Free Datadog APM & Distributed Tracing Fundamentals Sample Questions

Correct answer: B — To provide a centralized view of all services, their owners, dependencies, and performance metrics.

• A. Incorrect. The Service Catalog is not related to purchasing Datadog licenses or features; billing and account management are handled through separate administrative channels. Its focus is on documenting and organizing service metadata for observability rather than commercial transactions.
• B. Correct. The Datadog Service Catalog provides a centralized inventory of services, including their owners, dependencies, SLAs, and performance metrics. This enhances discoverability and provides operational context, allowing teams to correlate services with monitoring, alerts, and incidents for better ownership.
• C. Incorrect. While Datadog provides an Integrations page to list and configure supported third-party tools, the Service Catalog is specifically designed for your internal services and their operational metadata.
• D. Incorrect. The Service Catalog does not store application source code or backups; these are managed by version control systems like Git. The catalog only stores service-related metadata and links to documentation or repositories.

Correct answer: B — A collection of spans that tracks the complete journey of a request across a distributed system.

• A. Incorrect. A single line of text emitted by an application is defined as a log entry. While logs provide context, they are discrete events, whereas traces are composed of multiple spans that together describe the path of a request across services.
• B. Correct. Datadog defines a trace as a collection of spans that tracks the complete journey of a request as it moves across a distributed system. Each span represents an individual unit of work, and the trace provides end-to-end visibility into timing, causality, and service relationships.
• C. Incorrect. This describes a time-series metric. Metrics quantify system-level performance or utilization values over time, while traces specifically capture the execution path and latency of individual requests.
• D. Incorrect. A scheduled test that simulates traffic describes Datadog Synthetic Monitoring. While synthetic tests can generate traces, the trace itself is the resulting data representing the request flow, not the scheduled test script.

Correct answer: B — Because requests now cross multiple network boundaries, making it nearly impossible to track execution flow without distributed tracing.

• A. Incorrect. Microservices continue to generate traditional logs, but because these logs are fragmented across many different services, they become harder to correlate without the trace context provided by APM tools.
• B. Correct. In a microservices architecture, a single user request often traverses many services and network hops. Distributed tracing and APM are essential to follow the execution flow, measure latency between services, and identify the root cause of issues across these boundaries.
• C. Incorrect. Monolithic applications can and are commonly monitored by modern observability tools. The shift to microservices simply increases the necessity for distributed tracing specifically, as the complexity of service-to-service communication grows.
• D. Incorrect. Microservices typically increase infrastructure complexity and operational overhead rather than reducing it. APM's value lies in operational visibility and performance optimization, not in managing IT budget spending.

Correct answer: B — Filter APM traces by the payment service and the 500 error status code to isolate and inspect the failing requests.

• A. Rebooting servers is a disruptive, non-diagnostic action that fails to leverage APM data to identify the root cause. This approach results in unnecessary downtime and does not prevent the issue from recurring if it is code-related.
• B. This is the primary use case for APM. By filtering traces by service and the 500 error status code, an engineer can isolate specific failing requests. Inspecting the associated spans, flame graphs, and attached logs allows for the identification of the exact code path, database query, or downstream service call causing the error.
• C. Low CPU usage is not an indicator of application health regarding logic errors. Intermittent 500 errors are often caused by unhandled exceptions, resource contention, or failed dependencies which do not necessarily result in high CPU utilization.
• D. Pinging the homepage does not exercise the payment flow and therefore will not reproduce or detect errors occurring on the payment page. While Synthetic tests are useful for proactive monitoring, they must be targeted at the relevant endpoint to be effective.

Correct answer: B — As a DaemonSet, ensuring exactly one Datadog Agent runs on every worker node.

