Professional Cloud Developer Free Practice Questions — Page 16
Question 151
Your company has a new security initiative that requires all data stored in Google Cloud to be encrypted by customer-managed encryption keys. You plan to use Cloud Key Management Service (KMS) to configure access to the keys. You need to follow the "separation of duties" principle and Google-recommended best practices. What should you do? (Choose two.)
A. Provision Cloud KMS in its own project.
B. Do not assign an owner to the Cloud KMS project.
C. Provision Cloud KMS in the project where the keys are being used.
D. Grant the roles/cloudkms.admin role to the owner of the project where the keys from Cloud KMS are being used.
E. Grant an owner role for the Cloud KMS project to a different user than the owner of the project where the keys from Cloud KMS are being used.
Show Answer
Correct Answer: A, B
Explanation: Google-recommended best practices for Cloud KMS separation of duties state that keys should be hosted in a dedicated project, separate from the projects that use the keys. Additionally, to enforce strict separation of duties, the KMS project should not have project owners; instead, access should be granted using granular IAM roles (for example, cryptoKey encrypter/decrypter vs. key admin). This minimizes the risk that a single principal can both manage keys and use the encrypted data.
Question 152
You need to migrate a standalone Java application running in an on-premises Linux virtual machine (VM) to Google Cloud in a cost-effective manner. You decide not to take the lift-and-shift approach, and instead you plan to modernize the application by converting it to a container. How should you accomplish this task?
A. Use Migrate for Anthos to migrate the VM to your Google Kubernetes Engine (GKE) cluster as a container.
B. Export the VM as a raw disk and import it as an image. Create a Compute Engine instance from the Imported image.
C. Use Migrate for Compute Engine to migrate the VM to a Compute Engine instance, and use Cloud Build to convert it to a container.
D. Use Jib to build a Docker image from your source code, and upload it to Artifact Registry. Deploy the application in a GKE cluster, and test the application.
Show Answer
Correct Answer: D
Explanation: The goal is to modernize the application by converting it to a container in a cost‑effective way, not to lift‑and‑shift the VM. Using Jib builds an optimized container image directly from Java source code without needing a Dockerfile or VM migration, then stores it in Artifact Registry and deploys it to GKE. Options A, B, and C either package or migrate the VM itself (lift‑and‑shift) or add unnecessary steps and cost, rather than truly containerizing the Java application.
Question 153
Your organization has recently begun an initiative to replatform their legacy applications onto Google Kubernetes Engine. You need to decompose a monolithic application into microservices. Multiple instances have read and write access to a configuration file, which is stored on a shared file system. You want to minimize the effort required to manage this transition, and you want to avoid rewriting the application code. What should you do?
A. Create a new Cloud Storage bucket, and mount it via FUSE in the container.
B. Create a new persistent disk, and mount the volume as a shared PersistentVolume.
C. Create a new Filestore instance, and mount the volume as an NFS PersistentVolume.
D. Create a new ConfigMap and volumeMount to store the contents of the configuration file.
Show Answer
Correct Answer: C
Explanation: The application requires a shared file system with read and write access from multiple instances (ReadWriteMany) and minimal code changes. In GKE, Persistent Disks do not support RWX, ConfigMaps are read-only and not suitable for runtime writes, and Cloud Storage FUSE does not provide full POSIX semantics or safe concurrent writes. Filestore provides a managed NFS service that supports concurrent read/write access and can be mounted as an NFS PersistentVolume, making it the correct choice.
Question 154
Your development team has built several Cloud Functions using Java along with corresponding integration and service tests. You are building and deploying the functions and launching the tests using Cloud Build. Your Cloud Build job is reporting deployment failures immediately after successfully validating the code. What should you do?
A. Check the maximum number of Cloud Function instances.
B. Verify that your Cloud Build trigger has the correct build parameters.
C. Retry the tests using the truncated exponential backoff polling strategy.
D. Verify that the Cloud Build service account is assigned the Cloud Functions Developer role.
Show Answer
Correct Answer: D
Explanation: Cloud Build validates the code but fails during deployment because the Cloud Build service account lacks sufficient IAM permissions. Deploying Cloud Functions requires the Cloud Functions Developer role (or equivalent). Without it, deployment fails immediately after validation.
Question 155
You manage a microservices application on Google Kubernetes Engine (GKE) using Istio. You secure the communication channels between your microservices by implementing an Istio AuthorizationPolicy, a Kubernetes NetworkPolicy, and mTLS on your GKE cluster. You discover that HTTP requests between two Pods to specific URLs fail, while other requests to other URLs succeed. What is the cause of the connection issue?
A. A Kubernetes NetworkPolicy resource is blocking HTTP traffic between the Pods.
B. The Pod initiating the HTTP requests is attempting to connect to the target Pod via an incorrect TCP port.
C. The Authorization Policy of your cluster is blocking HTTP requests for specific paths within your application.
D. The cluster has mTLS configured in permissive mode, but the Pod's sidecar proxy is sending unencrypted traffic in plain text.
Show Answer
Correct Answer: C
Explanation: Only specific URL paths fail while other requests between the same Pods succeed, which rules out NetworkPolicy, port errors, or mTLS mode issues (these would affect all traffic). Istio AuthorizationPolicy can allow or deny traffic based on HTTP attributes such as paths and methods, so a misconfigured or missing rule for certain paths would block only those requests.
Question 156
You recently migrated an on-premises monolithic application to a microservices application on Google Kubernetes Engine (GKE). The application has dependencies on backend services on-premises, including a CRM system and a MySQL database that contains personally identifiable information (PII). The backend services must remain on-premises to meet regulatory requirements.
