Professional Cloud Developer Free Practice Questions — Page 16
Question 151
Your company has a new security initiative that requires all data stored in Google Cloud to be encrypted by customer-managed encryption keys. You plan to use Cloud Key Management Service (KMS) to configure access to the keys. You need to follow the "separation of duties" principle and Google-recommended best practices. What should you do? (Choose two.)
A. Provision Cloud KMS in its own project.
B. Do not assign an owner to the Cloud KMS project.
C. Provision Cloud KMS in the project where the keys are being used.
D. Grant the roles/cloudkms.admin role to the owner of the project where the keys from Cloud KMS are being used.
E. Grant an owner role for the Cloud KMS project to a different user than the owner of the project where the keys from Cloud KMS are being used.
Show Answer
Correct Answer: A, B
Explanation: Google recommends placing Cloud KMS in a separate project from the resources it protects to enable separation of duties. It also recommends avoiding assigning the primitive Owner role on the KMS project; instead use least-privilege IAM roles (such as Cloud KMS Admin) as needed. Option E is weaker because the best practice is to avoid Owner on the KMS project entirely rather than assigning it to a different person.
Question 152
You need to migrate a standalone Java application running in an on-premises Linux virtual machine (VM) to Google Cloud in a cost-effective manner. You decide not to take the lift-and-shift approach, and instead you plan to modernize the application by converting it to a container. How should you accomplish this task?
A. Use Migrate for Anthos to migrate the VM to your Google Kubernetes Engine (GKE) cluster as a container.
B. Export the VM as a raw disk and import it as an image. Create a Compute Engine instance from the Imported image.
C. Use Migrate for Compute Engine to migrate the VM to a Compute Engine instance, and use Cloud Build to convert it to a container.
D. Use Jib to build a Docker image from your source code, and upload it to Artifact Registry. Deploy the application in a GKE cluster, and test the application.
Show Answer
Correct Answer: D
Explanation: Because you are modernizing a standalone Java application rather than performing a VM lift-and-shift, the appropriate approach is to build a container image directly from the Java source using Jib, store it in Artifact Registry, and deploy it to GKE. Jib is designed for Java applications and creates optimized container images without requiring a Dockerfile. Options B and C primarily migrate VMs rather than modernize the application, and A packages the VM workload for Kubernetes instead of rebuilding the application as a cloud-native container.
Question 153
Your organization has recently begun an initiative to replatform their legacy applications onto Google Kubernetes Engine. You need to decompose a monolithic application into microservices. Multiple instances have read and write access to a configuration file, which is stored on a shared file system. You want to minimize the effort required to manage this transition, and you want to avoid rewriting the application code. What should you do?
A. Create a new Cloud Storage bucket, and mount it via FUSE in the container.
B. Create a new persistent disk, and mount the volume as a shared PersistentVolume.
C. Create a new Filestore instance, and mount the volume as an NFS PersistentVolume.
D. Create a new ConfigMap and volumeMount to store the contents of the configuration file.
Show Answer
Correct Answer: C
Explanation: The application requires a shared file system with both read and write access from multiple instances while minimizing code changes. Google Cloud Filestore provides a managed NFS service that supports ReadWriteMany access and integrates with GKE via an NFS PersistentVolume. Cloud Storage mounted with gcsfuse is not a POSIX-complete shared filesystem for concurrent read/write workloads, Persistent Disk does not provide ReadWriteMany for this use case, and ConfigMaps are intended for read-only configuration data exposed to Pods.
Question 154
Your development team has built several Cloud Functions using Java along with corresponding integration and service tests. You are building and deploying the functions and launching the tests using Cloud Build. Your Cloud Build job is reporting deployment failures immediately after successfully validating the code. What should you do?
