Professional Cloud Developer Free Practice Questions — Page 3
Question 21
You have developed a Python application that you want to containerize and deploy to Cloud Run. You have developed a Cloud Build pipeline with the following steps:
After triggering the pipeline, you notice in the Cloud Build logs that the final step of the pipeline fails and the container is unable to be deployed to Cloud Run. What is the cause of this issue, and how should you resolve it?
A. The final step uses a Cloud Run instance name that does not match the container name. Update the deployment step so that the Cloud Run instance name matches the container name, and rerun the pipeline.
B. The Docker container image has not been pushed to Artifact Registry. Add a step to the pipeline to push the application container image to Artifact Registry, and rerun the pipeline.
C. Cloud Run does not allow unauthenticated invocations. Remove the --allow-unauthenticated parameter to enforce authentication on the application, and rerun the pipeline.
D. Unit tests in the pipeline are failing. Update the application code so that all unit tests pass, and rerun the pipeline.
Show Answer
Correct Answer: B
Explanation: Cloud Run deployments reference a container image stored in Artifact Registry (or Container Registry). If the Cloud Build pipeline builds the image but never pushes it to Artifact Registry, the final deploy step will fail because Cloud Run cannot find the image. Adding a step to push the built image to Artifact Registry resolves the issue.
Question 22
You are designing a microservices application on GKE that will expose a public API to users. Users will interact with the application by using OAuth 2.0, and illegitimate requests should receive a 403 response code. You need the API to be resilient against distributed denial of service (DDoS) attacks and critical security risks such as SQL injection (SQL) and cross-site scripting (XSS).
You want to design the application's architecture while following Google-recommended practices. What should you do?
A. Install Service Mesh in your GKE cluster. Configure Service Mesh user authentication to integrate the service hosted on GKE by using an OpenID Connect-compliant identity provider. Expose the application externally by using an Istio Ingress Gateway. Use VPC firewall rules to restrict Ingress traffic to the Ingress gateway.
B. Run an Apache HTTP server on Cloud Run to expose a service with a public IP address. Configure the Apache HTTP server as a reverse proxy to only forward valid requests to the API hosted on GKE.
C. Use an external Application Load Balancer with Cloud Armor. Integrate Cloud Armor with reCAPTCHA Enterprise. Configure the load balancer to forward traffic to the application hosted on GKE.
D. Use an external Application Load Balancer with Cloud Armor, and configure the load balancer to forward requests to Apigee to check the validity of the API requests. Configure GKE as the application's backend.
Show Answer
Correct Answer: C
Explanation: Using an external Application Load Balancer with Cloud Armor is the Google‑recommended way to protect public GKE services against DDoS attacks and common web exploits such as SQL injection and XSS. Cloud Armor provides L7 DDoS protection, WAF rules, and can integrate with reCAPTCHA Enterprise to block abusive or automated traffic before it reaches GKE. This design cleanly separates edge security from the cluster, scales globally, and aligns with best practices for exposing public APIs on GKE. Apigee is not required unless advanced API management features are explicitly needed.
Question 23
Your team runs a Python job that reads millions of customer record files stored in a Cloud Storage bucket. To comply with regulatory requirements, you need to ensure that customer data is immediately deleted once the job is completed. You want to minimize the time required to complete this task. What should you do?
A. Add a final step in the job that deletes all the objects in the bucket in bulk by using batch requests to the Cloud Storage API.
B. Configure Object Lifecycle Management on the Cloud Storage bucket that deletes all the objects in the bucket at the end of the job execution.
C. Remove the bucket from the Google Cloud console when the job is completed
D. Use the gcloud CLI to execute the gcloud storage rm --recursive gs://BUCKET_NAME/ command.
Show Answer
Correct Answer: A
Explanation: Deleting objects in bulk using batch requests to the Cloud Storage API provides immediate, programmatic removal as soon as the job completes and minimizes total deletion time. Lifecycle rules are not immediate, deleting the bucket is unnecessary and disruptive, and a recursive CLI delete is slower and less controlled than API batch deletion.
