Professional Cloud DevOps Engineer Free Practice Questions — Page 10
Question 92
You manage an application that runs in Google Kubernetes Engine (GKE) and uses the blue/green deployment methodology. Extracts of the Kubernetes manifests are shown below:
The Deployment app-green was updated to use the new version of the application. During post-deployment monitoring, you notice that the majority of user requests are failing. You did not observe this behavior in the testing environment. You need to mitigate the incident impact on users and enable the developers to troubleshoot the issue. What should you do?
A. Update the Deployment app-blue to use the new version of the application.
B. Update the Deployment app-green to use the previous version of the application.
C. Change the selector on the Service app-svc to app: my-app.
D. Change the selector on the Service app-svc to app: my-app, version: blue.
Show Answer
Correct Answer: D
Explanation: In a blue/green deployment, the safest mitigation is to switch production traffic back to the known-good (blue) deployment while leaving the failing green deployment running for investigation. Changing the Service selector to target only pods labeled version: blue immediately restores users to the stable version without destroying the green environment, allowing developers to troubleshoot it. Rolling back the green Deployment (B) modifies the environment under investigation, while updating blue to the new version (A) worsens the issue. Selecting only app: my-app (C) would typically route traffic to both blue and green if both share that label, which would not mitigate the failures.
Question 93
Your company has a Google Cloud resource hierarchy with folders for production, test, and development. Your cyber security team needs to review your company's Google Cloud security posture to accelerate security issue identification and resolution. You need to centralize the logs generated by Google Cloud services from all projects only inside your production folder to allow for alerting and near-real time analysis. What should you do?
A. Enable the Workflows API and route all the logs to Cloud Logging.
B. Create a central Cloud Monitoring workspace and attach all related projects.
C. Create an aggregated log sink associated with the production folder that uses a Pub/Sub topic as the destination.
D. Create an aggregated log sink associated with the production folder that uses a Cloud Logging bucket as the destination.
Show Answer
Correct Answer: D
Explanation: An aggregated log sink at the production folder centralizes logs from all child projects only within that folder. Using a Cloud Logging bucket as the destination provides a centralized repository that supports Cloud Logging queries, log analytics, and log-based alerting with near-real-time availability. Pub/Sub is appropriate when streaming logs to downstream consumers or external SIEMs, but the question only requires centralization for alerting and near-real-time analysis within Google Cloud. Monitoring workspaces don't centralize logs, and Workflows is unrelated.
Question 94
You are configuring connectivity across Google Kubernetes Engine (GKE) clusters in different VPCs. You notice that the nodes in Cluster A are unable to access the nodes in Cluster B. You suspect that the workload access issue is due to the network configuration. You need to troubleshoot the issue but do not have execute access to workloads and nodes. You want to identify the layer at which the network connectivity is broken. What should you do?
A. Install a toolbox container on the node in Cluster Confirm that the routes to Cluster B are configured appropriately.
B. Use Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster
C. Use a debug container to run the traceroute command from Cluster A to Cluster B and from Cluster B to Cluster A. Identify the common failure point.
D. Enable VPC Flow Logs in both VPCs, and monitor packet drops.
Show Answer
Correct Answer: B
Explanation: Because you do not have execute access to workloads or nodes, options that require logging into nodes or running commands (A and C) are not feasible. Connectivity Tests in Network Intelligence Center (sometimes mistakenly referred to as Network Connectivity Center) can analyze the end-to-end network path and identify where connectivity fails without requiring access to the workloads or nodes. VPC Flow Logs (D) help observe traffic after enabling them but are not the primary tool for pinpointing the network layer where connectivity is broken.
Question 95
You built a serverless application by using Cloud Run and deployed the application to your production environment. You want to identify the resource utilization of the application for cost optimization. What should you do?
