grants access through policies that bind subjects to roles on specific resources, and access groups let administrators manage those policies at scale. Least privilege means granting only the roles needed for each tool or team.

Question 23Site Reliability Engineering Foundations

An SRE is asked to reduce mean time to recovery for a recurring database failover. Which change most directly improves MTTR?

  1. Adding more dashboards showing database metrics
  2. Automating the failover procedure and validating it with regular game days Correct answer.
  3. Increasing the SLO target for the database
  4. Extending the incident review timeline

Explanation

MTTR measures how quickly service is restored, so automating the failover and rehearsing it shortens recovery time and reduces human error. SLO targets, dashboards, and review timelines do not by themselves speed restoration.

Question 24Site Reliability Engineering Foundations

Which IBM Cloud service is best suited to storing long-term structured SRE metrics for retrospective capacity analysis?

  1. IBM Cloud Databases for PostgreSQL used as a metrics store Correct answer.
  2. IBM Cloud Internet Services load balancing
  3. IBM Cloud Activity Tracker
  4. IBM Cloud Code Engine

Explanation

A managed relational database can persist structured metric history for retrospective analysis and querying. Activity Tracker holds audit events, load balancing distributes traffic, and Code Engine runs workloads.

Question 25Site Reliability Engineering Foundations

A service's SLO is based on a 28-day rolling window, and the team wants faster feedback on regressions. Which adjustment is most reasonable?

  1. Add a shorter-window burn-rate alert while keeping the 28-day SLO Correct answer.
  2. Replace the SLO with a single daily measurement
  3. Remove the SLO and rely on ad hoc dashboards
  4. Measure only the last hour of traffic for the SLO

Explanation

A multi-window approach pairs the long SLO window with shorter burn-rate alerts so fast regressions are detected without abandoning the stable long-term target. Replacing or shrinking the SLO window sacrifices the reliability signal.

Question 26Site Reliability Engineering Foundations

An SRE team is writing an SLO for an API and must choose an error budget policy. Which statement best describes the purpose of an error budget in SRE practice?

  1. It sets the hard availability limit that IBM Cloud enforces automatically on a Kubernetes service.
  2. It quantifies the amount of unreliability a service may accumulate in a period before reliability work takes priority over new features. Correct answer.
  3. It defines the maximum number of engineers who may be paged during any single on-call rotation.
  4. It caps the number of deployments a team may ship per quarter to keep change risk predictable.

Explanation

An error budget is the complement of the SLO: if the target is 99.9 percent over a window, the budget is the remaining 0.1 percent of failures that may be spent. It is a management instrument that governs the trade-off between releasing change and investing in reliability, and it is not enforced by the platform.

Question 27Site Reliability Engineering Foundations

A team is choosing which signals to record for a new microservice. Which pairing correctly matches an SRE golden signal with an example measurement?

  1. Errors with the number of pods that the horizontal pod autoscaler added during the day.
  2. Traffic with the count of configuration changes merged into the deployment pipeline.
  3. Saturation with the number of open support tickets filed by end users.
  4. Latency with the time to serve a request, ideally split between successful and failed requests. Correct answer.

Explanation

The four golden signals are latency, traffic, errors, and saturation. Latency must be measured for successful and failed requests separately, because a fast error can otherwise mask a slow success and distort the picture.

Question 28Site Reliability Engineering Foundations

An SRE is asked to explain the difference between mean time to detect and mean time to recover for a payment service. Which description is accurate?

  1. MTTD is the average time from fault onset until monitoring or a human notices, while MTTR is the average time from detection until service is restored. Correct answer.
  2. MTTD covers the interval from fault injection to rollback, while MTTR covers only the time spent writing the postmortem.
  3. MTTD measures planned maintenance windows, while MTTR measures unplanned outages only.
  4. MTTD is the average interval between two production incidents, while MTTR is the average duration of a single incident.

Explanation

Detection time ends when the failure is observed, whether by an alert or a person, and recovery time runs from that observation until the service is healthy again. Reducing MTTR therefore focuses on diagnosis, runbooks, and safe rollback rather than on how quickly the fault is noticed.

Question 29Site Reliability Engineering Foundations

A team wants every production change to be traceable to an approved request without slowing deploys. Which practice best fits an SRE change-management approach?

  1. Freezing production for the final week of every quarter to reduce risk.
  2. Requiring a weekly change advisory board to approve each individual deployment manually.
  3. Removing all review so engineers can deploy whenever they choose.
  4. Automating the deployment pipeline so that every change is peer-reviewed, tested, and recorded with an audit trail. Correct answer.

