Professional Cloud Developer Free Practice Questions — Page 7
Question 47
You are developing a discussion portal that is built on Cloud Run. Incoming external requests are routed through a set of microservices before a response is sent. Some of these microservices connect to databases. You need to run a load test to identify any bottlenecks in the application when it is under load. You want to follow Google-recommended practices. What should you do?
A. Modify the response to include a time series that shows elapsed time per service. Use Log Analytics in Cloud Logging to create a heatmap that exposes any service that could be a bottleneck.
B. Configure Cloud Trace to capture the requests from the load testing clients. Review the timings in Cloud Trace.
C. Expose the latency metrics per service for each request. Configure Google Cloud Managed Service for Prometheus, and use it to scrape and analyze the metrics.
D. Add log statements that capture elapsed time. Analyze the logs and metrics by using BigQuery.
Show Answer
Correct Answer: B
Explanation: Cloud Trace is the Google-recommended service for distributed request tracing and latency analysis across microservices. During a load test, it shows end-to-end request timing and the latency contribution of each service, making it the appropriate tool to identify bottlenecks in a Cloud Run microservices architecture. The other options require custom instrumentation or log analysis when Cloud Trace is purpose-built for this use case.
Question 48
Your infrastructure team is responsible for creating and managing Compute Engine VMs. Your team uses the Google Cloud console and gcloud CLI to provision resources for the development environment. You need to ensure that all Compute Engine VMs are labeled correctly for compliance reasons. In case of missing labels, you need to implement corrective actions so the labels are configured accordingly without changing the current deployment process. You want to use the most scalable approach. What should you do?
A. Use a Cloud Audit Logs trigger to invoke a Cloud Function when a Compute Engine VM is created. Check for missing labels and assign them if necessary.
B. Deploy resources with Terraform. Use the gcloud terraform vet command with a policy to ensure that every Compute Engine VM that is provisioned by Terraform has labels set.
C. Write a script to check all Compute Engine VMs for missing labels regularly by using Cloud Scheduler. Use the script to assign the labels.
D. Check all Compute Engine VMs for missing labels regularly. Use the console to assign the labels.
Show Answer
Correct Answer: A
Explanation: Use an event-driven remediation approach that does not alter the existing provisioning workflow. A Cloud Audit Logs trigger can invoke a Cloud Function whenever a Compute Engine VM is created. The function checks for required labels and applies any that are missing, providing automatic, scalable, near-real-time compliance regardless of whether the VM was created via the Google Cloud console or gcloud CLI. The Terraform option changes the deployment process and only governs Terraform-managed resources, while scheduled or manual checks are less scalable and allow periods of noncompliance.
Question 49
You work for an environmental agency in a large city. You are developing a new monitoring platform that will capture air quality readings from thousands of locations in the city. You want the air quality reading devices to send and receive their data payload to the newly created RESTful backend systems every minute by using a curl command. The backend systems are running in a single cloud region and are using Premium Tier networking. You need to connect the devices to the backend while minimizing the daily average latency, measured by using Time to First Byte (TTFB). How should you build this service?
A. 1. Run the air quality devices’ backends on Compute Engine VMs. 2. Create a weighted round robin routing policy on Cloud DNS. 3. Configure the air quality devices to connect by using this DNS.
B. 1. Run the air quality devices’ backends on Compute Engine VMs. 2. Create a round robin routing policy on Cloud DNS for these Compute Engine VMs. 3. Configure the air quality devices to connect by using this DNS.
C. 1. Run the air quality devices' backends in a managed instance group. 2. Create an external passthrough Network Load Balancer to connect to the managed instance group. 3. Configure a connection between the air quality devices and the Network Load Balancer.
D. 1 Run the air quality devices' backends in a managed instance group. 2. Create an external Application Load Balancer, and connect it to the managed instance group. 3. Configure a connection between the air quality devices and the Application Load Balancer.
Show Answer
Correct Answer: D
Explanation: For a RESTful HTTP backend serving thousands of globally distributed clients within a region using Premium Tier, an external Application Load Balancer is the recommended solution. It provides Google Front Ends (GFEs), optimized HTTP(S) request handling, connection management, autoscaling support with managed instance groups, and typically minimizes Time to First Byte compared with DNS-based distribution or a passthrough Network Load Balancer, which operates at L4 and lacks HTTP-aware optimizations. DNS round robin or weighted routing cannot account for client/network conditions and do not provide load balancing or fast failover.