• A. Deploying the Datadog Agent as a single global instance or in a dedicated cluster is not recommended. This architecture creates a single point of failure, increases cross-node network latency, and prevents the Agent from efficiently collecting node-local metadata and container-specific tags.
• B. Deploying the Datadog Agent as a DaemonSet is the standard and recommended practice for Kubernetes. This ensures exactly one Agent instance runs on every worker node, allowing pods to send traces to the local Agent via host IP or Unix Domain Sockets (UDS). This setup scales automatically with the cluster, provides redundancy, and minimizes network overhead.
• C. Embedding the Agent directly inside application containers (fat containers) violates container best practices. It increases image size, complicates the lifecycle management of the monitoring agent, and leads to excessive resource duplication compared to a node-level shared Agent.
• D. Datadog Agents are designed to be persistent processes that handle continuous streams of telemetry. Using serverless functions to collect trace events would introduce extreme latency, high costs, and architectural complexity that is not supported for standard APM ingestion.

Correct answer: B — Distributed tracing context propagation (inject/extract) is not configured or is being stripped by an intermediate proxy.

• A. Datadog APM is language-agnostic and supports cross-language tracing. As long as the trace context is propagated correctly via standard headers, services written in different programming languages can be linked into a single trace.
• B. Distributed tracing relies on context propagation to link spans across service boundaries. This involves injecting trace IDs into outgoing request headers (e.g., x-datadog-trace-id or W3C traceparent) and extracting them on the receiving side. If this configuration is missing, or if an intermediate proxy or load balancer strips these headers, the downstream service will start a new trace instead of continuing the existing one.
• C. While high span volume can trigger sampling or rate-limiting which might result in missing data, it typically causes partial traces or missing spans rather than a consistent failure to link the frontend and backend. Broken linkage is fundamentally a propagation issue.
• D. The Datadog Agent is a server-side or host-level component, not a browser-based one. Client-side telemetry is collected via the Datadog RUM (Real User Monitoring) SDK, but the lack of an agent on a browser would not cause instrumented backend services to fail to connect to one another.

Correct answers: A, B — Programmatically using the Datadog tracing library's API (e.g., span.set_tag); By configuring the DD_TAGS environment variable for the application

• A. Correct. Using the Datadog tracing library's API (such as the `set_tag` method) allows developers to programmatically add dynamic, context-specific metadata to spans at runtime. This is the most flexible way to add custom tags based on application logic.
• B. Correct. Configuring the `DD_TAGS` environment variable (or tracer-specific variables like `DD_TRACE_GLOBAL_TAGS`) allows you to apply global tags to all spans emitted by the application. This is useful for including metadata like environment, service version, or team ownership without changing the application code.
• C. Incorrect. Trace and span data in Datadog is immutable once ingested. The Datadog UI does not support manual editing of spans; any tagging must be performed before the data is sent to Datadog.
• D. Incorrect. Datadog support does not modify individual trace or span data. Tagging is a configuration and instrumentation task handled by the user's infrastructure and application code.
• E. Incorrect. Comment blocks are ignored during compilation or interpretation of the source code and have no effect on the Datadog tracer's behavior at runtime.

Correct answer: B — Use the same service name but different span.type or operation_name tags for HTTP and queue spans

• A. Deploying the application twice adds unnecessary operational complexity and infrastructure overhead. It results in duplicate service entries rather than logically distinguishing operation types within a single service context.
• B. Using the same service name while differentiating via span.type (e.g., web vs. worker) or operation_name allows Datadog to group telemetry under one logical service. This provides the granularity needed to filter and analyze HTTP and queue operations separately in the Service Map, Trace Explorer, and APM monitors.
• C. Disabling tracing for background tasks eliminates critical visibility into asynchronous workflows, making it impossible to monitor performance, latencies, or errors for a significant portion of the application's logic.
• D. DD_VERSION is a reserved tag used specifically to track code releases and deployment iterations as part of Unified Service Tagging. Using it to categorize operation types is a misuse of the tag that would break version tracking and mislead performance analysis across deployments.

