SRE Foundation Certification Exam — Questions and Answers

Question 1: What is the 'primary and secondary on-call' model, and what is the role of the secondary on-call engineer?

The secondary on-call is responsible only for change management approvals, not incident response
The secondary on-call monitors all alerts and decides which ones to forward to the primary, acting as a filter
The secondary on-call handles alerts during business hours while the primary handles after-hours alerts only
The primary on-call responds first to all alerts; the secondary serves as backup if the primary cannot be reached within a defined timeout, and may assist on high-severity incidents requiring multiple responders (Correct answer)

Correct answer: The primary on-call responds first to all alerts; the secondary serves as backup if the primary cannot be reached within a defined timeout, and may assist on high-severity incidents requiring multiple responders

The primary handles the alert first; the secondary is the defined escalation path if the primary is unresponsive or the incident requires more than one responder — this structure is defined in advance so escalation is not ad hoc.

Question 2: In Chef, what is a 'cookbook'?

A list of managed nodes and their roles
A fundamental unit of configuration containing recipes and resources (Correct answer)
A testing framework for Chef policies
A log of all configuration changes applied to nodes

Correct answer: A fundamental unit of configuration containing recipes and resources

A Chef cookbook is the fundamental unit of configuration and policy distribution, containing recipes, attributes, and other files needed to configure a system.

Question 3: Which metric best indicates that a system has recovered from a chaos experiment?

Error budget consumption stopping
CPU utilization returning to baseline
All steady state indicators returning to pre-experiment values (Correct answer)
The number of alerts generated dropping to zero

Correct answer: All steady state indicators returning to pre-experiment values

Recovery is confirmed when all predefined steady state observables (latency, error rate, throughput) return to their normal ranges.

Question 4: Why does Google's SRE model argue that having a separate SRE team, rather than embedding reliability work in development teams, is beneficial?

Having a separate team reduces the headcount needed in the development organization
Regulatory requirements mandate that operations and development teams be separated
A dedicated SRE team creates structural incentives to prioritize reliability — developers are motivated to ship features, while SREs are specifically accountable for stability and operational excellence (Correct answer)
SREs have unique technical skills that cannot be learned by developers

Correct answer: A dedicated SRE team creates structural incentives to prioritize reliability — developers are motivated to ship features, while SREs are specifically accountable for stability and operational excellence

Google's SRE model creates a team whose primary incentive and success metric is reliability, counterbalancing development teams whose primary incentive is feature velocity. The structural separation aligns incentives with the organization's reliability goals.

Question 5: An error budget has been fully consumed three weeks before the end of the quarter. What is the MOST appropriate response?

Increase the SLO target to automatically replenish the error budget
Ignore the depletion since SLOs reset at the start of the next quarter
Freeze all non-critical feature releases and focus on reliability work (Correct answer)
Reduce monitoring frequency to lower the number of detected incidents

Correct answer: Freeze all non-critical feature releases and focus on reliability work

When the error budget is exhausted, the standard SRE practice is to halt feature work and redirect engineering effort toward reliability improvements until the budget recovers.

Question 6: Which metric BEST measures the impact of a toil-reduction initiative over time?

Percentage of engineering time spent on toil before and after automation (Correct answer)
Reduction in on-call headcount
Number of automation scripts written
Total lines of code added to the automation framework

Correct answer: Percentage of engineering time spent on toil before and after automation

Tracking the percentage of engineering time consumed by toil directly measures whether the initiative is freeing engineers for higher-value work.

Question 7: A company's SRE charter states that 'SREs must spend at least 50% of time on engineering work.' What is the purpose of setting this floor?

To ensure SREs continuously improve reliability through automation and engineering rather than becoming pure operations staff (Correct answer)
To limit the number of incidents the team responds to
To guarantee SREs work no more than 40 hours per week
To satisfy external compliance requirements for software engineering roles

Correct answer: To ensure SREs continuously improve reliability through automation and engineering rather than becoming pure operations staff

The engineering floor protects against SRE teams devolving into traditional ops teams buried in toil, maintaining their value as reliability engineers.

