Professional Cloud Developer Free Practice Questions — Page 13
Question 121
Your application stores customers’ content in a Cloud Storage bucket, with each object being encrypted with the customer's encryption key. The key for each object in Cloud Storage is entered into your application by the customer. You discover that your application is receiving an HTTP 4xx error when reading the object from Cloud Storage. What is a possible cause of this error?
A. You attempted the read operation on the object with the customer's base64-encoded key.
B. You attempted the read operation without the base64-encoded SHA256 hash of the encryption key.
C. You entered the same encryption algorithm specified by the customer when attempting the read operation.
D. You attempted the read operation on the object with the base64-encoded SHA256 hash of the customer's key.
Show Answer
Correct Answer: B
Explanation: When reading an object encrypted with a customer-supplied encryption key (CSEK), Cloud Storage expects the request to include the encryption key, the encryption algorithm (AES256), and the base64-encoded SHA256 hash of the key. Omitting the required SHA256 hash can result in an HTTP 4xx (such as 400 Bad Request). Using the base64-encoded key itself is correct; using only the hash is not sufficient, and the algorithm itself is not the cause if it is correct.
Question 122
You have two Google Cloud projects, named Project A and Project B. You need to create a Cloud Function in Project A that saves the output in a Cloud Storage bucket in Project B. You want to follow the principle of least privilege. What should you do?
A. 1. Create a Google service account in Project B. 2. Deploy the Cloud Function with the service account in Project 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
B. 1. Create a Google service account in Project A 2. Deploy the Cloud Function with the service account in Project A. 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project
C. 1. Determine the default App Engine service account ( [email protected] ) in Project A. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
D. 1. Determine the default App Engine service account ( [email protected] ) in Project B. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
Show Answer
Correct Answer: B
Explanation: A Cloud Function runs in Project A and should use a service account from the same project as its runtime identity. Grant that dedicated service account only the minimum required permission on the target bucket in Project B: roles/storage.objectCreator. Using a dedicated service account follows least privilege better than using the default App Engine service account.
Question 123
You plan to deploy a new Go application to Cloud Run. The source code is stored in Cloud Source Repositories. You need to configure a fully managed, automated, continuous deployment pipeline that runs when a source code commit is made. You want to use the simplest deployment solution. What should you do?
A. Configure a cron job on your workstations to periodically run gcloud run deploy --source in the working directory.
B. Configure a Jenkins trigger to run the container build and deploy process for each source code commit to Cloud Source Repositories.
C. Configure continuous deployment of new revisions from a source repository for Cloud Run using buildpacks.
D. Use Cloud Build with a trigger configured to run the container build and deploy process for each source code commit to Cloud Source Repositories.
Show Answer
Correct Answer: D
Explanation: A fully managed automated CI/CD pipeline triggered by commits in Cloud Source Repositories is most directly implemented with Cloud Build triggers that build and deploy to Cloud Run. Jenkins and cron are not the simplest managed solutions. The Cloud Run source deployment/buildpacks feature builds from source, but automated continuous deployment from Cloud Source Repositories is typically implemented via Cloud Build triggers.
Question 124
Your team has created an application that is hosted on a Google Kubernetes Engine (GKE) cluster. You need to connect the application to a legacy REST service that is deployed in two GKE clusters in two different regions. You want to connect your application to the target service in a way that is resilient. You also want to be able to run health checks on the legacy service on a separate port. How should you set up the connection? (Choose two.)
A. Use Traffic Director with a sidecar proxy to connect the application to the service.
B. Use a proxyless Traffic Director configuration to connect the application to the service.
C. Configure the legacy service's firewall to allow health checks originating from the proxy.
D. Configure the legacy service's firewall to allow health checks originating from the application.
E. Configure the legacy service's firewall to allow health checks originating from the Traffic Director control plane.
Show Answer
Correct Answer: A, C
Explanation: Traffic Director with sidecar proxies supports resilient service-to-service routing across multiple GKE clusters and advanced traffic management. Sidecar proxies (Envoy) can perform health checking to a separate port on the backend service, so the backend firewall must allow those health checks from the proxy. Proxyless Traffic Director does not provide the same sidecar-based health-check behavior, and health checks do not originate from the Traffic Director control plane or the application itself.
Question 125
You have an application running in a production Google Kubernetes Engine (GKE) cluster. You use Cloud Deploy to automatically deploy your application to your production GKE cluster. As part of your development process, you are planning to make frequent changes to the application’s source code and need to select the tools to test the changes before pushing them to your remote source code repository. Your toolset must meet the following requirements:
• Test frequent local changes automatically.
• Local deployment emulates production deployment.
Which tools should you use to test building and running a container on your laptop using minimal resources?
A. Docker Compose and dockerd
B. Terraform and kubeadm
C. Minikube and Skaffold
D. kaniko and Tekton
Show Answer
Correct Answer: C
Explanation: Minikube provides a lightweight local Kubernetes cluster that closely emulates a GKE deployment while using minimal resources. Skaffold automates the inner development loop by watching source changes, rebuilding images, and deploying updates to the local Kubernetes cluster automatically, making it well suited for frequent local testing before pushing code. The other options either do not provide a local Kubernetes environment or are focused on provisioning/CI rather than local iterative development.
Question 126
You are deploying a Python application to Cloud Run using Cloud Source Repositories and Cloud Build. The Cloud Build pipeline is shown below:
You want to optimize deployment times and avoid unnecessary steps. What should you do?
