Professional Cloud Developer Free Practice Questions — Page 15
Question 141
You are designing an application that uses a microservices architecture. You are planning to deploy the application in the cloud and on-premises. You want to make sure the application can scale up on demand and also use managed services as much as possible. What should you do?
A. Deploy open source Istio in a multi-cluster deployment on multiple Google Kubernetes Engine (GKE) clusters managed by Anthos.
B. Create a GKE cluster in each environment with Anthos, and use Cloud Run for Anthos to deploy your application to each cluster.
C. Install a GKE cluster in each environment with Anthos, and use Cloud Build to create a Deployment for your application in each cluster.
D. Create a GKE cluster in the cloud and install open-source Kubernetes on-premises. Use an external load balancer service to distribute traffic across the two environments.
Show Answer
Correct Answer: B
Explanation: Cloud Run for Anthos provides a managed serverless platform on Anthos-managed GKE clusters across both Google Cloud and on-premises environments. This supports microservices, autoscaling on demand, and maximizes the use of managed services while maintaining a consistent deployment model. The other options either focus primarily on service mesh (Istio), use lower-level Kubernetes deployments instead of managed serverless execution, or do not provide consistent hybrid management.
Question 142
Your team develops services that run on Google Cloud. You want to process messages sent to a Pub/Sub topic, and then store them. Each message must be processed exactly once to avoid duplication of data and any data conflicts. You need to use the cheapest and most simple solution. What should you do?
A. Process the messages with a Dataproc job, and write the output to storage.
B. Process the messages with a Dataflow streaming pipeline using Apache Beam's PubSubIO package, and write the output to storage.
C. Process the messages with a Cloud Function, and write the results to a BigQuery location where you can run a job to deduplicate the data.
D. Retrieve the messages with a Dataflow streaming pipeline, store them in Cloud Bigtable, and use another Dataflow streaming pipeline to deduplicate messages.
Show Answer
Correct Answer: B
Explanation: Dataflow streaming with Apache Beam's PubSubIO provides built-in deduplication based on Pub/Sub message IDs and is the simplest managed solution for processing streaming Pub/Sub messages with exactly-once semantics in the pipeline before writing to storage. The other options either do not provide exactly-once processing, require manual deduplication, or are more complex and costly.
Question 143
You have an on-premises application that authenticates to the Cloud Storage API using a user-managed service account with a user-managed key. The application connects to Cloud Storage using Private Google Access over a Dedicated Interconnect link. You discover that requests from the application to access objects in the Cloud Storage bucket are failing with a 403 Permission Denied error code. What is the likely cause of this issue?
A. The folder structure inside the bucket and object paths have changed.
B. The permissions of the service account’s predefined role have changed.
C. The service account key has been rotated but not updated on the application server.
D. The Interconnect link from the on-premises data center to Google Cloud is experiencing a temporary outage.
Show Answer
Correct Answer: B
Explanation: A 403 Permission Denied from Cloud Storage indicates the request was authenticated but the caller lacks authorization to perform the operation. A rotated or invalid service account key would typically cause authentication failures rather than an authorization failure. Network outages would not manifest as 403, and changed object paths would more likely produce 404 if the object is missing.
Sources:
https://docs.cloud.google.com/storage/docs/authentication
Question 144
You are using the Cloud Client Library to upload an image in your application to Cloud Storage. Users of the application report that occasionally the upload does not complete and the client library reports an HTTP 504 Gateway Timeout error. You want to make the application more resilient to errors. What changes to the application should you make?
A. Write an exponential backoff process around the client library call.
B. Write a one-second wait time backoff process around the client library call.
C. Design a retry button in the application and ask users to click if the error occurs.
D. Create a queue for the object and inform the users that the application will try again in 10 minutes.
Show Answer
Correct Answer: A
Explanation: HTTP 504 Gateway Timeout is typically a transient error. The recommended pattern for Cloud Storage client operations is to retry transient failures using exponential backoff, which reduces load during outages and improves resilience. A fixed one-second delay is less effective, requiring users to retry manually is poor resilience, and delaying retries by 10 minutes via a queue is unnecessary for transient upload failures.
Question 145
You made a typo in a low-level Linux configuration file that prevents your Compute Engine instance from booting to a normal run level. You just created the Compute Engine instance today and have done no other maintenance on it, other than tweaking files. How should you correct this error?
A. Download the file using scp, change the file, and then upload the modified version
B. Configure and log in to the Compute Engine instance through SSH, and change the file
C. Configure and log in to the Compute Engine instance through the serial port, and change the file
D. Configure and log in to the Compute Engine instance using a remote desktop client, and change the file
Show Answer
Correct Answer: C
Explanation: A boot failure caused by a low-level Linux configuration error can prevent the system from reaching the normal run level and starting services such as SSH. SCP also depends on SSH, and RDP is not applicable for a typical Linux Compute Engine instance. The serial console is specifically intended for troubleshooting boot problems and allows you to access the system to fix the configuration file.
Question 146
Your company’s corporate policy states that there must be a copyright comment at the very beginning of all source files. You want to write a custom step in Cloud Build that is triggered by each source commit. You need the trigger to validate that the source contains a copyright and add one for subsequent steps if not there. What should you do?
