Dynatrace-Associate Dynatrace Associate Certification Exam Questions and Answers

The Security Investigator app in Dynatrace is designed for advanced security analysis and threat investigation using Dynatrace Query Language (DQL).

It enables users to:

Run and chain multiple queries across logs, metrics, traces, and events

Correlate different data types stored in Grail

Perform deep investigations into potential security incidents

This query-driven approach allows analysts to explore data relationships and uncover threats efficiently.

Other options describe capabilities not related to this app:

Credential vault checks are unrelated

Session investigation is part of RUM and Session Replay

Memory profiling is not a feature of Security Investigator

Log ingestion rules in Dynatrace are configured at the environment level .

This ensures:

Centralized control of log ingestion

Consistent processing and filtering across all monitored entities

Unified configuration for all logs entering the platform

Other options are not valid configuration levels:

ActiveGate handles routing, not rule configuration

Host, Process Group, and Host Group are entity levels, not ingestion rule scopes

The Failure Analysis page is the primary view for investigating high failure rates.

It provides:

Breakdown of errors

Failure patterns

Root cause indicators

This makes it the first place to investigate when failures increase.

A Span represents a single unit of work within a distributed trace.

A Trace is the full end-to-end transaction

A Span is one step within that trace

Other options:

Context carries metadata

Span kind defines role

Exporter sends data

Only Span represents a single operation.

Dynatrace defines three main types of user actions:

Load Actions – full page loads

XHR Actions – background requests (AJAX/fetch)

Custom Actions – user-defined actions

Click Actions are not a separate action type; clicks are typically captured within other action types such as load or custom actions.

Yes, Kubernetes workloads and pods are monitored differently compared to traditional OneAgent-monitored processes. When Dynatrace is deployed into Kubernetes using the Dynatrace Operator, the OneAgent automatically injects itself into each pod at runtime. This means each container is monitored independently and is shown in Dynatrace as a container entity , not as a traditional process.

This container-based visibility is designed to suit the dynamic and short-lived nature of Kubernetes environments. Traditional OneAgent monitoring associates metrics and topology with processes and hosts, but in Kubernetes, the emphasis shifts toward containers, pods, and workloads. This shift allows Dynatrace to provide accurate and timely data on what’s really happening inside containerized apps, aligned with Kubernetes-native objects and metrics.

Other answer options either misstate the behavior (e.g., no service data or requiring OpenTelemetry) or oversimplify the relationship between traditional and Kubernetes monitoring (e.g., "same general information"), making Option E the only correct and fully accurate one.

The Dynatrace API can be used to dynamically retrieve the latest version of the RUM JavaScript snippet during build time. This ensures that the most up-to-date script is always injected into the application without manual updates.

Other options:

ActiveGate is for communication and routing

OpenKit is for custom apps

OneAgent is not used in agentless/manual injection

When a platform is not supported by OneAgent, Dynatrace provides alternative methods to ingest metrics:

OpenTelemetry allows ingestion of metrics using open standards, enabling integration with unsupported platforms by exporting telemetry data into Dynatrace

Dynatrace Extensions (especially Extensions v2) allow users to collect custom metrics from technologies that are not natively supported

Installing ActiveGate alone does not enable metric ingestion unless it is used in combination with extensions or APIs. Creating a Dynatrace App is unrelated to metric ingestion and is instead used for building custom UI or workflows within the platform.

The Dynatrace Hub is the central location for discovering and managing officially supported extensions that enhance the monitoring capabilities of the Dynatrace platform. It provides a curated collection of extensions built and maintained by Dynatrace, ensuring compatibility and support. These extensions cover a wide range of technologies and use cases, allowing users to tailor their monitoring environment to specific needs.

While GitHub hosts various open-source projects related to Dynatrace, not all are officially supported or maintained by Dynatrace. The Dynatrace Community is a valuable resource for user discussions, troubleshooting, and sharing best practices but does not serve as a repository for official extensions. Dynatrace University offers training and educational materials to help users understand and utilize Dynatrace effectively but is not a source for extensions.

Dynatrace uses hexagon-style health tiles with green and red indicators to visualize the health status of monitored entities.

These are specifically used in:

Service health tiles – showing health of services

Application health tiles – showing overall application health

These tiles provide a quick visual overview of system health using color-coded hexagons.

Other options:

Synthetic monitor health uses different visualization styles

Web applications is not a tile type

Problems shows problem cards, not hexagon visualization

In Dynatrace Digital Experience Monitoring, conversion goals are used to measure key user behaviors and business outcomes. These goals can be defined based on several criteria related to user sessions and actions.

