Professional Cloud Developer Free Practice Questions — Page 11
Question 101
You are a developer at a large corporation. You manage three Google Kubernetes Engine clusters on Google Cloud. Your team’s developers need to switch from one cluster to another regularly without losing access to their preferred development tools. You want to configure access to these multiple clusters while following Google-recommended best practices. What should you do?
A. Ask the developers to use Cloud Shell and run gcloud container clusters get-credential to switch to another cluster.
B. In a configuration file, define the clusters, users, and contexts. Share the file with the developers and ask them to use kubect1 contig to add cluster, user, and context details.
C. Ask the developers to install the gcloud CLI on their workstation and run gcloud container clusters get-credentials to switch to another cluster.
D. Ask the developers to open three terminals on their workstation and use kubect1 config to configure access to each cluster.
Show Answer
Correct Answer: C
Explanation: For GKE, the recommended workflow is for each developer to use the gcloud CLI and run `gcloud container clusters get-credentials` for the clusters they need. This updates the local kubeconfig with the cluster credentials and contexts, allowing them to switch contexts with standard kubectl commands while continuing to use their preferred local development tools. Sharing a prebuilt kubeconfig file is not a recommended practice because it can expose configuration or credentials and is less maintainable. Cloud Shell is unnecessary when developers want to keep using their own workstation tools, and using separate terminals per cluster is cumbersome.
Question 102
You are a lead developer working on a new retail system that runs on Cloud Run and Firestore. A web UI requirement is for the user to be able to browse through all products. A few months after go-live, you notice that Cloud Run instances are terminated with HTTP 500: Container instances are exceeding memory limits errors during busy times. This error coincides with spikes in the number of Firestore queries.
You need to prevent Cloud Run from crashing and decrease the number of Firestore queries. You want to use a solution that optimizes system performance. What should you do?
A. Modify the query that returns the product list using cursors with limits.
B. Create a custom index over the products.
C. Modify the query that returns the product list using integer offsets.
D. Modify the Cloud Run configuration to increase the memory limits.
Show Answer
Correct Answer: A
Explanation: Use Firestore query cursors with limits to paginate product browsing. This avoids loading large result sets into Cloud Run memory and is more efficient than offsets, which still require Firestore to scan skipped documents and increase read costs. A custom index improves query execution but does not address loading all products, and simply increasing Cloud Run memory does not reduce Firestore queries or optimize performance.
Question 103
You have a web application that publishes messages to Pub/Sub. You plan to build new versions of the application locally and want to quickly test Pub/Sub integration for each new build. How should you configure local testing?
A. Install Cloud Code on the integrated development environment (IDE). Navigate to Cloud APIs, and enable Pub/Sub against a valid Google Project ID. When developing locally, configure your application to call pubsub.googleapis.com.
B. Install the Pub/Sub emulator using gcloud, and start the emulator with a valid Google Project ID. When developing locally, configure your application to use the local emulator with ${gcloud beta emulators pubsub env-init}.
C. In the Google Cloud console, navigate to the API Library, and enable the Pub/Sub API. When developing locally, configure your application to call pubsub.googleapis.com.
D. Install the Pub/Sub emulator using gcloud, and start the emulator with a valid Google Project IWhen developing locally, configure your application to use the local emulator by exporting the PUBSUB_EMULATOR_HOST variable.
Show Answer
Correct Answer: B
Explanation: For local development and fast integration testing, Google Cloud recommends using the Pub/Sub emulator. Start the emulator with gcloud and configure your application using the environment settings generated by `gcloud beta emulators pubsub env-init`, which sets the appropriate emulator host variables for local use. Calling the production API is not local testing, and manually exporting `PUBSUB_EMULATOR_HOST` is the underlying mechanism but `env-init` is the recommended configuration flow for the local setup described.
Question 104
You are a developer at a large organization. Your team uses Git for source code management (SCM). You want to ensure that your team follows Google-recommended best practices to manage code to drive higher rates of software delivery. Which SCM process should your team use?
A. Each developer commits their code to the main branch before each product release, conducts testing, and rolls back if integration issues are detected.
