Professional Cloud Developer Free Practice Questions — Page 13
Question 121
Your application stores customers’ content in a Cloud Storage bucket, with each object being encrypted with the customer's encryption key. The key for each object in Cloud Storage is entered into your application by the customer. You discover that your application is receiving an HTTP 4xx error when reading the object from Cloud Storage. What is a possible cause of this error?
A. You attempted the read operation on the object with the customer's base64-encoded key.
B. You attempted the read operation without the base64-encoded SHA256 hash of the encryption key.
C. You entered the same encryption algorithm specified by the customer when attempting the read operation.
D. You attempted the read operation on the object with the base64-encoded SHA256 hash of the customer's key.
Show Answer
Correct Answer: B
Explanation: When using customer-supplied encryption keys (CSEK) with Cloud Storage, read requests must include both the base64-encoded raw encryption key and the base64-encoded SHA256 hash of that key. If the SHA256 hash is missing, invalid, or not provided, Cloud Storage cannot verify the key and returns an HTTP 4xx error (typically 400). Therefore, attempting to read the object without supplying the base64-encoded SHA256 hash of the encryption key is a valid cause of the error.
Question 122
You have two Google Cloud projects, named Project A and Project B. You need to create a Cloud Function in Project A that saves the output in a Cloud Storage bucket in Project B. You want to follow the principle of least privilege. What should you do?
A. 1. Create a Google service account in Project B. 2. Deploy the Cloud Function with the service account in Project 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
B. 1. Create a Google service account in Project A 2. Deploy the Cloud Function with the service account in Project A. 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project
C. 1. Determine the default App Engine service account ( [email protected] ) in Project A. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
D. 1. Determine the default App Engine service account ( [email protected] ) in Project B. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
Show Answer
Correct Answer: B
Explanation: The Cloud Function runs in Project A, so it must use a service account that belongs to Project A. To follow least privilege, you create a dedicated service account in Project A, deploy the function with that service account, and grant it only roles/storage.objectCreator on the specific Cloud Storage bucket in Project B. Using default service accounts (C, D) grants excessive permissions, and a Cloud Function cannot run under a service account from another project (A).
Question 123
You plan to deploy a new Go application to Cloud Run. The source code is stored in Cloud Source Repositories. You need to configure a fully managed, automated, continuous deployment pipeline that runs when a source code commit is made. You want to use the simplest deployment solution. What should you do?
A. Configure a cron job on your workstations to periodically run gcloud run deploy --source in the working directory.
B. Configure a Jenkins trigger to run the container build and deploy process for each source code commit to Cloud Source Repositories.
C. Configure continuous deployment of new revisions from a source repository for Cloud Run using buildpacks.
D. Use Cloud Build with a trigger configured to run the container build and deploy process for each source code commit to Cloud Source Repositories.
Show Answer
Correct Answer: C
Explanation: Cloud Run provides a built-in continuous deployment feature that can directly connect a source repository and automatically build and deploy new revisions using buildpacks on each commit. This is fully managed and requires minimal configuration, making it simpler than explicitly setting up Cloud Build triggers and deployment steps.
Question 124
Your team has created an application that is hosted on a Google Kubernetes Engine (GKE) cluster. You need to connect the application to a legacy REST service that is deployed in two GKE clusters in two different regions. You want to connect your application to the target service in a way that is resilient. You also want to be able to run health checks on the legacy service on a separate port. How should you set up the connection? (Choose two.)
A. Use Traffic Director with a sidecar proxy to connect the application to the service.
B. Use a proxyless Traffic Director configuration to connect the application to the service.
C. Configure the legacy service's firewall to allow health checks originating from the proxy.
D. Configure the legacy service's firewall to allow health checks originating from the application.
E. Configure the legacy service's firewall to allow health checks originating from the Traffic Director control plane.
Show Answer
Correct Answer: A, C
Explanation: Traffic Director with a sidecar proxy provides resilient, multi-region service discovery and traffic management between GKE clusters, including failover across regions. Health checks for services managed through Traffic Director and Envoy proxies originate from the data-plane proxies themselves on a configurable port, so the legacy service’s firewall must allow health checks from the proxy, not from the application or the control plane.
Question 125
You have an application running in a production Google Kubernetes Engine (GKE) cluster. You use Cloud Deploy to automatically deploy your application to your production GKE cluster. As part of your development process, you are planning to make frequent changes to the application’s source code and need to select the tools to test the changes before pushing them to your remote source code repository. Your toolset must meet the following requirements:
• Test frequent local changes automatically.
• Local deployment emulates production deployment.
Which tools should you use to test building and running a container on your laptop using minimal resources?
A. Docker Compose and dockerd
B. Terraform and kubeadm
C. Minikube and Skaffold
D. kaniko and Tekton
Show Answer
Correct Answer: C
Explanation: The requirements are to automatically test frequent local changes and to emulate a production Kubernetes deployment using minimal local resources. Minikube provides a lightweight, local Kubernetes cluster that closely mirrors a GKE environment, enabling realistic deployment testing. Skaffold automates the inner development loop by continuously building container images and deploying them to the local cluster on code changes. Together, they enable fast local iteration with a production-like Kubernetes deployment model.
Question 126
You are deploying a Python application to Cloud Run using Cloud Source Repositories and Cloud Build. The Cloud Build pipeline is shown below:
You want to optimize deployment times and avoid unnecessary steps. What should you do?