Correct answers: B, C — Application Security Management (ASM); Continuous Profiler

• A. Distributed Tracing is a standardized capability that can be implemented with both OOTB tracers and community tracers (like OpenTelemetry). Many community tracers can export spans in formats that Datadog can ingest via OTLP or specific adapters.
• B. Application Security Management (ASM) relies on runtime instrumentation, request payload analysis, and WAF hooks that are specifically built into Datadog's OOTB tracers. Community tracers typically lack these proprietary security hooks and the specific data collection required for Datadog's ASM engine.
• C. The Continuous Profiler requires low-overhead runtime data collection and specific upload pipelines that are integrated directly into Datadog's proprietary tracer and profiler libraries. Generic community tracers do not typically include the profiling mechanisms required by Datadog's profiling product.
• D. Log correlation involves injecting trace and span IDs into application logs. While Datadog's OOTB tracer automates this process, it can also be achieved with community tracers or OpenTelemetry by configuring the library to include the necessary fields in log metadata.
• E. APM Error Tracking is based on span metadata and error tags. Since community tracers can capture and report exceptions and error status codes using standard conventions, Datadog can process this data regardless of whether an OOTB tracer was used.

Correct answer: B — The Datadog Agent or backend automatically calculates these APM metrics from the ingested OpenTelemetry spans.

• A. Incorrect. Datadog is fully capable of generating APM metrics from OpenTelemetry spans. It ingests OTLP-exported spans and derives high-level metrics like request rates, error rates, and latency aggregates.
• B. Correct. The Datadog Agent or backend automatically calculates APM metrics (often referred to as RED metrics: Request, Error, Duration) from the ingested OpenTelemetry spans. This ensures users maintain high-level visibility and dashboarding capabilities even when using community-driven instrumentation.
• C. Incorrect. While users can choose to send custom StatsD metrics, it is not required for standard APM metrics. Datadog derives those basic metrics automatically from the span data it ingests.
• D. Incorrect. Standard APM features, including metric generation from OpenTelemetry, do not require a separate product purchase. OpenTelemetry support is a built-in feature of the Datadog APM platform.

Correct answers: A, B — Aggregated trace metrics are retained for 15 months.; Indexed spans are retained for 15 days.

• A. Aggregated trace metrics are derived from traces and stored as standard metrics. Therefore, they follow Datadog's standard metric retention policy of 15 months.
• B. Indexed spans, which are used for Span Search and Analytics, have a default retention period of 15 days in Datadog.
• C. Live traces are real-time data and are typically only available for a short window of approximately 15 minutes. They are not retained for 15 days.
• D. This statement is incorrect because indexed spans are retained for 15 days. The 15-month retention period applies to metrics (like aggregated trace metrics), not individual spans.
• E. This statement is incorrect because aggregated trace metrics are stored as metrics and retained for 15 months. The 15-day retention period applies to indexed spans.

Correct answer: C — By monkey-patching standard libraries and supported frameworks at runtime.

• A. Incorrect. Attaching a JVM (Java Virtual Machine) agent at runtime is the standard mechanism for instrumenting Java applications, not interpreted languages like Python and Ruby.
• B. Incorrect. The CLR (Common Language Runtime) Profiling API is specific to the .NET ecosystem and is not used for languages such as Python or Ruby.
• C. Correct. In dynamic, interpreted languages like Python and Ruby, Datadog's tracer libraries utilize monkey-patching. This involves dynamically replacing or wrapping functions and classes in standard libraries and supported frameworks (such as Flask, Django, or Rails) at runtime to inject tracing logic and collect performance data automatically.
• D. Incorrect. While some languages use bytecode manipulation, it typically happens at load-time (for Java) rather than a separate compilation phase for Python and Ruby. The standard approach for these interpreted languages in the Datadog ecosystem is runtime monkey-patching.

Correct answer: A — Prefix the startup command with `ddtrace-run`, for example: `ddtrace-run gunicorn myapp.wsgi`.

• A. Correct. Prefixing the startup command with `ddtrace-run` is the standard method for enabling Datadog automatic instrumentation in Python applications. This utility wraps the execution and automatically patches supported libraries (such as Django and Gunicorn) at runtime, allowing for tracing without any modifications to the application source code.
• B. Incorrect. The `-javaagent` flag is used exclusively for Java applications to attach the Datadog Java tracer to the JVM. It is not compatible with Python or Gunicorn.
• C. Incorrect. While Datadog uses many environment variables for configuration (e.g., `DD_SERVICE`), `DD_AUTO_INSTRUMENT=true` is not a standard variable that initiates automatic patching for Python applications. Automatic instrumentation is triggered by the `ddtrace-run` wrapper.
• D. Incorrect. Modifying `settings.py` to include Datadog middleware is a valid way to instrument Django, but it requires modifying the application's source code, which contradicts the specific requirement of the question.

