Professional Cloud Developer Free Practice Questions — Page 5
Question 26
You are developing an online chat application where users can upload profile pictures. Uploaded profile pictures must comply with content policies. You need to detect inappropriate images and label those images automatically when they are uploaded. In the future, this process will need to be expanded to include additional processing tasks such as watermarking and image compression.
You want to simplify orchestration and minimize operational overhead of the image scanning and labeling steps while also ensuring that additional steps can be added and removed easily later on. What should you do?
A. Save user-uploaded images to a temporary Cloud Storage bucket. Implement code on the backend server to retrieve the image content and call the Vision API to process each new uploaded image.
B. Save user-uploaded images to a Cloud Storage bucket. Configure a Cloud Function that is triggered when a new image is uploaded and calls one or more Cloud Run services. Create additional Cloud Run services that call the Vision API to process each new uploaded image.
C. Save user-uploaded images to a Cloud Storage bucket. Configure a Cloud Function that is triggered when a new image is uploaded and publishes a message to a Pub/Sub topic. Deploy microservices in GKE that subscribe to the Pub/Sub topic and call the Vision API to process each new uploaded image.
D. Save user-uploaded images to a Cloud Storage bucket. Create an Eventarc trigger that connects the bucket to the Workflows event receiver when a new image is uploaded. Create a workflow in Workflows with multiple Cloud Functions that call the Vision API to process each new uploaded image.
Show Answer
Correct Answer: D
Explanation: Workflows is designed to orchestrate multiple serverless processing steps with minimal operational overhead. Using Eventarc to trigger a Workflow from Cloud Storage events provides a clean event-driven architecture where individual processing steps (implemented as Cloud Functions) can be added, removed, or reordered easily. This fits the requirement for future extensibility better than embedding orchestration in application code, chaining Cloud Run manually, or managing GKE microservices.
Question 27
You are developing a new ecommerce website for your company. You want customers to receive a customized email notification when they place an order. You need to configure this email service while minimizing deployment effort. What should you do?
A. Create a Cloud Function that is triggered by a create type event in Firestore,
B. Create an email-sending application hosted on Compute Engine that is invoked by an HTTP request.
C. Create an email notification channel, and set up an alerting policy that is based on log metrics from a create type event.
D. Use Pub/Sub to send an email when the orders/ API returns an HTTP response of 200 OK.
Show Answer
Correct Answer: A
Explanation: A Cloud Function triggered by a Firestore document creation is the lowest-effort, event-driven solution. When a new order is written to Firestore, the function automatically executes and can call an email service (such as SendGrid) to send a customized confirmation email. This avoids managing servers. Compute Engine requires infrastructure management, Cloud Monitoring alerting is intended for operational alerts rather than customer notifications, and Pub/Sub triggered only by an HTTP 200 response is not the appropriate event source for customized order emails.
Question 28
You are deploying a microservices application to GKE. One microservice needs to download files from a Cloud Storage bucket. You have an IAM service account with the Storage Object Viewer role on the project with the bucket. You need to configure your application to access the Cloud Storage bucket while following Google-recommended practices. What should you do?
A. Assign the IAM service account to the cluster’s node pool. Configure the application to authenticate to the bucket by using Application Default Credentials.
B. Assign the IAM service account to the cluster’s node pool. Encrypt the IAM service account key file by using a symmetric block cipher, and store the encrypted file on a persistent volume. Store the encryption key in Secret Manager.
C. Create a Kubernetes service account. Create a Kubernetes secret with a base64-encoded IAM service account key file. Annotate the Kubernetes secret with the Kubernetes service account. Assign the Kubernetes ServiceAccount to the Pods that need to access the bucket.
D. Create a Kubernetes service account. Use an IAM policy to bind the IAM service account to a Kubernetes service account. Annotate the Kubernetes ServiceAccount object with the name of the bound IAM service account. Assign the Kubernetes ServiceAccount to the Pods that need to access the bucket.
Show Answer
Correct Answer: D
Explanation: The recommended practice for GKE is Workload Identity (or Workload Identity Federation for GKE), which maps a Kubernetes ServiceAccount to an IAM service account without using long-lived service account keys. Create a Kubernetes ServiceAccount, bind it to the IAM service account with the appropriate IAM policy, annotate the Kubernetes ServiceAccount with the IAM service account, and run the Pods using that Kubernetes ServiceAccount. This allows Application Default Credentials to obtain short-lived credentials securely.
