Professional Cloud Developer Free Practice Questions — Page 9
Question 67
You work for an ecommerce company, and you are responsible for deploying and managing multiple APIs. The operations team wants to review the traffic patterns in the orders-prod and users-prod environments. These are the only environments in the store-prod environment group. You want to follow Google-recommended practices. What should you do?
A. Assign the Apigee Analytics Viewer IAM role to the operations team for both environments. Use Cloud Monitoring to review traffic patterns.
B. Assign the Apigee Analytics Viewer IAM role to the operations team for both environments. Use Apigee API Analytics to review traffic patterns.
C. Assign the Apigee API Reader IAM role to each user of the operations team for both environments. Use Cloud Monitoring to review traffic patterns.
D. Assign the Apigee API Reader IAM role to each user of the operations team for both environments. Use Apigee API Analytics to review traffic patterns.
Show Answer
Correct Answer: B
Explanation: The operations team needs read-only access to analyze API traffic patterns, so the least-privilege IAM role is Apigee Analytics Viewer. Traffic pattern analysis for APIs is performed with Apigee API Analytics, which provides API-specific metrics such as traffic, latency, error rates, and response codes. The Apigee API Reader role is intended for viewing API configuration rather than analytics, and Cloud Monitoring is not the primary tool for reviewing Apigee API traffic analytics.
Question 68
You are developing a scalable web application for internal users. Your organization uses Google Workspace. You need to set up authentication to the application for the users, and then deploy the application on Google Cloud. You plan to use cloud-native features, and you want to minimize infrastructure management effort. What should you do? (Choose two.)
A. Create a Compute Engine VM, configure a web server, and deploy the application in a VPC.
B. Containerize the application, and deploy it as a Cloud Run service.
C. Configure Cloud SQL database with a table containing the users and password hashes. Add an authentication screen to ensure that only internal users can access the application.
D. Configure Identity Aware Proxy, and grant the roles/iap.httpsResourceAccessor IAM role to the users that need to access the application.
E. Configure Identity Aware Proxy, and grant the roles/iap.tunnelResourceAccessor IAM role to the users that need to access the application.
Show Answer
Correct Answer: B, D
Explanation: Cloud Run is a fully managed, serverless platform for containerized web applications, minimizing infrastructure management while providing automatic scalability. Identity-Aware Proxy (IAP) integrates with Google Workspace identities to authenticate internal users without building a custom authentication system. Users accessing web applications protected by IAP require the roles/iap.httpsResourceAccessor role. The tunnelResourceAccessor role is for IAP TCP tunneling (such as SSH/RDP), not HTTPS web application access.
Question 69
You use Cloud Build to build and test container images prior to deploying them to Cloud Run. Your images are stored in Artifact Registry. You need to ensure that only container images that have passed testing are deployed. You want to minimize operational overhead. What should you do?
A. Deploy a new revision to a Cloud Run service. Assign a tag that allows access to the revision at a specific URL without serving traffic. Test that revision again. Migrate the traffic to the Cloud Run service after you confirm that the new revision is performing as expected.
B. Enable Binary Authorization on your Cloud Run service. Create an attestation if the container image has passed all tests. Configure Binary Authorization to allow only images with appropriate attestation to be deployed to the Cloud Run service.
C. Create a GKE cluster. Verify that all tests have passed, and then deploy the image to the GKE cluster.
D. Configure build provenance on your Cloud Build pipeline. Verify that all the tests have passed, and then deploy the image to a Cloud Run service.
Show Answer
Correct Answer: B
Explanation: Binary Authorization integrates with Cloud Run to enforce that only trusted, attested container images can be deployed. Cloud Build can create attestations after successful testing, and Binary Authorization policies then block deployment of unapproved images. This directly satisfies the requirement while minimizing operational overhead. Option A performs post-deployment testing and does not enforce that only tested images are deployable. Option C unnecessarily introduces GKE. Option D provides provenance but provenance alone does not enforce deployment of only tested images.
Question 70
You are currently pushing container images to Artifact Registry and deploying a containerized microservices application to GKE. After deploying the application, you notice that the services do not behave as expected. You use the kubectl get pods command to inspect the state of the application Pods, and discover that one of the Pods has a state of CrashLoopBackoff. How should you troubleshoot the Pod?
