Practice English vocabulary for detecting incidents: monitoring alerts, threshold breaches, anomaly detection, and SLO triggers.
0 / 15 completed
1 / 15
The monitoring system sent an alert at 14:32 UTC. What does 'the monitoring alert ___' mean?
'The monitoring alert fired' means the alert was triggered and sent a notification. 'Fired' is the standard verb for an alert activating.
2 / 15
The error rate went above the configured limit. Which phrase describes this?
'The threshold was breached' means a configured limit was exceeded. This is the standard phrase when a metric crosses its defined boundary.
3 / 15
The system automatically noticed an unusual spike in traffic before any human did. Which phrase fits?
'The anomaly detection flagged unusual traffic' means the automated system identified and marked traffic patterns as abnormal for human review.
4 / 15
A customer called to report an outage 10 minutes before the monitoring system sent any alert. How do you describe this?
'The customer reported the issue before the alert fired' is the standard way to describe a gap in monitoring coverage where users detect problems before automated systems.
5 / 15
The 99th percentile response time jumped sharply, violating the service level objective. What triggered the alert?
'The P99 latency spike triggered the SLO alert' means the 99th percentile latency increase caused an automated SLO violation alert to fire.
6 / 15
During a code review of the new authentication service, Alice comments: 'The API response is returning a 500 status code with a message indicating 'Internal Server Error'. This suggests a problem within the service itself.' What does Alice mean by 'Internal Server Error'?
'Internal Server Error' indicates a problem within the application code itself—a bug or unexpected condition that prevented the server from completing the request as intended. It's different from client-side errors like invalid credentials which would return a 401 status code. While it *could* be transient, the key is the message implies a deeper issue needing investigation.
7 / 15
In a Slack channel for the DevOps team, Ben writes: 'We're seeing a high volume of requests to the payment gateway. The system is throttling responses and we've hit our rate limit.' What does 'rate limiting' imply in this context?
'Rate limiting' refers to the practice of restricting the number or frequency of requests a server will accept within a specific timeframe. This prevents overload and protects the service from being overwhelmed by excessive traffic—a common mitigation strategy for sudden spikes in demand. It's distinct from outright rejection, which would be a 429 'Too Many Requests' error.
8 / 15
During a standup meeting, Sarah reports: 'The incident detection system triggered an alert because the queue depth for order processing exceeded 1000 items.' What does 'queue depth' signify in this situation?
'Queue depth' is a metric that measures the length of the queue—the number of items waiting to be processed. In this case, it indicates a significant backlog of unprocessed orders, which is a strong indicator of a potential problem impacting order fulfillment and likely triggered the alert. It's not about user activity or system capacity.
9 / 15
You are reviewing a PR description for an update to the logging service: 'The new version includes enhanced detection of anomalous network traffic patterns. Specifically, it's configured to flag any sudden increases in outbound data transfer volume exceeding 50MB per minute.' What does 'anomalous network traffic' suggest?
'Anomalous network traffic' signifies that the system is actively looking for deviations from what's considered 'normal'. This typically involves comparing current traffic patterns to historical baselines or expected ranges. It doesn't mean *all* network traffic is monitored, but rather specific deviations are flagged as potentially problematic.
10 / 15
The monitoring system flags a critical incident: 'High CPU utilization on the database server – sustained above 95% for 5 minutes.' What does 'sustained' imply in this context?
'Sustained' indicates that the high CPU usage wasn't a transient spike but rather remained consistently above the threshold for an extended period (5 minutes). This level of sustained high utilization strongly suggests a deeper problem—perhaps a query inefficiency or resource contention—rather than a brief, isolated incident. Fluctuations would be a different scenario.
11 / 15
During a code review of the new authentication service, Alice comments: 'The API response is returning a 500 status code with a message indicating 'Internal Server Error'. This suggests a problem within the service itself.' What does Alice mean by 'Internal Server Error'?
'Internal Server Error' indicates a problem within the application code itself—a bug or unexpected condition that prevented the server from completing the request as intended. It's different from client-side errors like invalid credentials which would return a 401 status code. While it *could* be transient, the key is the message implies a deeper issue needing investigation.
12 / 15
In a Slack channel for the DevOps team, Ben writes: 'We're seeing a high volume of requests to the payment gateway. The system is throttling responses and we've hit our rate limit.' What does 'rate limiting' imply in this context?
'Rate limiting' refers to the practice of restricting the number or frequency of requests a server will accept within a specific timeframe. This prevents overload and protects the service from being overwhelmed by excessive traffic—a common mitigation strategy for sudden spikes in demand. It's distinct from outright rejection, which would be a 429 'Too Many Requests' error.
13 / 15
During a standup meeting, Sarah reports: 'The incident detection system triggered an alert because the queue depth for order processing exceeded 1000 items.' What does 'queue depth' signify in this situation?
'Queue depth' is a metric that measures the length of the queue—the number of items waiting to be processed. In this case, it indicates a significant backlog of unprocessed orders, which is a strong indicator of a potential problem impacting order fulfillment and likely triggered the alert. It's not about user activity or system capacity.
14 / 15
You are reviewing a PR description for an update to the logging service: 'The new version includes enhanced detection of anomalous network traffic patterns. Specifically, it's configured to flag any sudden increases in outbound data transfer volume exceeding 50MB per minute.' What does 'anomalous network traffic' suggest?
'Anomalous network traffic' signifies that the system is actively looking for deviations from what's considered 'normal'. This typically involves comparing current traffic patterns to historical baselines or expected ranges. It doesn't mean *all* network traffic is monitored, but rather specific deviations are flagged as potentially problematic.
15 / 15
The monitoring system flags a critical incident: 'High CPU utilization on the database server – sustained above 95% for 5 minutes.' What does 'sustained' imply in this context?
'Sustained' indicates that the high CPU usage wasn't a transient spike but rather remained consistently above the threshold for an extended period (5 minutes). This level of sustained high utilization strongly suggests a deeper problem—perhaps a query inefficiency or resource contention—rather than a brief, isolated incident. Fluctuations would be a different scenario.
What will I practise in "Incident Detection Vocabulary"?
Practice English vocabulary for detecting incidents: monitoring alerts, threshold breaches, anomaly detection, and SLO triggers.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Incident Response exercises?
Browse the full Incident Response hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.