Professional Cloud DevOps Engineer Free Practice Questions
This is the free Google Professional Cloud DevOps Engineer practice question bank —
110 of 208 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-06.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
You are designing a containerized CI pipeline to minimize reliance on public upstream container registries and improve build reproducibility and security. You need to design a pipeline to cache all containerized dependencies while minimizing the required amount of manual effort and maintenance. What should you do?
A. 1. Create a remote Docker repository for each upstream registry in Artifact Registry. 2. Access the container images in the CI pipeline through the remote repository.
B. 1. Create a standard Docker repository for each upstream registry in Artifact Registry. 2. Upload the containers used in the build pipelines to the appropriate repositories.
C. 1. Create a standard Docker repository for each upstream registry in Artifact Registry. 2. Create a central virtual Docker repository to serve the standard repositories. 3. Access the container images in the CI pipeline through the central repository.
D. 1. Create a remote Docker repository for each upstream registry in Artifact Registry. 2. Create a central virtual Docker repository to serve the remote repositories. 3. Access the container images in the CI pipeline through the central repository.
Show Answer
Correct Answer: D
Explanation: Remote Docker repositories in Artifact Registry are designed to cache artifacts from upstream public registries automatically, reducing manual synchronization and improving reproducibility. A virtual repository can aggregate multiple remote repositories behind a single endpoint, simplifying CI configuration while still benefiting from cached upstream content. Standard repositories would require manually copying and maintaining images, increasing operational effort.
Question 2
You are deploying a containerized application to Cloud Run. The application needs a password to connect to the database to fetch data. The password must be rotated each week to meet your company’s security requirements. You need to implement an easy- to-manage password rotation policy. What should you do?
A. 1. Deploy the container to Cloud Run. 2. Create a new container each week with the new database password set as an environment variable in a Dockerfile. 3. Deploy the new container to Cloud Run, and migrate the traffic to the new version.
B. 1. Create a secret in Secret Manager to hold the password. 2. Deploy the container to Cloud Run, and use the latest version of the secret as an environment variable. 3. Create a new version of the secret with the new password in Secret Manager each week.
C. 1. Deploy the container to Cloud Run. 2. Create a new container each week with the new database password set as a secret during the build phase. 3. Deploy the new container to Cloud Run, and migrate the traffic to the new version.
D. 1. Create a secret in Secret Manager to hold the password. 2. Deploy the container to Cloud Run, and use the latest version of the secret as a mounted volume. 3. Create a new version of the secret in Secret Manager each week.
Show Answer
Correct Answer: D
Explanation: Store the database password in Secret Manager and mount it into Cloud Run as a secret volume. Mounted secrets can reflect updated secret versions without baking credentials into the container image. Rotating the password is then managed by adding a new secret version each week, avoiding image rebuilds and improving security.
Question 3
You are configuring a Cloud Deploy pipeline to deploy an application to Google Kubernetes Engine (GKE). The application is deployed as a Deployment. You need to configure the Deployment so that there are two replicas in the development environment and five replicas in the production environment. You must ensure that all other configuration parameters are consistent between environments. You also need to minimize developmental overhead when updating the manifests in the future. How should you configure the skaffold.yaml file?
A. Create multiple profiles, and configure the manifests.kustomize section.
B. Create a single profile, and configure the manifests.kustomize section.
C. Create multiple profiles, and configure the manifests.rawYaml section.
D. Create a single profile, and configure the manifests.rawYaml section.
Show Answer
Correct Answer: A
Explanation: Use Kustomize overlays to keep a shared base manifest and vary only the replica count between environments. In Skaffold, configure multiple profiles (for development and production), each pointing to the appropriate Kustomize overlay. This minimizes duplication and future maintenance while keeping all other Deployment settings consistent.
Question 4
You are establishing a centralized platform to monitor your applications. Your applications are currently running on Kubernetes clusters on-premises and in the cloud across multiple Google Cloud projects. You want to enable developers to monitor both infrastructure and application metrics using OpenTelemetry across on-premises and Google Cloud environments. At the same time, you want to keep the operation easy to support and integrate all metrics into a single place. What should you do?
