Professional Cloud Developer Free Practice Questions — Page 6
Question 51
You are about to deploy an application hosted on a Compute Engine instance with Windows OS and Cloud SQL. You plan to use the Cloud SQL Auth Proxy for connectivity to the Cloud SQL instance. You plan to follow Google-recommended practices and the principle of least privilege. You have already created a custom service account. What should you do next?
A. Create and assign a custom role with the cloudsql.instances.connect permission to the custom service account. Adjust the Cloud SQL Auth Proxy start command to specify your instance connection name.
B. Grant the custom service account the roles/cloudsql.client role. Adjust the Cloud SQL Auth Proxy start command to use the --unix-socket CLI option.
C. Grant the custom service account the roles/cloudsql.editor role.
D. Grant the custom service account the roles/cloudsql.viewer role. Adjust the Cloud SQL Auth Proxy start command to specify your instance connection name.
Show Answer
Correct Answer: A
Explanation: The Cloud SQL Auth Proxy requires the ability to connect to and retrieve instance metadata. The predefined roles/cloudsql.client includes the needed permissions, but option B is invalid because it instructs use of the --unix-socket option, which is not supported on Windows. The editor role is overly broad, and the viewer role lacks connect permission. A grants the minimal required connect permission via a custom role and correctly specifies using the instance connection name for the proxy.
Question 52
You are developing a new API that creates requests on an asynchronous message service. Requests will be consumed by different services. You need to expose the API by using a gRPC interface while minimizing infrastructure management overhead. How should you deploy the API?
A. Deploy your API to App Engine. Create a Pub/Sub topic, and configure your API to push messages to the topic.
B. Deploy your API as a Cloud Run service. Create a Pub/Sub topic, and configure your API to push messages to the topic.
C. Deploy your API to a GKE cluster. Create a Kafka cluster, and configure your API to write messages to the cluster.
D. Deploy your API on a Compute Engine instance. Create a Kafka cluster, and configure your API to write messages to the cluster.
Show Answer
Correct Answer: B
Explanation: Cloud Run natively supports gRPC services over HTTP/2 and is fully managed, minimizing infrastructure management. Pub/Sub is the managed asynchronous messaging service for decoupled consumers. App Engine does not natively support serving gRPC APIs in the same way, while GKE/Compute Engine with Kafka requires significantly more infrastructure management.
Question 53
Your organization has users and groups configured in an external identity provider (IdP). You want to leverage the same external IdP to allow Google Cloud console access to all employees. You also want to personalize the sign-in experience by displaying the user's name and photo when users access the Google Cloud console. What should you do?
A. Configure workforce identity federation with the external IdP, and set up attribute mapping.
B. Configure a service account for each individual by using the user name and photo, and grant permissions for each user to impersonate their respective service accounts.
C. Configure workload identity federation to get the external IdP tokens, and use these tokens to sign in to the Google Cloud console.
D. Create a Google group that includes organization email IDs for all users. Ask users to use the same name, work email ID, and password to register and sign in.
Show Answer
Correct Answer: A
Explanation: Workforce Identity Federation is designed for authenticating human users from an external identity provider to access Google Cloud. By configuring attribute mapping, user attributes such as display name and photo can be mapped from the external IdP, enabling a personalized Google Cloud console sign-in experience. Workload Identity Federation is for workloads, not human console access. Service accounts are not appropriate for interactive user sign-in, and creating Google accounts/groups does not provide federated authentication with the external IdP.
Question 54
You are developing an external-facing application on GKE that provides a streaming API to users. You want to offer two subscription tiers, “basic" and “premium", to users based on the number of API requests that each client application is allowed to make each day. You want to design the application architecture to provide subscription tiers to users while following Google-recommended practices. What should you do?
A. 1. Configure the service on GKE as a backend to an Apigee proxy. 2. Provide API keys to users to identify client applications. 3. Configure a Quota policy in Apigee for API keys based on the subscription tier.
B. 1. Configure the service on GKE as a backend to an Apigee proxy. 2. Provide API keys to users to identify client applications. 3. Configure a SpikeArrest policy in Apigee for API keys based on the subscription tier.
C. 1. Configure the service on GKE as a backend to two new projects, each with a separate Application Load Balancer. 2. Configure the quota "Queries per second (QPS) per region per network” for each project individually. 3. Provide users with API endpoints based on the subscription tier.