Question 8: What is the purpose of a 'deployment pipeline' in the context of SRE?

To manage on-call schedules for release teams
To monitor application performance after deployment
To automate the path from code commit to production delivery with quality gates (Correct answer)
To automatically provision cloud infrastructure

Correct answer: To automate the path from code commit to production delivery with quality gates

A deployment pipeline automates build, test, and release steps, enforcing quality gates before production.

Question 9: What is a 'runbook' in the context of disaster recovery, and what makes it operationally effective?

A runbook is a documented, step-by-step procedure for responding to specific failure scenarios; it is effective when it is concrete (exact commands), tested, maintained, and executable by someone unfamiliar with the system (Correct answer)
A runbook is a post-incident summary document that captures what was done during the recovery for future reference
A runbook is an automated script that runs without human intervention during disaster recovery
A runbook is a high-level architecture document describing the recovery architecture for compliance audits

Correct answer: A runbook is a documented, step-by-step procedure for responding to specific failure scenarios; it is effective when it is concrete (exact commands), tested, maintained, and executable by someone unfamiliar with the system

An effective runbook contains exact commands (not just concepts), has been tested in a real or realistic environment, is kept up to date with system changes, and can be followed by an on-call engineer who did not write it — typically at 3 AM under stress.

Question 10: Which consistency model is required for a distributed counter that tracks the total number of page views across multiple servers, where slight temporary inaccuracies are acceptable but the count must eventually be correct?

Strong consistency requiring a distributed lock on every increment
Linearizability so all servers agree on the counter value after every operation
Read-your-writes consistency so each server sees its own increments immediately
Eventual consistency with a CRDT (Conflict-free Replicated Data Type) counter (Correct answer)

Correct answer: Eventual consistency with a CRDT (Conflict-free Replicated Data Type) counter

A CRDT increment counter (G-Counter) supports commutative, associative merges — each server tracks its own count and values are merged to get the global total. This provides eventual consistency without coordination on each write.

Question 11: Which of the following is an example of a latency metric?

HTTP 500 error rate
Request response time (Correct answer)
CPU utilization
Traffic volume

Correct answer: Request response time

Latency refers to the delay between a user's request and the system's response. Request response time directly measures this delay, indicating how quickly a service processes and returns a result for a given request. It is a crucial metric for user experience, as high latency can lead to frustration and perceived slowness, making it a direct example of a latency metric.

Question 12: A microservice running in Kubernetes is experiencing intermittent OOMKilled events. What is the MOST appropriate first response?

Analyze memory usage patterns using profiling tools to identify memory leaks or excessive allocation, then set appropriate memory limits and requests based on observed usage (Correct answer)
Increase the memory limit to 10× the current value to prevent future OOMKilled events
Scale the number of replicas to distribute memory load across more pods
Remove all memory limits so Kubernetes does not kill the pod when memory spikes

Correct answer: Analyze memory usage patterns using profiling tools to identify memory leaks or excessive allocation, then set appropriate memory limits and requests based on observed usage

OOMKilled events indicate the container exceeded its memory limit. The correct approach is to investigate whether the limit is too low for legitimate usage or whether there is a memory leak, then set limits based on profiled actual usage.

Question 13: When a SRE professional encounters an unfamiliar challenge in on-call practices & runbooks, what is the recommended first course of action?

Research applicable standards, consult with subject matter experts, and document the approach (Correct answer)
Postpone addressing the issue indefinitely
Proceed based on personal intuition alone
Apply the solution used for the most recent similar problem without adaptation

Correct answer: Research applicable standards, consult with subject matter experts, and document the approach

Professional practice requires a methodical approach to unfamiliar challenges: research the applicable standards, consult experts when needed, and document the reasoning for the chosen approach.

Question 14: A team uses Elasticsearch, Logstash, and Kibana (ELK stack). What is Logstash's role?