Correct answer: B — Continuous Profiling is not enabled for the service generating the span.

• A. Incorrect. While an outdated Datadog Agent can cause issues with data collection or transmission, it is not the most likely reason for missing profiling data. The Code Hotspots feature specifically relies on the configuration of the tracer's profiler.
• B. Correct. Code Hotspots is a feature that integrates APM traces with Continuous Profiling. For data to appear in the 'Code Hotspots' tab, Continuous Profiling must be explicitly enabled in the application's tracer configuration for the service generating the span.
• C. Incorrect. Continuous profiling runs independently of individual span duration by taking periodic samples. While extremely short spans might aggregate fewer samples, the complete absence of data typically indicates the profiling feature is not running at all.
• D. Incorrect. Code Hotspots are not limited to database spans. They map CPU, memory, and wall-time hotspots across any application code associated with a span, regardless of whether the operation is a database call or a standard internal function.

Correct answer: A — OpenTelemetry

• A. Correct. OpenTelemetry (OTel) is the industry-standard, vendor-neutral open-source framework for collecting observability data (traces, metrics, and logs). Datadog natively supports OpenTelemetry through OTLP ingestion in the Datadog Agent or directly, allowing users to instrument applications without being tied to a specific vendor's SDK.
• B. Incorrect. StatsD is a protocol for metric aggregation. While Datadog supports a compatible agent (DogStatsD), it is primarily focused on metrics and often includes Datadog-specific extensions (like tags), making it less of a comprehensive vendor-neutral standard for distributed tracing compared to OpenTelemetry.
• C. Incorrect. Fluentd is an open-source log collector and forwarder used for unified logging layers. While Datadog can ingest logs from Fluentd, it is not a general-purpose instrumentation standard for traces or metrics.
• D. Incorrect. GraphQL is a query language for APIs and a runtime for fulfilling those queries. It is an application development technology, not an observability instrumentation standard.

Correct answer: B — Datadog Single Step Instrumentation via the Datadog Cluster Agent

• A. Manual custom instrumentation requires developers to manually add instrumentation code and tracing calls to their applications. This involves modifying the source code and contradicts the requirement to enable APM without code or Dockerfile changes.
• B. Datadog Single Step Instrumentation utilizes the Datadog Admission Controller (via the Cluster Agent) to automatically inject instrumentation libraries and environment variables into pods at runtime. This allows for a cluster-wide deployment of APM across multiple services without requiring any modifications to the application code or Dockerfiles.
• C. OpenTelemetry manual instrumentation involves adding SDKs and writing specific code to handle tracing, which requires developer intervention and code modification. It does not meet the requirement of a 'no-code' approach.
• D. Adding libraries to dependency manifests like package.json or requirements.txt requires modifying the application's source repository and rebuilding the Docker images. This process involves developer effort and build-system changes, which the engineer specifically wants to avoid.

Correct answer: B — Deploy the Datadog Agent as a sidecar container in the same task definition.

• A. Incorrect. The Datadog Agent is a separate binary or container from the application. While application code is instrumented with language-specific tracing libraries (tracers), the Agent must run as a distinct process to receive and forward data. Embedding the Agent itself within application code is not a supported practice and would violate the principle of separation of concerns.
• B. Correct. In AWS Fargate, since you do not have access to the underlying host infrastructure to run a DaemonSet, the recommended approach is to deploy the Datadog Agent as a sidecar container within the same Task Definition. This setup allows the application container to send traces to the Agent via 'localhost:8126', providing a reliable and low-latency communication path.
• C. Incorrect. Using a centralized Datadog Agent on a separate EC2 instance is not the standard pattern for Fargate. Fargate tasks are isolated by design; routing traffic to a remote Agent introduces complex networking requirements (such as VPC peering or PrivateLink) and increases latency compared to the sidecar model.
• D. Incorrect. Datadog Lambda extensions are purpose-built for the AWS Lambda execution environment to handle the ephemeral nature of serverless functions. They cannot be used to collect APM traces from containerized workloads running on ECS or Fargate.