A. Use Cloud Trace with distributed tracing to monitor the resource utilization of the application.
B. Use Cloud Profiler with Ops Agent to monitor the CPU and memory utilization of the application.
C. Use Cloud Monitoring to monitor the container CPU and memory utilization of the application.
D. Use Cloud Ops to create logs-based metrics to monitor the resource utilization of the application.
Show Answer
Correct Answer: C
Explanation: Cloud Run automatically integrates with Cloud Monitoring, which provides container CPU and memory utilization metrics suitable for identifying resource usage and optimizing costs. Cloud Trace is for request tracing, not resource utilization. Cloud Profiler focuses on code-level profiling and the option is incorrect because it mentions using the Ops Agent, which is not used with Cloud Run. Logs-based metrics are not the primary mechanism for monitoring CPU and memory utilization.
Question 96
You are implementing a CI/CD pipeline for your application in your company’s multi-cloud environment. Your application is deployed by using custom Compute Engine images and the equivalent in other cloud providers. You need to implement a solution that will enable you to build and deploy the images to your current environment and is adaptable to future changes. Which solution stack should you use?
A. Cloud Build with Packer
B. Cloud Build with Google Cloud Deploy
C. Google Kubernetes Engine with Google Cloud Deploy
D. Cloud Build with kpt
Show Answer
Correct Answer: A
Explanation: Cloud Build handles the CI pipeline, while Packer is designed to create identical VM images from a single configuration across multiple cloud providers. Because the application is deployed using custom Compute Engine images and equivalent VM images in other clouds, Cloud Build with Packer provides a portable, multi-cloud image build workflow that is adaptable to future changes. Google Cloud Deploy is focused on application delivery (primarily to GKE/Cloud Run), and kpt is a Kubernetes configuration tool, making options B, C, and D unsuitable for VM image-based multi-cloud deployments.
Question 97
The new version of your containerized application has been tested and is ready to be deployed to production on Google Kubernetes Engine (GKE). You could not fully load-test the new version in your pre-production environment, and you need to ensure that the application does not have performance problems after deployment. Your deployment must be automated. What should you do?
A. Deploy the application through a continuous delivery pipeline by using canary deployments. Use Cloud Monitoring to look for performance issues, and ramp up traffic as supported by the metrics.
B. Deploy the application through a continuous delivery pipeline by using blue/green deployments. Migrate traffic to the new version of the application and use Cloud Monitoring to look for performance issues.
C. Deploy the application by using kubectl and use Config Connector to slowly ramp up traffic between versions. Use Cloud Monitoring to look for performance issues.
D. Deploy the application by using kubectl and set the spec.updateStrategy.type field to RollingUpdate. Use Cloud Monitoring to look for performance issues, and run the kubectl rollback command if there are any issues.
Show Answer
Correct Answer: A
Explanation: Canary deployments are the best fit because the new version could not be fully load-tested and the deployment must be automated. A canary rollout sends a small percentage of production traffic to the new version, allowing Cloud Monitoring metrics to validate performance before gradually increasing traffic. This minimizes user impact while enabling automated progressive delivery. Blue/green typically shifts all traffic at once after cutover, while the kubectl-based options are not aligned with the requirement for an automated deployment pipeline and do not provide progressive traffic management.
Question 98
You work for a global organization and run a service with an availability target of 99% with limited engineering resources.
For the current calendar month, you noticed that the service has 99.5% availability. You must ensure that your service meets the defined availability goals and can react to business changes, including the upcoming launch of new features.
You also need to reduce technical debt while minimizing operational costs. You want to follow Google-recommended practices. What should you do?
A. Add N+1 redundancy to your service by adding additional compute resources to the service.
B. Identify, measure, and eliminate toil by automating repetitive tasks.
C. Define an error budget for your service level availability and minimize the remaining error budget.
D. Allocate available engineers to the feature backlog while you ensure that the service remains within the availability target.
