Professional Cloud DevOps Engineer Free Practice Questions
This is the free Google Professional Cloud DevOps Engineer practice question bank —
100 of 199 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
Your company is actively developing a new web service following site reliability engineering (SRE) practices. You are leading the company's SRE team and preparing the service for production. You must ensure that the team follows Google-recommended SRE practices during this productionalization process. Which two actions should you take next? (Choose two.)
A. Establish monitoring and alerting systems.
B. Start to document infrastructure system guidelines.
C. Collaborate with the product team to design the service.
D. Implement redundancy measures.
E. Provide early engagement consulting to discuss architecture and design choices in detail.
Show Answer
Correct Answer: A, E
Explanation: Google SRE guidance emphasizes engaging early with product teams to influence architecture and reliability decisions before launch, which is captured by providing early engagement consulting. In parallel, establishing monitoring and alerting is foundational for defining SLIs/SLOs and safely operating the service in production. Other options are either subsets of these activities or typically follow after design and observability are in place.
Question 2
Your company is creating a new cloud-native Google Cloud organization. You expect this Google Cloud organization to first be used by a small number of departments and then expand to be used by a large number of departments. Each department has a large number of applications that range in size. You need to design the VPC network architecture. Your solution must minimize the amount of management required, while remaining flexible enough for development teams to quickly adapt to their evolving needs. What should you do?
A. Create a separate VPC for each department, and connect the VPCs with VPC Network Peering.
B. Create a separate VPC for each department. Use Private Service Connect to connect the VPCs.
C. Create a separate VPC for each application. Use Private Service Connect to connect the VPCs.
D. Create a separate VPC for each department, and connect the VPCs with Cloud VPN.
Show Answer
Correct Answer: A
Explanation: Use one VPC per department to balance isolation and manageability. This minimizes operational overhead compared to per-application VPCs, scales well as more departments are added, and gives teams flexibility within their VPC. VPC Network Peering provides simple, high-performance private connectivity between departments without the cost and complexity of VPNs, and Private Service Connect is not intended for general VPC-to-VPC connectivity.
Question 3
Your company is migrating its production systems to Google Cloud. You need to implement site reliability engineering (SRE) practices during the migration to minimize customer impact from potential future incidents. Which two SRE practices should you implement? (Choose two.)
A. Create up-to-date playbooks with instructions for debugging and mitigating issues.
B. Ensure that all teams can modify the production environment to resolve issues.
C. Create an alerting mechanism for your SRE team based on your system's internal behavior.
D. Automate common tasks to analyze key impact information and intelligently suggest mitigating actions for the on-call team.
E. Ensure that full autonomy and permissions are only granted to the on-call team.
Show Answer
Correct Answer: A, D
Explanation: SRE focuses on reducing mean time to recovery and customer impact through preparedness and automation. Up-to-date playbooks provide clear, tested procedures for diagnosing and mitigating incidents quickly. Automating common analysis and response tasks reduces toil, speeds incident response, and helps on-call engineers make effective mitigation decisions. The other options either weaken production safety or are not core SRE practices.
Question 4
You are deploying a new web application on Cloud Run in your Google Cloud project. You expect traffic to range from 10 requests per second during off-peak hours to 1000 requests per second during peak hours. You want to use autoscaling to efficiently handle the changes in traffic while ensuring that the autoscaler does not exceed your project's resource quotas. What should you do?
A. Manually adjust the number of instances based on observed traffic patterns throughout the day.
B. Define appropriate resource limits for the Cloud Run service, and ensure your project has sufficient resource quotas to accommodate the desired scaling range.
C. Configure the autoscaler to scale based on CPU utilization with a target of 80%.
D. Configure the autoscaler to scale based on request count, with a target of 500 requests per instance.
Show Answer
Correct Answer: B
Explanation: Cloud Run autoscaling is managed automatically, but it is constrained by service resource limits and project-level quotas. To handle large traffic fluctuations efficiently without exceeding quotas, you should set appropriate CPU/memory limits and ensure your project quotas support the maximum expected scale. Manual scaling or tuning specific metrics is unnecessary and does not address quota constraints directly.
Question 5
You manage a microservice that provides a public-facing API (Service A). Service A is time-critical and has a response SLO of 500 ms. Service A makes synchronous calls to internal API (Service B) that is known to become unreliable under heavy load, resulting in connection timeout errors or 500 errors. Service B is used to collect request information for the transactions processed by Service A. You need to mitigate the impact of Service B issues on your Service A users. What should you do?
A. Increase the size of the queue in front of the thread pool used by Service A instances.
B. Implement retry logic with exponential back-offs when calling Service
C. Implement a circuit breaker to store the request data in a database.
D. Implement rate limiting in Service A to limit the number of requests to Service B.
Show Answer
Correct Answer: C
Explanation: Service A has a strict 500 ms SLO and calls Service B synchronously, which becomes unreliable under load. To protect Service A users, you must prevent Service B failures from consuming latency budget and threads. A circuit breaker stops calls to Service B when error rates rise, providing isolation. Adding a fallback that stores request data (e.g., in a database or queue) allows Service A to continue responding quickly while preserving data for later processing. Retries, larger queues, or rate limiting would either increase latency or still couple Service A’s availability to Service B.
Question 6
You recently created a Cloud Build pipeline for deploying Terraform code stored in a GitHub repository. You make Terraform code changes in short-lived branches and sometimes use tags during development. You tag releases with a semantic version when they are ready for deployment. You require your pipeline to apply the Terraform code whenever there is a new release, and you need to minimize operational overhead. What should you do?
