Professional Cloud DevOps Engineer Free Practice Questions — Page 10
Question 92
Your company is using HTTPS requests to trigger a public Cloud Run-hosted service accessible at the https://booking-engine-abcdef.a.run.app URL. You need to give developers the ability to test the latest revisions of the service before the service is exposed to customers. What should you do?
A. Run the gcloud run deploy booking-engine --no-traffic --tag dev command. Use the https://dev--booking-engine-abcdef.a.run.app URL for testing.
B. Run the gcloud run services update-traffic booking-engine --to-revisions LATEST=1 command. Use the https://booking-engine-abcdef.a.run.app URL for testing.
C. Pass the curl –H “Authorization:Bearer $(gcloud auth print-identity-token)” auth token. Use the https://booking-engine-abcdef.a.run.app URL to test privately.
D. Grant the roles/run.invoker role to the developers testing the booking-engine service. Use the https://booking-engine-abcdef.private.run.app URL for testing.
Show Answer
Correct Answer: A
Explanation: You should deploy a new revision without sending it any production traffic and assign it a tag. Using `gcloud run deploy booking-engine --no-traffic --tag dev` creates a revision that is not exposed to customers, while Cloud Run automatically provides a tagged URL (`https://dev--booking-engine-abcdef.a.run.app`) that developers can use to test that specific revision. This is the recommended Cloud Run pattern for validating new revisions before shifting traffic.
Question 93
Your company operates in a highly regulated domain that requires you to store all organization logs for seven years. You want to minimize logging infrastructure complexity by using managed services. You need to avoid any future loss of log capture or stored logs due to misconfiguration or human error. What should you do?
A. Use Cloud Logging to configure an aggregated sink at the organization level to export all logs into a BigQuery dataset.
B. Use Cloud Logging to configure an aggregated sink at the organization level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.
C. Use Cloud Logging to configure an export sink at each project level to export all logs into a BigQuery dataset
D. Use Cloud Logging to configure an export sink at each project level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.
Show Answer
Correct Answer: B
Explanation: The requirement is organization-wide log retention for seven years with minimal complexity and strong protection against accidental or malicious deletion. An aggregated sink at the organization level ensures all current and future project logs are captured without per-project configuration. Exporting to Cloud Storage allows setting a seven-year retention policy, and Bucket Lock makes the retention policy immutable, preventing deletion or modification due to misconfiguration or human error. BigQuery does not provide immutable retention guarantees, and project-level sinks increase operational risk and complexity.
Question 94
You are using Terraform to manage infrastructure as code within a CI/CD pipeline. You notice that multiple copies of the entire infrastructure stack exist in your Google Cloud project, and a new copy is created each time a change to the existing infrastructure is made. You need to optimize your cloud spend by ensuring that only a single instance of your infrastructure stack exists at a time. You want to follow Google-recommended practices. What should you do?
A. Create a new pipeline to delete old infrastructure stacks when they are no longer needed.
B. Confirm that the pipeline is storing and retrieving the terraform.tfstate file from Cloud Storage with the Terraform gcs backend.
C. Verify that the pipeline is storing and retrieving the terraform.tfstate file from a source control.
D. Update the pipeline to remove any existing infrastructure before you apply the latest configuration.
Show Answer
Correct Answer: B
Explanation: Terraform creates new resources each run when it cannot find or share the existing state. Storing and retrieving terraform.tfstate in a remote backend such as Google Cloud Storage (GCS) is the Google‑recommended practice for CI/CD pipelines. A shared GCS backend provides a single source of truth for state, supports locking, and ensures Terraform updates the existing infrastructure instead of creating duplicate stacks.
Question 95
You are creating a CI/CD pipeline to perform Terraform deployments of Google Cloud resources. Your CI/CD tooling is running in Google Kubernetes Engine (GKE) and uses an ephemeral Pod for each pipeline run. You must ensure that the pipelines that run in the Pods have the appropriate Identity and Access Management (IAM) permissions to perform the Terraform deployments. You want to follow Google-recommended practices for identity management. What should you do? (Choose two.)
A. Create a new Kubernetes service account, and assign the service account to the Pods. Use Workload Identity to authenticate as the Google service account.
B. Create a new JSON service account key for the Google service account, store the key as a Kubernetes secret, inject the key into the Pods, and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.
C. Create a new Google service account, and assign the appropriate IAM permissions.
D. Create a new JSON service account key for the Google service account, store the key in the secret management store for the CI/CD tool, and configure Terraform to use this key for authentication.
E. Assign the appropriate IAM permissions to the Google service account associated with the Compute Engine VM instances that run the Pods.
Show Answer
Correct Answer: A, C
Explanation: Google-recommended practice for workloads running on GKE is to avoid long-lived service account keys and instead use Workload Identity. You create a Google service account with the required IAM roles for Terraform (C), then map it to a Kubernetes service account used by the CI/CD Pods via Workload Identity (A). This allows ephemeral Pods to securely authenticate to Google Cloud without managing JSON keys. Options involving JSON keys or using the node’s default Compute Engine service account are discouraged for security and least-privilege reasons.
Question 96
You are building an application that runs on Cloud Run. The application needs to access a third-party API by using an API key. You need to determine a secure way to store and use the API key in your application by following Google-recommended practices. What should you do?
A. Save the API key in Secret Manager as a secret. Reference the secret as an environment variable in the Cloud Run application.
B. Save the API key in Secret Manager as a secret key. Mount the secret key under the /sys/api_key directory, and decrypt the key in the Cloud Run application.
