Professional Cloud Developer Free Practice Questions — Page 15
Question 141
You are designing an application that uses a microservices architecture. You are planning to deploy the application in the cloud and on-premises. You want to make sure the application can scale up on demand and also use managed services as much as possible. What should you do?
A. Deploy open source Istio in a multi-cluster deployment on multiple Google Kubernetes Engine (GKE) clusters managed by Anthos.
B. Create a GKE cluster in each environment with Anthos, and use Cloud Run for Anthos to deploy your application to each cluster.
C. Install a GKE cluster in each environment with Anthos, and use Cloud Build to create a Deployment for your application in each cluster.
D. Create a GKE cluster in the cloud and install open-source Kubernetes on-premises. Use an external load balancer service to distribute traffic across the two environments.
Show Answer
Correct Answer: B
Explanation: The requirements are hybrid (cloud and on‑premises) deployment, on‑demand scaling, and maximum use of managed services. Anthos provides consistent Kubernetes management across cloud and on‑premises environments. Using Cloud Run for Anthos enables a fully managed, serverless deployment model on top of those clusters with automatic scaling and reduced operational overhead. This best satisfies scalability and managed‑services goals compared to manually managing deployments, service meshes, or mixed Kubernetes platforms.
Question 142
Your team develops services that run on Google Cloud. You want to process messages sent to a Pub/Sub topic, and then store them. Each message must be processed exactly once to avoid duplication of data and any data conflicts. You need to use the cheapest and most simple solution. What should you do?
A. Process the messages with a Dataproc job, and write the output to storage.
B. Process the messages with a Dataflow streaming pipeline using Apache Beam's PubSubIO package, and write the output to storage.
C. Process the messages with a Cloud Function, and write the results to a BigQuery location where you can run a job to deduplicate the data.
D. Retrieve the messages with a Dataflow streaming pipeline, store them in Cloud Bigtable, and use another Dataflow streaming pipeline to deduplicate messages.
Show Answer
Correct Answer: B
Explanation: Google Cloud Pub/Sub provides at-least-once delivery, so duplicates are possible. A Dataflow streaming pipeline using Apache Beam's PubSubIO supports automatic message deduplication based on Pub/Sub message_id, achieving effective exactly-once processing semantics. Dataflow is a managed service, simpler to operate than Dataproc, and avoids extra storage or secondary pipelines, making it both the cheapest and simplest solution that satisfies the exactly-once requirement.
Question 143
You have an on-premises application that authenticates to the Cloud Storage API using a user-managed service account with a user-managed key. The application connects to Cloud Storage using Private Google Access over a Dedicated Interconnect link. You discover that requests from the application to access objects in the Cloud Storage bucket are failing with a 403 Permission Denied error code. What is the likely cause of this issue?
A. The folder structure inside the bucket and object paths have changed.
B. The permissions of the service account’s predefined role have changed.
C. The service account key has been rotated but not updated on the application server.
D. The Interconnect link from the on-premises data center to Google Cloud is experiencing a temporary outage.
Show Answer
Correct Answer: B
Explanation: A 403 Permission Denied error indicates that the request was authenticated but the identity lacks sufficient authorization. With a service account and key, an invalid or rotated key would typically result in a 401 Unauthenticated error, not 403. Therefore, the most likely cause is that the service account’s IAM permissions (predefined role or bindings) no longer grant the required access to the Cloud Storage bucket.
Question 144
You are using the Cloud Client Library to upload an image in your application to Cloud Storage. Users of the application report that occasionally the upload does not complete and the client library reports an HTTP 504 Gateway Timeout error. You want to make the application more resilient to errors. What changes to the application should you make?
A. Write an exponential backoff process around the client library call.
B. Write a one-second wait time backoff process around the client library call.
C. Design a retry button in the application and ask users to click if the error occurs.
D. Create a queue for the object and inform the users that the application will try again in 10 minutes.
Show Answer
Correct Answer: A
Explanation: HTTP 504 errors are transient and commonly occur due to temporary network or service delays. Cloud client libraries and Google Cloud best practices recommend handling such transient failures with automatic retries using an exponential backoff strategy. This improves resilience while avoiding overwhelming the service. Fixed short waits, user-driven retries, or long delayed retries are inferior and do not align with recommended retry strategies.
Question 145
You made a typo in a low-level Linux configuration file that prevents your Compute Engine instance from booting to a normal run level. You just created the Compute Engine instance today and have done no other maintenance on it, other than tweaking files. How should you correct this error?
A. Download the file using scp, change the file, and then upload the modified version
B. Configure and log in to the Compute Engine instance through SSH, and change the file
C. Configure and log in to the Compute Engine instance through the serial port, and change the file
D. Configure and log in to the Compute Engine instance using a remote desktop client, and change the file
Show Answer
Correct Answer: C
Explanation: The instance cannot boot to a normal run level, so services like SSH or remote desktop are unavailable. SCP also depends on SSH. Google Compute Engine provides a serial console specifically for troubleshooting boot failures and low-level configuration errors, allowing login and file repair even when the OS does not fully boot.