Explanation

SRE treats change management as a source of risk to be reduced through automation and fast, safe rollback rather than through manual gatekeeping. Automated pipelines with mandatory review and immutable logs provide traceability while keeping batch sizes small and deploys frequent.

Question 30Site Reliability Engineering Foundations

An SRE is deciding how to measure toil for a team that spends much of its week on repetitive manual work. Which approach is most consistent with SRE guidance?

  1. Count only the hours spent inside formal incident bridges, since all other work counts as engineering.
  2. Treat all operational work as toil and target eliminating on-call rotations entirely.
  3. Measure toil by the number of alerts that fired, regardless of whether each alert required human action.
  4. Estimate the fraction of each engineer's time spent on manual, repetitive, automatable operational work and cap it at roughly half of total work. Correct answer.

Explanation

SRE guidance treats toil as manual, repetitive, automatable, tactical work that scales linearly with service growth, and suggests keeping it near or below 50 percent of each engineer's time. Measuring the fraction of time spent this way gives the team a concrete target for automation investment.

Question 31Site Reliability Engineering Foundations

A service has an SLO of 99.9 percent availability over 30 days. During the window it served 20 million requests. Approximately how many failed requests exhaust the entire error budget?

  1. 2,000,000 requests
  2. 20,000 requests Correct answer.
  3. 2,000 requests
  4. 200,000 requests

Explanation

An availability SLO of 99.9 percent allows 0.1 percent of requests to fail, so the budget is 20,000,000 multiplied by 0.001, which equals 20,000 failed requests. This figure is what the team compares against its current failure count to judge burn rate.

Question 32Site Reliability Engineering Foundations

An SRE wants an alert that fires early when a service is consuming its error budget far faster than the SLO window allows. Which alerting design is most appropriate?

  1. A static alert on CPU above 50 percent for five minutes.
  2. A daily email summarizing the previous day's total request count.
  3. An alert on every single failed request so nothing is missed.
  4. A multi-window burn-rate alert that compares short and long window error rates against the budget consumption rate. Correct answer.

Explanation

Multi-window, multi-burn-rate alerting compares recent error rates with the rate at which the budget may be spent, so a fast burn pages quickly while a slow burn opens a ticket. Pairing a short window with a longer one suppresses noise and prevents flapping.

Question 33Site Reliability Engineering Foundations

During an incident, an SRE team must decide when to declare a major incident and hand control to an incident commander. Which criterion is most appropriate?

  1. Only when the deployment pipeline has failed twice in a row.
  2. When user impact is significant or likely to grow and coordination across teams is needed. Correct answer.
  3. Only when a customer has filed a formal support escalation.
  4. Only when the root cause has been fully identified by the on-call engineer.

Explanation

Major-incident declaration is driven by user impact and the need for coordinated response, not by root-cause certainty. Declaring early brings structure, communication, and clear ownership while responders are still diagnosing.

Question 34Site Reliability Engineering Foundations

An SRE team is reviewing a service that has frequent small incidents and wants to reduce their recurrence. Which postmortem practice most improves outcomes?

  1. Restrict attendance to managers so engineers can keep working on the next release.
  2. Focus on blameless analysis of contributing causes and assign tracked action items with owners and due dates. Correct answer.
  3. Record only the timeline and omit any follow-up actions to keep the document short.
  4. Require the engineer who caused the outage to sign an acknowledgment of fault.

Explanation

Blameless postmortems elicit honest detail about contributing factors, and their value comes from concrete, owned, time-bound actions that remove recurrence. Without tracked remediation, the same failure mode tends to repeat.

Question 35Site Reliability Engineering Foundations

A service owner wants to publish an SLO that reflects user experience rather than internal component health. Which SLI definition best meets that goal?

  1. The average CPU utilization of the service across all worker nodes.
  2. The percentage of backend pods reporting a ready status at each scrape.
  3. The percentage of requests that complete successfully within a stated latency threshold, measured as close to the user as feasible. Correct answer.
  4. The number of deployment rollbacks performed during the measurement window.

Explanation

A user-centered SLI is a proportion of good events over valid events, where good typically means served successfully and fast enough, measured at a point that reflects what users actually experience. Internal readiness and resource usage are proxies that can look healthy while users are failing.

Question 36Site Reliability Engineering Foundations

An SRE observes that a service's p99 latency is stable but a growing share of requests exceeds the timeout threshold set by its clients. Which action addresses the underlying reliability risk most directly?