A. Build a new Docker container that examines the files in /workspace and then checks and adds a copyright for each source file. Changed files are explicitly committed back to the source repository.
B. Build a new Docker container that examines the files in /workspace and then checks and adds a copyright for each source file. Changed files do not need to be committed back to the source repository.
C. Build a new Docker container that examines the files in a Cloud Storage bucket and then checks and adds a copyright for each source file. Changed files are written back to the Cloud Storage bucket.
D. Build a new Docker container that examines the files in a Cloud Storage bucket and then checks and adds a copyright for each source file. Changed files are explicitly committed back to the source repository.
Show Answer
Correct Answer: A
Explanation: Cloud Build checks out source into the /workspace directory, which is shared across build steps. A custom builder should inspect and modify files there so subsequent build steps see the updated content. If the intent is to enforce the policy on future commits as well, changes must be committed back to the source repository; otherwise the modifications exist only for the current build.
Question 147
One of your deployed applications in Google Kubernetes Engine (GKE) is having intermittent performance issues. Your team uses a third-party logging solution. You want to install this solution on each node in your GKE cluster so you can view the logs. What should you do?
A. Deploy the third-party solution as a DaemonSet
B. Modify your container image to include the monitoring software
C. Use SSH to connect to the GKE node, and install the software manually
D. Deploy the third-party solution using Terraform and deploy the logging Pod as a Kubernetes Deployment
Show Answer
Correct Answer: A
Explanation: A DaemonSet ensures that a copy of a Pod runs on every node (or a selected subset of nodes) in the cluster, which is the standard Kubernetes pattern for node-level agents such as logging, monitoring, and metrics collectors. Modifying application images couples logging with the app, manually installing software on GKE nodes is not durable or manageable, and a Deployment does not guarantee one Pod per node.
Question 148
You are in the final stage of migrating an on-premises data center to Google Cloud. You are quickly approaching your deadline, and discover that a web API is running on a server slated for decommissioning. You need to recommend a solution to modernize this API while migrating to Google Cloud. The modernized web API must meet the following requirements:
• Autoscales during high traffic periods at the end of each month
• Written in Python 3.x
• Developers must be able to rapidly deploy new versions in response to frequent code changes
You want to minimize cost, effort, and operational overhead of this migration. What should you do?
A. Modernize and deploy the code on App Engine flexible environment.
B. Modernize and deploy the code on App Engine standard environment.
C. Deploy the modernized application to an n1-standard-1 Compute Engine instance.
D. Ask the development team to re-write the application to run as a Docker container on Google Kubernetes Engine.
Show Answer
Correct Answer: B
Explanation: App Engine standard environment best fits the requirements: it supports Python 3.x, provides automatic scaling (including scaling to zero for many workloads), enables rapid deployments, and minimizes operational overhead and cost compared with managing VMs, GKE, or App Engine flexible. Compute Engine does not inherently provide the required autoscaling for a single instance, and GKE adds unnecessary operational complexity for this migration.
Question 149
You are developing an application that consists of several microservices running in a Google Kubernetes Engine cluster. One microservice needs to connect to a third-party database running on-premises. You need to store credentials to the database and ensure that these credentials can be rotated while following security best practices. What should you do?
A. Store the credentials in a sidecar container proxy, and use it to connect to the third-party database.
B. Configure a service mesh to allow or restrict traffic from the Pods in your microservice to the database.
C. Store the credentials in an encrypted volume mount, and associate a Persistent Volume Claim with the client Pod.
D. Store the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.
Show Answer
Correct Answer: D
Explanation: Kubernetes Secrets are the standard mechanism for storing sensitive data such as database credentials in GKE. Using Google Cloud KMS (via GKE's KMS integration) encrypts Secrets at rest with customer-managed keys and supports secure key rotation practices. The application can consume the Secret while credential rotation is managed by updating the Secret. The other options do not provide appropriate secret management: a sidecar proxy is not a secret store, a service mesh controls network traffic rather than credential storage, and storing credentials on a persistent volume is not a recommended secret management practice.
Question 150
You manage your company's ecommerce platform's payment system, which runs on Google Cloud. Your company must retain user logs for 1 year for internal auditing purposes and for 3 years to meet compliance requirements. You need to store new user logs on Google Cloud to minimize on-premises storage usage and ensure that they are easily searchable. You want to minimize effort while ensuring that the logs are stored correctly. What should you do?
A. Store the logs in a Cloud Storage bucket with bucket lock turned on.
B. Store the logs in a Cloud Storage bucket with a 3-year retention period.
C. Store the logs in Cloud Logging as custom logs with a custom retention period.
D. Store the logs in a Cloud Storage bucket with a 1-year retention period. After 1 year, move the logs to another bucket with a 2-year retention period.
Show Answer
Correct Answer: C
Explanation: Cloud Logging supports custom logs with configurable retention periods (up to years) and provides built-in indexing and search capabilities. This satisfies the requirement to minimize on-premises storage, keep logs easily searchable, and retain them for the required 3 years with minimal operational effort. Cloud Storage retention policies and Bucket Lock address immutability/retention but do not provide the same searchable logging experience.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.