D. 1. Deploy the application to two GKE clusters, one for each subscription tier. Configure each cluster to have a separate Ingress. 2. Configure each cluster as a backend to an Apigee proxy. 3. Provide API keys to users to identify client applications. 4. Configure separate rate limits for client applications based on the subscription tier.
Show Answer
Correct Answer: A
Explanation: Use Apigee as the API gateway in front of the GKE service, identify client applications with API keys, and enforce daily request limits using the Apigee Quota policy. Quota is designed for subscription-based request allowances over a time interval (such as per day). SpikeArrest limits traffic spikes and requests per second, not daily quotas. The other options misuse infrastructure or duplicate deployments instead of using API management best practices.
Question 55
You need to deploy a new feature into production on Cloud Run. Your company’s SRE team mandates gradual deployments to avoid large downtimes caused by code change errors. You want to configure this deployment with minimal effort. What should you do?
A. Configure the application’s frontend load balancer to toggle between the new and old revisions.
B. Configure the application code to send a small percentage of users to the newly deployed revision.
C. Deploy the feature with “Serve this revision immediately” unchecked, and configure the new revision to serve a small percentage of traffic. Check for errors, and increase traffic to the revision as appropriate.
D. Deploy the feature with “Serve this revision immediately” checked. Check for errors, roll back to the previous revision, and repeat the process until you have verified that the deployment is bug-free.
Show Answer
Correct Answer: C
Explanation: Cloud Run natively supports gradual traffic migration between revisions. Deploy the new revision without immediately serving all traffic, then assign a small percentage of traffic to the new revision, monitor for errors, and progressively increase traffic as confidence grows. This satisfies gradual deployment requirements with minimal operational effort. Options A and B require custom infrastructure or application logic, and D performs an all-at-once deployment rather than a gradual rollout.
Question 56
Your ecommerce application has a rapidly growing user base, and it is experiencing performance issues due to excessive requests to your backend API. Your team develops and manages this API. The Cloud SQL backend database is struggling to handle the high demand, leading to latency and timeouts. You need to implement a solution that optimizes API performance and improves user experience. What should you do?
A. Use Apigee to expose your API. Use Memorystore for Redis to cache frequently accessed data. Implement exponential backoff in the application to retry failed requests.
B. Use Apigee to expose your API. Implement rate limiting and access control policies in Apigee to control API traffic. Use Pub/Sub to queue requests to prevent database overload.
C. Use Cloud Load Balancing to expose your API. Use Cloud CDN in front of the load balancer to cache responses. Implement exponential backoff to retry failed requests.
D. Use Cloud Load Balancing to expose your API. Increase the memory for the database instances to handle more concurrent requests. Implement a custom rate-limiting mechanism in your application code to control API requests.
Show Answer
Correct Answer: A
Explanation: The primary issue is excessive backend API requests causing Cloud SQL overload. Exposing the API through Apigee enables API management, while caching frequently accessed data in Memorystore for Redis reduces repeated database reads and significantly lowers load on Cloud SQL. Exponential backoff is a standard resilience pattern that prevents retry storms during transient failures. The other options either misuse Pub/Sub for synchronous API traffic, rely on Cloud CDN (which is suited to cache HTTP responses at the edge but is less appropriate for dynamic API/database-backed data than an application cache), or focus on scaling the database and custom rate limiting instead of reducing backend load efficiently.
Question 57
You are the lead developer for a company that provides a financial risk calculation API. The API is built on Cloud Run and has a gRPC interface. You frequently develop optimizations to the risk calculators. You want to enable these optimizations for select customers who registered to try out the optimizations prior to rolling out the optimization to all customers. Your CI/CD pipeline has built a new image and stored it in the Artifact Registry.
Which rollout strategy should you use?
A. Migrate the traffic to the new service by setting Cloud Run’s traffic split based on the percentage of registered customers.
B. Migrate the traffic to the new service by using a blue/green deployment approach.
C. Migrate the traffic to the new service by using a feature flag for registered customers.
D. Migrate the traffic to the new service and enable session affinity for Cloud Run.
Show Answer
Correct Answer: C
Explanation: Use a feature flag to enable the optimization only for registered customers while deploying the new revision. Cloud Run traffic splitting is percentage-based and cannot target specific customers. Blue/green deployment switches environments rather than selectively enabling features, and session affinity only keeps clients on the same instance/revision, not an opted-in cohort.
