Free Datadog Fundamentals Sample Questions

Correct answer: B — Restart the Datadog Agent service

• A. Refreshing the Datadog web UI does not affect the Agent's local configuration. The web UI is primarily used for visualization and backend monitoring settings; it does not communicate back to the agent process to trigger a configuration reload.
• B. Restarting the Datadog Agent service is necessary because the Agent process reads its configuration file (datadog.yaml) at startup. For any manual changes in the yaml file to be applied, the process must be restarted using commands like `systemctl restart datadog-agent` or `service datadog-agent restart`.
• C. There is no specific 'datadog-agent update' command designed to apply configuration changes. Update commands are generally used for upgrading the Agent binary rather than reloading settings.
• D. While rebooting the host machine would restart the Datadog Agent and apply the changes, it is an unnecessarily disruptive action. A simple restart of the agent service is sufficient and preferred over a full system reboot.

Correct answer: A — By using Datadog environment variables (e.g., DD_API_KEY)

• A. Correct. Datadog allows configuration keys to be overridden using environment variables prefixed with 'DD_'. This takes precedence over settings defined in datadog.yaml and is the standard approach for containerized environments (like Docker or Kubernetes) or automated deployments where file modification is impractical.
• B. Incorrect. The Datadog UI is used for visualizing data, managing monitors, and configuring platform-level features, but it cannot directly override or modify the local configuration settings stored in a specific Agent's datadog.yaml file.
• C. Incorrect. Datadog does not recognize a .override file for its core configuration. While specific integrations use files within the conf.d directory, the global datadog.yaml settings are overridden via environment variables or agent startup options.
• D. Incorrect. URL parameters are used for interacting with the Datadog API or navigating the web interface, but they are not a valid or supported method for defining or overriding Datadog Agent configuration settings.

Correct answer: A — integrations-core

• A. integrations-core holds the officially developed and supported integrations that Datadog packages directly into the Agent.
• B. integrations-extras holds community-developed integrations that are not packaged with the Agent by default.
• C. agent-checks-official is not the name of a real Datadog integrations repository.
• D. datadog-plugins is not the name of a real Datadog integrations repository.

Correct answer: A — `min_collection_interval`

• A. `min_collection_interval` is the instance-level setting, defaulting to 15 seconds, that controls how frequently a given check instance is run.
• B. `collection_delay` is not a real Datadog Agent check configuration key.
• C. `polling_frequency` is not the documented setting name used in Agent check configuration.
• D. `check_interval_seconds` is not the actual key used in the Agent checks framework.

Correct answer: A — /etc/datadog-agent/datadog.yaml

• A. This is correct: on Linux the Agent package installs its main configuration file under /etc/datadog-agent/, which is the standard location for host-level daemon configuration.
• B. This path is where macOS keeps datadog.yaml, not Linux, so it does not match the Linux packaging layout.
• C. The Agent package does not place configuration under /usr/local/datadog-agent/; that path is not used by the standard Linux install.
• D. /var/lib/ is typically used for variable application state data, not for the Agent's primary configuration file.

Correct answer: B — A VM runs a full guest operating system atop virtualized hardware, while a container shares the host OS kernel directly.

• A. This reverses the two technologies: it is the container that shares the host's kernel, while a VM runs its own separate guest operating system on virtualized hardware.
• B. This is correct because a VM includes a complete guest operating system running on emulated hardware, whereas a container shares the host kernel and only packages the application and its dependencies.
• C. Both VMs and containers are designed to share the underlying physical server's resources among multiple workloads, so requiring a fully dedicated server for each is not accurate.
• D. Neither technology is limited to a single storage medium in this way; both VMs and containers can use memory and disk storage as needed for their workloads.

Correct answer: A — configcheck

• A. This is correct: this subcommand lists every configuration file the Agent loaded and resolved at runtime, which is why it is used to confirm a check's config was picked up.
• B. This subcommand shows overall Agent and integration health, but it does not list which specific configuration files were loaded and resolved.
• C. This subcommand only prints the hostname the Agent is using and has no connection to configuration file loading.
• D. This subcommand only prints Agent version information and does not report on loaded configuration files.