Question 29
You recently developed an application that will be hosted on Cloud Run. You need to conduct a load test. You want to analyze the load test logs second by second to understand your Cloud Run service's response to rapid traffic spikes. You want to minimize effort. How should you analyze the logs?
A. Use estimation to extrapolate performance from summary monitoring charts.
B. Analyze the log data in BigQuery by configuring a BigQuery log sink with the appropriate inclusion filter for your application.
C. Use Cloud Monitoring’s default log console for analysis.
D. Analyze the log data in Cloud SQL for PostgreSQL by pushing logs to a Pub/Sub topic. Use Dataflow to process and ingest the logs.
Show Answer
Correct Answer: B
Explanation: Configuring a Cloud Logging sink to BigQuery enables detailed SQL analysis of log entries with second-level timestamp granularity, making it well suited for examining Cloud Run behavior during rapid traffic spikes with minimal operational effort. Estimation from summary charts lacks the needed precision, the default log console is not ideal for this level of analysis, and building a Pub/Sub/Dataflow/Cloud SQL pipeline is unnecessarily complex.
Question 30
Your company recently modernized their monolith ecommerce site to a microservices application in GKE. Your team uses Google Cloud's operations suite for monitoring and logging. You want to improve the logging indexing and searchabilty in Cloud Logging across your microservices with the least amount of effort. What should you do?
A. Ask the SRE team to enable Managed Service for Prometheus on your GKE cluster.
B. Reconfigure your applications to write logs to an emptyDir volume. Configure a sidecar agent to read the logs and send them to the Cloud Logging API.
C. Update your microservices code to emit logs in JSON format.
D. Instrument your microservices code with OpenTelemetry libraries.
Show Answer
Correct Answer: C
Explanation: Structured JSON logging enables Cloud Logging to automatically parse log fields into jsonPayload, making them indexed and searchable with minimal application changes. Managed Service for Prometheus is for metrics, OpenTelemetry is primarily for instrumentation and tracing/metrics (and is more effort), and using a sidecar with emptyDir changes log collection but does not itself improve indexing/searchability like structured logging does.
Question 31
You are designing a microservices architecture for a new application that will be deployed on Cloud Run. The application requires high-throughput communication between the internal microservices. You want to use the most effective, lowest latency communication protocol for this application. What should you do?
A. Configure the Cloud Run service to use HTTP/2. Implement gRPC for communication between the microservices. Use streaming gRPCs when a large amount of data has to be sent.
B. Implement the microservices with the REST API communication protocol. Use Apigee with rate-limiting to provide the best QoS for high-priority services.
C. Use SOAP to build the microservices API, and use XML as the data format for communication across the microservices. Define SOAP data contracts for each microservice.
D. Use HTTP REST to communicate across the microservices. Implement pagination and add indexing to your database.
Show Answer
Correct Answer: A
Explanation: gRPC over HTTP/2 is the preferred protocol for high-throughput, low-latency communication between internal microservices. HTTP/2 provides multiplexing, header compression, and efficient connection reuse, while gRPC uses compact Protocol Buffers and supports bidirectional and server/client streaming, making it more efficient than REST or SOAP for service-to-service communication. Apigee, SOAP, pagination, and database indexing do not address the core requirement of minimizing communication latency between Cloud Run microservices.
Question 32
Your company manages an application that captures stock data in an internal database. You need to create an API that provides real-time stock data to users. You want to return stock data to users as quickly as possible, and you want your solution to be highly scalable. What should you do?
A. Create a BigQuery dataset and table to act as the internal database. Query the table when user requests are received.
B. Create a Memorystore for Redis instance to store all stock market data. Query this database when user requests are received.
C. Create a Bigtable instance. Query the table when user requests are received. Configure a Pub/Sub topic to queue user requests that your API will respond to.
D. Create a Memorystore for Redis instance, and use this database to store the most accessed stock data. Query this instance first when user requests are received, and fall back to the internal database.