Correct answer: B — By using the Datadog Lambda Extension to flush traces asynchronously.

• A. Running a full Datadog Agent on an EC2 instance and routing Lambda traffic to it is not the recommended pattern for serverless. This approach introduces additional network hops and latency, which is contrary to the goal of minimizing function execution time.
• B. The Datadog Lambda Extension runs as a companion process within the Lambda execution environment. It uses the AWS Lambda Extension API to collect, batch, and flush traces asynchronously. This ensures that the telemetry forwarding does not block the function's primary execution path, thereby minimizing the impact on latency.
• C. Sending traces directly from the application code to the Datadog API would necessitate synchronous network calls. This would significantly increase the execution time of the function and increase AWS costs, as the function must remain active until the API call completes.
• D. A DaemonSet is a resource specific to Kubernetes environments that ensures a background process runs on every node in a cluster. AWS Lambda is a serverless execution environment and does not support Kubernetes-specific constructs like DaemonSets.

Correct answer: B — Add the `ddtrace` gem to the application's Gemfile and run `bundle install`.

• A. Datadog's Ruby tracing is distributed as the ddtrace gem, not a standalone 'dd-ruby-agent' binary. While the Datadog Agent process is required on the host or in the cluster to receive and forward traces, the application-level instrumentation for Ruby is not installed as a background binary.
• B. Adding the `ddtrace` gem to the application's Gemfile and running `bundle install` is the standard, idiomatic method for installing the Datadog tracing library in a Ruby on Rails application. This ensures the library is managed as a dependency and can be required or configured within the application code to enable auto-instrumentation.
• C. The npm (Node Package Manager) utility is used for Node.js environments. The `dd-trace` package installed via npm is the Node.js tracing library and is not compatible with Ruby applications, which use RubyGems.
• D. Datadog instrumentation is implemented at the application layer via gems and does not require a custom-compiled Ruby interpreter. There is no `--enable-datadog` flag for the standard Ruby interpreter.

Correct answers: A, C — Configuring `replace_tags` in the Datadog Agent.; Using custom span hooks or tracer-level scrubbing in the application code.

• A. Correct. Configuring `replace_tags` (within the `apm_config` section of the Agent configuration) allows you to define regex-based rules to mask or replace sensitive tag values before they are sent to Datadog. This is a centralized way to ensure PII is redacted at the Agent level.
• B. Incorrect. Disabling HTTPS communication would only affect the security of the data in transit (transport security) and would not redact PII from the trace payloads. It is also a major security risk.
• C. Correct. Using custom span hooks or tracer-level scrubbing (such as utilizing the `DD_APM_REPLACE_TAGS` environment variable or programmatic hooks like `on_span_finish` in some SDKs) allows the application to remove or obfuscate sensitive data before it ever leaves the application process.
• D. Incorrect. Rotating the Datadog API key is a security best practice for authentication and access control, but it does not inspect or filter the content of trace data for sensitive information.
• E. Incorrect. The `DD_SITE` variable specifies the Datadog intake region (e.g., datadoghq.com). Setting it to a private IP address would result in connection errors and does not provide any mechanism for data redaction.

Correct answer: B — APM metrics are calculated from 100% of traffic, but only a subset of traces are indexed by retention filters.

• A. Incorrect. If the Datadog Agent were dropping metrics due to high CPU usage, the Service Catalog would show missing or reduced request counts. Since the catalog is accurately showing 1,000 RPM, metrics are being received; the discrepancy lies in trace indexing.
• B. Correct. Datadog APM calculates service-level metrics (request, error, and latency) from 100% of the traces ingested by the agent. However, for storage and search in the Trace Explorer, retention filters are applied. If a retention filter is set to keep only 10% of traces, you will see a count in Trace Explorer that is significantly lower than the actual request volume shown in the Service Catalog.
• C. Incorrect. If the application were failing to send trace payloads, the Datadog Agent would have no data to calculate metrics from, meaning the Service Catalog would not show the 1,000 RPM figure.
• D. Incorrect. Exceeding billing limits typically triggers notifications or halts ingestion entirely. It does not cause a specific, selective discrepancy between total request metrics and indexed traces.