Correct answer: A — Allowlist the published Datadog IP ranges, since the specific addresses can change over time.

• A. This is correct. Datadog publishes IP ranges per site and recommends allowlisting the full ranges, because individual addresses within them can change due to routine network maintenance.
• B. This is incorrect. A single IP captured from one DNS lookup is not stable; Datadog's backend addresses rotate within published ranges, so a static single address can silently break connectivity.
• C. This is incorrect. Disabling the firewall removes necessary protections and is not the recommended approach; the guidance is to allowlist specific published ranges instead.
• D. This is incorrect. The loopback address only handles local traffic such as DogStatsD submissions on the host and has no bearing on outbound firewall rules to Datadog.

Correct answer: A — Disabled, so the Agent does not report the fully-qualified domain name by default

• A. On Linux and macOS this setting is off by default, meaning the Agent does not automatically switch to reporting a fully-qualified domain name unless it is explicitly turned on. This matches the documented default behavior.
• B. The setting is not enabled by default on these platforms, so the Agent does not automatically report an FQDN unless the option is turned on.
• C. This option only controls FQDN reporting and has no relationship to reporting a numeric EC2 instance ID, so this description is incorrect.
• D. This option does not cause the Agent to ignore manually configured hostnames, and it is not enabled by default, so this description is incorrect.

Correct answer: A — The EC2 instance ID retrieved from AWS cloud metadata

• A. With no configured hostname and a generic system hostname, the Agent falls through to the EC2 instance ID from cloud metadata as the next usable candidate, matching the documented resolution order.
• B. The generic system hostname pattern is specifically the kind of value the resolution logic skips over, so it would not be used as the canonical hostname here.
• C. No manual hostname was configured in this scenario, so there is no typed-in value for the Agent to fall back on.
• D. A Kubernetes node name only applies when the Agent is running inside a Kubernetes cluster, which is not the case for this standalone EC2 instance.

Correct answer: B — Restart the Datadog Agent service.

• A. The Datadog Agent does not automatically poll or reload the main datadog.yaml configuration file after a fixed interval. Manual intervention is required for the Agent to recognize and apply updates to the core configuration.
• B. Restarting the Datadog Agent service (e.g., using 'systemctl restart datadog-agent' on Linux) is the standard and necessary way to ensure the Agent re-reads the datadog.yaml file and applies new settings or tags to the host.
• C. The 'datadog-agent configcheck' command is used to validate the syntax and integrity of your configuration files to identify errors, but it does not reload the Agent or apply the changes to the running service.
• D. While rebooting the host machine would cause the Agent service to restart and pick up the changes, it is an unnecessarily disruptive and extreme measure when a simple service restart is sufficient.

Correct answer: C — 443

• A. Port 80 is the default port for unencrypted HTTP traffic. For security, the Datadog Agent sends data encrypted over HTTPS, and does not use plain HTTP (Port 80) for outbound communication.
• B. Port 8125 is the default port for DogStatsD. It is an inbound port used by applications to send custom metrics to the local Agent, rather than an outbound port used by the Agent to communicate with the Datadog platform.
• C. The Datadog Agent sends data to the Datadog platform over HTTPS, which by default uses outbound port 443. This is the standard port for secure web traffic and is used for uploading metrics, traces, and logs.
• D. Port 8126 is used locally by the Trace Agent to receive APM traces from instrumented applications. Like port 8125, it is an internal communication port for the Agent, not an outbound port to the Datadog platform.

Correct answer: C — API keys are used by the Agent to submit data, while Application keys are used to manage Datadog resources via the API.

• A. Incorrect. The roles are generally the opposite: API keys are primarily used to submit data (like metrics and logs) to Datadog, while Application keys are used to authenticate requests to query data or manage Datadog resources.
• B. Incorrect. This reverses the actual ownership model in Datadog. API keys are organization-wide and used for submitting data, whereas Application keys are associated with a specific user and inherit that user's permissions.
• C. Correct. API keys are used by the Datadog Agent and other clients to submit telemetry data (metrics, logs, traces) to the platform. Application keys are used to authenticate API calls that manage or query Datadog resources, such as dashboards and monitors, and are scoped to the permissions of the user who created them.
• D. Incorrect. Datadog does not impose a default 30-day expiration on either API or Application keys. Both remain valid until they are manually revoked or rotated by an administrator or the key's owner.

Correct answer: A — A Datadog API Key

• A. Correct. To authenticate requests to the Datadog API, both an API key and an Application key are typically required. The API key authenticates the organization account, while the Application key identifies the specific user or application and carries their associated permissions.
• B. Incorrect. User passwords are intended for interactive login via the Datadog web interface. Programmatic API access relies on API and Application keys rather than account passwords.
• C. Incorrect. SSH keys are used for secure shell access to remote servers and infrastructure. They are not used for authenticating HTTP requests to the Datadog API.
• D. Incorrect. SAML tokens are utilized for Single Sign-On (SSO) and identity federation during the user login process. They do not replace the API and Application key requirement for programmatic API interactions.

Correct answer: B — Create a separate API key for each environment and configure the respective Agents with their specific key.

• A. Incorrect. API keys are required for the Agent to send data, whereas Application keys are used for programmatic access to the Datadog API (e.g., for automation or querying). Using the same API key for all servers fails to provide isolation; revoking it would stop data ingestion for both environments.
• B. Correct. Creating separate API keys for each environment (Staging and Production) allows you to rotate or revoke the specific key used by the Staging environment without impacting the data flow from the Production environment. This provides the necessary security isolation for data ingestion.
• C. Incorrect. Datadog UI filters only control how data is displayed or queried and do not prevent the Agent from authenticating and sending data to Datadog. To effectively block a compromised environment, you must revoke the credentials (the API key) used for ingestion.
• D. Incorrect. While using separate Datadog organizations is a valid way to isolate data entirely, it is not required for this scenario. Multiple API keys can be generated and managed within a single organization to provide independent access control for different environments.

Correct answer: A — datadog-agent status

• A. Correct. Running 'datadog-agent status' provides a comprehensive summary of the Agent's runtime state. The resolved hostname is explicitly listed at the top of the output under the Agent Information section, making it the standard tool for verifying the hostname being used.
• B. Incorrect. 'datadog-agent check-host' is not a valid Datadog Agent command. While 'datadog-agent check <check_name>' exists to test specific integrations, it does not display the Agent's resolved hostname.
• C. Incorrect. 'datadog-agent config' (or 'datadog-agent configcheck') is used to display the Agent's configuration settings. While it might show a manually configured 'hostname' parameter, it does not confirm the actual hostname resolved by the Agent at runtime if it was automatically detected.
• D. Incorrect. 'datadog-agent verify' is not a standard subcommand for inspecting hostname resolution or general Agent status.

Correct answer: B — By querying the ip-ranges.datadoghq.com JSON endpoint

• A. The Datadog Agent configuration file (datadog.yaml) is used to define local Agent settings and target site endpoints, but it does not contain the authoritative, up-to-date list of Datadog's public IP ranges required for network allowlisting.
• B. Datadog publishes its official, up-to-date IP ranges via the ip-ranges.datadoghq.com JSON endpoint (and its regional equivalents). This endpoint is specifically maintained for programmatic retrieval to automate the configuration of firewalls and network access control lists.
• C. The 'datadog-agent info' (or status) command provides diagnostic information and configuration details for the specific Agent instance running on a host, but it does not return the global list of Datadog public IP addresses.
• D. While Organization Settings in the Datadog application manage account-level configurations like API keys and user memberships, the official source for network IP ranges is the dedicated IP ranges JSON endpoint and technical documentation.

Correct answer: B — logs

• A. Incorrect. The 'api' section lists IP ranges used for Datadog API endpoints and general API-related traffic. While allowing these ranges is important for many Agent operations, it does not cover the specific endpoints used for log ingestion.
• B. Correct. The 'logs' section of the Datadog IP ranges JSON file specifically designates the destination IP addresses used for log ingestion. This is the section referenced when configuring outbound firewall rules for Datadog Log Management.
• C. Incorrect. The 'process' section contains IP ranges dedicated to Process Monitoring and process-agent traffic, which are separate from log management traffic.
• D. Incorrect. The 'synthetics' section lists IP addresses for Synthetic Monitoring endpoints (such as browser and API tests) and is not used for log ingestion traffic.

Correct answer: B — 5001

• A. Port 5000 is not the default port used for IPC within the Datadog Agent architecture. It is commonly associated with other web services (like Flask) but is not part of Datadog's default internal configuration.
• B. Port 5001 is the default port used for Inter-Process Communication (IPC) between the core Datadog Agent and its various components (such as the Trace Agent or Process Agent). This port hosts the Agent's internal API and is used by the Agent CLI to communicate with the running Agent process.
• C. Port 5002 is not used for internal communication or IPC within the Datadog Agent. It is not a standard port in Datadog's core configuration.
• D. Port 5033 is not a default port associated with the Datadog Agent's IPC or any other standard core agent services.

Correct answer: B — It uses the %%port%% template variable to dynamically detect the exposed port of each container.

• A. Incorrect. Auto-discovery is designed to eliminate the need for manual configuration for each container instance. It uses dynamic templates rather than requiring a separate datadog.yaml file for every individual container.
• B. Correct. Datadog Auto-discovery supports template variables like %%port%%, %%host%%, and %%tags%%. These variables are automatically populated at runtime from container metadata, allowing the Agent to configure checks for each NGINX instance without hardcoding specific port numbers.
• C. Incorrect. The Agent does not brute-force scan all ports (1 to 65535), as this would be highly inefficient. Instead, it uses metadata from the container runtime (like Docker or Kubernetes) to identify the specific ports exposed by the container.
• D. Incorrect. Auto-discovery relies on local container-level metadata (labels, annotations, or runtime info) accessed via the container engine or orchestrator (Kubelet/Docker socket) rather than querying the Datadog API or cloud provider for port mappings.

Correct answer: A — The metric is a Gauge.

• A. Correct. The 'g' indicates the metric type is a Gauge. A Gauge represents a single numerical value that can go up or down over time, reflecting an instantaneous state (e.g., current temperature, memory usage, or number of users online).
• B. Incorrect. Grouping is not indicated by the 'g' suffix. Metric grouping or categorization in Datadog is typically managed via tags or metric naming conventions, not the type identifier.
• C. Incorrect. The 'g' does not represent a global metric. The scope or visibility of the metric is handled through tags (like '#env:prod') or aggregation settings, rather than the metric type letter.
• D. Incorrect. The 'g' specifically denotes the metric type 'Gauge' and does not represent a unit of measurement like Gigabytes. Units should be defined in the metric metadata or as part of the metric name.

Correct answer: B — Store them securely using environment variables or a secrets manager.

• A. Hardcoding API and Application keys directly into the source code is a major security risk. It exposes secrets to anyone with access to the repository, makes secret rotation difficult, and increases the risk of accidental leakage through version control.
• B. Storing keys securely using environment variables or a dedicated secrets manager is the recommended best practice. This method enhances security by keeping sensitive credentials out of the source code, enabling secure access control, and facilitating easier auditing and rotation.
• C. Sharing keys in public code repositories is highly insecure and exposes sensitive information to the public, where they can be harvested by attackers. Secrets should be restricted to authorized users via secure tooling rather than being exposed in public code.
• D. Using a single Application key for all users and scripts violates the principle of least privilege and removes the ability to audit actions per user. It is best practice to create scoped, unique keys for different users or services to enhance security and traceability.

Correct answer: B — Using a lightweight Java plugin called JMXFetch

• A. Datadog does not rely on parsing Java garbage collection logs to collect JMX metrics. GC logs are separate text-based logs that would require the Datadog Logs product or custom parsing, whereas JMX metrics are typically gathered directly from JVM MBeans.
• B. The Datadog Agent uses a lightweight Java helper called JMXFetch to query JVM MBeans and translate them into Datadog metrics. JMXFetch is configured via the JMX integration and runs as a sub-process of the Agent to collect and forward those metrics.
• C. JMX metrics are collected by JMXFetch and forwarded to the Agent's aggregator. While DogStatsD is a protocol used for custom metrics via UDP, it is not the primary mechanism the Agent uses to query and collect JMX MBean data.
• D. The Datadog REST API is used to interact with Datadog's services or submit data to the backend programmatically. It is not the method used by the Agent to pull local JMX metrics from a running Java application.

Correct answer: C — GAUGE

• A. The COUNT metric type represents a cumulative count of events or occurrences over time. It is used to track totals or increments rather than an instantaneous snapshot of a stateful value.
• B. The RATE metric type represents the change of a value per unit of time (e.g., requests per second). It describes frequency or velocity rather than the current value at a single point in time.
• C. The GAUGE metric type represents a snapshot of a value at a specific point in time. Gauges can go up or down and are the standard choice for reporting the current state of resources like available disk space, memory usage, or active user sessions.
• D. The HISTOGRAM metric type captures the statistical distribution of values over time, providing metrics like min, max, average, and percentiles. It is primarily used for latency or size distributions, not for point-in-time snapshots.

Correct answer: C — env, service, version

• A. Incorrect. These are infrastructure-level tags (host, role, zone) that describe where a resource runs rather than its logical service identity. Unified Service Tagging focuses on service-centric tags to enable consistent observability across telemetry and integrations.
• B. Incorrect. While app, tier, and region can be useful custom tags, they are not the official canonical foundation of Datadog's Unified Service Tagging. The recommended trio is focused on environment context, service identity, and release version.
• C. Correct. The 'env', 'service', and 'version' tags are the core foundation of Unified Service Tagging. These tags provide the necessary context to correlate metrics, traces, and logs across the entire Datadog platform by identifying the environment (e.g., prod, stage), the logical service name, and the specific software version deployed.
• D. Incorrect. These tags (cluster, pod, and container) are orchestration-level tags specific to containerized environments like Kubernetes. They describe deployment topology rather than the unified service identity used for cross-product correlation.

Correct answer: B — Cloud integrations rely on API polling, which introduces a natural delay based on the polling interval.

• A. Incorrect. The Datadog AWS integration (crawler) relies on API-to-API communication between Datadog and AWS CloudWatch. It does not require or depend on the Datadog Agent being installed on the EC2 instance for this specific data flow.
• B. Correct. Cloud integrations like the CloudWatch crawler rely on polling the AWS APIs at set intervals (typically every 10 minutes). This polling mechanism introduces an inherent delay between when a metric is recorded in CloudWatch and when Datadog retrieves it via the API.
• C. Incorrect. If the Datadog API key were expired, authentication would fail entirely, resulting in no data being ingested rather than a consistent multi-minute delay.
• D. Incorrect. Datadog supports all standard AWS regions. If a region were unsupported, the integration would fail to collect any data from that region rather than experiencing a processing delay.

Correct answer: B — C:\ProgramData\Datadog\logs\

• A. The 'C:\Program Files' directory is used for application installation binaries and executables. Datadog does not store its logs here to keep application data separate from system-wide program files.
• B. Correct. On Windows, the Datadog Agent (v6 and v7) defaults to 'C:\ProgramData\Datadog\logs\' for log storage. 'C:\ProgramData' is the standard Windows location for persistent application data and logs, though the folder is hidden by default.
• C. The 'C:\Windows\System32' directory is reserved for critical Windows system files and drivers. Storing third-party agent logs here is not standard practice and is not the default for Datadog.
• D. While it is possible to configure a custom log path, 'C:\Datadog\logs\' is not the out-of-the-box default location for the Datadog Agent on Windows.

Correct answers: A, C — Modifying the datadog.yaml file.; Using DD_* environment variables.

• A. Correct. The datadog.yaml file is the primary configuration file for the Agent on Linux, Windows, and macOS. It is the standard way to set persistent Agent configurations, such as the API key, tags, and logging settings.
• B. Incorrect. Registry keys are specific to the Windows operating system; Linux uses a file-based configuration system. Even on Windows, editing registry keys is not the standard way to configure the Agent's runtime behavior.
• C. Correct. Using DD_* environment variables (e.g., DD_API_KEY, DD_SITE) is a fully supported method to configure the Agent. This is particularly common in containerized deployments like Docker and Kubernetes and can be used to override settings in the datadog.yaml file.
• D. Incorrect. The Datadog Agent does not support persistent configuration via a POST request to a /config endpoint. Configuration must be handled through files, environment variables, or orchestration integrations.
• E. Incorrect. The Datadog Agent uses YAML for its configuration files (datadog.yaml and integration-specific conf.yaml files), not XML. There is no agent.xml file used by the Agent.

Correct answers: A, C — datadog-agent flare; datadog-agent configcheck

• A. Correct. The 'datadog-agent flare' command is a fundamental diagnostic tool used to collect logs, configuration files, and runtime information into a compressed bundle. This bundle can be uploaded to Datadog Support to help investigate and resolve technical issues.
• B. Incorrect. 'datadog-agent trace' is not a valid CLI subcommand. While Datadog handles APM and tracing, those features are managed by the trace-agent component and specific tracer libraries rather than a direct agent CLI command of this name.
• C. Correct. The 'datadog-agent configcheck' command is used to validate the integrity and syntax of Agent and integration configuration files. It identifies common errors such as YAML formatting issues, helping to verify the setup before the Agent is restarted.
• D. Incorrect. 'datadog-agent push' is not a recognized Datadog Agent CLI command. The Agent automatically transmits data to Datadog based on set collection intervals; there is no manual 'push' command for generic data transmission.
• E. Incorrect. 'datadog-agent sync' is not a standard Datadog Agent command. Common troubleshooting commands include status, flare, health, and configcheck.

Correct answers: A, B — Grouping hosts by specific tags; Filtering the displayed hosts using tags

• A. Correct. The Host Map allows you to group hosts by specific tags (such as role, environment, or availability zone) using the 'Group by' control. This helps in organizing and visualizing hosts based on different infrastructure attributes and helps aggregate metrics across segments.
• B. Correct. The Host Map interface supports filtering hosts using tags via the search bar and filter controls. This enables users to focus on specific subsets of infrastructure that meet certain tag-based criteria, making it easier to manage large fleets of hosts.
• C. Incorrect. Upgrading the Datadog Agent is an operational task typically performed on the host itself or via configuration management tools (like Ansible, Chef, or Puppet). It is not a feature available directly from the Host Map interface.
• D. Incorrect. The Host Map is a visualization and navigation tool; it does not provide native SSH terminal access into a host. SSH access is handled through external terminal applications or remote access tooling.
• E. Incorrect. Modifying local firewall rules is a system configuration change that must be performed on the host or via security management software. Datadog provides monitoring and visualization but does not manage host-level security policies.