B. Each group of developers copies the repository, commits their changes to their repository, and merges their code into the main repository before each product release.
C. Each developer creates a branch for their own work, commits their changes to their branch, and merges their code into the main branch daily.
D. Each group of developers creates a feature branch from the main branch for their work, commits their changes to their branch, and merges their code into the main branch after the change advisory board approves it.
Show Answer
Correct Answer: C
Explanation: Google and DORA recommend trunk-based development with short-lived individual branches and frequent integration into the main branch. Daily merges reduce integration risk and support continuous integration and continuous delivery. The other options rely on infrequent integration, forks for internal team development, or long-lived feature branches gated by a change advisory board, all of which slow delivery.
Question 105
Your team is creating a serverless web application on Cloud Run. The application needs to access images stored in a private Cloud Storage bucket. You want to give the application Identity and Access Management (IAM) permission to access the images in the bucket, while also securing the services using Google-recommended best practices. What should you do?
A. Enforce signed URLs for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
B. Enforce public access prevention for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
C. Enforce signed URLs for the desired bucket. Create and update the Cloud Run service to use a user-managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account.
D. Enforce public access prevention for the desired bucket. Create and update the Cloud Run service to use a user-managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account.
Show Answer
Correct Answer: D
Explanation: Cloud Run should use a user-managed service account following least-privilege best practices, rather than the Compute Engine default service account. Grant that service account the Storage Object Viewer role on the private bucket. Public Access Prevention is the recommended control to ensure the bucket cannot be made publicly accessible. Signed URLs are primarily for delegated temporary access and are not needed when the Cloud Run service accesses the bucket directly via IAM.
Question 106
A governmental regulation was recently passed that affects your application. For compliance purposes, you are now required to send a duplicate of specific application logs from your application’s project to a project that is restricted to the security team. What should you do?
A. Create user-defined log buckets in the security team’s project. Configure a Cloud Logging sink to route your application’s logs to log buckets in the security team’s project.
B. Create a job that copies the logs from the _Required log bucket into the security team’s log bucket in their project.
C. Modify the _Default log bucket sink rules to reroute the logs into the security team’s log bucket.
D. Create a job that copies the System Event logs from the _Required log bucket into the security team’s log bucket in their project.
Show Answer
Correct Answer: A
Explanation: Use a Cloud Logging sink to route a copy of the required application logs to a user-defined log bucket in the security team's project. Logging sinks are designed for centralized and cross-project log routing and duplication. Modifying the default bucket sink would reroute rather than duplicate logs, and scheduled copy jobs are unnecessary and less appropriate for continuous compliance.
Question 107
Your application is running as a container in a Google Kubernetes Engine cluster. You need to add a secret to your application using a secure approach. What should you do?
A. Create a Kubernetes Secret, and pass the Secret as an environment variable to the container.
B. Enable Application-layer Secret Encryption on the cluster using a Cloud Key Management Service (KMS) key.
C. Store the credential in Cloud KMS. Create a Google service account (GSA) to read the credential from Cloud KMS. Export the GSA as a .json file, and pass the .json file to the container as a volume which can read the credential from Cloud KMS.
D. Store the credential in Secret Manager. Create a Google service account (GSA) to read the credential from Secret Manager. Create a Kubernetes service account (KSA) to run the container. Use Workload Identity to configure your KSA to act as a GSA.
Show Answer
Correct Answer: D
Explanation: The most secure and Google-recommended approach is to store secrets in Secret Manager and access them from GKE using Workload Identity, which lets the Kubernetes service account impersonate a Google service account without distributing long-lived JSON keys. Kubernetes Secrets (A) are only base64-encoded by default and are less secure for sensitive credentials. Application-layer Secret Encryption (B) protects Kubernetes Secrets at rest in etcd but does not replace a proper secret management solution. Option C is insecure because it relies on exporting and mounting a service account JSON key.
Question 108
You are a developer at a large organization. You are deploying a web application to Google Kubernetes Engine (GKE). The DevOps team has built a CI/CD pipeline that uses Cloud Deploy to deploy the application to Dev, Test, and Prod clusters in GKE. After Cloud Deploy successfully deploys the application to the Dev cluster, you want to automatically promote it to the Test cluster. How should you configure this process following Google-recommended best practices?
