Professional Cloud Developer Free Practice Questions — Page 7
Question 61
You are using App Engine and Cloud SQL for PostgreSQL to develop an application. You want to test your application code locally before deploying new application versions to the development environment that is shared with other developers. You need to set up your App Engine local development environment to test your application while keeping all traffic to Cloud SQL instances encrypted and authenticated to Cloud IAM and PostgreSQL. What should you do before starting the local development server?
A. Install PostgreSQL on your local workstation. Run a local PostgreSQL database on your workstation. Configure the application to connect to a PostgreSQL instance on localhost.
B. Download and install the Cloud SQL Auth Proxy to your local development environment. Configure the Cloud SQL Auth Proxy to connect to the Cloud SQL instance and run the proxy. Configure the application to connect to a PostgreSQL instance on localhost.
C. Deploy a Compute Engine instance, and install HAProxy on the instance. Configure Cloud SQL Auth Proxy on the instance, and use the instance’s service account to authenticate to Cloud SQL. Configure the application to connect to the Compute Engine instance's IP address.
D. Configure your local development server to connect to the private IP address of the Cloud SQL instance. Encrypt database entries with a cryptographic library before submitting them to the database. Store the decryption key as an environment variable in App Engine.
Show Answer
Correct Answer: B
Explanation: For local App Engine development with Cloud SQL for PostgreSQL, the recommended approach is to run the Cloud SQL Auth Proxy locally. The proxy provides encrypted connections and authenticates using Cloud IAM, while your application connects to localhost as if the database were local. This preserves secure, authenticated access without exposing the database directly or requiring manual SSL management.
Question 62
You are developing a web application by using Cloud Run and Cloud Storage. You are notified of a production issue that you need to troubleshoot immediately. You need to implement a workaround that requires you to execute a script on a Git repository. Your corporate laptop is unavailable but you have your personal computer. You can use your corporate credentials to access the required Git repository and Google Cloud resources. You want to fix the issue as quickly and efficiently as possible while minimizing additional cost. What should you do?
A. Create and launch a workstation with Cloud Workstations on your personal computer. Authenticate and set up API access in the workstation. Clone the Git repository and execute the workaround script. Ensure that the issue has been fixed.
B. Install VS Code and the extension Cloud Code for VS Code on your personal computer. Check the Cloud Run logs in Cloud Code to confirm the error. Execute the workaround script. Ensure that the issue has been fixed.
C. Connect to the Google Cloud console and open Cloud Shell on your personal computer. Clone the Git repository and execute the workaround script. Ensure that the issue has been fixed.
D. Download and install the gcloud CLI on your personal computer. Authenticate and set up API access. Clone the Git repository and execute the workaround script. Ensure that the issue has been fixed.
Show Answer
Correct Answer: C
Explanation: Cloud Shell is the fastest and most cost-effective option because it provides a browser-based, preauthenticated Google Cloud environment with the gcloud CLI and Git already available. From Cloud Shell, you can authenticate with corporate credentials, clone the Git repository, run the workaround script, and verify the fix without installing software on a personal computer or provisioning additional managed development environments. Cloud Workstations incurs additional setup and cost, while installing local tools on a personal device is slower and less desirable for a one-time urgent fix.
Question 63
You are a developer at a company that operates an ecommerce website. The website stores the customer order data in a Cloud SQL for PostgreSQL database. Data scientists on the marketing team access this data to run their reports. Every time they run these reports, the website's performance is negatively affected. You want to provide access to up-to-date customer order datasets without affecting your website. What should you do?
A. Configure Cloud Scheduler to run an hourly Cloud Function that exports the data from the Cloud SQL database into CSV format and sends the data to a Cloud Storage bucket.
B. Set up a Bigtable table for the data science team. Configure the application to perform dual writes to both Cloud SQL and Bigtable simultaneously.
C. Set up a BigQuery dataset for the data science team. Configure Datastream to replicate the relevant Cloud SQL tables in BigQuery.
D. Create a clone of the PostgreSQL database instance for the data science team. Schedule a job to create a new clone every 15 minutes.
Show Answer
Correct Answer: C
Explanation: BigQuery is the appropriate analytics platform for running large reporting queries without impacting the transactional Cloud SQL database. Datastream provides near real-time change data capture (CDC) from Cloud SQL for PostgreSQL into BigQuery, keeping the analytical dataset up to date while offloading reporting workloads from the production database.
Question 64
You are developing a container build pipeline for an application hosted on GKE. You have the following requirements:
• Only images that are created using your build pipeline should be deployed on your GKE cluster.
• All code and build artifacts should remain within your environment and protected from data exfiltration.
How should you build the pipeline?