C. Save the API key in Cloud Key Management Service (Cloud KMS) as a key. Reference the key as an environment variable in the Cloud Run application.
D. Encrypt the API key by using Cloud Key Management Service (Cloud KMS), and pass the key to Cloud Run as an environment variable. Decrypt and use the key in Cloud Run.
Show Answer
Correct Answer: A
Explanation: Google-recommended practice for Cloud Run is to store sensitive values like API keys in Secret Manager and inject them into the service as environment variables. This keeps secrets out of source code and images, provides IAM-based access control and auditing, and is natively supported by Cloud Run. Cloud KMS is for key management and encryption, not for directly storing and injecting application secrets, and mounting or manually decrypting secrets is unnecessary and unsupported in the described ways.
Question 97
Your company runs services by using multiple globally distributed Google Kubernetes Engine (GKE) clusters. Your operations team has set up workload monitoring that uses Prometheus-based tooling for metrics, alerts, and generating dashboards. This setup does not provide a method to view metrics globally across all clusters. You need to implement a scalable solution to support global Prometheus querying and minimize management overhead. What should you do?
A. Configure Prometheus cross-service federation for centralized data access.
B. Configure workload metrics within Cloud Operations for GKE.
C. Configure Prometheus hierarchical federation for centralized data access.
D. Configure Google Cloud Managed Service for Prometheus.
Show Answer
Correct Answer: D
Explanation: Google Cloud Managed Service for Prometheus is a fully managed, scalable solution that supports global PromQL querying across multiple GKE clusters with minimal operational overhead. It centralizes metrics collection, storage, and querying without requiring you to manage Prometheus federation, while remaining compatible with existing Prometheus exporters, alerts, and Grafana dashboards.
Question 98
Your company’s security team needs to have read-only access to Data Access audit logs in the _Required bucket. You want to provide your security team with the necessary permissions following the principle of least privilege and Google-recommended practices. What should you do?
A. Assign the roles/logging.viewer role to each member of the security team.
B. Assign the roles/logging.viewer role to a group with all the security team members.
C. Assign the roles/logging.privateLogViewer role to each member of the security team.
D. Assign the roles/logging.privateLogViewer role to a group with all the security team members.
Show Answer
Correct Answer: D
Explanation: Data Access audit logs are considered private logs and require the roles/logging.privateLogViewer role for read-only access. Granting this role follows least privilege compared to roles/logging.viewer. Assigning the role to a Google group (rather than individual users) is a Google-recommended IAM best practice for easier, centralized access management.
Question 99
You are currently planning how to display Cloud Monitoring metrics for your organization’s Google Cloud projects. Your organization has three folders and six projects:
You want to configure Cloud Monitoring dashboards to only display metrics from the projects within one folder. You need to ensure that the dashboards do not display metrics from projects in the other folders. You want to follow Google-recommended practices. What should you do?
A. Create a single new scoping project.
B. Create new scoping projects for each folder.
C. Use the current app-one-prod project as the scoping project.
D. Use the current app-one-dev, app-one-staging, and app-one-prod projects as the scoping project for each folder.
Show Answer
Correct Answer: B
Explanation: Cloud Monitoring dashboards use a scoping project to determine which monitored projects’ metrics are visible. Google-recommended practice is to use a dedicated (new or empty) scoping project rather than an existing workload project. To restrict dashboards to only the projects within a specific folder, you should create a separate scoping project for each folder and add only that folder’s projects as monitored projects. This cleanly isolates metrics between folders and avoids mixing data from other folders.
Question 100
You want to share a Cloud Monitoring custom dashboard with a partner team. What should you do?
A. Provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard.
B. Export the metrics to BigQuery. Use Looker Studio to create a dashboard, and share the dashboard with the partner team.
C. Copy the Monitoring Query Language (MQL) query from the dashboard, and send the ML query to the partner team.
D. Download the JSON definition of the dashboard, and send the JSON file to the partner team.
Show Answer
Correct Answer: D
Explanation: To share a Cloud Monitoring custom dashboard with a partner team so they can replicate it in their own project, you should download and share the dashboard’s JSON definition. Cloud Monitoring supports exporting dashboards as JSON, which can then be imported into another project to create an exact copy of the dashboard structure. Sharing a URL only works within the same project and IAM scope, MQL queries don’t capture full dashboard layout, and using BigQuery/Looker Studio is unnecessary for this use case.
Question 101
You use Terraform to manage an application deployed to a Google Cloud environment. The application runs on instances deployed by a managed instance group. The Terraform code is deployed by using a CI/CD pipeline. When you change the machine type on the instance template used by the managed instance group, the pipeline fails at the terraform apply stage with the following error message:
You need to update the instance template and minimize disruption to the application and the number of pipeline runs.
What should you do?
A. Delete the managed instance group, and recreate it after updating the instance template.
B. Add a new instance template, update the managed instance group to use the new instance template, and delete the old instance template.
C. Remove the managed instance group from the Terraform state file, update the instance template, and reimport the managed instance group.
D. Set the create_before_destroy meta-argument to true in the lifecycle block on the instance template.
Show Answer
Correct Answer: D
Explanation: Changing the machine type requires a new instance template because instance templates are immutable. By setting the create_before_destroy lifecycle meta-argument on the instance template, Terraform will create the new template first and then update the managed instance group to reference it before destroying the old template. This avoids downtime, minimizes application disruption, and prevents Terraform apply failures in a CI/CD pipeline, while requiring only a single pipeline run.
$19
Get all 199 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.