Correct answer: A — Top List

• A. The Top List widget is specifically designed to display the highest or lowest values for a metric across a tag key (such as 'host'). It allows you to configure a ranking (e.g., top 10) for specific metrics like CPU usage, providing a concise summary of the most resource-intensive entities.
• B. The Log Stream widget displays raw log events in real-time. It is used for viewing log data and troubleshooting events, but it cannot aggregate, rank, or visualize metric values like CPU usage across multiple hosts.
• C. The Alert Graph widget visualizes the status and history of a specific monitor or alert. It is focused on alerting conditions and thresholds rather than producing a ranked list of entities based on live metric data.
• D. The IFrame widget is used to embed external web content or URLs into a Datadog dashboard. It does not have the native capability to query, aggregate, or rank internal Datadog metrics such as host CPU load.

Correct answer: B — Recovery threshold

• A. Anomaly detection is used to identify deviations from historical patterns and baseline behavior. While it can detect unusual disk usage patterns, it does not provide the hysteresis or stabilization logic required to stop a threshold-based monitor from flapping between states.
• B. A recovery threshold (also known as hysteresis) allows you to set a separate, typically lower value for a monitor to resolve. By requiring the metric to drop further before the alert clears (e.g., alert at 90% but only recover at 85%), you prevent rapid state changes caused by minor fluctuations around a single threshold.
• C. Log rehydration is a feature used to pull archived logs back into Datadog for indexing and analysis. It is related to storage and investigation, not the configuration of monitor thresholds or alert state management.
• D. Synthetic browser tests simulate user interactions with web applications to monitor uptime and performance. They are a separate monitoring product and do not provide threshold stabilization for infrastructure-level disk usage alerts.

Correct answer: C — Gauge

• A. Count metrics are used to track the total number of events or occurrences over a specific time interval. Because they represent cumulative totals or monotonic increases, they are not suited for representing instantaneous, fluctuating measurements like available RAM.
• B. Rate metrics represent the change of a counter per unit of time, typically used to measure throughput or the frequency of events. They do not provide a point-in-time snapshot of a resource's current state, such as the amount of free memory.
• C. Gauges represent instantaneous values that can go up and down at any time, such as CPU usage, temperature, or available RAM. Since a gauge provides a snapshot of the current state at a given point in time, it is the most appropriate metric type for monitoring memory availability.
• D. Histograms are used to track the distribution of data points (like latencies or sizes) across different ranges or buckets to provide percentiles and averages. While they could capture memory samples over time, they are designed for statistical analysis of distributions rather than monitoring a single current value.

Correct answer: B — Group the query (avg by) using the availability_zone tag

• A. Filtering the query by the availability_zone tag limits the results to specific zones rather than producing separate lines for every zone. Filtering is used to narrow scope, not to segment data into multiple series.
• B. Grouping a query (e.g., using 'avg by') by a specific tag is the standard method in Datadog to split a metric into multiple lines. This segments the data so that each unique value of the availability_zone tag appears as a distinct series on the timeseries graph.
• C. Excluding the availability_zone tag would result in all data being aggregated into a single line. This prevents you from distinguishing between different zones, which is the opposite of the desired outcome.
• D. Template variables are used for dynamic dashboard filtering. While they allow you to select specific hosts or zones, they do not automatically group data into separate lines on a graph; that logic must be defined within the query's grouping parameters.

Correct answer: B — Set the monitor to trigger on a 'Multi Alert' and group by the host tag.

• A. A Simple Alert evaluates the entire scope as a single entity and produces one notification. While filtering by a host tag narrows the scope of hosts included in the calculation, it still results in a single aggregate alert rather than splitting notifications per host.
• B. A Multi Alert allows the monitor to apply the alerting logic to each group independently. By grouping by the 'host' tag, Datadog generates a separate alert status and notification for every individual host, which is the standard way to achieve per-host alerting.
• C. Adding host tags to the notification message body using template variables can provide context within an alert, but it does not change the triggering logic. It will not convert a single alert into multiple per-host alerts.
• D. Creating a separate monitor for every host is inefficient, difficult to maintain, and does not scale. Multi Alerts are specifically designed to solve this problem by managing alerts for many entities within a single monitor configuration.