A. Remove the step that pushes the container to Artifact Registry.
B. Deploy a new Docker registry in a VPC, and use Cloud Build worker pools inside the VPC to run the build pipeline.
C. Store image artifacts in a Cloud Storage bucket in the same region as the Cloud Run instance.
D. Add the --cache-from argument to the Docker build step in your build config file.
Show Answer
Correct Answer: D
Explanation: Using Docker layer caching with the --cache-from argument allows Cloud Build to reuse unchanged image layers from a previously built image, reducing build and deployment time. Pushing the image to Artifact Registry is required for Cloud Run deployments, using a custom registry or VPC worker pool adds unnecessary complexity, and Cloud Storage is not a container image registry for Cloud Run deployments.
Question 127
You are developing an event-driven application. You have created a topic to receive messages sent to Pub/Sub. You want those messages to be processed in real time. You need the application to be independent from any other system and only incur costs when new messages arrive. How should you configure the architecture?
A. Deploy the application on Compute Engine. Use a Pub/Sub push subscription to process new messages in the topic.
B. Deploy your code on Cloud Functions. Use a Pub/Sub trigger to invoke the Cloud Function. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
C. Deploy the application on Google Kubernetes Engine. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
D. Deploy your code on Cloud Functions. Use a Pub/Sub trigger to handle new messages in the topic.
Show Answer
Correct Answer: D
Explanation: Cloud Functions with a Pub/Sub trigger is the native serverless event-driven pattern. The trigger automatically manages the underlying Pub/Sub subscription, invokes the function when messages arrive, and you pay only for function execution. Option B is incorrect because it redundantly suggests creating and polling a pull subscription yourself, which is unnecessary when using a Pub/Sub-triggered Cloud Function. Compute Engine and GKE require always-on infrastructure, so they do not meet the cost requirement.
Question 128
You have an application running on Google Kubernetes Engine (GKE). The application is currently using a logging library and is outputting to standard output. You need to export the logs to Cloud Logging, and you need the logs to include metadata about each request. You want to use the simplest method to accomplish this. What should you do?
A. Change your application’s logging library to the Cloud Logging library, and configure your application to export logs to Cloud Logging.
B. Update your application to output logs in JSON format, and add the necessary metadata to the JSON.
C. Update your application to output logs in CSV format, and add the necessary metadata to the CSV.
D. Install the Fluent Bit agent on each of your GKE nodes, and have the agent export all logs from /var/log.
Show Answer
Correct Answer: B
Explanation: GKE natively collects container stdout/stderr and forwards it to Cloud Logging using the built-in logging agent. To include richer request metadata with the simplest approach, emit structured JSON logs to stdout and include the relevant metadata fields. Replacing the logging library is unnecessary, installing Fluent Bit is redundant on standard GKE, and CSV is not appropriate for structured Cloud Logging ingestion.
Question 129
You are working on a new application that is deployed on Cloud Run and uses Cloud Functions. Each time new features are added, new Cloud Functions and Cloud Run services are deployed. You use ENV variables to keep track of the services and enable interservice communication, but the maintenance of the ENV variables has become difficult. You want to implement dynamic discovery in a scalable way. What should you do?
A. Configure your microservices to use the Cloud Run Admin and Cloud Functions APIs to query for deployed Cloud Run services and Cloud Functions in the Google Cloud project.
B. Create a Service Directory namespace. Use API calls to register the services during deployment, and query during runtime.
C. Rename the Cloud Functions and Cloud Run services endpoint is using a well-documented naming convention.
D. Deploy Hashicorp Consul on a single Compute Engine instance. Register the services with Consul during deployment, and query during runtime.
Show Answer
Correct Answer: B
Explanation: Service Directory is Google Cloud's managed service registry and discovery solution. Creating a Service Directory namespace, registering Cloud Run services and Cloud Functions during deployment, and querying the registry at runtime provides scalable dynamic service discovery without maintaining environment variables. Querying Admin APIs is not intended as a runtime service discovery mechanism, a naming convention alone does not provide discovery, and running Consul on a single VM adds unnecessary operational overhead and a single point of failure.
Question 130
You work for a financial services company that has a container-first approach. Your team develops microservices applications. A Cloud Build pipeline creates the container image, runs regression tests, and publishes the image to Artifact Registry. You need to ensure that only containers that have passed the regression tests are deployed to Google Kubernetes Engine (GKE) clusters. You have already enabled Binary Authorization on the GKE clusters. What should you do next?
A. Create an attestor and a policy. After a container image has successfully passed the regression tests, use Cloud Build to run Kritis Signer to create an attestation for the container image.
B. Deploy Voucher Server and Voucher Client components. After a container image has successfully passed the regression tests, run Voucher Client as a step in the Cloud Build pipeline.
C. Set the Pod Security Standard level to Restricted for the relevant namespaces. Use Cloud Build to digitally sign the container images that have passed the regression tests.
D. Create an attestor and a policy. Create an attestation for the container images that have passed the regression tests as a step in the Cloud Build pipeline.
Show Answer
Correct Answer: D
Explanation: Binary Authorization requires an attestor and an admission policy that checks for required attestations. After the regression tests succeed in Cloud Build, create an attestation for the image as a pipeline step. Kritis Signer is one possible implementation, but it is not required because Cloud Build can create Binary Authorization attestations directly.
Sources:
https://anjudevopsjourney.hashnode.dev/gcp-exam-question-from-googles-professional-cloud-devops-engineer
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.