Storing and indexing log data for search
Providing the visualization and dashboarding interface
Collecting metrics from application endpoints via scraping
Ingesting, transforming, and shipping log data to Elasticsearch (Correct answer)

Correct answer: Ingesting, transforming, and shipping log data to Elasticsearch

Logstash is the data processing pipeline that ingests logs from various sources, applies filters and transformations, and forwards them to Elasticsearch.

Question 15: What is the purpose of Kubernetes resource requests and limits, and what happens when a container exceeds its CPU limit?

Both requests and limits define the maximum resources a container can use; exceeding either causes the pod to be evicted
Requests and limits are identical unless the QoS class is set to Burstable, in which case limits can exceed requests
Requests are used for scheduling decisions (the minimum guaranteed resources); limits cap usage. A container that exceeds its CPU limit is throttled (not killed), while exceeding memory limits causes OOMKill (Correct answer)
Requests define the initial allocation; limits define the maximum. Exceeding CPU limits kills the container, just like exceeding memory limits

Correct answer: Requests are used for scheduling decisions (the minimum guaranteed resources); limits cap usage. A container that exceeds its CPU limit is throttled (not killed), while exceeding memory limits causes OOMKill

CPU limits cause throttling (reduced CPU time) not termination. Memory limits cause OOMKill. Requests inform the scheduler about the minimum resources needed for a pod to be placed on a node.

Question 16: What role does continuous improvement play in release engineering & ci/cd for SRE certified professionals?

It focuses exclusively on cost reduction
It is optional and only necessary during certification renewal
It applies only to new professionals in their first year
It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation (Correct answer)

Correct answer: It drives ongoing enhancement of practices, processes, and outcomes through systematic evaluation

Continuous improvement is fundamental to professional practice in release engineering & ci/cd, involving regular evaluation, feedback integration, and process enhancement to maintain high standards.

Question 17: What is the purpose of a 'capacity model' in SRE practice?

Tracking incident resolution times
Mapping resource consumption to traffic levels to forecast infrastructure needs (Correct answer)
Defining SLOs for each service tier
Documenting on-call rotation schedules

Correct answer: Mapping resource consumption to traffic levels to forecast infrastructure needs

A capacity model quantifies the relationship between traffic/usage and resource consumption, enabling accurate infrastructure forecasting as load grows.

Question 18: What is the key difference between an SLO and an SLA?

SLOs apply to latency only; SLAs apply to availability only
SLOs are internal targets that guide engineering decisions; SLAs are external contractual commitments with financial or legal consequences for breach (Correct answer)
SLOs are set by customers; SLAs are set by the engineering team
SLOs measure real-time performance; SLAs measure historical performance over a quarter

Correct answer: SLOs are internal targets that guide engineering decisions; SLAs are external contractual commitments with financial or legal consequences for breach

SLOs are internal targets that teams use to drive reliability work and gate releases. SLAs are contracts with customers — if the SLA is breached, there are consequences (credits, contract termination). SLOs are typically set stricter than SLAs to provide a buffer.

Question 19: What is 'on-call rotation design,' and which team size and rotation frequency minimizes on-call fatigue?

A minimum of 8 engineers in the rotation with a weekly rotation provides adequate coverage while ensuring each engineer is on-call less than once every two months, though actual minimum depends on service criticality and alert volume (Correct answer)
A 2-person rotation with a daily rotation maximizes freshness of on-call engineers and minimizes the same person carrying extended responsibility
On-call rotation size is irrelevant; only the total number of hours per week of on-call coverage matters
A 12-person rotation with a monthly rotation is the industry standard for all SRE teams regardless of service criticality

Correct answer: A minimum of 8 engineers in the rotation with a weekly rotation provides adequate coverage while ensuring each engineer is on-call less than once every two months, though actual minimum depends on service criticality and alert volume

Google's SRE practice recommends at least 8 people in the rotation so that each person is on-call roughly every 8 weeks, providing adequate recovery time between rotations. Smaller teams need to either hire or reduce service scope.