A. Implement a sidecar OpenTelemetry Collector alongside each Pod in all Kubernetes clusters (on-premises and GKE). Configure these collectors to export Prometheus-formatted metrics. Use dedicated Prometheus instances in each Kubernetes cluster and Thanos in a central GKE cluster. Install Grafana on a GKE cluster, and use Grafana to monitor the applications.
B. Create a scoping project and add all the Google Cloud projects to it. Use Bindplane to streamline OpenTelemetry metric collection for the on-premises Kubernetes clusters into Cloud Monitoring.
C. Create a new Google Cloud project to use as a scoping project and add all the other Google Cloud projects to it. Instrument the applications running on-premises to export the metrics to Cloud Monitoring as user-defined metrics. Use Cloud Monitoring to monitor the applications.
D. Enable Google Cloud Managed Service for Prometheus collections by using the OpenTelemetry Collector on the Google Kubernetes Engine (GKE) clusters, and enable non-managed Prometheus for the on-premises Kubernetes clusters. Install Grafana on a GKE cluster, and use Grafana to monitor the applications.
Show Answer
Correct Answer: B
Explanation: A Cloud Monitoring scoping project provides a single view across multiple Google Cloud projects. Bindplane is designed to simplify OpenTelemetry-based telemetry collection from on-premises environments and forward it to Cloud Monitoring, reducing operational overhead while centralizing infrastructure and application metrics across hybrid environments.
Question 5
You have an application deployed to Cloud Run. A new version of the application has recently been deployed using the canary deployment strategy. Your Site Reliability Engineering (SRE) teammate informs you that an SLO has been exceeded for this application. You need to make the application healthy as quickly as possible. What should you do first?
A. Configure traffic splitting to send 100% of the traffic to the latest revision.
B. Configure traffic splitting to send 100% of the traffic to the previous revision.
C. Create a new revision using the last known good version of the application.
D. Identify the cause of the latency by using Cloud Trace.
Show Answer
Correct Answer: B
Explanation: With a canary deployment, the fastest way to restore service after an SLO breach is to immediately shift all traffic back to the last known healthy revision. Cloud Run traffic splitting allows instant rollback without creating a new revision. Investigating the root cause can happen after service is stabilized.
Question 6
Your company is trying to centralize all monitoring and alerting capabilities. Your VPC network has an internally exposed webhook you can call to trigger alerts. You need to integrate your Google Cloud alerts to call this webhook. You want to minimize costs while following Google-recommended practices. What should you do?
A. Configure a new Pub/Sub notification channel with a new topic. Create a pull subscription to consume the events.
B. Configure a new Pub/Sub notification channel with a new topic. Create a push subscription with the webhook as a subscriber to get the events.
C. Configure a new webhook notification channel. Edit your alerting policies to use the new notification channel to propagate the events.
D. Configure a new Pub/Sub notification channel with a new topic. Create a new Cloud Run function with direct VPC egress to write the events to the internal endpoint. Create a push subscription with the Cloud Run function as a subscriber to get the events.
Show Answer
Correct Answer: D
Explanation: Cloud Monitoring webhook notification channels require a publicly reachable HTTPS endpoint, so they cannot directly call an internal VPC-only webhook. Pub/Sub is the recommended integration mechanism. A Cloud Run service/function with direct VPC egress can receive Pub/Sub push messages and securely forward them to the internal webhook, minimizing operational overhead and following Google-recommended serverless practices. A pull subscription adds unnecessary infrastructure, and a Pub/Sub push subscription cannot deliver directly to a private internal endpoint.
Question 7
You use Google Cloud Managed Service for Prometheus with managed collection to gather metrics from your service running on Google Kubernetes Engine (GKE). After deploying the service, there is no metric data appearing in Cloud Monitoring and you have not encountered any error messages. You need to troubleshoot this issue. What should you do?
