Professional Cloud Developer Free Practice Questions — Page 4
Question 31
You are designing a microservices architecture for a new application that will be deployed on Cloud Run. The application requires high-throughput communication between the internal microservices. You want to use the most effective, lowest latency communication protocol for this application. What should you do?
A. Configure the Cloud Run service to use HTTP/2. Implement gRPC for communication between the microservices. Use streaming gRPCs when a large amount of data has to be sent.
B. Implement the microservices with the REST API communication protocol. Use Apigee with rate-limiting to provide the best QoS for high-priority services.
C. Use SOAP to build the microservices API, and use XML as the data format for communication across the microservices. Define SOAP data contracts for each microservice.
D. Use HTTP REST to communicate across the microservices. Implement pagination and add indexing to your database.
Show Answer
Correct Answer: A
Explanation: For high-throughput, low-latency communication between internal microservices on Cloud Run, gRPC over HTTP/2 is the most effective choice. gRPC is designed specifically for efficient service-to-service communication, leveraging HTTP/2 features such as multiplexing, header compression, and bidirectional streaming. This reduces overhead and latency compared to REST over HTTP/1.1. Streaming gRPC further improves performance when transferring large volumes of data. The other options (REST, SOAP, or API management tools) add unnecessary overhead and are not optimized for low-latency internal microservice communication.
Question 32
Your company manages an application that captures stock data in an internal database. You need to create an API that provides real-time stock data to users. You want to return stock data to users as quickly as possible, and you want your solution to be highly scalable. What should you do?
A. Create a BigQuery dataset and table to act as the internal database. Query the table when user requests are received.
B. Create a Memorystore for Redis instance to store all stock market data. Query this database when user requests are received.
C. Create a Bigtable instance. Query the table when user requests are received. Configure a Pub/Sub topic to queue user requests that your API will respond to.
D. Create a Memorystore for Redis instance, and use this database to store the most accessed stock data. Query this instance first when user requests are received, and fall back to the internal database.
Show Answer
Correct Answer: D
Explanation: To deliver real-time stock data with minimal latency and high scalability, a caching layer is ideal. Memorystore for Redis provides in-memory access, which is much faster than querying a primary database. By storing the most frequently accessed stock data in Redis and querying it first, the API can respond quickly to common requests. Falling back to the internal database ensures completeness and correctness for less common or uncached data. This pattern optimizes performance and scales well under high read traffic.
Question 33
You are using the latest stable version of Python 3 to develop an API that stores data in a Cloud SQL database. You need to perform CRUD operations on the production database securely and reliably with minimal effort. What should you do?
A. 1. Use Cloud Composer to manage the connection to the Cloud SQL database from your Python application. 2. Grant an IAM role to the service account that includes the composer.worker permission.
B. 1. Use the Cloud SQL API to connect to the Cloud SQL database from your Python application. 2. Grant an IAM role to the service account that includes the cloudsql.instances.login permission.
C. 1. Use the Cloud SQL connector library for Python to connect to the Cloud SQL database through a Cloud SQL Auth Proxy. 2. Grant an IAM role to the service account that includes the cloudsql.instances.connect permission.
D. 1. Use the Cloud SQL emulator to connect to the Cloud SQL database from Cloud Shell 2. Grant an IAM role to the user that includes the cloudsql.instances.login permission.
Show Answer
Correct Answer: C
Explanation: The Cloud SQL Connector library for Python provides the simplest and most secure way to connect to Cloud SQL using modern Python versions. It handles authentication and encryption automatically by leveraging Cloud SQL Auth Proxy functionality without requiring you to run the proxy yourself. Granting the service account the cloudsql.instances.connect permission is the correct IAM requirement for secure, authorized connections. The other options misuse unrelated services, incorrect APIs, or non-production tools.
Question 34
Your team has created an application that is hosted on a GKE cluster. You need to connect the application to a REST service that is deployed in two GKE clusters in two different regions. How should you set up the connection and health checks? (Choose two.)
A. Use Cloud Service Mesh with sidecar proxies to connect the application to the REST service.
B. Use Cloud Service Mesh with proxyless gRPC to connect the application to the REST service.
C. Configure the REST service's firewall to allow health checks originating from the GKE service’s IP ranges.
D. Configure the REST service's firewall to allow health checks originating from the GKE control plane’s IP ranges.
E. Configure the REST service's firewall to allow health checks originating from the GKE check probe’s IP ranges.
Show Answer
Correct Answer: A, E
Explanation: To connect an application running on GKE to a REST service deployed across multiple GKE clusters and regions, you need both cross‑cluster service connectivity and proper health checking.
A is correct because Cloud Service Mesh with sidecar proxies (Istio-based) is designed for multi‑cluster, multi‑region service-to-service connectivity. Sidecars enable traffic management, load balancing, mTLS, and failover between clusters, which fits this use case. Proxyless gRPC (B) is not applicable because the service is REST-based, not gRPC.
E is correct because GKE health checks originate from specific Google health check probe IP ranges. Firewall rules must allow these IP ranges so that health checks can reach the REST service successfully. Allowing control plane IPs (D) or generic service IPs (C) does not correctly address how Google-managed health checks are performed.
Question 35
Your infrastructure team uses Terraform Cloud and manages Google Cloud resources by using Terraform configuration files. You want to configure an infrastructure as code pipeline that authenticates to Google Cloud APIs. You want to use the most secure approach and minimize changes to the configuration. How should you configure the authentication?
A. Use Terraform on GKE. Create a Kubernetes service account to execute the Terraform code. Use workload identity federation to authenticate as the Google service account.
B. Install Terraform on a Compute Engine VM. Configure the VM by using a service account that has the required permissions to manage the Google Cloud resources.
C. Configure Terraform Cloud to use workload identity federation to authenticate to the Google Cloud APIs.
D. Create a service account that has the required permissions to manage the Google Cloud resources, and import the service account key to Terraform Cloud. Use this service account to authenticate to the Google Cloud APIs.
Show Answer
Correct Answer: C
Explanation: Terraform Cloud natively supports workload identity federation with Google Cloud, allowing it to authenticate to Google Cloud APIs without storing long‑lived service account keys. This follows Google and HashiCorp security best practices, reduces credential management risk, and requires minimal changes to existing Terraform configurations compared to moving execution to GKE or Compute Engine or importing service account keys.
Question 36
You have an application running on a GKE cluster. Your application has a stateless web frontend, and has a high-availability requirement. Your cluster is set to automatically upgrade, and some of your nodes need to be drained. You need to ensure that the application has a serving capacity of 10% of the Pods prior to the drain. What should you do?
A. Configure a Vertical Pod Autoscaler (VPA) to increase the memory and CPU by 10% and set the updateMode to Auto.
B. Configure the Pod replica count to be 10% more than the current replica count.
C. Configure a Pod Disruption Budget (PDB) value to have a minAvailable value of 10%.
D. Configure the Horizontal Pod Autoscaler (HPA) maxReplicas value to 10% more than the current replica count.
Show Answer
Correct Answer: C
Explanation: During GKE node drains (a voluntary disruption), Kubernetes respects Pod Disruption Budgets. Setting a PDB with minAvailable: 10% guarantees that at least 10% of the Pods remain available while nodes are being drained, directly meeting the high-availability requirement. Increasing replicas or autoscaler limits does not ensure availability during a drain.
Question 37
You are a developer at a large organization. Your team uses Git for source code management (SCM). You want to ensure that your team follows Google-recommended best practices to manage code to drive higher rates of software delivery. Which SCM process should your team use?
A. Each developer commits their code to the main branch before each product release, conducts testing, and rolls back if integration issues are detected.
B. Each group of developers copies the repository, commits their changes to their repository, and merges their code into the main repository before each product release.
C. Each developer creates a branch for their own work, commits their changes to their branch, and merges their code into the main branch daily.
D. Each group of developers creates a feature branch from the main branch for their work, commits their changes to their branch, and merges their code into the main branch before each major release.
Show Answer
Correct Answer: C
Explanation: Google-recommended SCM best practices emphasize trunk-based development with frequent integration. Each developer works in a short-lived branch, commits changes there, and merges into the main branch daily. This minimizes merge conflicts, enables continuous integration, and supports faster, more reliable software delivery. The other options delay integration until releases or major milestones, increasing risk and slowing feedback.
Question 38
You are responsible for developing a new ecommerce application that is running on Cloud Run. You need to connect your application to a Cloud SQL database that is in a separate project. This project is on an isolated network dedicated to multiple databases without a public IP. You need to connect your application to this database. What should you do?
A. Create a Private Service Connect endpoint on your network. Create a Serverless VPC Access connector on your project. Use Cloud SQL Language Connectors to create an internal connection.
B. Configure VPC Network Peering between both networks. In Cloud Run, create a Cloud SQL connection that uses the internal IP. Use Cloud SQL Language Connectors to interact with the database.
C. Configure private services access on your project. In Cloud Run, create a Cloud SQL connection. Use Cloud SQL Language Connectors to interact with the database.
D. Create a subnet on your VPC. Create a Serverless VPC Access connector on your project using the new subnet. In Cloud Run, create a Cloud SQL connection. Use Cloud SQL Language Connectors to interact with the database.
Show Answer
Correct Answer: A
Explanation: The Cloud SQL instance has only a private IP and is in a separate, isolated project. Cloud Run requires a Serverless VPC Access connector to reach private networks, and cross-project private connectivity should be established without exposing IPs. Private Service Connect is the recommended and supported approach for private, cross-project access to managed services like Cloud SQL without VPC peering. Option D is incomplete because it does not establish any network connectivity to the separate project hosting Cloud SQL.
Question 39
You have an on-premises containerized service written in the current stable version of Python 3 that is available only to users in the United States. The service has high traffic during the day and no traffic at night. You need to migrate this application to Google Cloud and track error logs after the migration in Error Reporting. You want to minimize the cost and effort of these tasks. What should you do?
A. Deploy the code on Cloud Run. Configure your code to write errors to standard error.
B. Deploy the code on Cloud Run. Configure your code to stream errors to a Cloud Storage bucket.
C. Deploy the code on a GKE Autopilot cluster. Configure your code to write error logs to standard error.
D. Deploy the code on a GKE Autopilot cluster. Configure your code to write error logs to a Cloud Storage bucket.
Show Answer
Correct Answer: A
Explanation: Cloud Run is a fully managed serverless platform that automatically scales to zero when there is no traffic, minimizing cost for a service with daytime-only usage and requiring minimal operational effort. It natively supports containerized Python applications. Google Cloud Error Reporting automatically ingests errors written to standard error from Cloud Run via Cloud Logging, requiring no additional configuration. GKE Autopilot would add unnecessary complexity and cost, and exporting logs to Cloud Storage is not needed for Error Reporting.
Question 40
Your team plans to use AlloyDB as their database backend for an upcoming application release. Your application is currently hosted in a different project and network than the AlloyDB instances. You need to securely connect your application to the AlloyDB instance while keeping the projects isolated. You want to minimize additional operations and follow Google-recommended practices. How should you configure the network for database connectivity?
A. Provision a Shared VPC project where both the application project and the AlloyDB project are service projects.
B. Use AlloyDB Auth Proxy and configure the application project’s firewall to allow connections to port 5433.
C. Provision a service account from the AlloyDB project. Use this service account’s JSON key file as the --credentials-file to connect to the AlloyDB instance.
D. Ask the database team to provision AlloyDB databases in the same project and network as the application.
Show Answer
Correct Answer: A
Explanation: AlloyDB is accessed over private IP and relies on VPC-level connectivity (via Private Service Access or Private Service Connect). To securely connect applications in a different project while keeping projects isolated and minimizing operational overhead, Google-recommended practice is to use a Shared VPC where both the application project and the AlloyDB project are service projects. This provides native, private network connectivity without proxies or credential management. The AlloyDB Auth Proxy handles authentication, not cross-project network connectivity, and therefore does not replace proper VPC design.
$19
Get all 357 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.