A. Connect to the problematic Pod by running the kubectl exec -it POD_NAME - /bin/bash command where the POD_NAME parameter is the name of the problematic Pod. Inspect the logs in the /var/log/messages folder to determine the root cause.
B. Execute the gcloud projects get-iam-policy PROJECT_ID command where the PROJECT_ID parameter is the name of the project where your Artifact Registry resides. Inspect the IAM bindings of the node pool s service account. Validate if the service account has the roles/artifactregistry.reader role.
C. Run the kubectl logs POD_NAME command where the POD_NAME parameter is the name of the problematic Pod. Analyze the logs of the Pod from previous runs to determine the root cause of failed start attempts of the Pod.
D. In the Google Cloud console, navigate to Cloud Logging in the project of the cluster’s VPC. Enter a filter to show denied egress traffic to the Private Google Access CIDR range. Validate if egress traffic is denied from your GKE cluster to the Private Google Access CIDR range.
Show Answer
Correct Answer: C
Explanation: A Pod in CrashLoopBackOff repeatedly starts and crashes. The first troubleshooting step is to inspect the container logs, especially from the previous failed instance if needed (for example, using kubectl logs POD_NAME --previous). Option A is not reliable because you often cannot exec into a crashing container, and /var/log/messages is not the standard place to inspect application failures. Options B and D address specific infrastructure issues that could cause image pull or networking problems, but they are not the general troubleshooting approach for a CrashLoopBackOff Pod.
Question 71
You work for a company that operates an ecommerce website. You are developing a new integration that will manage all order fulfillment steps after orders are placed. You have created multiple Cloud Functions to process each order. You need to orchestrate the execution of the functions, using the output of each function to determine the flow. You want to minimize the latency of this process. What should you do?
A. Use Workflows to call the functions, and use callbacks to handle the execution logic.
B. Use Workflows to call the functions, and use conditional jumps to handle the execution logic.
C. Use Cloud Composer to call the functions, and use an Apache Airflow HTTP operator to handle the execution logic.
D. Use Cloud Composer to call the functions, and use an Apache Airflow operator to handle the execution logic.
Show Answer
Correct Answer: B
Explanation: Workflows is the managed Google Cloud service designed to orchestrate Cloud Functions and other services with very low operational overhead and low latency. It natively supports conditional branching (switch/conditional jumps) based on the output of previous steps, making it appropriate for order-fulfillment workflows whose execution path depends on function results. Callbacks are intended for waiting on external asynchronous events rather than ordinary branching logic, and Cloud Composer (Apache Airflow) is better suited to batch/data pipeline orchestration rather than low-latency request-driven workflows.
Question 72
You manage an application deployed on GKE clusters across multiple environments. You are using Cloud Build to run user acceptance testing (UAT) tests. You have integrated Cloud Build with Artifact Analysis, and enabled the Binary Authorization API in all Google Cloud projects hosting your environments. You want only container images that have passed certain automated UAT tests to be deployed to the production environment. You have already created an attestor. What should you do next?
A. After the UAT phase, sign the attestation with a key stored as a Kubernetes secret. Add a GKE cluster-specific rule in Binary Authorization for the UAT Google Cloud project.
B. After the UAT phase, sign the attestation with a key stored as a Kubernetes secret. Add a GKE cluster-specific rule in Binary Authorization for the production Google Cloud project policy.
C. After the UAT phase, sign the attestation with a key stored in Cloud Key Management Service (KMS). Add a default rule in Binary Authorization for the UAT Google Cloud project.
D. After the UAT phase, sign the attestation with a key stored in Cloud Key Management Service (KMS). Add a GKE cluster-specific rule in Binary Authorization for the production Google Cloud project policy.
Show Answer
Correct Answer: D
Explanation: Binary Authorization should enforce deployment policy in the production environment, requiring an attestation from the configured attestor before admitting images. Attestations should be signed with a key managed in Cloud KMS, which is the recommended secure key management approach for Binary Authorization. A production GKE cluster-specific policy requiring the attestation ensures only images that passed UAT can be deployed.
Question 73
You are developing a mobile application that allows users to create and manage to-do lists. Your application has the following requirements:
• Store and synchronize data between different mobile devices.
