Professional Cloud Developer Free Practice Questions — Page 3
Question 21
You have developed a Python application that you want to containerize and deploy to Cloud Run. You have developed a Cloud Build pipeline with the following steps:
After triggering the pipeline, you notice in the Cloud Build logs that the final step of the pipeline fails and the container is unable to be deployed to Cloud Run. What is the cause of this issue, and how should you resolve it?
A. The final step uses a Cloud Run instance name that does not match the container name. Update the deployment step so that the Cloud Run instance name matches the container name, and rerun the pipeline.
B. The Docker container image has not been pushed to Artifact Registry. Add a step to the pipeline to push the application container image to Artifact Registry, and rerun the pipeline.
C. Cloud Run does not allow unauthenticated invocations. Remove the --allow-unauthenticated parameter to enforce authentication on the application, and rerun the pipeline.
D. Unit tests in the pipeline are failing. Update the application code so that all unit tests pass, and rerun the pipeline.
Show Answer
Correct Answer: B
Explanation: Cloud Run deploys a container image from a registry. If the Cloud Build pipeline builds the image but does not push it to Artifact Registry (or another supported registry), the deploy step cannot find the image and fails. Adding a push step before deployment resolves the issue.
Question 22
You are designing a microservices application on GKE that will expose a public API to users. Users will interact with the application by using OAuth 2.0, and illegitimate requests should receive a 403 response code. You need the API to be resilient against distributed denial of service (DDoS) attacks and critical security risks such as SQL injection (SQL) and cross-site scripting (XSS).
You want to design the application's architecture while following Google-recommended practices. What should you do?
A. Install Service Mesh in your GKE cluster. Configure Service Mesh user authentication to integrate the service hosted on GKE by using an OpenID Connect-compliant identity provider. Expose the application externally by using an Istio Ingress Gateway. Use VPC firewall rules to restrict Ingress traffic to the Ingress gateway.
B. Run an Apache HTTP server on Cloud Run to expose a service with a public IP address. Configure the Apache HTTP server as a reverse proxy to only forward valid requests to the API hosted on GKE.
C. Use an external Application Load Balancer with Cloud Armor. Integrate Cloud Armor with reCAPTCHA Enterprise. Configure the load balancer to forward traffic to the application hosted on GKE.
D. Use an external Application Load Balancer with Cloud Armor, and configure the load balancer to forward requests to Apigee to check the validity of the API requests. Configure GKE as the application's backend.
Show Answer
Correct Answer: C
Explanation: An external Application Load Balancer with Cloud Armor is the Google-recommended front end for public GKE services requiring DDoS protection and WAF capabilities. Cloud Armor provides protection against volumetric attacks and can enforce preconfigured WAF rules that mitigate common web exploits such as SQL injection and XSS. Integration with reCAPTCHA Enterprise helps distinguish legitimate users from abusive traffic. OAuth 2.0 authentication is handled by the application/API, while Cloud Armor protects the edge and forwards valid traffic to GKE.
Question 23
Your team runs a Python job that reads millions of customer record files stored in a Cloud Storage bucket. To comply with regulatory requirements, you need to ensure that customer data is immediately deleted once the job is completed. You want to minimize the time required to complete this task. What should you do?
A. Add a final step in the job that deletes all the objects in the bucket in bulk by using batch requests to the Cloud Storage API.
B. Configure Object Lifecycle Management on the Cloud Storage bucket that deletes all the objects in the bucket at the end of the job execution.
C. Remove the bucket from the Google Cloud console when the job is completed
D. Use the gcloud CLI to execute the gcloud storage rm --recursive gs://BUCKET_NAME/ command.
Show Answer
Correct Answer: A
Explanation: Option A is correct because it performs explicit deletion immediately after the job completes and uses batch requests to reduce API overhead when deleting many objects. Object Lifecycle Management does not guarantee immediate deletion at job completion, deleting the bucket is unnecessary and may fail if objects remain, and using a recursive CLI delete is generally less efficient and not integrated into the job flow for minimizing completion time.