  1. Add more dashboard panels showing the same average latency.
  2. Measure the distribution of latency against the client timeout and reduce tail latency or raise the timeout with client agreement. Correct answer.
  3. Disable client-side timeouts so requests can complete regardless of duration.
  4. Raise the SLO target to 99.99 percent so the problem becomes visible in reports.

Explanation

A stable p99 can hide a shifting tail beyond the client timeout, so the team must compare the latency distribution with the threshold clients actually enforce. Reducing tail latency, or renegotiating the timeout, aligns the service with its callers instead of masking the mismatch.

Question 37Site Reliability Engineering Foundations

A platform team is designing on-call for a service with a 24x7 SLO. Which arrangement best supports sustainable incident response?

  1. Follow-the-sun rotations with documented escalation, runbooks, and a page-worthy alert policy. Correct answer.
  2. A single engineer on call permanently, with no escalation path to keep handoffs simple.
  3. Paging the entire engineering organization for every alert to guarantee someone responds.
  4. Relying on a shared chat channel where anyone may respond when they notice a problem.

Explanation

Sustainable on-call distributes load across time zones or shifts, provides clear escalation when the primary cannot resolve an issue, and keeps paging limited to actionable, user-impacting conditions. Runbooks shorten diagnosis and reduce stress on the responder.

Question 38Site Reliability Engineering Foundations

An SRE is comparing two candidate SLIs for a queue-based worker: consumer lag and job completion latency. Which reasoning best supports choosing one?

  1. Consumer lag is preferable because it is a resource metric and resource metrics always map to user experience.
  2. Completion latency is preferable because queue depth never affects user-visible results.
  3. Both are interchangeable, since any metric stored in IBM Cloud Monitoring can serve as an SLI.
  4. Completion latency is preferable when users wait on job results, because it measures the outcome users perceive rather than an internal backlog. Correct answer.

Explanation

An SLI should capture the quality users experience, so when users wait on processed jobs, end-to-end completion latency is the more faithful measure. Consumer lag is a useful diagnostic and early-warning signal but is an internal proxy that can be high while jobs still complete acceptably.

Question 39Site Reliability Engineering Foundations

A team wants a capacity plan for a service whose traffic grows steadily. Which approach best reflects SRE practice?

  1. Provision for peak observed traffic plus headroom derived from load tests, and re-evaluate as traffic trends change. Correct answer.
  2. Provision based on the number of engineers on the team rather than on measured demand.
  3. Provision for the average traffic of the last week and rely on autoscaling to absorb all peaks.
  4. Provision for the highest traffic ever recorded and never revisit the estimate.

Explanation

Capacity planning combines measured demand, load testing to find the knee of the performance curve, and explicit headroom so that failover or a zone loss does not exhaust spare capacity. It is revisited as trends and architecture change rather than fixed once.

Question 40Site Reliability Engineering Foundations

An SRE team finds that a recurring outage class stems from configuration drift between environments. Which investment most directly reduces the likelihood of recurrence?

  1. Scheduling more frequent meetings to review configuration changes.
  2. Managing configuration as version-controlled code with automated drift detection and promotion through identical pipelines. Correct answer.
  3. Increasing the number of environments to isolate differences.
  4. Adding more manual verification steps to the release checklist.

Explanation

Treating configuration as versioned code and promoting the same artifacts through identical environments removes the human copying that creates drift. Automated drift detection surfaces divergence before it causes an outage.

Question 41Monitoring, Observability, and Incident Response

In IBM Cloud, which service is the primary platform-native tool for collecting and searching application and platform logs across services and regions?

  1. IBM Cloud Kubernetes Service audit log
  2. IBM Cloud Logs Correct answer.
  3. IBM Cloud Monitoring
  4. IBM Cloud Activity Tracker Event Routing

Explanation

IBM Cloud Logs is the platform logging service that ingests, indexes, and lets you query log data from IBM Cloud services and your own workloads. Monitoring handles metrics, Activity Tracker handles audit events, and cluster audit logs cover only Kubernetes API activity.

Question 42Monitoring, Observability, and Incident Response

An SRE wants to be alerted when the request rate to an IBM Cloud service drops below a threshold for five consecutive minutes. Which IBM Cloud Monitoring construct should be used?

  1. A log alert rule on the log query
  2. A Kubernetes liveness probe
  3. A metric alert with a sustained-duration condition Correct answer.
  4. An activity tracking route

Explanation

Metric alerts in IBM Cloud Monitoring evaluate a metric query over a window and fire when the condition holds for the configured duration, which fits a five-minute sustained drop. Log alerts evaluate log queries, activity routes forward audit events, and liveness probes restart containers rather than notify humans.

