Professional Cloud Developer Free Practice Questions — Page 4
Question 15
Your application is deployed in a Google Kubernetes Engine (GKE) cluster. When a new version of your application is released, your CI/CD tool updates the spec.template.spec.containers[0].image value to reference the Docker image of your new application version. When the Deployment object applies the change, you want to deploy at least 1 replica of the new version and maintain the previous replicas until the new replica is healthy.
Which change should you make to the GKE Deployment object shown below?
A. Set the Deployment strategy to RollingUpdate with maxSurge set to 0, maxUnavailable set to 1.
B. Set the Deployment strategy to RollingUpdate with maxSurge set to 1, maxUnavailable set to 0.
C. Set the Deployment strategy to Recreate with maxSurge set to 0, maxUnavailable set to 1.
D. Set the Deployment strategy to Recreate with maxSurge set to 1, maxUnavailable set to 0.
Show Answer
Correct Answer: B
Explanation: Use a RollingUpdate strategy with maxSurge: 1 and maxUnavailable: 0. The Deployment can create one extra new-version replica, while keeping all existing replicas available until the new replica is ready; it can then continue replacing the old replicas.
Question 16
You work for an ecommerce company. You are developing a new application with the following requirements:
• The application must have access to the most up-to-date data at all times.
• Due to company policy, data older than 30 days must be automatically deleted.
You need to determine which service should host the database, and how to configure the data deletion. You want to use the most efficient solution. What should you do?
A. Configure Spanner to host the database. Use Data Catalog to delete data older than 30 days.
B. Configure Spanner to host the database. Create a time-to-live policy that deletes data older than 30 days.
C. Configure Bigtable to host the database. Create a time-to-live policy that deletes data older than 30 days.
D. Configure Bigtable to host the database. Create a garbage collection policy in Bigtable that deletes data older than 30 days.
Show Answer
Correct Answer: B
Explanation: Cloud Spanner is the appropriate choice for an ecommerce application that requires strongly consistent, ACID-compliant access to the most up-to-date data. Cloud Spanner supports built-in row deletion through Time-to-Live (TTL) policies, allowing automatic deletion of data older than 30 days. Bigtable's garbage collection is designed for storage cleanup and does not provide the same transactional relational capabilities required for this scenario.
Question 17
You are developing a dashboard that aggregates temperature readings from thousands of IoT devices monitoring a city's ambient temperature. You expect a large amount of viewing traffic resulting in a large amount of data egress once the dashboard is live. The dashboard temperature display data doesn't need to be real-time and can tolerate a few seconds of lag. You decide to deploy Memorystore for Redis as the storage backend. You want to ensure that the dashboard will be highly available. How should you configure the service in Memorystore for Redis?
A. Update Memorystore for Redis to the latest version.
B. Configure Memorystore to use read replicas.
C. Use Private Service Access to enable low-latency network throughput.
D. Set up Serverless VPC Access to avoid receiving traffic over the internet.
Show Answer
Correct Answer: B
Explanation: Read replicas allow a read-heavy workload to scale by serving read requests from replicas while improving availability. The dashboard tolerates slight replication lag, making read replicas an appropriate fit. The other options do not address scaling read traffic and high availability for this use case.
Question 18
You are deploying a containerized application to GKE. You have set up a build pipeline by using Cloud Build that builds a Java application and pushes the application container image to Artifact Registry. Your build pipeline executes multiple sequential steps that reference Docker container images with the same layers.
You notice that the Cloud Build pipeline runs are taking longer than expected to complete. How should you optimize the Docker image build process?
A. Add the --squash parameter to the Docker build steps to combine newly built layers into a single layer.
B. Configure Cloud Build to use a private pool in your VPC for pipeline executions.
C. Specify the cached image by adding the --cache-from argument in your build config file with the image as a cache source.
D. Store container artifacts on Cloud Storage. Configure Cloud CDN on the Cloud Storage bucket to enable caching on edge locations.
Show Answer
Correct Answer: C
Explanation: Cloud Build runs each build on a fresh worker, so the local Docker layer cache is not preserved between builds. Using the Docker build --cache-from option allows Docker to reuse layers from a previously built image stored in Artifact Registry, significantly reducing build time when many layers are unchanged. The other options do not address Docker layer cache reuse: --squash reduces image layers but not build caching, private pools primarily affect isolation/networking, and Cloud CDN with Cloud Storage is unrelated to container image build caching.
Question 19
You developed a Python script that retrieves information from files that are uploaded to Cloud Storage and writes the information to Bigtable. You have completed testing on your local environment and created the python-script service account with the Bigtable User IAM role. You want to deploy the code with the appropriate authentication while following Google-recommended practices. What should you do?
A. 1. Deploy your code to Cloud Functions. Create a Cloud Storage trigger. 2. Configure IAM binding for authentication.
B. 1. Deploy your code to Cloud Functions. Create a Cloud Storage trigger. 2. Create a service account key for authentication
C. 1. Deploy your image to Cloud Run. Create a trigger in Cloud Scheduler that triggers the service every minute. 2. Configure IAM binding for authentication.
D. 1. Deploy your image to Cloud Run. Create a trigger in Cloud Scheduler that triggers the service every minute. 2. Create a service account key for authentication.
Show Answer
Correct Answer: A
Explanation: Use an event-driven Cloud Function triggered by Cloud Storage object uploads. Authenticate using the function's attached service account with the required Bigtable IAM role (IAM binding), which follows Google-recommended practice of avoiding long-lived service account keys. Cloud Scheduler is inappropriate because the workload is event-driven, and creating service account keys is discouraged.
Question 20
You are responsible for improving the security of your Cloud Run services to protect these services against supply chain threats. You need to ensure that there are adequate security controls such as SLSA Level 3 builds for container images and non-falsifiable provenance for container images by using Google Cloud tools. What should you do?
A. Ask developers to build container images locally and ensure strict version controls by using Container Registry.
B. Use Cloud Build to build container images. Configure a Binary Authorization policy on the Cloud Run job.
C. Use Cloud Deploy to generate authenticated and non-falsifiable build provenance for container images.
D. Use Cloud Build to build container images. Use Cloud Scheduler to automate delivery of your applications to a series of target environments in a defined sequence.
Show Answer
Correct Answer: B
Explanation: Cloud Build provides out-of-the-box SLSA Level 3 builds for container images and generates authenticated, non-falsifiable build provenance. To protect Cloud Run deployments, enforce trust with Binary Authorization policies. Cloud Deploy is a deployment service and does not generate the build provenance itself.
Sources:
https://cloud.google.com/software-supply-chain-security/docs/overview
https://cloud.google.com/security/solutions/software-supply-chain-security
Question 22
You are designing a microservices application on GKE that will expose a public API to users. Users will interact with the application by using OAuth 2.0, and illegitimate requests should receive a 403 response code. You need the API to be resilient against distributed denial of service (DDoS) attacks and critical security risks such as SQL injection (SQL) and cross-site scripting (XSS).
You want to design the application's architecture while following Google-recommended practices. What should you do?
A. Install Service Mesh in your GKE cluster. Configure Service Mesh user authentication to integrate the service hosted on GKE by using an OpenID Connect-compliant identity provider. Expose the application externally by using an Istio Ingress Gateway. Use VPC firewall rules to restrict Ingress traffic to the Ingress gateway.
B. Run an Apache HTTP server on Cloud Run to expose a service with a public IP address. Configure the Apache HTTP server as a reverse proxy to only forward valid requests to the API hosted on GKE.
C. Use an external Application Load Balancer with Cloud Armor. Integrate Cloud Armor with reCAPTCHA Enterprise. Configure the load balancer to forward traffic to the application hosted on GKE.
D. Use an external Application Load Balancer with Cloud Armor, and configure the load balancer to forward requests to Apigee to check the validity of the API requests. Configure GKE as the application's backend.
Show Answer
Correct Answer: C
Explanation: An external Application Load Balancer with Cloud Armor is the Google-recommended front end for public GKE services requiring DDoS protection and WAF capabilities. Cloud Armor provides protection against volumetric attacks and can enforce preconfigured WAF rules that mitigate common web exploits such as SQL injection and XSS. Integration with reCAPTCHA Enterprise helps distinguish legitimate users from abusive traffic. OAuth 2.0 authentication is handled by the application/API, while Cloud Armor protects the edge and forwards valid traffic to GKE.
Question 23
Your team runs a Python job that reads millions of customer record files stored in a Cloud Storage bucket. To comply with regulatory requirements, you need to ensure that customer data is immediately deleted once the job is completed. You want to minimize the time required to complete this task. What should you do?
A. Add a final step in the job that deletes all the objects in the bucket in bulk by using batch requests to the Cloud Storage API.
B. Configure Object Lifecycle Management on the Cloud Storage bucket that deletes all the objects in the bucket at the end of the job execution.
C. Remove the bucket from the Google Cloud console when the job is completed
D. Use the gcloud CLI to execute the gcloud storage rm --recursive gs://BUCKET_NAME/ command.
Show Answer
Correct Answer: A
Explanation: Option A is correct because it performs explicit deletion immediately after the job completes and uses batch requests to reduce API overhead when deleting many objects. Object Lifecycle Management does not guarantee immediate deletion at job completion, deleting the bucket is unnecessary and may fail if objects remain, and using a recursive CLI delete is generally less efficient and not integrated into the job flow for minimizing completion time.
Question 24
You have a Cloud Run service that needs to connect to a Cloud SQL instance in a different project. You provisioned the Cloud Run service account with the Cloud SQL Client IAM role on the project that is hosting Cloud SQL. However, when you test the connection, the connection fails. You want to fix the connection failure while following Google-recommended practices. What should you do?
A. Add the cloudsql.instances.connect IAM permission to the Cloud Run service account.
B. Request additional API quota for Cloud SQL Auth Proxy,
C. Enable the Cloud SQL Admin API in both projects.
D. Migrate the Cloud SQL instance into the same project as the Cloud Run service.
Show Answer
Correct Answer: C
Explanation: For Cloud Run to connect to a Cloud SQL instance across projects using the Cloud SQL connector/Auth Proxy integration, the Cloud SQL Client role already grants the required connect permission. A common cross-project requirement is that the Cloud SQL Admin API be enabled in both the Cloud Run project and the Cloud SQL project so the connector can retrieve instance connection metadata. Additional quota is unrelated, and migrating the instance is unnecessary.
Question 25
You are compiling a compliance report on vulnerability metadata for a specific set of images identified by Artifact Analysis. Metadata from images scanned more than 30 days ago are missing from the compliance report. You need to access the vulnerability metadata for these older images. What should you do?
A. Create a Pub/Sub subscription to pull from Artifact Analysis topics.
B. Check Artifact Analysis storage buckets in Cloud Storage.
C. Push or pull the images from Artifact Registry.
D. Check Cloud Trace logs for Artifact Analysis findings.
Show Answer
Correct Answer: C
Explanation: Artifact Analysis retains vulnerability occurrences for a limited period. To regenerate vulnerability metadata for older images, you need to trigger a new scan by pushing or pulling the images from Artifact Registry. Pub/Sub does not provide historical data, Cloud Trace is unrelated, and there are no user-accessible Artifact Analysis Cloud Storage buckets for archived findings.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