Question 50
You are developing a secure document sharing platform. The platform allows users to share documents with other users who may be external to their organization. Access to these documents should be revoked after a configurable time period. The documents are stored in Cloud Storage. How should you configure Cloud Storage to support this functionality?
A. Create signed policy documents on the Cloud Storage bucket.
B. Apply access control list (ACL) permissions to the Cloud Storage bucket.
C. Generate a signed URL for each document the user wants to share.
D. Grant the Storage Object Viewer IAM role to all authenticated users.
Show Answer
Correct Answer: C
Explanation: Signed URLs provide time-limited access to specific Cloud Storage objects without requiring IAM changes. You can configure an expiration time so access is automatically revoked after the specified period. ACLs and IAM roles do not provide built-in time-based expiration for shared access, and signed policy documents are intended for controlling uploads via HTML forms rather than secure temporary download sharing.
Question 51
You are about to deploy an application hosted on a Compute Engine instance with Windows OS and Cloud SQL. You plan to use the Cloud SQL Auth Proxy for connectivity to the Cloud SQL instance. You plan to follow Google-recommended practices and the principle of least privilege. You have already created a custom service account. What should you do next?
A. Create and assign a custom role with the cloudsql.instances.connect permission to the custom service account. Adjust the Cloud SQL Auth Proxy start command to specify your instance connection name.
B. Grant the custom service account the roles/cloudsql.client role. Adjust the Cloud SQL Auth Proxy start command to use the --unix-socket CLI option.
C. Grant the custom service account the roles/cloudsql.editor role.
D. Grant the custom service account the roles/cloudsql.viewer role. Adjust the Cloud SQL Auth Proxy start command to specify your instance connection name.
Show Answer
Correct Answer: A
Explanation: The Cloud SQL Auth Proxy requires the ability to connect to and retrieve instance metadata. The predefined roles/cloudsql.client includes the needed permissions, but option B is invalid because it instructs use of the --unix-socket option, which is not supported on Windows. The editor role is overly broad, and the viewer role lacks connect permission. A grants the minimal required connect permission via a custom role and correctly specifies using the instance connection name for the proxy.
Question 52
You are developing a new API that creates requests on an asynchronous message service. Requests will be consumed by different services. You need to expose the API by using a gRPC interface while minimizing infrastructure management overhead. How should you deploy the API?
A. Deploy your API to App Engine. Create a Pub/Sub topic, and configure your API to push messages to the topic.
B. Deploy your API as a Cloud Run service. Create a Pub/Sub topic, and configure your API to push messages to the topic.
C. Deploy your API to a GKE cluster. Create a Kafka cluster, and configure your API to write messages to the cluster.
D. Deploy your API on a Compute Engine instance. Create a Kafka cluster, and configure your API to write messages to the cluster.
Show Answer
Correct Answer: B
Explanation: Cloud Run natively supports gRPC services over HTTP/2 and is fully managed, minimizing infrastructure management. Pub/Sub is the managed asynchronous messaging service for decoupled consumers. App Engine does not natively support serving gRPC APIs in the same way, while GKE/Compute Engine with Kafka requires significantly more infrastructure management.
Question 53
Your organization has users and groups configured in an external identity provider (IdP). You want to leverage the same external IdP to allow Google Cloud console access to all employees. You also want to personalize the sign-in experience by displaying the user's name and photo when users access the Google Cloud console. What should you do?
A. Configure workforce identity federation with the external IdP, and set up attribute mapping.
B. Configure a service account for each individual by using the user name and photo, and grant permissions for each user to impersonate their respective service accounts.
C. Configure workload identity federation to get the external IdP tokens, and use these tokens to sign in to the Google Cloud console.
D. Create a Google group that includes organization email IDs for all users. Ask users to use the same name, work email ID, and password to register and sign in.
Show Answer
Correct Answer: A
Explanation: Workforce Identity Federation is designed for authenticating human users from an external identity provider to access Google Cloud. By configuring attribute mapping, user attributes such as display name and photo can be mapped from the external IdP, enabling a personalized Google Cloud console sign-in experience. Workload Identity Federation is for workloads, not human console access. Service accounts are not appropriate for interactive user sign-in, and creating Google accounts/groups does not provide federated authentication with the external IdP.
