Professional Cloud Developer Free Practice Questions — Page 14
Question 119
Your team manages a large Google Kubernetes Engine (GKE) cluster. Several application teams currently use the same namespace to develop microservices for the cluster. Your organization plans to onboard additional teams to create microservices. You need to configure multiple environments while ensuring the security and optimal performance of each team’s work. You want to minimize cost and follow Google-recommended best practices. What should you do?
A. Create new role-based access controls (RBAC) for each team in the existing cluster, and define resource quotas.
B. Create a new namespace for each environment in the existing cluster, and define resource quotas.
C. Create a new GKE cluster for each team.
D. Create a new namespace for each team in the existing cluster, and define resource quotas.
Show Answer
Correct Answer: D
Explanation: Using a separate namespace for each team within the existing GKE cluster provides logical isolation, supports per-team RBAC and policies, and allows resource quotas to prevent contention. This aligns with Google-recommended multi-tenant cluster practices while minimizing cost compared to separate clusters. Creating namespaces per environment alone does not isolate teams, and RBAC alone without namespaces is insufficient for multi-team isolation.
Question 120
You have deployed a Java application to Cloud Run. Your application requires access to a database hosted on Cloud SQL. Due to regulatory requirements, your connection to the Cloud SQL instance must use its internal IP address. How should you configure the connectivity while following Google-recommended best practices?
A. Configure your Cloud Run service with a Cloud SQL connection.
B. Configure your Cloud Run service to use a Serverless VPC Access connector.
C. Configure your application to use the Cloud SQL Java connector.
D. Configure your application to connect to an instance of the Cloud SQL Auth proxy.
Show Answer
Correct Answer: B
Explanation: To reach a Cloud SQL instance over its private (internal) IP from Cloud Run, the service needs network connectivity into the VPC. The recommended approach is to attach a Serverless VPC Access connector (or Direct VPC egress in newer architectures, but that is not an option here). The Cloud SQL Java connector handles authentication and secure connections but does not itself provide the network path to a private IP. The Cloud SQL Auth Proxy likewise does not create VPC connectivity. Configuring a Cloud SQL connection alone does not satisfy the requirement to use the instance's internal IP.
Question 121
Your application stores customers’ content in a Cloud Storage bucket, with each object being encrypted with the customer's encryption key. The key for each object in Cloud Storage is entered into your application by the customer. You discover that your application is receiving an HTTP 4xx error when reading the object from Cloud Storage. What is a possible cause of this error?
A. You attempted the read operation on the object with the customer's base64-encoded key.
B. You attempted the read operation without the base64-encoded SHA256 hash of the encryption key.
C. You entered the same encryption algorithm specified by the customer when attempting the read operation.
D. You attempted the read operation on the object with the base64-encoded SHA256 hash of the customer's key.
Show Answer
Correct Answer: B
Explanation: When reading an object encrypted with a customer-supplied encryption key (CSEK), Cloud Storage expects the request to include the encryption key, the encryption algorithm (AES256), and the base64-encoded SHA256 hash of the key. Omitting the required SHA256 hash can result in an HTTP 4xx (such as 400 Bad Request). Using the base64-encoded key itself is correct; using only the hash is not sufficient, and the algorithm itself is not the cause if it is correct.
Question 122
You have two Google Cloud projects, named Project A and Project B. You need to create a Cloud Function in Project A that saves the output in a Cloud Storage bucket in Project B. You want to follow the principle of least privilege. What should you do?
A. 1. Create a Google service account in Project B. 2. Deploy the Cloud Function with the service account in Project 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
B. 1. Create a Google service account in Project A 2. Deploy the Cloud Function with the service account in Project A. 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project
C. 1. Determine the default App Engine service account ( [email protected] ) in Project A. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
D. 1. Determine the default App Engine service account ( [email protected] ) in Project B. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
Show Answer
Correct Answer: B
Explanation: A Cloud Function runs in Project A and should use a service account from the same project as its runtime identity. Grant that dedicated service account only the minimum required permission on the target bucket in Project B: roles/storage.objectCreator. Using a dedicated service account follows least privilege better than using the default App Engine service account.
Question 123
You plan to deploy a new Go application to Cloud Run. The source code is stored in Cloud Source Repositories. You need to configure a fully managed, automated, continuous deployment pipeline that runs when a source code commit is made. You want to use the simplest deployment solution. What should you do?
A. Configure a cron job on your workstations to periodically run gcloud run deploy --source in the working directory.
B. Configure a Jenkins trigger to run the container build and deploy process for each source code commit to Cloud Source Repositories.
C. Configure continuous deployment of new revisions from a source repository for Cloud Run using buildpacks.
D. Use Cloud Build with a trigger configured to run the container build and deploy process for each source code commit to Cloud Source Repositories.
Show Answer
Correct Answer: D
Explanation: A fully managed automated CI/CD pipeline triggered by commits in Cloud Source Repositories is most directly implemented with Cloud Build triggers that build and deploy to Cloud Run. Jenkins and cron are not the simplest managed solutions. The Cloud Run source deployment/buildpacks feature builds from source, but automated continuous deployment from Cloud Source Repositories is typically implemented via Cloud Build triggers.
Question 124
Your team has created an application that is hosted on a Google Kubernetes Engine (GKE) cluster. You need to connect the application to a legacy REST service that is deployed in two GKE clusters in two different regions. You want to connect your application to the target service in a way that is resilient. You also want to be able to run health checks on the legacy service on a separate port. How should you set up the connection? (Choose two.)
