Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud DevOps Engineer practice bank has 1,455 more like it. Try 10 free: instant score, no account.
A DevOps engineer is configuring proactive alerting policies in Google Cloud Monitoring using Prometheus Query Language (PromQL) to detect performance anomalies across a microservices cluster. The engineer defines an alerting condition with an Evaluation interval set to 120 seconds (2 minutes).
During a test, a brief anomaly causes the PromQL condition to evaluate to true, opening a new incident. On subsequent evaluations, the metric normalizes and no longer meets the condition. The engineer observes that the incident does not follow the standard incident autoclose duration configured at the policy level.
How does Cloud Monitoring determine when to automatically close an incident created by this PromQL-based alerting policy?
In Google Cloud Monitoring, alerting policies created using Prometheus Query Language (PromQL) have a specialized incident resolution lifecycle. Unlike standard metric-threshold conditions or log-based alerts, PromQL-based alerting conditions do not rely on user-defined incident autoclose durations configured in the policy settings. Instead, Cloud Monitoring calculates an automatic incident closure time based on the condition's Evaluation interval and the last moment the condition was satisfied.
This built-in mechanism aligns Cloud Monitoring's incident management engine with Prometheus alerting semantics, ensuring reliable alert state transitions while preventing premature closures during transient recovery phases.
Manual incident resolution is an operational workflow where an on-call engineer explicitly acknowledges and resolves an active incident through the Google Cloud Console, gcloud CLI, or the Monitoring REST API.
Cloud Monitoring incidents generated by metric conditions—including PromQL queries—are designed to be self-healing and automatically managed by the platform. They do not require manual intervention to close once the metric returns to healthy levels. Cloud Monitoring automatically initiates the closing sequence as soon as the condition is no longer met, terminating the incident once the required time threshold has elapsed.
Cloud Monitoring lacked automatic incident resolution capabilities and mandated human intervention for all incident state transitions.
SRE best practices emphasize automated alert clearance when telemetry reflects healthy system behavior to reduce operator cognitive load.
The Incident autoclose duration is a setting available in Cloud Monitoring metric-threshold and SQL alerting policies. It determines how long Cloud Monitoring waits before automatically closing an open incident when telemetry data stops arriving altogether.
PromQL-based alerting conditions explicitly do not use or follow the policy-level incident autoclose duration setting. While standard metric policies default to a 7-day autoclose period when data ceases, PromQL alerting policies calculate their incident closure strictly from the condition's Evaluation interval and the timestamp of the last violation.
The policy were a standard metric-threshold alerting policy where telemetry streams unexpectedly vanished and data stopped arriving.
Understanding which condition types honor global policy settings versus specialized rule engines is critical for configuring accurate observability in Google Cloud.
Immediate closure refers to a state machine model where an incident is terminated as soon as a single evaluation returns non-violating data (or an empty result vector in PromQL).
Cloud Monitoring intentionally does not close PromQL incidents immediately upon receiving a single non-violating evaluation. Immediate closure would cause severe alert flapping when monitoring noisy, bursty, or high-cardinality time series. If a service experiences intermittent failures where every other evaluation cycle passes, an immediate closure design would repeatedly open and resolve dozens of distinct incidents and dispatch duplicate paging notifications.
Cloud Monitoring implemented instantaneous alert reset behavior without hysteresis or dampening timers.
To prevent spurious alerts in production, monitoring platforms always incorporate stabilization or hold-down timers between violation states and recovery states.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated