1. An organization uses Cloud Monitoring to observe a multi-tier application. The team wants to create an alerting policy that fires only when BOTH of the following conditions are true simultaneously for more than 5 minutes: CPU utilization on the API tier exceeds 85%, AND the error rate on the database tier exceeds 50 errors per second. Which alerting policy configuration achieves this?
- A. Create two separate alerting policies — one for CPU and one for error rate — and configure PagerDuty to deduplicate alerts when both fire at the same time.
- B. Create a single alerting policy with multiple conditions and set the condition combiner to `AND`, with each condition specifying its own metric threshold and a 5-minute duration window.✓ Correct
- C. Create a single alerting policy with multiple conditions and set the condition combiner to `OR` so that either condition alone can trigger the alert.
- D. Use a log-based alert that queries Cloud Logging for log entries matching both high CPU and high error rate patterns within a 5-minute window.
Explanation
Option B is correct because Cloud Monitoring alerting policies support multiple conditions with an `AND` combiner (also known as `ALL_CONDITIONS_MET`). With this setting, the incident is only created when all specified conditions are simultaneously in a breach state, and the 5-minute duration window is configurable per condition. This precisely matches the requirement. Option A is wrong because relying on an external tool like PagerDuty for deduplication is not a reliable way to enforce simultaneous condition logic — the two policies fire independently and there is no guaranteed correlation. Option C is wrong because an `OR` combiner fires when either condition alone breaches the threshold, which does not match the requirement of both being true simultaneously. Option D is wrong because CPU utilization is a metric, not a log — log-based alerts cannot directly query metric values, and this approach would be fragile and incomplete.