Correct answers: A, C — It automatically retains a representative selection of traces across different endpoints.; It automatically prioritizes keeping traces that contain errors or high latency.

• A. Correct. Intelligent Retention is designed to automatically retain a representative selection of traces across services, endpoints, and environments, ensuring that you maintain a baseline visibility into all parts of your application traffic even when sampling is applied.
• B. Incorrect. Intelligent Retention is a selective sampling strategy used to manage storage and costs; it does not retain 100% of all traces. Retaining all traces regardless of volume is a function of ingestion and indexing configuration, not specifically the 'Intelligent Retention' filter.
• C. Correct. A key feature of Intelligent Retention is the automatic prioritization of high-value traces. It identifies and retains traces that contain errors, exceptions, or unusual latency to ensure they are available for debugging and root cause analysis.
• D. Incorrect. Intelligent Retention is managed on the Datadog platform (via the UI or Retention Filters API). It is a server-side processing feature and does not require manual activation or configuration within the local Datadog Agent's datadog.yaml file.
• E. Incorrect. While traces are visible in 'Live Search' for a rolling 15-minute window, Intelligent Retention refers to the process of indexing traces for long-term storage (typically 15 days). It does not impose a 15-minute maximum limit on retention.

Correct answer: B — Include the links in the service definition metadata (e.g., service.datadog.yaml).

• A. The Datadog Agent configuration file (datadog.yaml) is used for host-level settings and integrations. It is not designed to store service-specific metadata like Slack channels or runbooks, as it is host-scoped rather than service-scoped.
• B. Service definition metadata (e.g., service.datadog.yaml) is the standard method for providing context in the Datadog Software Catalog. By defining contact details, runbook links, and chat channels here, the information is automatically surfaced in the service's overview, Service Catalog, and incident pages, ensuring it is readily available during alerts.
• C. Hardcoding links into application log messages is brittle and generates unnecessary noise. Logs are intended for debugging application behavior and are not the canonical location for service metadata; they will not integrate with the Software Catalog or incident workflows.
• D. Custom dashboards can display information but do not provide the native integration that the Software Catalog offers. Pinning a dashboard to global navigation creates clutter and does not automatically associate the links with specific service alerts or service-level pages.

Correct answer: B — The Service Catalog / Service Page

• A. The Infrastructure List focuses on hosts, containers, and server-level inventory rather than application-level APM metrics. It does not provide the unified service-centric view required to see ownership metadata or application deployment history.
• B. The Service Catalog (and individual Service Pages) in Datadog APM acts as a centralized hub. It provides a unified view of performance metrics (Requests, Errors, Duration), service-level metadata such as team ownership, and integration with deployment tracking to show recent changes in service behavior.
• C. Synthetics Test results show uptime, availability, and functional behavior for endpoints. While useful for monitoring availability, they do not provide the comprehensive internal APM metrics, ownership details, or deployment timelines found in the Service Catalog.
• D. The Audit Trail is used for tracking user actions and administrative configuration changes within the Datadog platform for security and compliance. It does not display runtime service performance metrics or service ownership information.

Correct answer: B — DD_VERSION

• A. DATADOG_RELEASE is not a recognized environment variable for specifying the release version in Datadog APM. Setting it will not automatically tag traces or services in Datadog.
• B. DD_VERSION is the standard environment variable used by Datadog APM to specify the release version of your application. As part of Unified Service Tagging, setting this variable allows Datadog to tag traces and services with the specific version, enabling deployment tracking and version-based filtering.
• C. APP_VERSION is an arbitrary environment variable and is not automatically consumed by Datadog APM for release tracking. While a developer might use it for internal logic, Datadog requires DD_VERSION for its native integration.
• D. DD_DEPLOYMENT is not a standard Datadog environment variable for specifying a release version. Datadog relies on DD_VERSION for version tagging; deployment events are typically tracked through the Deployments API, CI/CD integrations, or by detecting changes in DD_VERSION.

