Professional Cloud Developer Free Practice Questions — Page 11
Question 101
You are a developer at a large corporation. You manage three Google Kubernetes Engine clusters on Google Cloud. Your team’s developers need to switch from one cluster to another regularly without losing access to their preferred development tools. You want to configure access to these multiple clusters while following Google-recommended best practices. What should you do?
A. Ask the developers to use Cloud Shell and run gcloud container clusters get-credential to switch to another cluster.
B. In a configuration file, define the clusters, users, and contexts. Share the file with the developers and ask them to use kubect1 contig to add cluster, user, and context details.
C. Ask the developers to install the gcloud CLI on their workstation and run gcloud container clusters get-credentials to switch to another cluster.
D. Ask the developers to open three terminals on their workstation and use kubect1 config to configure access to each cluster.
Show Answer
Correct Answer: C
Explanation: For Google Kubernetes Engine, the Google-recommended best practice is to use the gcloud CLI to manage cluster credentials. Running `gcloud container clusters get-credentials` on the developer’s workstation automatically updates the kubeconfig with the correct cluster, user, and context, allowing easy switching between clusters while keeping existing development tools. Sharing kubeconfig files (B) is error-prone and a security risk, Cloud Shell (A) limits tool choice, and managing multiple terminals manually (D) is cumbersome and not recommended.
Question 102
You are a lead developer working on a new retail system that runs on Cloud Run and Firestore. A web UI requirement is for the user to be able to browse through all products. A few months after go-live, you notice that Cloud Run instances are terminated with HTTP 500: Container instances are exceeding memory limits errors during busy times. This error coincides with spikes in the number of Firestore queries.
You need to prevent Cloud Run from crashing and decrease the number of Firestore queries. You want to use a solution that optimizes system performance. What should you do?
A. Modify the query that returns the product list using cursors with limits.
B. Create a custom index over the products.
C. Modify the query that returns the product list using integer offsets.
D. Modify the Cloud Run configuration to increase the memory limits.
Show Answer
Correct Answer: A
Explanation: The issue is caused by loading too much data and triggering excessive Firestore reads during peak traffic, leading to high memory usage in Cloud Run. Using cursor-based pagination with limits returns only a small subset of products per request, reducing memory consumption and the total number of documents read. This optimizes performance and prevents container crashes. Custom indexes do not reduce result size, integer offsets are inefficient and costly in Firestore, and increasing memory only masks the underlying performance problem.
Question 103
You have a web application that publishes messages to Pub/Sub. You plan to build new versions of the application locally and want to quickly test Pub/Sub integration for each new build. How should you configure local testing?
A. Install Cloud Code on the integrated development environment (IDE). Navigate to Cloud APIs, and enable Pub/Sub against a valid Google Project ID. When developing locally, configure your application to call pubsub.googleapis.com.
B. Install the Pub/Sub emulator using gcloud, and start the emulator with a valid Google Project ID. When developing locally, configure your application to use the local emulator with ${gcloud beta emulators pubsub env-init}.
C. In the Google Cloud console, navigate to the API Library, and enable the Pub/Sub API. When developing locally, configure your application to call pubsub.googleapis.com.
D. Install the Pub/Sub emulator using gcloud, and start the emulator with a valid Google Project IWhen developing locally, configure your application to use the local emulator by exporting the PUBSUB_EMULATOR_HOST variable.
Show Answer
Correct Answer: B
Explanation: For fast local testing of Pub/Sub integration, the recommended approach is to use the Pub/Sub emulator. Option B correctly describes installing and running the emulator with gcloud and using `gcloud beta emulators pubsub env-init` to automatically configure environment variables so the application points to the local emulator instead of the real Pub/Sub service. This avoids external API calls, works for rapid local iteration, and matches Google’s documented best practice.
Question 104
You are a developer at a large organization. Your team uses Git for source code management (SCM). You want to ensure that your team follows Google-recommended best practices to manage code to drive higher rates of software delivery. Which SCM process should your team use?
A. Each developer commits their code to the main branch before each product release, conducts testing, and rolls back if integration issues are detected.
B. Each group of developers copies the repository, commits their changes to their repository, and merges their code into the main repository before each product release.