Supported bases for conversion goals include:

Specific User Action , such as clicking a button or completing a defined interaction

Destination URL , where reaching a specific page indicates a successful conversion

Number of Actions per Session , which reflects engagement level

Session Duration , indicating how long users interact with the application

The Number of Errors on Session end is not used as a basis for defining conversion goals. Instead, it is used more for session quality analysis rather than measuring successful conversions.

The dt.security.context attribute enables fine-grained access control over ingested data, including Business Events.

It allows:

Segmentation of data

Restricting access to specific users or groups

Applying security boundaries to sensitive datasets

Other attributes are related to tracing:

dt.traceid and dt.spanid are for distributed tracing

dt.entity.process_group_instance links data to entities

Only dt.security.context provides control over data access and segmentation.

Dynatrace recommends selecting the appropriate OneAgent mode depending on the role of the host:

Infrastructure mode is recommended when only host-level monitoring is required with minimal overhead

Full-Stack mode is used when deep monitoring is needed, including process-level visibility and full observability

Options like Full support , Discovery , and Half stack are not valid OneAgent monitoring modes in Dynatrace.

Log Metrics allow converting log occurrences into measurable metrics.

They enable:

Counting occurrences

Creating thresholds and alerts

Trend analysis

Other options:

Log Viewer = manual view

Log Events = alerting

Anomaly detection = metric-based

Smartscape is the Dynatrace capability that provides a real-time visualization of the entire environment, including all topological dependencies across infrastructure, processes, services, and applications.

It automatically maps and displays relationships between:

Hosts and infrastructure components

Processes running on those hosts

Services and how they communicate with each other

This dynamic topology view allows users to quickly understand dependencies, identify bottlenecks, and analyze the impact of issues across the full stack.

Other options such as “Technologies and Processes classic” and “Services classic” provide filtered or specific views but do not deliver the complete, unified topology visualization. “Dynatrace Extension” is used to extend monitoring capabilities and does not provide topology visualization.

OneAgent is the primary component used to initially enable Application Security (AppSec) monitoring in Dynatrace.

It automatically:

Instruments application code

Detects vulnerabilities at runtime

Captures security-related data such as code-level weaknesses and attack vectors

This built-in capability allows Dynatrace to provide continuous application security without requiring additional manual instrumentation.

AppSec Apps are used to analyze and visualize detected vulnerabilities but rely on data collected by OneAgent.

ActiveGate handles communication and routing.

OpenTelemetry is used for telemetry ingestion, not native AppSec monitoring.

Dynatrace categorizes problems based on the type of issue detected:

Availability – when a service or application becomes unavailable

Errors – when there is an increase in failure rate

Slowdown – when response times degrade

Resource – when infrastructure resources (CPU, memory, disk) are saturated

Critical is not a problem type; it is a severity level used to indicate importance, not classification.

Log Processing rules in Dynatrace allow transformation of log data during the ingestion phase.

They enable:

Parsing and structuring log data

Masking sensitive information

Enriching logs with additional attributes

Filtering and modifying log content before storage

Other options are unrelated:

Anomaly detection rules are for alerting

Log events are outputs, not transformation tools

Custom process monitoring rules and service detection rules are unrelated to logs

Dynatrace uses DQL (Dynatrace Query Language) to query Business Event data stored in Grail.

DQL enables:

Querying across logs, metrics, traces, and business events

Advanced filtering, aggregation, and correlation

Unified analysis across all observability and business data

Grail is the data platform, not a query language.

SQL is not used in Dynatrace for this purpose.

USQL is legacy and not used for Grail-based querying.

When Dynatrace detects that a vulnerable component is exposed to the internet, it highlights this in the risk assessment by marking it with “public internet exposure.”

This indicates:

The vulnerability is not just present

But also externally accessible , increasing its severity and exploitability

This context is critical in prioritizing security issues, as publicly exposed vulnerabilities pose a significantly higher risk.

Other options are incorrect:

Dynatrace does show this information

Tagging alone is not the primary method of indicating exposure

Email alerts are configurable but not the defining behavior

In distributed tracing, Dynatrace follows standard tracing protocols (such as W3C Trace Context), where the trace ID is propagated via HTTP headers between services.

This enables:

End-to-end trace continuity across services

Correlation of requests across distributed systems

Seamless tracking through microservices architectures

The trace context is typically included in headers like traceparent, ensuring each downstream service continues the same trace.

Other options are incorrect because:

XML and JSON payloads are not used for trace propagation

TLS handshake is unrelated to trace context propagation