Define what needs attention
An anomaly is an observation unusual under a chosen model or reference, not automatically a fraud, failure, or safety incident. Define the entity, time horizon, action, and cost of missed cases and unnecessary reviews. If reliable labels exist, compare a supervised classifier with unsupervised approaches. For time series, seasonality and trend matter; for independent records, distance or reconstruction-based methods may be useful. Establish a simple baseline and review the limits of each assumption.
A payment amount is unusual for one customer but normal for the wider population. Describe how the reference population changes the meaning of the alert and what additional context an investigator needs.
Choose thresholds with the review process
A score needs a decision rule. Use labeled, representative validation examples where available to compare detection rates, false alarms, and review volume. When labels are sparse, combine expert review with a governed sample of unflagged cases; reviewing only alerts cannot reveal all missed incidents. In BigQuery ML, the documented anomaly-detection parameters vary by model type: a contamination setting for supported k-means, PCA, or autoencoder models determines a score cutoff from training data. It is not a guarantee of the fraction of future records flagged.
A team configures a 2% contamination setting and receives 8% alerts on a later population. List three possible explanations and explain why the setting alone does not guarantee a 2% future alert rate.
Respect time and feedback delays
For a time series, evaluate on periods after the training cutoff and compare against a seasonal baseline. Check the effect of missing data, late arrivals, holidays, and changes in measurement. An observed value outside an expected interval can warrant review, but the model’s probability or score must be interpreted according to its documented method. Do not use future observations to construct a real-time threshold unless they were available at the alert time.
A service’s traffic spikes every Monday. Explain why a threshold based on a constant daily average may generate recurring false alerts, and design a time-aware validation period.
Operate alerts as a feedback loop
Record the model version, score, threshold, context, reviewer disposition, and investigation time. Monitor alert volume, latency, data quality, outcomes, and relevant slices; distinguish a detector alert from a confirmed incident. Define escalation, suppression, and retraining ownership, and check for feedback effects when reviewers label only what the detector sends. Review thresholds when costs, capacity, or populations change.
A detector produces 100 alerts, and reviewers confirm 20 incidents. Calculate alert precision as 20% among reviewed alerts. Explain why this information alone cannot establish recall.
A k-means anomaly detector uses a 2% contamination setting. What should you expect for a new population?
Keep exploring
Use the official certification page and its linked resources to validate your coverage. For guided labs, explore the Google Skills learning path. Revisit the practical exercise and explain your decision in your own words before moving on.