Question 20: What does Kubernetes horizontal pod autoscaling (HPA) do, and what metric is it MOST commonly configured to use?

HPA distributes pods across nodes to maximize hardware utilization based on CPU load
HPA adjusts the CPU and memory limits of running pods based on their actual usage without changing the replica count
HPA automatically adjusts the number of pod replicas based on observed metrics (most commonly CPU utilization), scaling out when demand increases and in when it decreases (Correct answer)
HPA monitors pod health and replaces unhealthy pods with new ones during high-load periods

Correct answer: HPA automatically adjusts the number of pod replicas based on observed metrics (most commonly CPU utilization), scaling out when demand increases and in when it decreases

HPA watches metrics (default: CPU utilization as a percentage of the CPU request) and scales the number of replicas up or down to maintain the target metric value. It is the primary autoscaling mechanism for request-driven workloads.

Question 21: Which of the following best describes a key competency required for release engineering & ci/cd in SRE practice?

Strong analytical skills combined with effective communication and ethical judgment (Correct answer)
The ability to work independently without any oversight
Memorization of all relevant regulations without understanding context
Reliance on a single methodology for all situations

Correct answer: Strong analytical skills combined with effective communication and ethical judgment

SRE professionals working in release engineering & ci/cd need analytical skills to assess situations, communication skills to convey findings, and ethical judgment to make sound decisions.

Question 22: What is the 'two-minute rule' in runbook design and what problem does it address?

Every runbook action must be completed within two minutes or the responder must escalate immediately
Runbook steps should be written so that any engineer can execute them within two minutes, regardless of their familiarity with the service
If a runbook step takes more than two minutes to read and understand, it should be broken into smaller, more focused steps — ensuring the responder can act quickly without reading paragraphs of context mid-incident (Correct answer)
Two-minute rules require runbooks to be reviewed and updated at least every two months to ensure accuracy

Correct answer: If a runbook step takes more than two minutes to read and understand, it should be broken into smaller, more focused steps — ensuring the responder can act quickly without reading paragraphs of context mid-incident

Long, dense runbook steps force the responder to stop and read extensively during a high-pressure incident. Breaking instructions into small, scannable steps that can be understood and executed in under two minutes maintains momentum and reduces cognitive load.

Question 23: Which technique allows a team to test system behavior under 2× production load without generating real user traffic?

Shadow traffic (dark launch) mirroring (Correct answer)
Enabling database read replicas
Feature flag rollout to 50% of users
Increasing CDN TTLs

Correct answer: Shadow traffic (dark launch) mirroring

Shadow traffic mirrors real production requests to a parallel environment, allowing load testing at scale with real patterns without impacting users.

Question 24: What is 'alert deduplication' in monitoring systems, and why is it important for on-call effectiveness?

Alert deduplication groups multiple alerts with the same root cause into a single notification, preventing the on-call engineer from being flooded with hundreds of related alerts from a single incident (Correct answer)
Alert deduplication removes duplicate monitoring rules from the alerting configuration to reduce maintenance overhead
Alert deduplication ensures the same alert is not sent to both the primary and secondary on-call engineers simultaneously
Alert deduplication archives historical alerts to prevent the alerting system from running out of storage

Correct answer: Alert deduplication groups multiple alerts with the same root cause into a single notification, preventing the on-call engineer from being flooded with hundreds of related alerts from a single incident

Without deduplication, a single incident can generate hundreds of alerts (one from each affected service or host), burying the on-call engineer in notifications and making it hard to understand the scope and nature of the incident.

Question 25: A team implements structured logging in JSON format. What is the primary operational benefit?

Automatic encryption of sensitive fields
Smaller log file sizes compared to plain text
Faster write throughput to disk
Machine-parseable fields that enable consistent filtering and alerting (Correct answer)

Correct answer: Machine-parseable fields that enable consistent filtering and alerting

Structured JSON logs expose consistent, typed fields that log aggregation tools can index and query without fragile regex parsing.

Question 26: What does a rollback strategy ensure?