A. Determine if your service has exceeded its quota for writes to the Cloud Monitoring API.
B. Verify that your PodMonitoring configuration references a valid port.
C. Check if the Grafana service is installed on your GKE cluster.
D. Confirm that your service has the monitoring.servicesViewer IAM role.
Show Answer
Correct Answer: B
Explanation: With Google Cloud Managed Service for Prometheus using managed collection, scraping is driven by PodMonitoring or ClusterPodMonitoring resources. If the PodMonitoring references an invalid container port or named port, the target will not be scraped, resulting in no metrics appearing in Cloud Monitoring without necessarily producing obvious errors. The other options do not address the primary managed collection discovery and scraping configuration: API write quota is not typically the issue for managed scraping, Grafana is optional, and the monitoring.servicesViewer role is unrelated to metric ingestion.
Question 8
You are building an ecommerce web application that will be deployed to Google Cloud. You need to periodically test the checkout process in production to ensure its functionality and confirm that you are receiving automated notifications for failures. You also want to minimize administrative effort and follow Google-recommended practices. What should you do?
A. Use Workflows to create a workflow verifying the functionality, and trigger the workflow periodically by using Cloud Tasks.
B. Implement a Cloud Run function for synthetic monitoring with an alerting policy.
C. Create an alerting policy in Cloud Logging to monitor for failed logs during the checkout process.
D. Configure an uptime check with an alerting policy.
Show Answer
Correct Answer: B
Explanation: Synthetic monitoring is the recommended approach for periodically exercising critical user journeys such as an ecommerce checkout in production. Implementing the test as a Cloud Run function and attaching an alerting policy allows scheduled execution, validation of the end-to-end flow, and notification on failures with minimal operational overhead. Uptime checks only verify endpoint availability, Cloud Logging alerts are passive and do not actively test the workflow, and Cloud Tasks is not the recommended scheduler for this use case.
Question 9
You have a CI/CD pipeline set up in Cloud Build that builds container images. These containers are stored in Artifact Registry. You need to ensure that only images built by the Cloud Build pipeline in your production project are deployed to your Google Kubernetes Engine (GKE) cluster. You want to minimize the amount of manual effort required for implementation and maintenance. What should you do?
A. Enable Binary Authorization on the GKE cluster. Create a Cloud Run function triggered by Artifact Registry INSERT events to verify that pushed containers have the projects/PROJECT_ID/attestors/built-by-cloud-build attestor.
B. Configure Artifact Registry to only allow the Cloud Build service account to push containers.
C. Enable Binary Authorization on the GKE cluster. Create a Cloud Key Management Service (Cloud KMS) keyring and the built-by-cloud-build attestor. After Cloud Build pushes the container, use the key to create an attestation. Update the Binary Authorization policy to require the projects/PROJECT_ID/attestors/built-by-cloud-build attestor.
D. Enable Binary Authorization on the GKE cluster. Configure the Binary Authorization policy to require the projects/PROJECT_ID/attestors/built-by-cloud-build attestor.
Show Answer
Correct Answer: D
Explanation: Binary Authorization enforces deployment policies on GKE. Cloud Build has built-in support for creating the built-by-cloud-build attestation, so requiring the built-by-cloud-build attestor in the Binary Authorization policy ensures that only images built by the Cloud Build pipeline are deployable with minimal ongoing effort. Option C adds unnecessary manual attestation steps, B only restricts pushing to Artifact Registry and does not control deployment, and A incorrectly relies on a custom function rather than Binary Authorization's enforcement.
Question 10
Your company is actively developing a new web service following site reliability engineering (SRE) practices. You are leading the company's SRE team and preparing the service for production. You must ensure that the team follows Google-recommended SRE practices during this productionalization process. Which two actions should you take next? (Choose two.)
A. Establish monitoring and alerting systems.
B. Start to document infrastructure system guidelines.
C. Collaborate with the product team to design the service.
D. Implement redundancy measures.
E. Provide early engagement consulting to discuss architecture and design choices in detail.
Show Answer
Correct Answer: A, E
Explanation: Google SRE productionalization emphasizes engaging SRE early in the service lifecycle to influence architecture and reliability decisions, and establishing monitoring and alerting as foundational operational capabilities for SLIs, SLOs, and incident response. Documentation and redundancy are important but are not the primary next productionalization actions, and designing the service is owned by the product/development team rather than the SRE team itself.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.