C. Each developer creates a branch for their own work, commits their changes to their branch, and merges their code into the main branch daily.
D. Each group of developers creates a feature branch from the main branch for their work, commits their changes to their branch, and merges their code into the main branch after the change advisory board approves it.
Show Answer
Correct Answer: C
Explanation: Google-recommended SCM best practices emphasize trunk-based development: short-lived branches (often per developer), frequent integration into the main branch (at least daily), and avoiding long-lived feature branches or manual approval gates that slow delivery. Option C aligns with these principles and supports high deployment frequency and low integration risk, whereas option D introduces feature branches and change advisory boards, which conflict with Google’s DevOps and DORA guidance.
Question 105
Your team is creating a serverless web application on Cloud Run. The application needs to access images stored in a private Cloud Storage bucket. You want to give the application Identity and Access Management (IAM) permission to access the images in the bucket, while also securing the services using Google-recommended best practices. What should you do?
A. Enforce signed URLs for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
B. Enforce public access prevention for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
C. Enforce signed URLs for the desired bucket. Create and update the Cloud Run service to use a user-managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account.
D. Enforce public access prevention for the desired bucket. Create and update the Cloud Run service to use a user-managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account.
Show Answer
Correct Answer: D
Explanation: Cloud Run should access Cloud Storage using a dedicated user-managed service account, following the principle of least privilege. Granting that service account the Storage Object Viewer role on the private bucket allows secure access without exposing data publicly. Enforcing public access prevention aligns with Google best practices, and signed URLs are unnecessary when the service itself accesses the bucket via IAM.
Question 106
A governmental regulation was recently passed that affects your application. For compliance purposes, you are now required to send a duplicate of specific application logs from your application’s project to a project that is restricted to the security team. What should you do?
A. Create user-defined log buckets in the security team’s project. Configure a Cloud Logging sink to route your application’s logs to log buckets in the security team’s project.
B. Create a job that copies the logs from the _Required log bucket into the security team’s log bucket in their project.
C. Modify the _Default log bucket sink rules to reroute the logs into the security team’s log bucket.
D. Create a job that copies the System Event logs from the _Required log bucket into the security team’s log bucket in their project.
Show Answer
Correct Answer: A
Explanation: The requirement is to send a duplicate of specific application logs to a security-restricted project in a compliant, automated way. Cloud Logging sinks are designed to route or duplicate logs across projects and destinations in near real time. Creating user-defined log buckets in the security team’s project and configuring a sink from the application project allows selective log routing without modifying default or required buckets. Copy jobs are manual, delayed, and error-prone, and modifying _Default or _Required buckets is not supported for this use case. Therefore, option A is the correct and compliant solution.
Question 107
Your application is running as a container in a Google Kubernetes Engine cluster. You need to add a secret to your application using a secure approach. What should you do?
A. Create a Kubernetes Secret, and pass the Secret as an environment variable to the container.
B. Enable Application-layer Secret Encryption on the cluster using a Cloud Key Management Service (KMS) key.
C. Store the credential in Cloud KMS. Create a Google service account (GSA) to read the credential from Cloud KMS. Export the GSA as a .json file, and pass the .json file to the container as a volume which can read the credential from Cloud KMS.
D. Store the credential in Secret Manager. Create a Google service account (GSA) to read the credential from Secret Manager. Create a Kubernetes service account (KSA) to run the container. Use Workload Identity to configure your KSA to act as a GSA.
Show Answer
Correct Answer: D
Explanation: The most secure approach on GKE is to store secrets in Google Secret Manager and access them using Workload Identity. This avoids storing secrets in Kubernetes Secrets or service account key files, eliminates long-lived credentials, and enforces IAM-based access control. Kubernetes Secrets (option A) are only base64-encoded and are less secure by default. Options B and C do not directly provide secure secret injection into the application.
Question 108
You are a developer at a large organization. You are deploying a web application to Google Kubernetes Engine (GKE). The DevOps team has built a CI/CD pipeline that uses Cloud Deploy to deploy the application to Dev, Test, and Prod clusters in GKE. After Cloud Deploy successfully deploys the application to the Dev cluster, you want to automatically promote it to the Test cluster. How should you configure this process following Google-recommended best practices?