Question 58
You are developing a web application that will be deployed to production on Cloud Run. The application consists of multiple microservices, some of which will be publicly accessible and others that will only be accessible after authentication by Google identities. You need to ensure that only authenticated users can access the restricted services, while allowing unrestricted access to the public services of the application. You want to use the most secure approach while minimizing management overhead and complexity. How should you configure access?
A. Enable Identity-Aware Proxy (IAP) for all microservices. Develop a new microservice that checks the authentication requirements for each application and controls access to the respective services.
B. Enable Identity-Aware Proxy (IAP) for all microservices. Manage access control lists (ACLs) for the restricted services, and configure allAuthenticatedUsers access to the public services.
C. Use Cloud Endpoints with Firebase Authentication for all microservices. Configure Firebase rules to manage access control lists (ACLs) for each service, allowing access to the public services.
D. Configure separate Cloud Run services for the public and restricted microservices. Enable Identity-Aware Proxy (IAP) only for the restricted services, and configure the Cloud Run ingress settings to ‘Internal and Cloud Load Balancing’.
Show Answer
Correct Answer: D
Explanation: Separate public and restricted Cloud Run services so only the restricted services require Google identity authentication. Protect those services with Identity-Aware Proxy behind an external HTTP(S) load balancer, and set Cloud Run ingress to 'Internal and Cloud Load Balancing' so they can only be reached through the load balancer/IAP. Leave public services publicly accessible. This provides strong access control with minimal operational complexity. Option A adds unnecessary custom logic, B incorrectly grants public access using allAuthenticatedUsers rather than unauthenticated public access and applies IAP everywhere, and C introduces Firebase/Endpoints complexity that does not match the requirement for Google identity authentication.
Question 59
You are developing a new image processing application that needs to handle various tasks, such as resizing, cropping, and watermarking images. You also need to monitor the workflow and ensure that it scales efficiently when there are large volumes of images. You want to automate the image processing tasks and workflow monitoring with the least effort. What should you do?
A. Employ Cloud Composer to manage the image processing workflows. Use Dataproc for workflow monitoring and analytics.
B. Use Cloud Run to deploy the image processing functions. Use Apigee to expose the API. Use Cloud Logging for workflow monitoring.
C. Implement Workflows to orchestrate the image processing tasks. Use Cloud Logging for workflow monitoring.
D. Use Cloud Build to trigger Cloud Functions for the image processing tasks. Use Cloud Monitoring for workflow monitoring.
Show Answer
Correct Answer: C
Explanation: Workflows is the managed orchestration service for coordinating multi-step processes across Google Cloud services, making it a good fit for automating image processing steps such as resizing, cropping, and watermarking with minimal operational effort. Cloud Logging integrates with Google Cloud services for centralized workflow execution logs and monitoring. The other options misuse services (Dataproc is for big data, Apigee is unnecessary for this requirement, and Cloud Build is for CI/CD rather than workflow orchestration).
Question 60
You are developing a public web application on Cloud Run. You expose the Cloud Run service directly with its public IP address. You are now running a load test to ensure that your application is resilient against high traffic loads. You notice that your application performs as expected when you initiate light traffic. However, when you generate high loads, your web server runs slowly and returns error messages. How should you troubleshoot this issue?
A. Check the network traffic to Cloud Run in Cloud Monitoring to validate whether a traffic spike occurred. If necessary, enable traffic splitting on the Cloud Run instance to route some of the traffic to a previous instance revision.
B. Check the min-instances value for your Cloud Run service. If necessary, increase the min-instances value to match the maximum number of virtual users in your load test.
C. Check whether Cloud Armor is detecting distributed denial of service (DDoS) attacks and is blocking traffic before the traffic is routed to your Cloud Run service. If necessary, disable any Cloud Armor policies in your project.
D. Check whether the Cloud Run service has scaled to a number of instances that equals the max-instances value. If necessary, increase the max-instances value.
Show Answer
Correct Answer: D
Explanation: Cloud Run automatically scales by creating more instances up to the configured maximum. If the service becomes slow and returns errors only under high load, a common cause is that it has reached its configured max-instances limit, preventing further scale-out. Increasing max-instances allows Cloud Run to handle more concurrent requests. Traffic splitting is for deployments, not load handling; min-instances affects cold starts rather than peak scaling capacity; Cloud Armor is unrelated unless it is intentionally blocking traffic, which is not indicated.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.