A. 1. Create a build pipeline by using Cloud Build with the default worker pool. 2. Deploy container images to a private container registry in your VPC. 3. Create a VPC firewall policy in your project that denies all egress and ingress traffic to public networks.
B. 1. Create a build pipeline by using Cloud Build with a private worker pool. 2. Use VPC Service Controls to place all components and services in your CI/CD pipeline inside a security perimeter. 3. Configure your GKE cluster to only allow container images signed by Binary Authorization.
C. 1. Create a build pipeline by using Cloud Build with a private worker pool. 2. Configure the CI/CD pipeline to build container images and store them in Artifact Registry. 3. Configure Artifact Registry to encrypt container images by using customer-managed encryption keys (CMEK).
D. 1. Create a build pipeline by using Cloud Build with the default worker pool. 2. Configure the CI/CD pipeline to build container images and store them in Artifact Registry. 3. Configure your GKE cluster to only allow container images signed by Binary Authorization.
Show Answer
Correct Answer: B
Explanation: A private Cloud Build worker pool keeps builds within your controlled VPC environment. VPC Service Controls help protect supported Google Cloud services from data exfiltration by placing them inside a security perimeter. Binary Authorization enforces that only trusted, signed images produced by your pipeline can be deployed to GKE. The other options either use the default Cloud Build worker pool, do not address data exfiltration, or focus on encryption rather than deployment trust and perimeter security.
Question 65
Your team uses Cloud Storage for a video and image application that was recently migrated to Google Cloud. Following a viral surge, users are reporting application instability, coinciding with a 10x increase in HTTP 429 error codes from Cloud Storage APIs. You need to resolve the errors and establish a long-term solution. You want to ensure that the application remains stable if the load increases again in the future. What should you do?
A. Optimize the application code to reduce unnecessary calls to Cloud Storage APIs to prevent HTTP 429 errors.
B. Compress the video and images files to reduce their size, and minimize storage costs and bandwidth usage. Implement a custom throttling mechanism in the application that limits the number of concurrent API calls.
C. Migrate all image and video data to Firestore. Replace the Cloud Storage APIs in the application code with the new Firestore database.
D. Implement a retry strategy with exponential backoff for requests that encounter HTTP 429 errors.
Show Answer
Correct Answer: D
Explanation: HTTP 429 indicates rate limiting or temporary request throttling. Cloud Storage best practice is to implement retries with exponential backoff for 429 (and certain transient) errors so requests succeed as the service scales. This provides a resilient long-term solution during traffic spikes. While reducing unnecessary API calls is generally beneficial, it does not by itself address transient throttling. Compressing files or migrating to Firestore do not solve Cloud Storage request-rate limits.
Question 66
You are migrating a containerized application to Cloud Run. You plan to use Cloud Build to build your container image and push it to Artifact Registry, and you plan to use Cloud Deploy to deploy the image to production. You need to ensure that only secure images are deployed to production. What should you do?
A. Use Cloud Armor in front of Cloud Run to protect the container image from threats.
B. Use Artifact Analysis to scan the image for vulnerabilities. Use Cloud Key Management Service to encrypt the image to be deployed to production.
C. Use Secret Manager to store the encrypted image. Deploy this image to production.
D. Use Binary Authorization to enforce a policy that only allows images that have been signed with a trusted key to be deployed to production.
Show Answer
Correct Answer: D
Explanation: Binary Authorization enforces deployment policies so that only trusted, signed container images can be deployed. This is the control specifically designed to prevent untrusted or insecure images from reaching production. Artifact Analysis can scan for vulnerabilities, but scanning alone does not enforce deployment policy. Cloud Armor protects running services, not images. Secret Manager and Cloud KMS are not used to store or deploy container images.
Question 67
You work for an ecommerce company, and you are responsible for deploying and managing multiple APIs. The operations team wants to review the traffic patterns in the orders-prod and users-prod environments. These are the only environments in the store-prod environment group. You want to follow Google-recommended practices. What should you do?
A. Assign the Apigee Analytics Viewer IAM role to the operations team for both environments. Use Cloud Monitoring to review traffic patterns.
B. Assign the Apigee Analytics Viewer IAM role to the operations team for both environments. Use Apigee API Analytics to review traffic patterns.
C. Assign the Apigee API Reader IAM role to each user of the operations team for both environments. Use Cloud Monitoring to review traffic patterns.
D. Assign the Apigee API Reader IAM role to each user of the operations team for both environments. Use Apigee API Analytics to review traffic patterns.