A. Check the maximum number of Cloud Function instances.
B. Verify that your Cloud Build trigger has the correct build parameters.
C. Retry the tests using the truncated exponential backoff polling strategy.
D. Verify that the Cloud Build service account is assigned the Cloud Functions Developer role.
Show Answer
Correct Answer: D
Explanation: If code validation succeeds but deployment fails immediately in Cloud Build, a common cause is insufficient IAM permissions for the Cloud Build service account. Deploying Cloud Functions requires appropriate Cloud Functions deployment permissions, such as the Cloud Functions Developer role (along with any other required roles for the deployment). The other options do not specifically address immediate deployment failures after validation.
Question 155
You manage a microservices application on Google Kubernetes Engine (GKE) using Istio. You secure the communication channels between your microservices by implementing an Istio AuthorizationPolicy, a Kubernetes NetworkPolicy, and mTLS on your GKE cluster. You discover that HTTP requests between two Pods to specific URLs fail, while other requests to other URLs succeed. What is the cause of the connection issue?
A. A Kubernetes NetworkPolicy resource is blocking HTTP traffic between the Pods.
B. The Pod initiating the HTTP requests is attempting to connect to the target Pod via an incorrect TCP port.
C. The Authorization Policy of your cluster is blocking HTTP requests for specific paths within your application.
D. The cluster has mTLS configured in permissive mode, but the Pod's sidecar proxy is sending unencrypted traffic in plain text.
Show Answer
Correct Answer: C
Explanation: The key clue is that only requests to specific URLs fail while other requests between the same Pods succeed. Kubernetes NetworkPolicy operates at L3/L4 (IP/port) and cannot filter by HTTP path, so it would affect connectivity rather than selected URLs. An incorrect TCP port would generally prevent all requests to that service. Istio AuthorizationPolicy can match HTTP attributes such as paths and methods and deny only specific URLs. mTLS in permissive mode accepts both plaintext and mTLS traffic, so it would not selectively block certain HTTP paths.
Question 156
You recently migrated an on-premises monolithic application to a microservices application on Google Kubernetes Engine (GKE). The application has dependencies on backend services on-premises, including a CRM system and a MySQL database that contains personally identifiable information (PII). The backend services must remain on-premises to meet regulatory requirements.
You established a Cloud VPN connection between your on-premises data center and Google Cloud. You notice that some requests from your microservices application on GKE to the backend services are failing due to latency issues caused by fluctuating bandwidth, which is causing the application to crash. How should you address the latency issues?
A. Use Memorystore to cache frequently accessed PII data from the on-premises MySQL database
B. Use Istio to create a service mesh that includes the microservices on GKE and the on-premises services
C. Increase the number of Cloud VPN tunnels for the connection between Google Cloud and the on-premises services
D. Decrease the network layer packet size by decreasing the Maximum Transmission Unit (MTU) value from its default value on Cloud VPN
Show Answer
Correct Answer: C
Explanation: The failures are attributed to fluctuating bandwidth over Cloud VPN causing latency. Increasing the number of Cloud VPN tunnels can increase available VPN throughput and help mitigate bandwidth bottlenecks. Istio provides traffic management features such as retries and circuit breaking, which improve resilience but do not increase underlying network bandwidth or reduce VPN latency. Caching PII does not directly address the bandwidth issue and may introduce data consistency and compliance concerns. Reducing MTU generally increases packet overhead and is not an appropriate solution for fluctuating bandwidth.
Sources:
https://medium.com/@rksachin/practice-thesequestions-for-google-cloud-certified-professional-cloud-architect-exam-6a66c86d5825
Question 157
You are designing an application that consists of several microservices. Each microservice has its own RESTful API and will be deployed as a separate Kubernetes Service. You want to ensure that the consumers of these APIs aren't impacted when there is a change to your API, and also ensure that third-party systems aren't interrupted when new versions of the API are released. How should you configure the connection to the application following Google-recommended best practices?