There’s a backup plan if the change fails (Correct answer)
Increased deployment time.
More errors during deployment.
No monitoring is needed.

Correct answer: There’s a backup plan if the change fails

A rollback strategy is a critical component of robust deployment and change management processes. It ensures that if a new change or deployment introduces errors or fails to perform as expected, the system can be quickly and safely reverted to a previous stable state. This backup plan minimizes downtime and reduces the negative impact of failed deployments on users and services.

Question 27: In PagerDuty or OpsGenie, what is an 'override' typically used for?

Disabling all alerts for a service
Temporarily assigning on-call duty to a different engineer for a defined time window (Correct answer)
Changing the escalation policy permanently
Permanently reassigning on-call ownership

Correct answer: Temporarily assigning on-call duty to a different engineer for a defined time window

An override temporarily substitutes one engineer for another in the schedule, used for vacations, sick days, or planned absences without changing the permanent rotation.

Question 28: What is 'Chaos Monkey' and which company originally developed it?

A load testing tool developed by Google
A network packet dropper developed by Amazon
A random instance terminator developed by Netflix as part of the Simian Army (Correct answer)
A memory leak injector developed by Microsoft

Correct answer: A random instance terminator developed by Netflix as part of the Simian Army

Netflix created Chaos Monkey to randomly terminate EC2 instances in production, forcing engineers to build resilient auto-recovering services.

Question 29: Why should SLOs be reviewed periodically?

To make them more strict over time.
To align with changing requirements and reliability targets (Correct answer)
To comply with financial audits.
To replace SLIs and SLAs.

Correct answer: To align with changing requirements and reliability targets

SLOs are not static; they should evolve as the business, user expectations, and system capabilities change over time. Periodic review ensures that SLOs remain relevant and accurately reflect current business objectives and user needs. This dynamic approach allows SRE teams to adapt their reliability efforts and resource allocation to new priorities and technological advancements, maintaining their effectiveness.

Question 30: In release engineering, what is the purpose of semantic versioning (SemVer)?

To communicate the type and impact of changes (major, minor, patch) through the version number (Correct answer)
To automate changelog generation from commit history
To enforce branch naming conventions
To encrypt release artifacts

Correct answer: To communicate the type and impact of changes (major, minor, patch) through the version number

SemVer uses MAJOR.MINOR.PATCH to signal breaking changes, new features, and bug fixes respectively.

Question 31: What does 'pipeline as code' mean in modern CI/CD practices?

Defining pipeline configuration in version-controlled files alongside application code (Correct answer)
Writing pipeline logic in the application's main codebase
Using a GUI to configure pipeline steps
Storing pipeline execution logs in the code repository

Correct answer: Defining pipeline configuration in version-controlled files alongside application code

Pipeline as code means storing pipeline definitions (e.g., Jenkinsfile, .gitlab-ci.yml) in version control for auditability and reproducibility.

Question 32: What is the most effective way to measure success in observability & logging within SRE professional practice?

Rely solely on supervisor opinion
Count only the number of activities completed
Compare only with industry averages without considering context
Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives (Correct answer)

Correct answer: Use a combination of quantitative metrics, qualitative assessments, and stakeholder feedback aligned with defined objectives

Effective measurement combines multiple data sources — quantitative metrics, qualitative assessments, and stakeholder feedback — all aligned with clearly defined objectives for a comprehensive evaluation.

Question 33: A service team wants to define SLIs for a batch data pipeline that processes files every night. Which SLI is MOST appropriate?

Proportion of nightly batch runs that complete successfully within the defined processing window (e.g., 4 hours) (Correct answer)
Number of files processed per hour during peak load
Average CPU utilization of the batch processing servers during runs
Time since the last successful batch run as reported by the scheduler

Correct answer: Proportion of nightly batch runs that complete successfully within the defined processing window (e.g., 4 hours)

For a batch pipeline, the key user concern is whether the batch completes on time and successfully. The proportion of runs completing within the processing window directly measures this user-visible concern.