Question 54
You are developing an external-facing application on GKE that provides a streaming API to users. You want to offer two subscription tiers, “basic" and “premium", to users based on the number of API requests that each client application is allowed to make each day. You want to design the application architecture to provide subscription tiers to users while following Google-recommended practices. What should you do?
A. 1. Configure the service on GKE as a backend to an Apigee proxy. 2. Provide API keys to users to identify client applications. 3. Configure a Quota policy in Apigee for API keys based on the subscription tier.
B. 1. Configure the service on GKE as a backend to an Apigee proxy. 2. Provide API keys to users to identify client applications. 3. Configure a SpikeArrest policy in Apigee for API keys based on the subscription tier.
C. 1. Configure the service on GKE as a backend to two new projects, each with a separate Application Load Balancer. 2. Configure the quota "Queries per second (QPS) per region per network” for each project individually. 3. Provide users with API endpoints based on the subscription tier.
D. 1. Deploy the application to two GKE clusters, one for each subscription tier. Configure each cluster to have a separate Ingress. 2. Configure each cluster as a backend to an Apigee proxy. 3. Provide API keys to users to identify client applications. 4. Configure separate rate limits for client applications based on the subscription tier.
Show Answer
Correct Answer: A
Explanation: Use Apigee as the API gateway in front of the GKE service, identify client applications with API keys, and enforce daily request limits using the Apigee Quota policy. Quota is designed for subscription-based request allowances over a time interval (such as per day). SpikeArrest limits traffic spikes and requests per second, not daily quotas. The other options misuse infrastructure or duplicate deployments instead of using API management best practices.
Question 55
You need to deploy a new feature into production on Cloud Run. Your company’s SRE team mandates gradual deployments to avoid large downtimes caused by code change errors. You want to configure this deployment with minimal effort. What should you do?
A. Configure the application’s frontend load balancer to toggle between the new and old revisions.
B. Configure the application code to send a small percentage of users to the newly deployed revision.
C. Deploy the feature with “Serve this revision immediately” unchecked, and configure the new revision to serve a small percentage of traffic. Check for errors, and increase traffic to the revision as appropriate.
D. Deploy the feature with “Serve this revision immediately” checked. Check for errors, roll back to the previous revision, and repeat the process until you have verified that the deployment is bug-free.
Show Answer
Correct Answer: C
Explanation: Cloud Run natively supports gradual traffic migration between revisions. Deploy the new revision without immediately serving all traffic, then assign a small percentage of traffic to the new revision, monitor for errors, and progressively increase traffic as confidence grows. This satisfies gradual deployment requirements with minimal operational effort. Options A and B require custom infrastructure or application logic, and D performs an all-at-once deployment rather than a gradual rollout.
Question 56
Your ecommerce application has a rapidly growing user base, and it is experiencing performance issues due to excessive requests to your backend API. Your team develops and manages this API. The Cloud SQL backend database is struggling to handle the high demand, leading to latency and timeouts. You need to implement a solution that optimizes API performance and improves user experience. What should you do?
A. Use Apigee to expose your API. Use Memorystore for Redis to cache frequently accessed data. Implement exponential backoff in the application to retry failed requests.
B. Use Apigee to expose your API. Implement rate limiting and access control policies in Apigee to control API traffic. Use Pub/Sub to queue requests to prevent database overload.
C. Use Cloud Load Balancing to expose your API. Use Cloud CDN in front of the load balancer to cache responses. Implement exponential backoff to retry failed requests.
D. Use Cloud Load Balancing to expose your API. Increase the memory for the database instances to handle more concurrent requests. Implement a custom rate-limiting mechanism in your application code to control API requests.
Show Answer
Correct Answer: A
Explanation: The primary issue is excessive backend API requests causing Cloud SQL overload. Exposing the API through Apigee enables API management, while caching frequently accessed data in Memorystore for Redis reduces repeated database reads and significantly lowers load on Cloud SQL. Exponential backoff is a standard resilience pattern that prevents retry storms during transient failures. The other options either misuse Pub/Sub for synchronous API traffic, rely on Cloud CDN (which is suited to cache HTTP responses at the edge but is less appropriate for dynamic API/database-backed data than an application cache), or focus on scaling the database and custom rate limiting instead of reducing backend load efficiently.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.