A. Create a build trigger with the \d+\.\d+\.\d+ tag pattern.
B. Create a build trigger with the \d+\.\d+\.\d+ branch pattern.
C. Create a build trigger with the .* tag pattern.
D. Create a build trigger with the .* branch pattern.
Show Answer
Correct Answer: A
Explanation: The requirement is to deploy only when a new release is created and releases are identified by semantic version tags. Cloud Build supports triggers based on Git tags using regular expressions. Configuring a trigger with the tag pattern `\d+\.\d+\.\d+` ensures the pipeline runs only when a semantic version tag (for example, 1.2.3) is pushed. This minimizes operational overhead and avoids triggering builds for branches or non-release tags.
Question 7
Your company has an application deployed on Google Kubernetes Engine (GKE) consisting of 12 microservices. Multiple teams are working concurrently on various features across three envi-ronments: Dev, Staging, and Prod. Developers report dependency test failures and delayed re-leases due to deployments from multiple feature branches in the shared Dev GKE cluster.
You need to implement a cost-effective solution for developers to test their microservice features in a stable development environment isolated from other development activities. What should you do?
A. Automate CI pipelines by using Cloud Build for container image creation and Kubernetes manifest updates from main branch merge requests. Integrate with Config Sync to test new im-ages in dynamically created namespaces on the Dev GKE cluster with autoscaling enabled. Im-plement a post-test namespace cleanup routine.
B. Automate CI pipelines by using Cloud Build to create container images and update Kuber-netes manifests for each commit. Use Cloud Deploy for progressive delivery to Dev, Staging, and Prod GKE clusters. Enable Config Sync for consistent Kubernetes configurations across en-vironments.
C. Use Cloud Build to automate CI pipelines and update Kubernetes manifest files from feature branch commits. Integrate with Config Sync to test new images in dynamically created namespaces on the Dev GKE cluster with autoscaling enabled. Implement a post-test namespace cleanup routine.
D. Use Cloud Build to automate CI pipelines and update Kubernetes manifest files from feature branch commits. Integrate with Config Sync to test new images in dynamically created GKE Dev clusters for each feature branch, which are deleted upon merge request.
Show Answer
Correct Answer: C
Explanation: The problem is interference between concurrent feature development in a shared Dev GKE cluster. The most cost‑effective way to provide isolation is to give each feature branch its own ephemeral environment without creating full clusters. Option C does this by triggering CI from feature branch commits, deploying into dynamically created namespaces within the existing Dev cluster, and cleaning them up after testing. This isolates dependencies, enables early testing, avoids cross‑team conflicts, and is cheaper and faster than per‑branch clusters or main‑branch–only deployments.
Question 8
You are deploying a new application on Google Kubernetes Engine (GKE) that processes personally identifiable information (PII). You need to configure Cloud Logging to collect logs from your application while ensuring that sensitive user information is not exposed. What should you do?
A. Implement log sampling to reduce the volume of logs collected.
B. Configure Cloud Data Loss Prevention to scan logs in real-time and redact PII before it's stored in Cloud Logging.
C. Disable Cloud Logging for the application to prevent sensitive data from being logged.
D. Store all logs in an encrypted Cloud Storage bucket with restricted access.
Show Answer
Correct Answer: B
Explanation: Cloud Data Loss Prevention (DLP) is designed to detect and redact or de-identify PII. Integrating DLP with Cloud Logging (for example via log sinks) allows sensitive fields to be masked before logs are stored, meeting the requirement to collect logs while preventing exposure of PII. Other options do not directly prevent sensitive data from being logged.
Question 9
Your team is preparing to launch a new API in Cloud Run. The API uses an OpenTelemetry agent to send distributed tracing data to Cloud Trace to monitor the time each request takes. The team has noticed inconsistent trace collection. You need to resolve the issue. What should you do?
A. Use an HTTP health check.
B. Configure CPU to be always-allocated.
C. Increase the CPU limit in Cloud Run from 2 to 4.
D. Configure CPU to be allocated only during request processing.
Show Answer
Correct Answer: B
Explanation: Cloud Run normally allocates CPU only during request handling. OpenTelemetry agents often send trace data asynchronously after the request finishes, which can be interrupted when CPU is deallocated, leading to inconsistent traces. Configuring CPU to be always allocated ensures the agent has CPU time to reliably export traces to Cloud Trace.
Question 10
You are developing a Node.js utility on a workstation in Cloud Workstations by using Code OSS. The utility is a simple web page, and you have already confirmed that all necessary firewall rules are in place. You tested the application by starting it on port 3000 on your workstation in Cloud Workstations, but you need to be able to access the web page from your local machine. You need to follow Google-recommended security practices. What should you do?
A. Use a browser running on a bastion host VM.
B. Run the gcloud compute start-iap-tunnel command to the Cloud Workstations VM.
C. Allow public IP addresses in the Cloud Workstations configuration.
D. Click the preview link in the Code OSS panel.
Show Answer
Correct Answer: D
Explanation: Cloud Workstations with Code OSS provides a built-in preview feature that securely exposes locally running web apps (such as on port 3000) to your local browser without opening public IPs or creating tunnels. This follows Google-recommended security practices and is specifically designed for previewing web applications from the workstation.
$19
Get all 199 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.