Question 24
You have a Cloud Run service that needs to connect to a Cloud SQL instance in a different project. You provisioned the Cloud Run service account with the Cloud SQL Client IAM role on the project that is hosting Cloud SQL. However, when you test the connection, the connection fails. You want to fix the connection failure while following Google-recommended practices. What should you do?
A. Add the cloudsql.instances.connect IAM permission to the Cloud Run service account.
B. Request additional API quota for Cloud SQL Auth Proxy,
C. Enable the Cloud SQL Admin API in both projects.
D. Migrate the Cloud SQL instance into the same project as the Cloud Run service.
Show Answer
Correct Answer: C
Explanation: For Cloud Run to connect to Cloud SQL—especially across projects—Google recommends enabling the Cloud SQL Admin API in both the Cloud Run project and the Cloud SQL project. Even with the Cloud SQL Client IAM role correctly granted, the connection can fail if the Admin API is not enabled, because it is required to retrieve instance metadata and manage secure connections. The Cloud SQL Client role already includes the needed permissions, quota is not the issue, and migrating projects is unnecessary.
Question 25
You are compiling a compliance report on vulnerability metadata for a specific set of images identified by Artifact Analysis. Metadata from images scanned more than 30 days ago are missing from the compliance report. You need to access the vulnerability metadata for these older images. What should you do?
A. Create a Pub/Sub subscription to pull from Artifact Analysis topics.
B. Check Artifact Analysis storage buckets in Cloud Storage.
C. Push or pull the images from Artifact Registry.
D. Check Cloud Trace logs for Artifact Analysis findings.
Show Answer
Correct Answer: B
Explanation: Artifact Analysis retains detailed vulnerability metadata only for a limited time via its APIs (about 30 days). Older vulnerability findings are archived to Cloud Storage buckets managed by Artifact Analysis. To access metadata for images scanned more than 30 days ago, you must check these Cloud Storage buckets. Pub/Sub does not provide historical data, pulling images does not restore past scan metadata, and Cloud Trace does not contain vulnerability findings.
Question 26
You are developing an online chat application where users can upload profile pictures. Uploaded profile pictures must comply with content policies. You need to detect inappropriate images and label those images automatically when they are uploaded. In the future, this process will need to be expanded to include additional processing tasks such as watermarking and image compression.
You want to simplify orchestration and minimize operational overhead of the image scanning and labeling steps while also ensuring that additional steps can be added and removed easily later on. What should you do?
A. Save user-uploaded images to a temporary Cloud Storage bucket. Implement code on the backend server to retrieve the image content and call the Vision API to process each new uploaded image.
B. Save user-uploaded images to a Cloud Storage bucket. Configure a Cloud Function that is triggered when a new image is uploaded and calls one or more Cloud Run services. Create additional Cloud Run services that call the Vision API to process each new uploaded image.
C. Save user-uploaded images to a Cloud Storage bucket. Configure a Cloud Function that is triggered when a new image is uploaded and publishes a message to a Pub/Sub topic. Deploy microservices in GKE that subscribe to the Pub/Sub topic and call the Vision API to process each new uploaded image.
D. Save user-uploaded images to a Cloud Storage bucket. Create an Eventarc trigger that connects the bucket to the Workflows event receiver when a new image is uploaded. Create a workflow in Workflows with multiple Cloud Functions that call the Vision API to process each new uploaded image.
Show Answer
Correct Answer: D
Explanation: Using Eventarc to trigger Workflows on Cloud Storage events provides a serverless, low-ops orchestration layer. Workflows makes it easy to add, remove, or reorder processing steps (e.g., content moderation via Vision API, watermarking, compression) without managing infrastructure. This minimizes operational overhead and simplifies future expansion compared to managing custom orchestration with Functions, Pub/Sub, GKE, or backend code.
Question 27
You are developing a new ecommerce website for your company. You want customers to receive a customized email notification when they place an order. You need to configure this email service while minimizing deployment effort. What should you do?
A. Create a Cloud Function that is triggered by a create type event in Firestore,
B. Create an email-sending application hosted on Compute Engine that is invoked by an HTTP request.
C. Create an email notification channel, and set up an alerting policy that is based on log metrics from a create type event.
D. Use Pub/Sub to send an email when the orders/ API returns an HTTP response of 200 OK.
Show Answer
Correct Answer: A
Explanation: To minimize deployment effort, a serverless, event-driven solution is preferred. A Cloud Function triggered by a create event in Firestore automatically runs when a new order is stored, requiring no server management. The function can send a customized email using an external email service, making this approach simple, scalable, and tightly integrated with the order workflow. Other options involve more infrastructure, are not designed for customer notifications, or are indirect and less appropriate.
Question 28
You are deploying a microservices application to GKE. One microservice needs to download files from a Cloud Storage bucket. You have an IAM service account with the Storage Object Viewer role on the project with the bucket. You need to configure your application to access the Cloud Storage bucket while following Google-recommended practices. What should you do?
A. Assign the IAM service account to the cluster’s node pool. Configure the application to authenticate to the bucket by using Application Default Credentials.
B. Assign the IAM service account to the cluster’s node pool. Encrypt the IAM service account key file by using a symmetric block cipher, and store the encrypted file on a persistent volume. Store the encryption key in Secret Manager.
C. Create a Kubernetes service account. Create a Kubernetes secret with a base64-encoded IAM service account key file. Annotate the Kubernetes secret with the Kubernetes service account. Assign the Kubernetes ServiceAccount to the Pods that need to access the bucket.
D. Create a Kubernetes service account. Use an IAM policy to bind the IAM service account to a Kubernetes service account. Annotate the Kubernetes ServiceAccount object with the name of the bound IAM service account. Assign the Kubernetes ServiceAccount to the Pods that need to access the bucket.
Show Answer
Correct Answer: D
Explanation: The Google‑recommended best practice for GKE workloads accessing Google Cloud services is Workload Identity. By creating a Kubernetes ServiceAccount and binding it to an IAM service account via an IAM policy, Pods can obtain short‑lived credentials without managing or storing service account keys. Annotating the Kubernetes ServiceAccount and assigning it to the Pods enables secure, least‑privilege access to the Cloud Storage bucket. Other options rely on node‑level identities or service account keys, which are discouraged.
Question 29
You recently developed an application that will be hosted on Cloud Run. You need to conduct a load test. You want to analyze the load test logs second by second to understand your Cloud Run service's response to rapid traffic spikes. You want to minimize effort. How should you analyze the logs?
A. Use estimation to extrapolate performance from summary monitoring charts.
B. Analyze the log data in BigQuery by configuring a BigQuery log sink with the appropriate inclusion filter for your application.
C. Use Cloud Monitoring’s default log console for analysis.
D. Analyze the log data in Cloud SQL for PostgreSQL by pushing logs to a Pub/Sub topic. Use Dataflow to process and ingest the logs.
Show Answer
Correct Answer: B
Explanation: Exporting Cloud Logging entries to BigQuery via a log sink allows efficient, fine‑grained, second‑by‑second analysis using SQL with minimal setup. This is well suited for analyzing load test behavior and rapid traffic spikes on Cloud Run. Other options either lack sufficient granularity or require significantly more effort and infrastructure.
Question 30
Your company recently modernized their monolith ecommerce site to a microservices application in GKE. Your team uses Google Cloud's operations suite for monitoring and logging. You want to improve the logging indexing and searchabilty in Cloud Logging across your microservices with the least amount of effort. What should you do?
A. Ask the SRE team to enable Managed Service for Prometheus on your GKE cluster.
B. Reconfigure your applications to write logs to an emptyDir volume. Configure a sidecar agent to read the logs and send them to the Cloud Logging API.
C. Update your microservices code to emit logs in JSON format.
D. Instrument your microservices code with OpenTelemetry libraries.
Show Answer
Correct Answer: C
Explanation: Cloud Logging provides the best indexing and search capabilities when logs are emitted in structured JSON. By updating microservices to output JSON logs, fields are automatically parsed and indexed without extra agents, sidecars, or infrastructure changes, delivering improved searchability with the least effort.
$19
Get all 357 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.