A. 1. Create a Cloud Build trigger that listens for SUCCEEDED Pub/Sub messages from the clouddeploy-operations topic. 2. Configure Cloud Build to include a step that promotes the application to the Test cluster.
B. 1. Create a Cloud Function that calls the Google Cloud Deploy API to promote the application to the Test cluster. 2. Configure this function to be triggered by SUCCEEDED Pub/Sub messages from the cloud-builds topic.
C. 1. Create a Cloud Function that calls the Google Cloud Deploy API to promote the application to the Test cluster. 2. Configure this function to be triggered by SUCCEEDED Pub/Sub messages from the clouddeploy-operations topic.
D. 1. Create a Cloud Build pipeline that uses the gke-deploy builder. 2. Create a Cloud Build trigger that listens for SUCCEEDED Pub/Sub messages from the cloud-builds topic. 3. Configure this pipeline to run a deployment step to the Test cluster.
Show Answer
Correct Answer: A
Explanation: Cloud Deploy publishes deployment events to the clouddeploy-operations Pub/Sub topic. A Cloud Build trigger can subscribe to successful deployment events and run a build step that invokes `gcloud deploy releases promote` (or the Cloud Deploy API) to promote the release to the next target. This is the documented integration pattern for automating post-deployment actions. Options B and D use the wrong Pub/Sub topic, and while a Cloud Function could call the API, the recommended integration pattern for this workflow is a Cloud Build trigger on Cloud Deploy events.
Question 109
You are developing an online gaming platform as a microservices application on Google Kubernetes Engine (GKE). Users on social media are complaining about long loading times for certain URL requests to the application. You need to investigate performance bottlenecks in the application and identify which HTTP requests have a significantly high latency span in user requests. What should you do?
A. Configure GKE workload metrics using kubectl. Select all Pods to send their metrics to Cloud Monitoring. Create a custom dashboard of application metrics in Cloud Monitoring to determine performance bottlenecks of your GKE cluster.
B. Update your microservices to log HTTP request methods and URL paths to STDOUT. Use the logs router to send container logs to Cloud Logging. Create filters in Cloud Logging to evaluate the latency of user requests across different methods and URL paths.
C. Instrument your microservices by installing the OpenTelemetry tracing package. Update your application code to send traces to Trace for inspection and analysis. Create an analysis report on Trace to analyze user requests.
D. Install tcpdump on your GKE nodes. Run tcpdump to capture network traffic over an extended period of time to collect data. Analyze the data files using Wireshark to determine the cause of high latency.
Show Answer
Correct Answer: C
Explanation: Cloud Trace with OpenTelemetry instrumentation is the appropriate solution for distributed tracing in a GKE-based microservices application. It allows you to trace end-to-end user requests across services, identify high-latency spans, and analyze which HTTP requests and service interactions are causing performance bottlenecks. Workload metrics and logs alone do not provide distributed request-span analysis, and packet captures are not the appropriate long-term application performance analysis tool.
Question 110
You are a developer at a financial institution. You use Cloud Shell to interact with Google Cloud services. User data is currently stored on an ephemeral disk; however, a recently passed regulation mandates that you can no longer store sensitive information on an ephemeral disk. You need to implement a new storage solution for your user data. You want to minimize code changes. Where should you store your user data?
A. Store user data on a Cloud Shell home disk, and log in at least every 120 days to prevent its deletion.
B. Store user data on a persistent disk in a Compute Engine instance.
C. Store user data in a Cloud Storage bucket.
D. Store user data in BigQuery tables.
Show Answer
Correct Answer: B
Explanation: Cloud Shell itself provides a persistent home directory, but it is still part of the managed Cloud Shell environment and is not appropriate when a requirement prohibits storing sensitive information on the Cloud Shell environment's ephemeral disk. To minimize code changes while moving storage off the ephemeral disk, attaching and using a persistent disk on a Compute Engine instance provides the closest filesystem-based replacement. Cloud Storage and BigQuery require different access patterns and typically more application changes.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.