A. 1. Create a Cloud Build trigger that listens for SUCCEEDED Pub/Sub messages from the clouddeploy-operations topic. 2. Configure Cloud Build to include a step that promotes the application to the Test cluster.
B. 1. Create a Cloud Function that calls the Google Cloud Deploy API to promote the application to the Test cluster. 2. Configure this function to be triggered by SUCCEEDED Pub/Sub messages from the cloud-builds topic.
C. 1. Create a Cloud Function that calls the Google Cloud Deploy API to promote the application to the Test cluster. 2. Configure this function to be triggered by SUCCEEDED Pub/Sub messages from the clouddeploy-operations topic.
D. 1. Create a Cloud Build pipeline that uses the gke-deploy builder. 2. Create a Cloud Build trigger that listens for SUCCEEDED Pub/Sub messages from the cloud-builds topic. 3. Configure this pipeline to run a deployment step to the Test cluster.
Show Answer
Correct Answer: A
Explanation: Cloud Deploy publishes lifecycle events (including SUCCEEDED) to the clouddeploy-operations Pub/Sub topic. Google-recommended practice for integrating automated steps after a deployment is to trigger Cloud Build from these events and run promotion or testing steps there. Using a Cloud Build trigger subscribed to clouddeploy-operations cleanly integrates with Cloud Deploy and uses Cloud Deploy’s native promotion mechanism, whereas using Cloud Functions is not the documented or recommended integration pattern for promotions.
Question 109
You are developing an online gaming platform as a microservices application on Google Kubernetes Engine (GKE). Users on social media are complaining about long loading times for certain URL requests to the application. You need to investigate performance bottlenecks in the application and identify which HTTP requests have a significantly high latency span in user requests. What should you do?
A. Configure GKE workload metrics using kubectl. Select all Pods to send their metrics to Cloud Monitoring. Create a custom dashboard of application metrics in Cloud Monitoring to determine performance bottlenecks of your GKE cluster.
B. Update your microservices to log HTTP request methods and URL paths to STDOUT. Use the logs router to send container logs to Cloud Logging. Create filters in Cloud Logging to evaluate the latency of user requests across different methods and URL paths.
C. Instrument your microservices by installing the OpenTelemetry tracing package. Update your application code to send traces to Trace for inspection and analysis. Create an analysis report on Trace to analyze user requests.
D. Install tcpdump on your GKE nodes. Run tcpdump to capture network traffic over an extended period of time to collect data. Analyze the data files using Wireshark to determine the cause of high latency.
Show Answer
Correct Answer: C
Explanation: To identify high-latency HTTP requests in a distributed microservices application, you need end-to-end request visibility. Distributed tracing with OpenTelemetry and Cloud Trace is purpose-built for this use case, allowing you to inspect individual request spans, see latency breakdowns across services, and pinpoint bottlenecks. Metrics alone lack per-request detail, logs are inefficient for latency analysis at scale, and packet captures are impractical and low-level for application performance troubleshooting.
Question 110
You are a developer at a financial institution. You use Cloud Shell to interact with Google Cloud services. User data is currently stored on an ephemeral disk; however, a recently passed regulation mandates that you can no longer store sensitive information on an ephemeral disk. You need to implement a new storage solution for your user data. You want to minimize code changes. Where should you store your user data?
A. Store user data on a Cloud Shell home disk, and log in at least every 120 days to prevent its deletion.
B. Store user data on a persistent disk in a Compute Engine instance.
C. Store user data in a Cloud Storage bucket.
D. Store user data in BigQuery tables.
Show Answer
Correct Answer: B
Explanation: Cloud Shell runs on a temporary Compute Engine VM with an ephemeral disk, but it also provides a persistent disk that survives session restarts. Using a persistent disk in a Compute Engine context most closely matches existing filesystem-based access patterns, allowing you to store sensitive data without keeping it on ephemeral storage and with minimal code changes. Cloud Storage or BigQuery would require refactoring application logic to use object or query-based access rather than a local filesystem.
$19
Get all 357 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.