Show Answer
Correct Answer: B
Explanation: The operations team needs read-only access to analyze API traffic patterns, so the least-privilege IAM role is Apigee Analytics Viewer. Traffic pattern analysis for APIs is performed with Apigee API Analytics, which provides API-specific metrics such as traffic, latency, error rates, and response codes. The Apigee API Reader role is intended for viewing API configuration rather than analytics, and Cloud Monitoring is not the primary tool for reviewing Apigee API traffic analytics.
Question 68
You are developing a scalable web application for internal users. Your organization uses Google Workspace. You need to set up authentication to the application for the users, and then deploy the application on Google Cloud. You plan to use cloud-native features, and you want to minimize infrastructure management effort. What should you do? (Choose two.)
A. Create a Compute Engine VM, configure a web server, and deploy the application in a VPC.
B. Containerize the application, and deploy it as a Cloud Run service.
C. Configure Cloud SQL database with a table containing the users and password hashes. Add an authentication screen to ensure that only internal users can access the application.
D. Configure Identity Aware Proxy, and grant the roles/iap.httpsResourceAccessor IAM role to the users that need to access the application.
E. Configure Identity Aware Proxy, and grant the roles/iap.tunnelResourceAccessor IAM role to the users that need to access the application.
Show Answer
Correct Answer: B, D
Explanation: Cloud Run is a fully managed, serverless platform for containerized web applications, minimizing infrastructure management while providing automatic scalability. Identity-Aware Proxy (IAP) integrates with Google Workspace identities to authenticate internal users without building a custom authentication system. Users accessing web applications protected by IAP require the roles/iap.httpsResourceAccessor role. The tunnelResourceAccessor role is for IAP TCP tunneling (such as SSH/RDP), not HTTPS web application access.
Question 69
You use Cloud Build to build and test container images prior to deploying them to Cloud Run. Your images are stored in Artifact Registry. You need to ensure that only container images that have passed testing are deployed. You want to minimize operational overhead. What should you do?
A. Deploy a new revision to a Cloud Run service. Assign a tag that allows access to the revision at a specific URL without serving traffic. Test that revision again. Migrate the traffic to the Cloud Run service after you confirm that the new revision is performing as expected.
B. Enable Binary Authorization on your Cloud Run service. Create an attestation if the container image has passed all tests. Configure Binary Authorization to allow only images with appropriate attestation to be deployed to the Cloud Run service.
C. Create a GKE cluster. Verify that all tests have passed, and then deploy the image to the GKE cluster.
D. Configure build provenance on your Cloud Build pipeline. Verify that all the tests have passed, and then deploy the image to a Cloud Run service.
Show Answer
Correct Answer: B
Explanation: Binary Authorization integrates with Cloud Run to enforce that only trusted, attested container images can be deployed. Cloud Build can create attestations after successful testing, and Binary Authorization policies then block deployment of unapproved images. This directly satisfies the requirement while minimizing operational overhead. Option A performs post-deployment testing and does not enforce that only tested images are deployable. Option C unnecessarily introduces GKE. Option D provides provenance but provenance alone does not enforce deployment of only tested images.
Question 70
You are currently pushing container images to Artifact Registry and deploying a containerized microservices application to GKE. After deploying the application, you notice that the services do not behave as expected. You use the kubectl get pods command to inspect the state of the application Pods, and discover that one of the Pods has a state of CrashLoopBackoff. How should you troubleshoot the Pod?
A. Connect to the problematic Pod by running the kubectl exec -it POD_NAME - /bin/bash command where the POD_NAME parameter is the name of the problematic Pod. Inspect the logs in the /var/log/messages folder to determine the root cause.
B. Execute the gcloud projects get-iam-policy PROJECT_ID command where the PROJECT_ID parameter is the name of the project where your Artifact Registry resides. Inspect the IAM bindings of the node pool s service account. Validate if the service account has the roles/artifactregistry.reader role.
C. Run the kubectl logs POD_NAME command where the POD_NAME parameter is the name of the problematic Pod. Analyze the logs of the Pod from previous runs to determine the root cause of failed start attempts of the Pod.
D. In the Google Cloud console, navigate to Cloud Logging in the project of the cluster’s VPC. Enter a filter to show denied egress traffic to the Private Google Access CIDR range. Validate if egress traffic is denied from your GKE cluster to the Private Google Access CIDR range.
Show Answer
Correct Answer: C
Explanation: A Pod in CrashLoopBackOff repeatedly starts and crashes. The first troubleshooting step is to inspect the container logs, especially from the previous failed instance if needed (for example, using kubectl logs POD_NAME --previous). Option A is not reliable because you often cannot exec into a crashing container, and /var/log/messages is not the standard place to inspect application failures. Options B and D address specific infrastructure issues that could cause image pull or networking problems, but they are not the general troubleshooting approach for a CrashLoopBackOff Pod.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.