• Support offline access.
• Provide real-time updates on each user's device.
You need to implement a database solution while minimizing operational effort. Which approach should you use?
A. Create a Cloud SQL for MySQL instance. Implement a data model to store to-do list information. Create indexes for the most heavily and frequently used queries.
B. Create a Bigtable instance. Design a database schema to avoid hotspots when writing data. Use a Bigtable change stream to capture data changes.
C. Use Firestore as the database. Configure Firestore offline persistence to cache a copy of the Firestore data. Listen to document changes to update applications whenever there are document changes.
D. Implement a SQLite database on each user's device. Use a scheduled job to synchronize each device database with a copy stored in Cloud Storage.
Show Answer
Correct Answer: C
Explanation: Firestore is designed for mobile and web applications, providing fully managed data storage with built-in real-time synchronization, offline persistence, and automatic syncing when connectivity is restored. This satisfies the requirements while minimizing operational effort. Cloud SQL and Bigtable require more operational design and do not provide client-side offline sync and real-time mobile features out of the box. SQLite with Cloud Storage requires custom synchronization logic and lacks real-time updates.
Question 74
You maintain a popular mobile game deployed on Google Cloud services that include Firebase, Firestore, and Cloud Functions. Recently, the game experienced a surge in usage, and the application encountered HTTP 429 RESOURCE_EXHAUSTED errors when accessing the Firestore API. The application has now stabilized. You want to quickly fix this issue because your company has a marketing campaign next week and you expect another surge in usage. What should you do?
A. Request a quota increase, and modify the application code to retry the Firestore API call with fixed backoff.
B. Request a quota increase, and modify the application code to retry the Firestore API call with exponential backoff.
C. Optimize database queries to reduce read/write operations, and modify the application code to retry the Firestore API call with fixed backoff.
D. Optimize database queries to reduce read/write operations, and modify the application code to retry the Firestore API call with exponential backoff.
Show Answer
Correct Answer: B
Explanation: HTTP 429 RESOURCE_EXHAUSTED indicates throttling or quota/resource limits. Client retries should use exponential backoff, not fixed backoff, to avoid amplifying load. Because the priority is a quick mitigation before an expected traffic surge, requesting a quota increase is faster and lower risk than redesigning and optimizing database queries. Query optimization is valuable longer term, but the immediate fix is to increase available quota and implement exponential backoff.
Question 75
You are developing an application component to capture user behavior data and stream the data to BigQuery. You plan to use the BigQuery Storage Write API. You need to ensure that the data that arrives in BigQuery does not have any duplicates. You want to use the simplest operational method to achieve this. What should you do?
A. Create a write stream in the default type.
B. Create a write stream in the committed type.
C. Configure a Kafka cluster. Use a primary universally unique identifier (UUID) for duplicate messages.
D. Configure a Pub/Sub topic. Use Cloud Functions to subscribe to the topic and remove any duplicates.
Show Answer
Correct Answer: B
Explanation: The committed write stream type in the BigQuery Storage Write API supports exactly-once semantics when using stream offsets, enabling BigQuery to prevent duplicate writes. The default stream is optimized for at-least-once ingestion and does not by itself guarantee deduplication. The Kafka and Pub/Sub options add unnecessary operational complexity when the requirement is to use the simplest operational method.
Question 76
You are designing a Node.js-based mobile news feed application that stores data on Google Cloud. You need to select the application's database. You want the database to have zonal resiliency out of the box, low latency responses, ACID compliance, an optional middle tier, semi-structured data storage, and network-partition-tolerant and offline-mode client libraries. What should you do?
A. Configure Firestore and use the Firestore client library in the app.
B. Configure Bigtable and use the Bigtable client in the app.
C. Configure Cloud SQL and use the Google Client Library for Cloud SQL in the app.
D. Configure BigQuery and use the BigQuery REST API in the app.
Show Answer
Correct Answer: A
Explanation: Firestore best matches the requirements: built-in high availability and zonal resiliency, low-latency access for mobile apps, ACID transactions, document-based semi-structured storage, optional direct client SDK access without a middle tier, and client libraries with offline persistence and synchronization that tolerate network partitions.
$19
Get all 358 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.