A. Use an Ingress that uses the API's URL to route requests to the appropriate backend.
B. Leverage a Service Discovery system, and connect to the backend specified by the request.
C. Use multiple clusters, and use DNS entries to route requests to separate versioned backends.
D. Combine multiple versions in the same service, and then specify the API version in the POST request.
Show Answer
Correct Answer: A
Explanation: Use an Ingress to route requests based on versioned API URL paths (for example, /v1 and /v2) to the appropriate Kubernetes Services. This decouples clients from backend implementations, supports multiple API versions concurrently, and allows new API versions to be deployed without disrupting existing consumers. Service discovery is not the mechanism for external API versioning, multiple clusters are unnecessary for this purpose, and placing the API version in the POST body is not a RESTful versioning practice.
Question 158
Your team is building an application for a financial institution. The application's frontend runs on Compute Engine, and the data resides in Cloud SQL and one Cloud Storage bucket. The application will collect data containing PII, which will be stored in the Cloud SQL database and the Cloud Storage bucket. You need to secure the PII data. What should you do?
A. 1. Create the relevant firewall rules to allow only the frontend to communicate with the Cloud SQL database 2. Using IAM, allow only the frontend service account to access the Cloud Storage bucket
B. 1. Create the relevant firewall rules to allow only the frontend to communicate with the Cloud SQL database 2. Enable private access to allow the frontend to access the Cloud Storage bucket privately
C. 1. Configure a private IP address for Cloud SQL 2. Use VPC-SC to create a service perimeter 3. Add the Cloud SQL database and the Cloud Storage bucket to the same service perimeter
D. 1. Configure a private IP address for Cloud SQL 2. Use VPC-SC to create a service perimeter 3. Add the Cloud SQL database and the Cloud Storage bucket to different service perimeters
Show Answer
Correct Answer: C
Explanation: Configuring Cloud SQL with a private IP keeps database traffic on the VPC network, reducing exposure. VPC Service Controls (VPC-SC) are designed to mitigate data exfiltration risks for supported Google Cloud services such as Cloud Storage and Cloud SQL. Placing both the Cloud SQL instance and the Cloud Storage bucket within the same service perimeter allows the application to access both while protecting sensitive PII. Firewall rules and IAM alone do not provide equivalent protection against data exfiltration, and placing the resources in different service perimeters would hinder legitimate communication.
Question 159
You are developing an application that needs to store files belonging to users in Cloud Storage. You want each user to have their own subdirectory in Cloud Storage. When a new user is created, the corresponding empty subdirectory should also be created. What should you do?
A. Create an object with the name of the subdirectory ending with a trailing slash ('/') that is zero bytes in length.
B. Create an object with the name of the subdirectory, and then immediately delete the object within that subdirectory.
C. Create an object with the name of the subdirectory that is zero bytes in length and has WRITER access control list permission.
D. Create an object with the name of the subdirectory that is zero bytes in length. Set the Content-Type metadata to CLOUDSTORAGE_FOLDER.
Show Answer
Correct Answer: A
Explanation: Cloud Storage uses a flat namespace and does not have real directories. To create the appearance of an empty folder, create a zero-byte object whose name ends with a trailing slash ('/'). Many tools and the Google Cloud Console interpret such placeholder objects as folders. The other options describe behaviors or metadata that Cloud Storage does not use to represent folders.
Question 160
Your application is deployed on hundreds of Compute Engine instances in a managed instance group (MIG) in multiple zones. You need to deploy a new instance template to fix a critical vulnerability immediately but must avoid impact to your service. What setting should be made to the MIG after updating the instance template?
A. Set the Max Surge to 100%.
B. Set the Update mode to Opportunistic.
C. Set the Maximum Unavailable to 100%.
D. Set the Minimum Wait time to 0 seconds.
Show Answer
Correct Answer: A
Explanation: For an urgent rollout that must avoid service impact, use a proactive rolling update with a high Max Surge so new instances are created before old ones are removed. Opportunistic mode delays updates, Maximum Unavailable of 100% permits full outage, and Minimum Wait Time only affects the pause after a new instance becomes healthy rather than the rollout capacity or speed.
Sources:
https://docs.cloud.google.com/sdk/gcloud/reference/compute/instance-groups/managed/create
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.