Question 24
You have a Cloud Run service that needs to connect to a Cloud SQL instance in a different project. You provisioned the Cloud Run service account with the Cloud SQL Client IAM role on the project that is hosting Cloud SQL. However, when you test the connection, the connection fails. You want to fix the connection failure while following Google-recommended practices. What should you do?
A. Add the cloudsql.instances.connect IAM permission to the Cloud Run service account.
B. Request additional API quota for Cloud SQL Auth Proxy,
C. Enable the Cloud SQL Admin API in both projects.
D. Migrate the Cloud SQL instance into the same project as the Cloud Run service.
Show Answer
Correct Answer: C
Explanation: For Cloud Run to connect to a Cloud SQL instance across projects using the Cloud SQL connector/Auth Proxy integration, the Cloud SQL Client role already grants the required connect permission. A common cross-project requirement is that the Cloud SQL Admin API be enabled in both the Cloud Run project and the Cloud SQL project so the connector can retrieve instance connection metadata. Additional quota is unrelated, and migrating the instance is unnecessary.
Question 25
You are compiling a compliance report on vulnerability metadata for a specific set of images identified by Artifact Analysis. Metadata from images scanned more than 30 days ago are missing from the compliance report. You need to access the vulnerability metadata for these older images. What should you do?
A. Create a Pub/Sub subscription to pull from Artifact Analysis topics.
B. Check Artifact Analysis storage buckets in Cloud Storage.
C. Push or pull the images from Artifact Registry.
D. Check Cloud Trace logs for Artifact Analysis findings.
Show Answer
Correct Answer: C
Explanation: Artifact Analysis retains vulnerability occurrences for a limited period. To regenerate vulnerability metadata for older images, you need to trigger a new scan by pushing or pulling the images from Artifact Registry. Pub/Sub does not provide historical data, Cloud Trace is unrelated, and there are no user-accessible Artifact Analysis Cloud Storage buckets for archived findings.
Question 26
You are developing an online chat application where users can upload profile pictures. Uploaded profile pictures must comply with content policies. You need to detect inappropriate images and label those images automatically when they are uploaded. In the future, this process will need to be expanded to include additional processing tasks such as watermarking and image compression.
You want to simplify orchestration and minimize operational overhead of the image scanning and labeling steps while also ensuring that additional steps can be added and removed easily later on. What should you do?
A. Save user-uploaded images to a temporary Cloud Storage bucket. Implement code on the backend server to retrieve the image content and call the Vision API to process each new uploaded image.
B. Save user-uploaded images to a Cloud Storage bucket. Configure a Cloud Function that is triggered when a new image is uploaded and calls one or more Cloud Run services. Create additional Cloud Run services that call the Vision API to process each new uploaded image.
C. Save user-uploaded images to a Cloud Storage bucket. Configure a Cloud Function that is triggered when a new image is uploaded and publishes a message to a Pub/Sub topic. Deploy microservices in GKE that subscribe to the Pub/Sub topic and call the Vision API to process each new uploaded image.
D. Save user-uploaded images to a Cloud Storage bucket. Create an Eventarc trigger that connects the bucket to the Workflows event receiver when a new image is uploaded. Create a workflow in Workflows with multiple Cloud Functions that call the Vision API to process each new uploaded image.
Show Answer
Correct Answer: D
Explanation: Workflows is designed to orchestrate multiple serverless processing steps with minimal operational overhead. Using Eventarc to trigger a Workflow from Cloud Storage events provides a clean event-driven architecture where individual processing steps (implemented as Cloud Functions) can be added, removed, or reordered easily. This fits the requirement for future extensibility better than embedding orchestration in application code, chaining Cloud Run manually, or managing GKE microservices.
Question 27
You are developing a new ecommerce website for your company. You want customers to receive a customized email notification when they place an order. You need to configure this email service while minimizing deployment effort. What should you do?
A. Create a Cloud Function that is triggered by a create type event in Firestore,
B. Create an email-sending application hosted on Compute Engine that is invoked by an HTTP request.
C. Create an email notification channel, and set up an alerting policy that is based on log metrics from a create type event.
D. Use Pub/Sub to send an email when the orders/ API returns an HTTP response of 200 OK.
Show Answer
Correct Answer: A
Explanation: A Cloud Function triggered by a Firestore document creation is the lowest-effort, event-driven solution. When a new order is written to Firestore, the function automatically executes and can call an email service (such as SendGrid) to send a customized confirmation email. This avoids managing servers. Compute Engine requires infrastructure management, Cloud Monitoring alerting is intended for operational alerts rather than customer notifications, and Pub/Sub triggered only by an HTTP 200 response is not the appropriate event source for customized order emails.
Question 28
You are deploying a microservices application to GKE. One microservice needs to download files from a Cloud Storage bucket. You have an IAM service account with the Storage Object Viewer role on the project with the bucket. You need to configure your application to access the Cloud Storage bucket while following Google-recommended practices. What should you do?
A. Assign the IAM service account to the cluster’s node pool. Configure the application to authenticate to the bucket by using Application Default Credentials.
B. Assign the IAM service account to the cluster’s node pool. Encrypt the IAM service account key file by using a symmetric block cipher, and store the encrypted file on a persistent volume. Store the encryption key in Secret Manager.
C. Create a Kubernetes service account. Create a Kubernetes secret with a base64-encoded IAM service account key file. Annotate the Kubernetes secret with the Kubernetes service account. Assign the Kubernetes ServiceAccount to the Pods that need to access the bucket.
D. Create a Kubernetes service account. Use an IAM policy to bind the IAM service account to a Kubernetes service account. Annotate the Kubernetes ServiceAccount object with the name of the bound IAM service account. Assign the Kubernetes ServiceAccount to the Pods that need to access the bucket.
Show Answer
Correct Answer: D
Explanation: The recommended practice for GKE is Workload Identity (or Workload Identity Federation for GKE), which maps a Kubernetes ServiceAccount to an IAM service account without using long-lived service account keys. Create a Kubernetes ServiceAccount, bind it to the IAM service account with the appropriate IAM policy, annotate the Kubernetes ServiceAccount with the IAM service account, and run the Pods using that Kubernetes ServiceAccount. This allows Application Default Credentials to obtain short-lived credentials securely.
Question 29
You recently developed an application that will be hosted on Cloud Run. You need to conduct a load test. You want to analyze the load test logs second by second to understand your Cloud Run service's response to rapid traffic spikes. You want to minimize effort. How should you analyze the logs?
A. Use estimation to extrapolate performance from summary monitoring charts.
B. Analyze the log data in BigQuery by configuring a BigQuery log sink with the appropriate inclusion filter for your application.
C. Use Cloud Monitoring’s default log console for analysis.
D. Analyze the log data in Cloud SQL for PostgreSQL by pushing logs to a Pub/Sub topic. Use Dataflow to process and ingest the logs.
Show Answer
Correct Answer: B
Explanation: Configuring a Cloud Logging sink to BigQuery enables detailed SQL analysis of log entries with second-level timestamp granularity, making it well suited for examining Cloud Run behavior during rapid traffic spikes with minimal operational effort. Estimation from summary charts lacks the needed precision, the default log console is not ideal for this level of analysis, and building a Pub/Sub/Dataflow/Cloud SQL pipeline is unnecessarily complex.
Question 30
Your company recently modernized their monolith ecommerce site to a microservices application in GKE. Your team uses Google Cloud's operations suite for monitoring and logging. You want to improve the logging indexing and searchabilty in Cloud Logging across your microservices with the least amount of effort. What should you do?
A. Ask the SRE team to enable Managed Service for Prometheus on your GKE cluster.
B. Reconfigure your applications to write logs to an emptyDir volume. Configure a sidecar agent to read the logs and send them to the Cloud Logging API.
C. Update your microservices code to emit logs in JSON format.
D. Instrument your microservices code with OpenTelemetry libraries.
Show Answer
Correct Answer: C
Explanation: Structured JSON logging enables Cloud Logging to automatically parse log fields into jsonPayload, making them indexed and searchable with minimal application changes. Managed Service for Prometheus is for metrics, OpenTelemetry is primarily for instrumentation and tracing/metrics (and is more effort), and using a sidecar with emptyDir changes log collection but does not itself improve indexing/searchability like structured logging does.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.