Show Answer
Correct Answer: D
Explanation: Using an in-memory Redis cache for the hottest stock data provides the lowest latency for the majority of requests while allowing the authoritative internal database to remain the source of truth. Querying Redis first and falling back to the internal database is a standard highly scalable cache-aside pattern. BigQuery is an analytical data warehouse, not suited for low-latency transactional lookups. Redis alone is not an ideal primary persistent store for all stock data. Bigtable is a scalable low-latency database, but adding Pub/Sub to queue synchronous user requests would increase latency rather than improve real-time API responses.
Question 33
You are using the latest stable version of Python 3 to develop an API that stores data in a Cloud SQL database. You need to perform CRUD operations on the production database securely and reliably with minimal effort. What should you do?
A. 1. Use Cloud Composer to manage the connection to the Cloud SQL database from your Python application. 2. Grant an IAM role to the service account that includes the composer.worker permission.
B. 1. Use the Cloud SQL API to connect to the Cloud SQL database from your Python application. 2. Grant an IAM role to the service account that includes the cloudsql.instances.login permission.
C. 1. Use the Cloud SQL connector library for Python to connect to the Cloud SQL database through a Cloud SQL Auth Proxy. 2. Grant an IAM role to the service account that includes the cloudsql.instances.connect permission.
D. 1. Use the Cloud SQL emulator to connect to the Cloud SQL database from Cloud Shell 2. Grant an IAM role to the user that includes the cloudsql.instances.login permission.
Show Answer
Correct Answer: C
Explanation: The recommended approach for Python applications is to use the Cloud SQL Python Connector (Cloud SQL connector library), which provides secure, IAM-authenticated connectivity and works with the Cloud SQL Auth Proxy mechanism, minimizing connection management effort. The service account needs permission to connect to the instance, provided by the Cloud SQL Client role, which includes the cloudsql.instances.connect permission. The other options reference inappropriate services, APIs, permissions, or nonexistent components for application database connectivity.
Question 34
Your team has created an application that is hosted on a GKE cluster. You need to connect the application to a REST service that is deployed in two GKE clusters in two different regions. How should you set up the connection and health checks? (Choose two.)
A. Use Cloud Service Mesh with sidecar proxies to connect the application to the REST service.
B. Use Cloud Service Mesh with proxyless gRPC to connect the application to the REST service.
C. Configure the REST service's firewall to allow health checks originating from the GKE service’s IP ranges.
D. Configure the REST service's firewall to allow health checks originating from the GKE control plane’s IP ranges.
E. Configure the REST service's firewall to allow health checks originating from the GKE check probe’s IP ranges.
Show Answer
Correct Answer: A, E
Explanation: For connecting services across multiple GKE clusters and regions, Cloud Service Mesh with sidecar proxies is the standard approach for HTTP/REST services, providing service discovery, traffic management, and mTLS. Proxyless gRPC is specific to gRPC workloads and is not appropriate for a REST service. For health checks to reach the service, firewall rules must allow the health check probe source ranges used for GKE load balancer health checks rather than the control plane or generic service IP ranges.
Question 35
Your infrastructure team uses Terraform Cloud and manages Google Cloud resources by using Terraform configuration files. You want to configure an infrastructure as code pipeline that authenticates to Google Cloud APIs. You want to use the most secure approach and minimize changes to the configuration. How should you configure the authentication?
A. Use Terraform on GKE. Create a Kubernetes service account to execute the Terraform code. Use workload identity federation to authenticate as the Google service account.
B. Install Terraform on a Compute Engine VM. Configure the VM by using a service account that has the required permissions to manage the Google Cloud resources.
C. Configure Terraform Cloud to use workload identity federation to authenticate to the Google Cloud APIs.
D. Create a service account that has the required permissions to manage the Google Cloud resources, and import the service account key to Terraform Cloud. Use this service account to authenticate to the Google Cloud APIs.
Show Answer
Correct Answer: C
Explanation: Workload Identity Federation is the recommended and most secure authentication method for Terraform Cloud because it avoids long-lived service account keys and allows Terraform Cloud to obtain short-lived credentials to impersonate a Google service account with the required IAM permissions. This requires minimal changes to existing Terraform configuration compared with moving execution to GKE or Compute Engine, and is more secure than importing a service account key.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.