Show Answer
Correct Answer: C
Explanation: Google SRE recommends managing reliability with SLOs and error budgets. Since the service is exceeding its 99% availability target (currently 99.5%), the remaining error budget should be used to balance reliability with feature velocity and technical debt reduction rather than investing in unnecessary reliability. Defining and using an error budget enables reacting to business changes while avoiding over-engineering. Option A increases cost unnecessarily, B is a good SRE practice but does not directly address the central reliability-versus-velocity decision, and D ignores the explicit error-budget approach.
Sources:
https://cloud.google.com/blog/products/gcp/understanding-error-budget-overspend-cre-life-lessons
https://cloud.google.com/blog/products/gcp/available-or-not-that-is-the-question-cre-life-lessons
Question 99
You are building and running client applications in Cloud Run and Cloud Functions. Your client requires that all logs must be available for one year so that the client can import the logs into their logging service. You must minimize required code changes. What should you do?
A. Update all images in Cloud Run and all functions in Cloud Functions to send logs to both Cloud Logging and the client's logging service. Ensure that all the ports required to send logs are open in the VPC firewall.
B. Create a Pub/Sub topic, subscription, and logging sink. Configure the logging sink to send all logs into the topic. Give your client access to the topic to retrieve the logs.
C. Create a storage bucket and appropriate VPC firewall rules. Update all images in Cloud Run and all functions in Cloud Functions to send logs to a file within the storage bucket.
D. Create a logs bucket and logging sink. Set the retention on the logs bucket to 365 days. Configure the logging sink to send logs to the bucket. Give your client access to the bucket to retrieve the logs.
Show Answer
Correct Answer: D
Explanation: Cloud Run and Cloud Functions automatically write logs to Cloud Logging, so no application code changes are needed. Create a dedicated Cloud Logging logs bucket with a 365-day retention policy and configure a logging sink to route the required logs into that bucket. Then grant the client access to the logs bucket so they can retrieve or export the logs. This satisfies the one-year retention requirement while minimizing operational and code changes. Options A and C require modifying applications, and B uses Pub/Sub, which is intended for streaming/export rather than long-term log retention.
Question 100
You are building and running client applications in Cloud Run and Cloud Functions. Your client requires that all logs must be available for one year so that the client can import the logs into their logging service. You must minimize required code changes. What should you do?
A. Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods.
B. Configure Identity and Access Management (IAM) policies to create a least privilege model on your GKE clusters.
C. Use Binary Authorization to attest images during your CI/CD pipeline.
D. Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images.
Show Answer
Correct Answer: C
Explanation: The provided question and answer choices are mismatched. The choices are about GKE/container security rather than Cloud Run/Cloud Functions logging retention. Among the given options, the correct answer for the likely intended security question is to use Binary Authorization to enforce that only trusted, attested container images are deployed through the CI/CD pipeline.
Question 101
Your company is using HTTPS requests to trigger a public Cloud Run-hosted service accessible at the https://booking-engine-abcdef.a.run.app URL. You need to give developers the ability to test the latest revisions of the service before the service is exposed to customers. What should you do?
A. Run the gcloud run deploy booking-engine --no-traffic --tag dev command. Use the https://dev--booking-engine-abcdef.a.run.app URL for testing.
B. Run the gcloud run services update-traffic booking-engine --to-revisions LATEST=1 command. Use the https://booking-engine-abcdef.a.run.app URL for testing.
C. Pass the curl –H “Authorization:Bearer $(gcloud auth print-identity-token)” auth token. Use the https://booking-engine-abcdef.a.run.app URL to test privately.
D. Grant the roles/run.invoker role to the developers testing the booking-engine service. Use the https://booking-engine-abcdef.private.run.app URL for testing.
Show Answer
Correct Answer: A
Explanation: Deploy the new revision with no traffic and assign it a tag. Tagged revisions receive a dedicated URL (for example, https://dev--booking-engine-abcdef.a.run.app) that developers can use to test the revision without affecting customer traffic. Option B routes traffic to the latest revision on the production URL, C does not isolate revisions and only authenticates requests, and D refers to a private.run.app URL that is not how public Cloud Run tagged revision testing works.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.