Correct answer: A — Error Tracking

• A. Correct. Error Tracking is the Datadog product specifically designed to group similar exceptions into 'issues' and provide error aggregation. It integrates seamlessly with APM Deployment Tracking to identify exactly which version (release) introduced a specific exception, allowing teams to prioritize fixes based on deployment impact.
• B. Incorrect. Synthetic Monitoring focuses on proactive testing through scripted API and browser checks to validate uptime and functionality from external locations. It does not provide the application-level exception grouping or release-based version attribution found in Error Tracking.
• C. Incorrect. Cloud SIEM is a security-focused product used for detecting, correlating, and investigating security threats and signals. It is not designed for application-level error grouping or tracking which software version introduced a code-level exception.
• D. Incorrect. Incident Management is a workflow tool used to orchestrate responses to outages and manage on-call rotations. While it can be linked to errors found during a deployment, it does not perform the technical function of grouping exceptions by similarity or identifying the introducing release.

Correct answer: B — DD_PROFILING_ENABLED=true

• A. Incorrect. This environment variable is often used to enable the APM feature within the Datadog Agent or specifically within certain library configurations to toggle tracing, but it does not activate the Continuous Profiler.
• B. Correct. DD_PROFILING_ENABLED=true is the standard environment variable used across most supported languages (including Java, Python, Go, and Node.js) to enable the Datadog Continuous Profiler feature alongside the tracer.
• C. Incorrect. This variable is used to enable the automatic injection of trace and span IDs into application logs, which helps correlate logs with distributed traces, but it has no effect on profiling.
• D. Incorrect. This variable was primarily used for enabling legacy Trace Analytics (App Analytics) features and does not control the activation of the Continuous Profiler.

Correct answer: B — APM traces, Logs, and RUM events

• A. Incorrect. While APM traces are a primary source of error events, Error Tracking is not limited to traces alone. It also ingests errors from other sources, making the statement 'Only APM traces' too restrictive for the product's capabilities.
• B. Correct. Datadog Error Tracking generates and groups issues from APM traces, Logs, and RUM (Real User Monitoring) events. This multi-source approach allows it to correlate and group errors across backend services, logged exceptions, and frontend user errors, providing a comprehensive view for diagnosis and triage.
• C. Incorrect. Infrastructure metrics are time-series measurements (like CPU or memory) and are not the primary inputs for Error Tracking issue generation. Error Tracking focuses on event-based data like exceptions and error-level logs rather than metric-based monitoring.
• D. Incorrect. Synthetic tests surface availability and functional failures, but they are not a standard data source used by the Error Tracking grouping system to generate issues. Error Tracking specifically utilizes telemetry from traces, logs, and RUM events.

Correct answer: B — The Top Endpoints / Resources list sorted by Latency.

• A. The Total Requests timeseries graph displays request volume over time and does not break down performance by individual resources or database queries. It is useful for monitoring traffic patterns and identifying surges, but it cannot surface which specific queries are slow.
• B. The Top Endpoints / Resources list (often found in the Resources section of the Service page) shows individual resources, including database statements or resource names captured by APM, ranked by their latency or time consumed. This widget allows you to quickly identify which specific queries or resource calls are taking the longest to execute.
• C. The Error Rate percentage widget reports the proportion of requests that resulted in errors. While critical for monitoring application health and stability, it does not provide information regarding the duration or latency of database queries.
• D. The Host CPU Utilization graph shows host-level infrastructure performance and is unrelated to identifying specific application-level database query durations. While high CPU might correlate with performance issues, this widget does not list or rank specific queries.

Correct answer: B — AND

• A. Incorrect. The OR operator is not the default; it must be explicitly specified. Using OR would broaden results to include traces matching any of the terms, whereas Datadog's default behavior is conjunctive.
• B. Correct. In Datadog search syntax (including APM and Logs), space-separated search terms are treated as AND by default. This means all terms must match for a result to be returned, allowing users to narrow down results efficiently.
• C. Incorrect. The NOT operator (or the minus sign '-') is used to exclude specific terms from results and must be explicitly stated; it is never the default behavior for space-separated terms.
• D. Incorrect. XOR (exclusive OR) is not a supported operator in Datadog search syntax. Datadog utilizes standard boolean logic focusing on AND, OR, and NOT.

