3.0 Operations CV0-004 Practice Quiz

• A. To automatically fix application errors when they occur
• B. To record events, errors, transactions, and system activities over time, providing an audit trail and data source for troubleshooting, security analysis, and compliance
• C. To replace monitoring dashboards with text-based status reports
• D. To store application code changes for version control purposes

Logging captures a persistent, time-stamped record of system and application events, enabling post-incident investigation, security forensics, compliance auditing, and performance analysis. This is the correct answer.

• A. The process of deleting old logs to free up storage space
• B. The process of gathering log data from various sources, applications, operating systems, cloud services, and network devices, and forwarding it to a centralized storage and analysis platform
• C. The manual process of reading logs on each server individually
• D. The process of creating new log entries from monitoring metrics

Log collection gathers log data from all sources in a distributed environment and forwards it to a centralized platform (ELK stack, Splunk, CloudWatch Logs) for unified storage, search, and analysis. This is the correct answer.

• A. Increasing the size of production servers to prevent incidents
• B. Configuring structured logging at an appropriate verbosity level, shipping logs to a centralized log management platform, and ensuring log availability persists beyond instance termination
• C. Adding more developers to the team to investigate incidents faster
• D. Using a different programming language that generates fewer errors

Structured logging with appropriate verbosity, shipped to a centralized platform outside the instance, ensures logs survive instance termination and are searchable during post-incident investigation. This is the correct answer.

• A. Increase container storage so logs persist longer before being overwritten
• B. Deploy a log collection agent (e.g., Fluentd, Fluent Bit, Filebeat) on each node that continuously reads container logs from the node's log directory and forwards them to a centralized log platform outside the container lifecycle
• C. Reduce container restart frequency to preserve logs longer
• D. Store logs inside the container image for retrieval after restart

Node-level log collection agents continuously forward logs to an external platform in real time. By the time a container restarts, its logs are already safely stored outside the container lifecycle, preventing data loss on restart. This is the correct answer.

• A. Reduce the number of microservices to reduce the number of log streams
• B. Implement a centralized log aggregation platform (ELK stack, Datadog, Splunk) that collects all 30 service log streams and makes them searchable from a single interface with correlation by shared request trace ID
• C. Ask each service team to email their logs to the incident team
• D. Increase log verbosity in each service to include the logs of all other services

A centralized aggregation platform with trace ID correlation allows engineers to search all 30 services simultaneously, following a single request ID across all service logs in one query rather than checking 30 separate locations. This is the correct answer.

• A. Application performance logs from the current week
• B. Cloud control plane audit logs (e.g., AWS CloudTrail, Azure Activity Log) that record all API calls including who made the call, what action was taken, from which IP address, and at what time, retained for at least 90 days
• C. Network flow logs showing traffic volumes between instances
• D. Container stdout logs from currently running pods

Cloud audit logs record every API call against cloud infrastructure, including IAM identity, timestamp, action taken, and source IP. With 90+ day retention, changes from 3 weeks ago are recoverable for forensic investigation. This is the correct answer.

• A. Reduce log verbosity so fewer logs are generated
• B. Implement structured logging (JSON format with consistent fields: timestamp, level, service, trace_id, message) and ship to a log management platform with indexing and query capabilities, enabling precise, fast queries across large log volumes
• C. Delete logs older than 24 hours to reduce the search space
• D. Assign one engineer permanently to manually search logs for errors

Structured logging with consistent fields enables query engines to efficiently find specific events across millions of records in seconds, transforming an unmanageable text search problem into a precise database-style query. This is the correct answer.

• A. Stop collecting logs during traffic spikes to reduce agent CPU overhead
• B. Configure the collection agents to use buffering and batching, writing logs to a local buffer queue and forwarding in batches rather than per-event, reducing the CPU overhead of continuous network transmission
• C. Switch to a single centralized log collection server to reduce per-agent work
• D. Increase server CPU allocation to absorb the collection agent overhead

Buffering and batching reduces the frequency of network write operations, instead of processing each log event individually (high overhead), agents accumulate events in memory and send them in efficient batches, dramatically reducing CPU and network I/O overhead. This is the correct answer.