Question 146
Your company’s corporate policy states that there must be a copyright comment at the very beginning of all source files. You want to write a custom step in Cloud Build that is triggered by each source commit. You need the trigger to validate that the source contains a copyright and add one for subsequent steps if not there. What should you do?
A. Build a new Docker container that examines the files in /workspace and then checks and adds a copyright for each source file. Changed files are explicitly committed back to the source repository.
B. Build a new Docker container that examines the files in /workspace and then checks and adds a copyright for each source file. Changed files do not need to be committed back to the source repository.
C. Build a new Docker container that examines the files in a Cloud Storage bucket and then checks and adds a copyright for each source file. Changed files are written back to the Cloud Storage bucket.
D. Build a new Docker container that examines the files in a Cloud Storage bucket and then checks and adds a copyright for each source file. Changed files are explicitly committed back to the source repository.
Show Answer
Correct Answer: B
Explanation: Cloud Build checks out the source into the /workspace directory, which is shared across all build steps. A custom container can scan and modify files there, and those changes will be visible to subsequent steps in the same build without committing anything back to the repository. The requirement is to validate and add the copyright for subsequent steps, not to push changes to source control, making committing unnecessary and often undesirable.
Question 147
One of your deployed applications in Google Kubernetes Engine (GKE) is having intermittent performance issues. Your team uses a third-party logging solution. You want to install this solution on each node in your GKE cluster so you can view the logs. What should you do?
A. Deploy the third-party solution as a DaemonSet
B. Modify your container image to include the monitoring software
C. Use SSH to connect to the GKE node, and install the software manually
D. Deploy the third-party solution using Terraform and deploy the logging Pod as a Kubernetes Deployment
Show Answer
Correct Answer: A
Explanation: A DaemonSet ensures that a copy of the logging agent runs on every node (or a selected subset of nodes) in the GKE cluster, which is the correct pattern for node-level logging and monitoring. This avoids modifying application images, manual node changes, or inappropriate use of Deployments for per-node agents.
Question 148
You are in the final stage of migrating an on-premises data center to Google Cloud. You are quickly approaching your deadline, and discover that a web API is running on a server slated for decommissioning. You need to recommend a solution to modernize this API while migrating to Google Cloud. The modernized web API must meet the following requirements:
• Autoscales during high traffic periods at the end of each month
• Written in Python 3.x
• Developers must be able to rapidly deploy new versions in response to frequent code changes
You want to minimize cost, effort, and operational overhead of this migration. What should you do?
A. Modernize and deploy the code on App Engine flexible environment.
B. Modernize and deploy the code on App Engine standard environment.
C. Deploy the modernized application to an n1-standard-1 Compute Engine instance.
D. Ask the development team to re-write the application to run as a Docker container on Google Kubernetes Engine.
Show Answer
Correct Answer: B
Explanation: App Engine standard environment best meets the requirements with minimal cost and operational overhead. It natively supports Python 3.x, provides automatic scaling that can scale down to zero during low traffic, and enables very fast deployments for frequent code changes. App Engine flexible has higher cost and cannot scale to zero, Compute Engine lacks built-in autoscaling and increases ops burden, and GKE requires containerization and cluster management, which increases effort and cost.
Question 149
You are developing an application that consists of several microservices running in a Google Kubernetes Engine cluster. One microservice needs to connect to a third-party database running on-premises. You need to store credentials to the database and ensure that these credentials can be rotated while following security best practices. What should you do?
A. Store the credentials in a sidecar container proxy, and use it to connect to the third-party database.
B. Configure a service mesh to allow or restrict traffic from the Pods in your microservice to the database.
C. Store the credentials in an encrypted volume mount, and associate a Persistent Volume Claim with the client Pod.
D. Store the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.
Show Answer
Correct Answer: D
Explanation: Kubernetes Secrets are the standard way to store sensitive data like database credentials for Pods. Integrating GKE with Cloud Key Management Service (KMS) encrypts secrets at rest using customer‑managed keys, supports secure access, auditing, and enables credential rotation without redeploying applications. The other options do not directly address secure secret storage and rotation best practices.
Question 150
You manage your company's ecommerce platform's payment system, which runs on Google Cloud. Your company must retain user logs for 1 year for internal auditing purposes and for 3 years to meet compliance requirements. You need to store new user logs on Google Cloud to minimize on-premises storage usage and ensure that they are easily searchable. You want to minimize effort while ensuring that the logs are stored correctly. What should you do?
A. Store the logs in a Cloud Storage bucket with bucket lock turned on.
B. Store the logs in a Cloud Storage bucket with a 3-year retention period.
C. Store the logs in Cloud Logging as custom logs with a custom retention period.
D. Store the logs in a Cloud Storage bucket with a 1-year retention period. After 1 year, move the logs to another bucket with a 2-year retention period.
Show Answer
Correct Answer: C
Explanation: The logs must be easily searchable and retained to meet compliance with minimal operational effort. Cloud Logging is designed for log ingestion, indexing, and search, and it supports custom retention periods up to several years. Using Cloud Storage buckets (with or without retention or bucket lock) would store logs as objects that are not easily searchable without additional tooling and more operational overhead. Therefore, storing logs in Cloud Logging with a custom retention period best satisfies all requirements.
$19
Get all 357 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.