Correct answer: B — Retained (Indexed) traces

• A. Live Search traces are intended for real-time troubleshooting and provide ephemeral streaming visibility (typically the last 15 minutes). They are not retained for historical queries and cannot power a 7-day dashboard widget.
• B. Retained (Indexed) traces are stored and indexed by Datadog based on retention filters. This enables historical querying, filtering by specific tags (like checkout errors), and aggregation over time windows such as the past 7 days, making them the correct source for dashboard widgets.
• C. While Datadog ingests all (unsampled) traces, only those that are 'Indexed' via retention filters are stored long-term for search and analytics. Simply being unsampled does not guarantee the trace is searchable for a 7-day period.
• D. Live Tail metrics and data are real-time streaming tools for immediate observability and debugging. They are not persisted in a historical store and cannot serve as the data source for a multi-day error-count widget.

Correct answer: B — version:v2.1.0

• A. The tag `release` is not a standard Datadog APM trace attribute or part of the Unified Service Tagging specification. This query would not return results unless a custom tag was manually implemented and indexed.
• B. Correct. Datadog uses Unified Service Tagging, which utilizes three reserved tags: `env`, `service`, and `version`. The `version` tag (typically set via the `DD_VERSION` environment variable or tag) is the standard facet used to filter traces for specific application releases in the Trace Explorer.
• C. While `app_version` is descriptive, it is not a standard facet or reserved tag in Datadog APM. To use this, you would have to manually add it as a custom tag in your instrumentation.
• D. The tag `build` is not typically used to track application versions in Datadog APM and is not a default trace attribute in the Datadog ecosystem.

Correct answer: A — Focus optimization efforts on the /dashboard endpoint's rendering logic, as it has the highest impact.

• A. Correct. The Span Summary in Datadog APM ranks operations by 'Impact,' which is calculated as the product of the average duration and the execution frequency (Total Time). Focusing on the endpoint or span with the highest impact is the standard procedure for achieving the most significant performance gains.
• B. Incorrect. The Span Summary is designed to identify hotspots and areas for improvement. Even if an endpoint is 'working as expected' (not failing), it may still be the primary contributor to latency. Ignoring a high-impact endpoint prevents meaningful optimization.
• C. Incorrect. Increasing server memory is a horizontal or vertical scaling solution that should be driven by resource utilization metrics. The Span Summary identifies application-level code bottlenecks; infrastructure changes are speculative without evidence of a resource bottleneck.
• D. Incorrect. Disabling tracing for high-latency spans like 'template.render' removes critical visibility into the system's performance. While this might slightly reduce ingestion costs, it does not improve performance and hinders future troubleshooting.

Correct answer: A — The time frame over which Datadog aggregates the metric data to check against the threshold.

• A. Correct. The evaluation window in Datadog represents the lookback period over which metrics (such as average, sum, or max) are aggregated and evaluated against the set threshold. This window determines how much historical data is considered for each evaluation cycle.
• B. Incorrect. The time it takes for a notification to reach a service like PagerDuty is related to integration latency and routing, not the monitor's internal evaluation window.
• C. Incorrect. Controlling the duration a monitor is silenced during a deployment is handled by Downtime settings or manual muting, which is a separate configuration from the evaluation window.
• D. Incorrect. The retention period refers to the length of time Datadog stores trace data in its backend (e.g., 15 days), whereas the evaluation window is a functional window used for real-time alerting logic.

Correct answer: A — 15 minutes

• A. Correct. Live Search in the Datadog APM Trace Explorer provides a rolling window of 15 minutes of all traces received by Datadog. This allows for real-time troubleshooting and visibility into 100% of ingested traces before they are filtered by retention policies.
• B. Incorrect. While 1 hour is a common default time range for many Datadog dashboards and historical queries, the streaming buffer for Live Search (non-indexed traces) is specifically limited to a 15-minute window.
• C. Incorrect. 15 days is the standard default retention period for indexed spans (Trace Search & Analytics) that have been captured by retention filters, rather than the real-time Live Search stream.
• D. Incorrect. 30 days refers to optional longer-term retention settings available for indexed traces depending on the specific plan and configuration, but it does not apply to the Live Search feature.