Computer Fundamentals
20-25%of exam
ShellOSNetworkingMetadataHardwareConfig Files
Infrastructure Development
15-20%of exam
Agent InstallAPI KeysApp KeysHostnameRunning Agent
Networking + Agent Config
10-15%of exam
PortsFirewallAutodiscoveryIP Allowlisting
Data Collection
20-25%of exam
Troubleshooting Datadog
10-15%of exam
Data Visualization + Use
15-20%of exam
Host MapDashboardsMonitorsAlertsUsing Tags
Quick Facts
- Exam
- Datadog Fundamentals
- Questions
- 90 (75 scored, 15 pretest)
- Time
- 2 hours
- Fee
- $100 USD
- Validity
- 3 years
- Retakes
- 3 per 180 days
- Wait
- 24-48h between attempts
- Delivery
- Kryterion Webassessor
- Pass score
- Not disclosed by Datadog
- Weights
- Not published by Datadog
Shell + OS
- sudo
- Run as rootLinux
- systemctl
- Manage service
- journalctl
- Read service logs
- >
- Overwrite file
- >>
- Append to file
- YAML
- Indent-sensitive config
- JSON
- API payload format
- Daemon
- Background service
Hardware + Metadata
- CPU
- Processor load
- RAM
- Active memory
- Disk
- Persistent storage
- Swap
- Disk overflow memory
- Metadata
- Key-value context
- Port
- Logical endpoint
- TCP
- Reliable ordered
- UDP
- Fire-and-forget
Key Roles
API submits, App manages
API key: ingestionApp key: managementService account: shared
API Key vs App Key
API key
- Data ingestion
- Submit metrics
- Org-wide
App key
- Management API
- Create dashboards
- User-scoped
Submit vs manage
Agent + API Keys
- Agent
- Background daemonCore
- API key
- Data ingestion auth
- App key
- Management API auth
- Service account key
- Shared automation
- DD_API_KEY
- Env var secret
- DD_SITE
- Datadog region
- datadog.yaml
- Main Agent config
- conf.d
- Integration configs
Agent Behavior
- Restart
- Apply config changes
- Hostname override
- Fixed reported name
- Duplicate host
- Reused hostname risk
- User deactivation
- Keys deactivated too
- Browser API key
- Exposes org secret
- DD_ prefix
- Container env config
Datadog Ports
8125 UDP metrics, 8126 TCP traces
8125 UDP: DogStatsD8126 TCP: APM443: HTTPS outbound
TCP vs UDP
TCP
- Reliable ordered
- 8126 APM
- 443 HTTPS
UDP
- Fire-and-forget
- 8125 DogStatsD
- No retransmit
Reliable vs fast
Ports + Firewall
- 8125 UDP
- DogStatsD metricsPort
- 8126 TCP
- APM tracesPort
- 443 TCP
- Outbound HTTPSPort
- Allowlist domains
- Not static IPs
- *.datadoghq.com
- US1 site domain
- Autodiscovery
- Label-based detection
- Docker labels
- Container auto-conf
- K8s annotations
- Pod auto-conf
Unified Tagging
env, service, version correlate all
env: deploymentservice: componentversion: release
Metrics vs Logs
Metrics
- Numeric timeseries
- Aggregatable
- Low storage
Logs
- Text events
- Per-line
- High storage
Numbers vs text
Metric Source Picker
- Host metrics→Agent(Default install)
- App custom metric→DogStatsD(UDP 8125)
- No Agent possible→API POST(Serverless)
- Cloud provider metrics→Crawler integration(Polls API)
- Log lines→Log collection(Tail files)
- App spans→APM trace lib(TCP 8126)
Metrics
- Gauge
- Snapshot value
- Count
- Accumulated rate
- Rate
- Per-second count
- Timer
- Duration metric
- Set
- Unique value count
- DogStatsD
- UDP custom metrics
- Rollup
- Zoom-out binning
- Space agg
- avg vs max
Gauge vs Count
Gauge
- Snapshot value
- Memory used
- Point in time
Count
- Accumulated value
- Requests/sec
- Resets periodically
Snapshot vs accumulated
Logs + Integrations
- Log tailer
- Reads line by line
- Newline
- Entry delimiter
- Duplicate source
- Double-tail risk
- conf.yaml.example
- Copy to conf.yaml
- Missing Data
- Integration no data
- Crawler
- Cloud API poller
- Cloud latency
- Minutes not seconds
- Direct API
- Serverless submission
Agent Command Order
status, configcheck, flare, restart
status: healthconfigcheck: parseflare: supportrestart: apply
Troubleshoot Picker
- Agent healthy?→status(First command)
- Config parsed?→configcheck(YAML check)
- Need support help→flare(Diagnostic bundle)
- Read Agent logs→journalctl(systemd)
- Apply config change→restart(Reload not enough)
- Integration no data→conf.yaml + creds(Check creds)
Agent Commands
- status
- Health + integrationsFirst
- configcheck
- Validate resolved config
- flare
- Send support bundle
- journalctl -u
- Read Agent logs
- systemctl status
- terse service state
- restart
- Apply new config
- Inactive metric
- Hidden until new data
Monitor vs Notification
Monitor
- Alert condition
- Query + threshold
- avg by group
Notification
- Delivery message
- Email, Slack
- Per trigger
Condition vs delivery
Visualization Picker
- Spot host outliers→Host Map(Color grid)
- Single metric quick→Metrics Explorer(No save)
- Saved graph set→Dashboard(Shareable)
- Alert on threshold→Monitor(avg by tag)
- Filter telemetry→Tags(env, service)
Dashboards + Monitors
- Host Map
- Grid colored by metric
- Metrics Explorer
- Quick graph
- Dashboard
- Saved graph set
- Monitor
- Alert condition
- avg by
- Group evaluation
- Monitor tags
- Route + organize
- Notification
- Alert delivery
- SLO
- Reliability target
Common Traps
Submit vs manage
API key submits data ≠ App key manages resources
Snapshot vs accumulated
Gauge is point-in-time ≠ Count resets periodically
Tag vs metric name
env:prod tag filters ≠ Embedded name clutters namespace
Identity vs grouping
Hostname identifies host ≠ Tags group + filter
Condition vs delivery
Monitor defines threshold ≠ Notification delivers message
Reload vs restart
Edit does not apply ≠ Restart Agent for config
Static IP vs domain
IPs change silently ≠ Allowlist domains instead
Last Minute
- 1.90 Q = 75 scored + 15 pretest
- 2.2 hours, $100, 3-year validity
- 3.3 attempts / 180 days, 24-48h wait
- 4.No published weights or pass score
- 5.API key submits; App key manages
- 6.env, service, version = unified tagging
- 7.8125 DogStatsD, 8126 APM, 443 HTTPS
- 8.status, configcheck, flare, restart
- 9.Restart Agent after datadog.yaml edits
- 10.Allowlist domains, not static IPs
- 11.Gauge = snapshot; Count = accumulated
- 12.Hostname = identity; Tags = grouping
Buy on Amazon