A. Use Traffic Director with a sidecar proxy to connect the application to the service.
B. Use a proxyless Traffic Director configuration to connect the application to the service.
C. Configure the legacy service's firewall to allow health checks originating from the proxy.
D. Configure the legacy service's firewall to allow health checks originating from the application.
E. Configure the legacy service's firewall to allow health checks originating from the Traffic Director control plane.
Show Answer
Correct Answer: A, C
Explanation: Traffic Director with sidecar proxies supports resilient service-to-service routing across multiple GKE clusters and advanced traffic management. Sidecar proxies (Envoy) can perform health checking to a separate port on the backend service, so the backend firewall must allow those health checks from the proxy. Proxyless Traffic Director does not provide the same sidecar-based health-check behavior, and health checks do not originate from the Traffic Director control plane or the application itself.
Question 125
You have an application running in a production Google Kubernetes Engine (GKE) cluster. You use Cloud Deploy to automatically deploy your application to your production GKE cluster. As part of your development process, you are planning to make frequent changes to the application’s source code and need to select the tools to test the changes before pushing them to your remote source code repository. Your toolset must meet the following requirements:
• Test frequent local changes automatically.
• Local deployment emulates production deployment.
Which tools should you use to test building and running a container on your laptop using minimal resources?
A. Docker Compose and dockerd
B. Terraform and kubeadm
C. Minikube and Skaffold
D. kaniko and Tekton
Show Answer
Correct Answer: C
Explanation: Minikube provides a lightweight local Kubernetes cluster that closely emulates a GKE deployment while using minimal resources. Skaffold automates the inner development loop by watching source changes, rebuilding images, and deploying updates to the local Kubernetes cluster automatically, making it well suited for frequent local testing before pushing code. The other options either do not provide a local Kubernetes environment or are focused on provisioning/CI rather than local iterative development.
Question 127
You are developing an event-driven application. You have created a topic to receive messages sent to Pub/Sub. You want those messages to be processed in real time. You need the application to be independent from any other system and only incur costs when new messages arrive. How should you configure the architecture?
A. Deploy the application on Compute Engine. Use a Pub/Sub push subscription to process new messages in the topic.
B. Deploy your code on Cloud Functions. Use a Pub/Sub trigger to invoke the Cloud Function. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
C. Deploy the application on Google Kubernetes Engine. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
D. Deploy your code on Cloud Functions. Use a Pub/Sub trigger to handle new messages in the topic.
Show Answer
Correct Answer: D
Explanation: Cloud Functions with a Pub/Sub trigger is the native serverless event-driven pattern. The trigger automatically manages the underlying Pub/Sub subscription, invokes the function when messages arrive, and you pay only for function execution. Option B is incorrect because it redundantly suggests creating and polling a pull subscription yourself, which is unnecessary when using a Pub/Sub-triggered Cloud Function. Compute Engine and GKE require always-on infrastructure, so they do not meet the cost requirement.
Question 128
You have an application running on Google Kubernetes Engine (GKE). The application is currently using a logging library and is outputting to standard output. You need to export the logs to Cloud Logging, and you need the logs to include metadata about each request. You want to use the simplest method to accomplish this. What should you do?
A. Change your application’s logging library to the Cloud Logging library, and configure your application to export logs to Cloud Logging.
B. Update your application to output logs in JSON format, and add the necessary metadata to the JSON.
C. Update your application to output logs in CSV format, and add the necessary metadata to the CSV.
D. Install the Fluent Bit agent on each of your GKE nodes, and have the agent export all logs from /var/log.
Show Answer
Correct Answer: B
Explanation: GKE natively collects container stdout/stderr and forwards it to Cloud Logging using the built-in logging agent. To include richer request metadata with the simplest approach, emit structured JSON logs to stdout and include the relevant metadata fields. Replacing the logging library is unnecessary, installing Fluent Bit is redundant on standard GKE, and CSV is not appropriate for structured Cloud Logging ingestion.
Question 129
You are working on a new application that is deployed on Cloud Run and uses Cloud Functions. Each time new features are added, new Cloud Functions and Cloud Run services are deployed. You use ENV variables to keep track of the services and enable interservice communication, but the maintenance of the ENV variables has become difficult. You want to implement dynamic discovery in a scalable way. What should you do?
A. Configure your microservices to use the Cloud Run Admin and Cloud Functions APIs to query for deployed Cloud Run services and Cloud Functions in the Google Cloud project.
B. Create a Service Directory namespace. Use API calls to register the services during deployment, and query during runtime.
C. Rename the Cloud Functions and Cloud Run services endpoint is using a well-documented naming convention.
D. Deploy Hashicorp Consul on a single Compute Engine instance. Register the services with Consul during deployment, and query during runtime.
Show Answer
Correct Answer: B
Explanation: Service Directory is Google Cloud's managed service registry and discovery solution. Creating a Service Directory namespace, registering Cloud Run services and Cloud Functions during deployment, and querying the registry at runtime provides scalable dynamic service discovery without maintaining environment variables. Querying Admin APIs is not intended as a runtime service discovery mechanism, a naming convention alone does not provide discovery, and running Consul on a single VM adds unnecessary operational overhead and a single point of failure.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.