A. Remove the step that pushes the container to Artifact Registry.
B. Deploy a new Docker registry in a VPC, and use Cloud Build worker pools inside the VPC to run the build pipeline.
C. Store image artifacts in a Cloud Storage bucket in the same region as the Cloud Run instance.
D. Add the --cache-from argument to the Docker build step in your build config file.
Show Answer
Correct Answer: D
Explanation: Adding the --cache-from argument allows Cloud Build to reuse previously built Docker image layers instead of rebuilding them every time. This significantly reduces build and deployment time by avoiding unnecessary work, directly optimizing the pipeline. The other options either add complexity or do not address build-time optimization.
Question 127
You are developing an event-driven application. You have created a topic to receive messages sent to Pub/Sub. You want those messages to be processed in real time. You need the application to be independent from any other system and only incur costs when new messages arrive. How should you configure the architecture?
A. Deploy the application on Compute Engine. Use a Pub/Sub push subscription to process new messages in the topic.
B. Deploy your code on Cloud Functions. Use a Pub/Sub trigger to invoke the Cloud Function. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
C. Deploy the application on Google Kubernetes Engine. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
D. Deploy your code on Cloud Functions. Use a Pub/Sub trigger to handle new messages in the topic.
Show Answer
Correct Answer: D
Explanation: The requirements are real-time processing, event-driven, independence from other systems, and costs only when messages arrive. Cloud Functions with a Pub/Sub trigger is a fully managed serverless pattern: Pub/Sub automatically creates and manages the subscription and invokes the function as messages arrive. There is no need to run servers or poll, and billing occurs only on function invocations. Options A and C require always-on infrastructure, and B is incorrect because a Cloud Function triggered by Pub/Sub does not need (and should not use) a manual pull subscription.
Question 128
You have an application running on Google Kubernetes Engine (GKE). The application is currently using a logging library and is outputting to standard output. You need to export the logs to Cloud Logging, and you need the logs to include metadata about each request. You want to use the simplest method to accomplish this. What should you do?
A. Change your application’s logging library to the Cloud Logging library, and configure your application to export logs to Cloud Logging.
B. Update your application to output logs in JSON format, and add the necessary metadata to the JSON.
C. Update your application to output logs in CSV format, and add the necessary metadata to the CSV.
D. Install the Fluent Bit agent on each of your GKE nodes, and have the agent export all logs from /var/log.
Show Answer
Correct Answer: B
Explanation: GKE is integrated with Cloud Logging by default and automatically collects logs written to standard output. The simplest way to include request metadata is to emit structured logs in JSON format to stdout and include the metadata fields. Cloud Logging will automatically parse the JSON and enrich it with Kubernetes metadata. Changing to the Cloud Logging client library is unnecessary extra work, and installing agents is not required.
Question 129
You are working on a new application that is deployed on Cloud Run and uses Cloud Functions. Each time new features are added, new Cloud Functions and Cloud Run services are deployed. You use ENV variables to keep track of the services and enable interservice communication, but the maintenance of the ENV variables has become difficult. You want to implement dynamic discovery in a scalable way. What should you do?
A. Configure your microservices to use the Cloud Run Admin and Cloud Functions APIs to query for deployed Cloud Run services and Cloud Functions in the Google Cloud project.
B. Create a Service Directory namespace. Use API calls to register the services during deployment, and query during runtime.
C. Rename the Cloud Functions and Cloud Run services endpoint is using a well-documented naming convention.
D. Deploy Hashicorp Consul on a single Compute Engine instance. Register the services with Consul during deployment, and query during runtime.
Show Answer
Correct Answer: B
Explanation: Google Cloud Service Directory is designed for scalable service discovery. Creating a namespace and registering Cloud Run services and Cloud Functions during deployment allows services to dynamically discover each other at runtime without maintaining environment variables. It is a managed, cloud-native solution, unlike querying admin APIs, relying on naming conventions, or running your own Consul instance.
Question 130
You work for a financial services company that has a container-first approach. Your team develops microservices applications. A Cloud Build pipeline creates the container image, runs regression tests, and publishes the image to Artifact Registry. You need to ensure that only containers that have passed the regression tests are deployed to Google Kubernetes Engine (GKE) clusters. You have already enabled Binary Authorization on the GKE clusters. What should you do next?
A. Create an attestor and a policy. After a container image has successfully passed the regression tests, use Cloud Build to run Kritis Signer to create an attestation for the container image.
B. Deploy Voucher Server and Voucher Client components. After a container image has successfully passed the regression tests, run Voucher Client as a step in the Cloud Build pipeline.
C. Set the Pod Security Standard level to Restricted for the relevant namespaces. Use Cloud Build to digitally sign the container images that have passed the regression tests.
D. Create an attestor and a policy. Create an attestation for the container images that have passed the regression tests as a step in the Cloud Build pipeline.
Show Answer
Correct Answer: A
Explanation: With Binary Authorization already enabled, the next required step is to define who can attest images and what attestations are required. You do this by creating a Binary Authorization policy and an attestor. After the regression tests pass in Cloud Build, the pipeline must create an attestation for the specific container image. Using Kritis Signer from Cloud Build is a standard and supported way to generate that attestation so that GKE admits only images that have passed the tests.
$19
Get all 357 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.