Question 43Monitoring, Observability, and Incident Response

Which IBM Cloud capability records control-plane and account-level activities such as resource provisioning and IAM policy changes for audit purposes?

  1. IBM Cloud Code Engine logs
  2. IBM Cloud Metrics Routing
  3. IBM Cloud Activity Tracker Correct answer.
  4. IBM Cloud Object Storage access logs

Explanation

Activity Tracker captures auditable events describing actions taken on IBM Cloud resources, including IAM and provisioning changes, and can route them to destinations such as Object Storage or Event Streams. Metrics Routing moves metric data, while the other two options cover workload or bucket-level logging only.

Question 44Monitoring, Observability, and Incident Response

During an incident, an SRE needs a single place to correlate metrics, logs, and topology for workloads running in an IBM Cloud Kubernetes cluster. Which combination best supports that goal?

  1. IBM Cloud Monitoring with the Kubernetes agent plus IBM Cloud Logs Correct answer.
  2. Terraform state files in a version control repository
  3. Activity Tracker alone with email routing
  4. A static runbook stored in Object Storage

Explanation

The Monitoring Kubernetes agent collects cluster and pod metrics while IBM Cloud Logs ingests container logs, letting responders correlate numeric signals with log evidence. Audit events, runbooks, and state files each provide only one narrow slice of the picture.

Question 45Monitoring, Observability, and Incident Response

What is the purpose of a service level objective (SLO) in an SRE monitoring practice?

  1. To enumerate every alert that must page the on-call engineer
  2. To specify the retention period for audit events
  3. To list the infrastructure components owned by a team
  4. To define the target reliability level measured against an SLI over a window Correct answer.

Explanation

An SLO states a target value for a service level indicator across a measurement window, such as 99.9 percent of requests succeeding over 30 days. Alert lists, ownership inventories, and retention settings are separate configuration concerns.

Question 46Monitoring, Observability, and Incident Response

An error budget for a service with a 99.9 percent availability SLO over 30 days has been fully consumed. What is the standard SRE response?

  1. Disable all alerting to reduce noise
  2. Delete the SLO and replace it with a dashboard
  3. Increase the SLO target to 99.99 percent immediately
  4. Freeze risky releases and prioritize reliability work until the budget recovers Correct answer.

Explanation

The error budget is the allowed unreliability implied by the SLO; exhausting it signals that reliability work should take precedence over feature releases. Raising the target or removing monitoring would worsen the situation rather than restore the balance.

Question 47Monitoring, Observability, and Incident Response

Which signal is the best leading indicator that a service is approaching its latency SLO breach before customers complain?

  1. The number of open change requests
  2. The monthly invoice total
  3. A rising p99 latency trend on a burn-rate alert Correct answer.
  4. The count of stored container images

Explanation

Tail latency trends and multi-window burn-rate alerts fire when the error budget is being consumed faster than the SLO permits, giving responders lead time. Cost, change volume, and image counts do not measure user-facing latency.

Question 48Monitoring, Observability, and Incident Response

An SRE wants IBM Cloud Monitoring alerts to open incidents automatically in an external on-call tool. Which mechanism is appropriate?

  1. Enable verbose debug logging on the monitoring agent
  2. Create an Activity Tracker route to Object Storage
  3. Configure a webhook notification channel in the alert definition Correct answer.
  4. Add a second liveness probe to the pod

Explanation

Alert definitions in IBM Cloud Monitoring support notification channels including webhooks, which can call an incident management API. Debug logging, audit routing, and extra probes do not deliver structured alert payloads to an external system.

Question 49Monitoring, Observability, and Incident Response

Which practice most improves the actionability of paging alerts in an SRE rotation?

  1. Routing every warning-level event to the primary pager
  2. Sending alerts only as daily email digests
  3. Tying each page to a symptom with a documented runbook and owner Correct answer.
  4. Increasing the alert evaluation window to 24 hours

Explanation

Pages should represent user-impacting symptoms and arrive with an owner and a runbook so the responder can act. Paging on every warning or delaying to daily digests either causes fatigue or removes timely signal.

Question 50Monitoring, Observability, and Incident Response

What distinguishes IBM Cloud Activity Tracker events from application logs in an incident investigation?

  1. Activity Tracker captures packet payloads from the network
  2. Activity Tracker events contain application stack traces
  3. Activity Tracker events describe who performed which action on which resource Correct answer.
  4. Activity Tracker stores only numeric time series

Explanation

Activity Tracker records auditable actions with initiator, action, and target resource, which supports attribution and change correlation. Application logs hold runtime output, metrics are numeric, and packet capture is a network tool.