Question 34: Which of the following best describes Infrastructure as Code?

Infrastructure managed using scripts and configuration files (Correct answer)
Infrastructure defined using GUI interfaces.
Infrastructure managed only by operations teams.
Infrastructure hardcoded into applications.

Correct answer: Infrastructure managed using scripts and configuration files

Infrastructure as Code (IaC) fundamentally means defining and managing infrastructure resources (like servers, networks, and databases) using code, typically in scripts or declarative configuration files. This approach allows infrastructure to be treated like application code, enabling version control, automated testing, and consistent deployment across environments. It moves away from manual, GUI-based configuration to a programmatic and repeatable approach.

Question 35: What should an SLO be tied to?

Codebase complexity
Deployment frequency
Infrastructure cost
Business objectives and user impact (Correct answer)

Correct answer: Business objectives and user impact

Service Level Objectives (SLOs) should always be tied directly to what matters most to the business and its users. They define the acceptable performance and reliability from the perspective of the end-user experience and critical business functions. This ensures that SRE efforts are focused on improving aspects that directly contribute to user satisfaction and overall business success, making them impactful and relevant.

Question 36: A runbook step says 'run this SQL query monthly to archive old records.' How should an SRE classify and address this?

Delegate it permanently to the database team
Classify as toil and automate with a scheduled cron job or database maintenance policy (Correct answer)
Convert it to a quarterly task to reduce frequency
Keep it in the runbook since it only runs once a month

Correct answer: Classify as toil and automate with a scheduled cron job or database maintenance policy

Repetitive manual tasks with predictable triggers are classic toil regardless of frequency and should be automated away.

Question 37: A monitoring system sends 500 alerts in a single day during a major outage, most of which are symptoms of one root cause. What monitoring design pattern would BEST reduce this alert storm?

Implement an alert blackout window during known outage periods
Increase alert thresholds globally by 50% to reduce sensitivity
Route all alerts to email instead of paging to reduce interrupt load
Alert on symptoms that matter to users (e.g., elevated error rate) rather than on every downstream effect and system metric (Correct answer)

Correct answer: Alert on symptoms that matter to users (e.g., elevated error rate) rather than on every downstream effect and system metric

Symptom-based alerting (alert on high user-visible error rates) rather than cause-based alerting (alert on every internal metric deviation) dramatically reduces alert storms by targeting the root signal rather than all downstream effects.

Question 38: What is 'alert correlation' in a mature SRE observability platform?

An ML approach to predicting future alert volume based on historical firing patterns
A technique that compares alert rates between production and staging environments
The process of linking multiple related alerts to a common root cause or triggering event (Correct answer)
A method for mapping alert severity levels to SLO violation percentages

Correct answer: The process of linking multiple related alerts to a common root cause or triggering event

Alert correlation groups related alerts that likely share a common cause, helping on-call engineers quickly identify the root incident rather than being overwhelmed by many symptom-level alerts firing simultaneously.

Question 39: What problem does 'log rotation' solve in host-based logging?

It replicates logs across multiple hosts for redundancy
It parses logs in real time for alerting
It ensures logs are written in structured JSON format
It prevents log files from growing indefinitely and consuming all disk space (Correct answer)

Correct answer: It prevents log files from growing indefinitely and consuming all disk space

Log rotation periodically archives or deletes old log files to prevent unbounded disk consumption on the host.

Question 40: What problem does remote Terraform state storage (e.g., S3 + DynamoDB) solve?

It reduces the time required for terraform plan
It automatically encrypts all managed resources
It provides rollback capability for failed deployments
It enables team collaboration and prevents concurrent state modifications (Correct answer)

Correct answer: It enables team collaboration and prevents concurrent state modifications

Remote state storage enables multiple team members to share state and uses locking (e.g., DynamoDB) to prevent simultaneous conflicting changes.

SRE Foundation Certification Exam

The SRE Foundation Certification Exam validates an individual's understanding of the core principles and practices of Site Reliability Engineering (SRE).

Questions

60 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds