Professional Cloud Developer Free Practice Questions — Page 4
Question 31
You are designing a microservices architecture for a new application that will be deployed on Cloud Run. The application requires high-throughput communication between the internal microservices. You want to use the most effective, lowest latency communication protocol for this application. What should you do?
A. Configure the Cloud Run service to use HTTP/2. Implement gRPC for communication between the microservices. Use streaming gRPCs when a large amount of data has to be sent.
B. Implement the microservices with the REST API communication protocol. Use Apigee with rate-limiting to provide the best QoS for high-priority services.
C. Use SOAP to build the microservices API, and use XML as the data format for communication across the microservices. Define SOAP data contracts for each microservice.
D. Use HTTP REST to communicate across the microservices. Implement pagination and add indexing to your database.
Show Answer
Correct Answer: A
Explanation: gRPC over HTTP/2 is the preferred protocol for high-throughput, low-latency communication between internal microservices. HTTP/2 provides multiplexing, header compression, and efficient connection reuse, while gRPC uses compact Protocol Buffers and supports bidirectional and server/client streaming, making it more efficient than REST or SOAP for service-to-service communication. Apigee, SOAP, pagination, and database indexing do not address the core requirement of minimizing communication latency between Cloud Run microservices.
Question 32
Your company manages an application that captures stock data in an internal database. You need to create an API that provides real-time stock data to users. You want to return stock data to users as quickly as possible, and you want your solution to be highly scalable. What should you do?
A. Create a BigQuery dataset and table to act as the internal database. Query the table when user requests are received.
B. Create a Memorystore for Redis instance to store all stock market data. Query this database when user requests are received.
C. Create a Bigtable instance. Query the table when user requests are received. Configure a Pub/Sub topic to queue user requests that your API will respond to.
D. Create a Memorystore for Redis instance, and use this database to store the most accessed stock data. Query this instance first when user requests are received, and fall back to the internal database.
Show Answer
Correct Answer: D
Explanation: Using an in-memory Redis cache for the hottest stock data provides the lowest latency for the majority of requests while allowing the authoritative internal database to remain the source of truth. Querying Redis first and falling back to the internal database is a standard highly scalable cache-aside pattern. BigQuery is an analytical data warehouse, not suited for low-latency transactional lookups. Redis alone is not an ideal primary persistent store for all stock data. Bigtable is a scalable low-latency database, but adding Pub/Sub to queue synchronous user requests would increase latency rather than improve real-time API responses.
Question 33
You are using the latest stable version of Python 3 to develop an API that stores data in a Cloud SQL database. You need to perform CRUD operations on the production database securely and reliably with minimal effort. What should you do?
A. 1. Use Cloud Composer to manage the connection to the Cloud SQL database from your Python application. 2. Grant an IAM role to the service account that includes the composer.worker permission.
B. 1. Use the Cloud SQL API to connect to the Cloud SQL database from your Python application. 2. Grant an IAM role to the service account that includes the cloudsql.instances.login permission.
C. 1. Use the Cloud SQL connector library for Python to connect to the Cloud SQL database through a Cloud SQL Auth Proxy. 2. Grant an IAM role to the service account that includes the cloudsql.instances.connect permission.
D. 1. Use the Cloud SQL emulator to connect to the Cloud SQL database from Cloud Shell 2. Grant an IAM role to the user that includes the cloudsql.instances.login permission.
Show Answer
Correct Answer: C
Explanation: The recommended approach for Python applications is to use the Cloud SQL Python Connector (Cloud SQL connector library), which provides secure, IAM-authenticated connectivity and works with the Cloud SQL Auth Proxy mechanism, minimizing connection management effort. The service account needs permission to connect to the instance, provided by the Cloud SQL Client role, which includes the cloudsql.instances.connect permission. The other options reference inappropriate services, APIs, permissions, or nonexistent components for application database connectivity.
Question 34
Your team has created an application that is hosted on a GKE cluster. You need to connect the application to a REST service that is deployed in two GKE clusters in two different regions. How should you set up the connection and health checks? (Choose two.)
A. Use Cloud Service Mesh with sidecar proxies to connect the application to the REST service.
B. Use Cloud Service Mesh with proxyless gRPC to connect the application to the REST service.
C. Configure the REST service's firewall to allow health checks originating from the GKE service’s IP ranges.
D. Configure the REST service's firewall to allow health checks originating from the GKE control plane’s IP ranges.
E. Configure the REST service's firewall to allow health checks originating from the GKE check probe’s IP ranges.
Show Answer
Correct Answer: A, E
Explanation: For connecting services across multiple GKE clusters and regions, Cloud Service Mesh with sidecar proxies is the standard approach for HTTP/REST services, providing service discovery, traffic management, and mTLS. Proxyless gRPC is specific to gRPC workloads and is not appropriate for a REST service. For health checks to reach the service, firewall rules must allow the health check probe source ranges used for GKE load balancer health checks rather than the control plane or generic service IP ranges.
Question 35
Your infrastructure team uses Terraform Cloud and manages Google Cloud resources by using Terraform configuration files. You want to configure an infrastructure as code pipeline that authenticates to Google Cloud APIs. You want to use the most secure approach and minimize changes to the configuration. How should you configure the authentication?
A. Use Terraform on GKE. Create a Kubernetes service account to execute the Terraform code. Use workload identity federation to authenticate as the Google service account.
B. Install Terraform on a Compute Engine VM. Configure the VM by using a service account that has the required permissions to manage the Google Cloud resources.
C. Configure Terraform Cloud to use workload identity federation to authenticate to the Google Cloud APIs.
D. Create a service account that has the required permissions to manage the Google Cloud resources, and import the service account key to Terraform Cloud. Use this service account to authenticate to the Google Cloud APIs.
Show Answer
Correct Answer: C
Explanation: Workload Identity Federation is the recommended and most secure authentication method for Terraform Cloud because it avoids long-lived service account keys and allows Terraform Cloud to obtain short-lived credentials to impersonate a Google service account with the required IAM permissions. This requires minimal changes to existing Terraform configuration compared with moving execution to GKE or Compute Engine, and is more secure than importing a service account key.
Question 36
You have an application running on a GKE cluster. Your application has a stateless web frontend, and has a high-availability requirement. Your cluster is set to automatically upgrade, and some of your nodes need to be drained. You need to ensure that the application has a serving capacity of 10% of the Pods prior to the drain. What should you do?
A. Configure a Vertical Pod Autoscaler (VPA) to increase the memory and CPU by 10% and set the updateMode to Auto.
B. Configure the Pod replica count to be 10% more than the current replica count.
C. Configure a Pod Disruption Budget (PDB) value to have a minAvailable value of 10%.
D. Configure the Horizontal Pod Autoscaler (HPA) maxReplicas value to 10% more than the current replica count.
Show Answer
Correct Answer: C
Explanation: A Pod Disruption Budget (PDB) is the Kubernetes mechanism that controls voluntary disruptions such as node drains during GKE automatic upgrades. Setting a PDB with minAvailable ensures that at least the specified number or percentage of Pods remains available before evictions proceed. VPA and HPA do not guarantee extra serving capacity before a drain, and simply increasing replica count is not enforced during node drain operations.
Question 37
You are a developer at a large organization. Your team uses Git for source code management (SCM). You want to ensure that your team follows Google-recommended best practices to manage code to drive higher rates of software delivery. Which SCM process should your team use?
A. Each developer commits their code to the main branch before each product release, conducts testing, and rolls back if integration issues are detected.
B. Each group of developers copies the repository, commits their changes to their repository, and merges their code into the main repository before each product release.
C. Each developer creates a branch for their own work, commits their changes to their branch, and merges their code into the main branch daily.
D. Each group of developers creates a feature branch from the main branch for their work, commits their changes to their branch, and merges their code into the main branch before each major release.
Show Answer
Correct Answer: C
Explanation: Google's recommended SCM practice aligns with trunk-based development: developers work in short-lived branches, integrate frequently (ideally daily), and merge into the main branch continuously. Frequent integration reduces merge conflicts, supports continuous integration, and improves software delivery performance. The other options delay integration until releases or major milestones, increasing integration risk and slowing feedback.
Question 38
You are responsible for developing a new ecommerce application that is running on Cloud Run. You need to connect your application to a Cloud SQL database that is in a separate project. This project is on an isolated network dedicated to multiple databases without a public IP. You need to connect your application to this database. What should you do?
A. Create a Private Service Connect endpoint on your network. Create a Serverless VPC Access connector on your project. Use Cloud SQL Language Connectors to create an internal connection.
B. Configure VPC Network Peering between both networks. In Cloud Run, create a Cloud SQL connection that uses the internal IP. Use Cloud SQL Language Connectors to interact with the database.
C. Configure private services access on your project. In Cloud Run, create a Cloud SQL connection. Use Cloud SQL Language Connectors to interact with the database.
D. Create a subnet on your VPC. Create a Serverless VPC Access connector on your project using the new subnet. In Cloud Run, create a Cloud SQL connection. Use Cloud SQL Language Connectors to interact with the database.
Show Answer
Correct Answer: A
Explanation: For a Cloud Run service connecting to a Cloud SQL instance that has only a private IP and resides in a separate project on an isolated network, the recommended modern approach is to provide private connectivity with Private Service Connect, use a Serverless VPC Access connector for Cloud Run to reach the VPC, and connect using the Cloud SQL language connectors. VPC peering is not the recommended pattern for this use case, private services access is for provisioning private managed services rather than application connectivity, and creating only a Serverless VPC Access connector does not by itself establish cross-project network connectivity.
Sources:
https://cloud.google.com/sql/mysql
Question 39
You have an on-premises containerized service written in the current stable version of Python 3 that is available only to users in the United States. The service has high traffic during the day and no traffic at night. You need to migrate this application to Google Cloud and track error logs after the migration in Error Reporting. You want to minimize the cost and effort of these tasks. What should you do?
A. Deploy the code on Cloud Run. Configure your code to write errors to standard error.
B. Deploy the code on Cloud Run. Configure your code to stream errors to a Cloud Storage bucket.
C. Deploy the code on a GKE Autopilot cluster. Configure your code to write error logs to standard error.
D. Deploy the code on a GKE Autopilot cluster. Configure your code to write error logs to a Cloud Storage bucket.
Show Answer
Correct Answer: A
Explanation: Cloud Run is the lowest-effort, cost-effective choice for a containerized Python service with spiky daytime traffic because it scales to zero when idle. Cloud Run automatically integrates with Cloud Logging, and writing errors to standard error allows Error Reporting to ingest and group application errors without additional infrastructure. GKE Autopilot has higher operational overhead and does not scale to zero in the same way for this use case, while writing logs to Cloud Storage does not integrate directly with Error Reporting.
Question 40
Your team plans to use AlloyDB as their database backend for an upcoming application release. Your application is currently hosted in a different project and network than the AlloyDB instances. You need to securely connect your application to the AlloyDB instance while keeping the projects isolated. You want to minimize additional operations and follow Google-recommended practices. How should you configure the network for database connectivity?
A. Provision a Shared VPC project where both the application project and the AlloyDB project are service projects.
B. Use AlloyDB Auth Proxy and configure the application project’s firewall to allow connections to port 5433.
C. Provision a service account from the AlloyDB project. Use this service account’s JSON key file as the --credentials-file to connect to the AlloyDB instance.
D. Ask the database team to provision AlloyDB databases in the same project and network as the application.
Show Answer
Correct Answer: A
Explanation: Shared VPC is the recommended way to provide network connectivity between isolated projects while keeping project separation. AlloyDB still requires private connectivity (such as Private Service Connect or Private Services Access depending on the deployment), but among the given options only Shared VPC correctly addresses the cross-project networking requirement. The Auth Proxy provides authentication and encryption but does not replace the underlying network path. Using a service account key does not establish connectivity, and moving the database into the application project breaks the stated isolation requirement.
Sources:
https://medium.com/google-cloud/private-connectivity-for-alloydb-vpc-peering-vs-private-service-connect-3ddf24c64ab6
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.