You established a Cloud VPN connection between your on-premises data center and Google Cloud. You notice that some requests from your microservices application on GKE to the backend services are failing due to latency issues caused by fluctuating bandwidth, which is causing the application to crash. How should you address the latency issues?
A. Use Memorystore to cache frequently accessed PII data from the on-premises MySQL database
B. Use Istio to create a service mesh that includes the microservices on GKE and the on-premises services
C. Increase the number of Cloud VPN tunnels for the connection between Google Cloud and the on-premises services
D. Decrease the network layer packet size by decreasing the Maximum Transmission Unit (MTU) value from its default value on Cloud VPN
Show Answer
Correct Answer: C
Explanation: The failures are caused by fluctuating bandwidth and resulting latency on the Cloud VPN link. The correct way to address this is to increase available and more stable throughput by adding multiple Cloud VPN tunnels (using equal-cost multi-path routing), which is a supported and recommended pattern. Istio does not reduce network latency or bandwidth constraints, MTU reduction increases packet overhead, and caching PII is inappropriate and does not solve the bandwidth issue.
Question 157
You are designing an application that consists of several microservices. Each microservice has its own RESTful API and will be deployed as a separate Kubernetes Service. You want to ensure that the consumers of these APIs aren't impacted when there is a change to your API, and also ensure that third-party systems aren't interrupted when new versions of the API are released. How should you configure the connection to the application following Google-recommended best practices?
A. Use an Ingress that uses the API's URL to route requests to the appropriate backend.
B. Leverage a Service Discovery system, and connect to the backend specified by the request.
C. Use multiple clusters, and use DNS entries to route requests to separate versioned backends.
D. Combine multiple versions in the same service, and then specify the API version in the POST request.
Show Answer
Correct Answer: A
Explanation: Google-recommended best practice for API versioning and consumer stability is to expose APIs through a stable entry point (such as an Ingress or HTTP(S) Load Balancer) and route traffic based on URL paths (for example, /v1, /v2) to different backend services. An Ingress decouples clients from backend implementations, allows multiple API versions to coexist, and enables rolling out new versions without interrupting existing consumers or third-party systems. Other options either don’t work for external clients, are over-engineered, or violate REST best practices.
Question 158
Your team is building an application for a financial institution. The application's frontend runs on Compute Engine, and the data resides in Cloud SQL and one Cloud Storage bucket. The application will collect data containing PII, which will be stored in the Cloud SQL database and the Cloud Storage bucket. You need to secure the PII data. What should you do?
A. 1. Create the relevant firewall rules to allow only the frontend to communicate with the Cloud SQL database 2. Using IAM, allow only the frontend service account to access the Cloud Storage bucket
B. 1. Create the relevant firewall rules to allow only the frontend to communicate with the Cloud SQL database 2. Enable private access to allow the frontend to access the Cloud Storage bucket privately
C. 1. Configure a private IP address for Cloud SQL 2. Use VPC-SC to create a service perimeter 3. Add the Cloud SQL database and the Cloud Storage bucket to the same service perimeter
D. 1. Configure a private IP address for Cloud SQL 2. Use VPC-SC to create a service perimeter 3. Add the Cloud SQL database and the Cloud Storage bucket to different service perimeters
Show Answer
Correct Answer: C
Explanation: PII must be protected both at the network level and against data exfiltration. Configuring Cloud SQL with a private IP ensures database traffic stays within the VPC. Using VPC Service Controls creates a service perimeter that prevents unauthorized access and data exfiltration from managed services. Placing both Cloud SQL and the Cloud Storage bucket in the same service perimeter allows the application to access required resources securely while enforcing strong isolation, which the other options do not fully provide.
Question 159
You are developing an application that needs to store files belonging to users in Cloud Storage. You want each user to have their own subdirectory in Cloud Storage. When a new user is created, the corresponding empty subdirectory should also be created. What should you do?
A. Create an object with the name of the subdirectory ending with a trailing slash ('/') that is zero bytes in length.
B. Create an object with the name of the subdirectory, and then immediately delete the object within that subdirectory.
C. Create an object with the name of the subdirectory that is zero bytes in length and has WRITER access control list permission.
D. Create an object with the name of the subdirectory that is zero bytes in length. Set the Content-Type metadata to CLOUDSTORAGE_FOLDER.
Show Answer
Correct Answer: A
Explanation: Cloud Storage has a flat namespace and does not have real directories. Folders are a UI abstraction created by object name prefixes. To create an empty "folder," you create a zero-byte object whose name ends with a trailing slash (for example, user123/). Cloud Storage tools and consoles then display this prefix as a folder. Other options describe behaviors or metadata that Cloud Storage does not recognize as creating a folder.
Question 160
Your application is deployed on hundreds of Compute Engine instances in a managed instance group (MIG) in multiple zones. You need to deploy a new instance template to fix a critical vulnerability immediately but must avoid impact to your service. What setting should be made to the MIG after updating the instance template?
A. Set the Max Surge to 100%.
B. Set the Update mode to Opportunistic.
C. Set the Maximum Unavailable to 100%.
D. Set the Minimum Wait time to 0 seconds.
Show Answer
Correct Answer: A
Explanation: To fix a critical vulnerability immediately while avoiding service impact, you should configure the rolling update to add capacity before removing old instances. Setting **Max Surge to 100%** allows the managed instance group to temporarily create up to an equal number of new instances using the updated template, ensuring full serving capacity throughout the update. Other options either risk downtime (Maximum Unavailable), delay the update (Opportunistic), or do not materially control availability (Minimum Wait Time).
$19
Get all 357 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.