Professional Cloud DevOps Engineer Free Practice Questions — Page 11
Question 102
Your company operates in a highly regulated domain that requires you to store all organization logs for seven years. You want to minimize logging infrastructure complexity by using managed services. You need to avoid any future loss of log capture or stored logs due to misconfiguration or human error. What should you do?
A. Use Cloud Logging to configure an aggregated sink at the organization level to export all logs into a BigQuery dataset.
B. Use Cloud Logging to configure an aggregated sink at the organization level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.
C. Use Cloud Logging to configure an export sink at each project level to export all logs into a BigQuery dataset
D. Use Cloud Logging to configure an export sink at each project level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.
Show Answer
Correct Answer: B
Explanation: An organization-level aggregated sink captures logs across the entire organization, reducing configuration complexity and avoiding gaps from per-project misconfiguration. Exporting to Cloud Storage is appropriate for long-term archival, and configuring a seven-year retention policy with Bucket Lock provides immutable retention to protect against accidental or intentional deletion, satisfying regulatory requirements and minimizing risk from human error.
Question 103
You are using Terraform to manage infrastructure as code within a CI/CD pipeline. You notice that multiple copies of the entire infrastructure stack exist in your Google Cloud project, and a new copy is created each time a change to the existing infrastructure is made. You need to optimize your cloud spend by ensuring that only a single instance of your infrastructure stack exists at a time. You want to follow Google-recommended practices. What should you do?
A. Create a new pipeline to delete old infrastructure stacks when they are no longer needed.
B. Confirm that the pipeline is storing and retrieving the terraform.tfstate file from Cloud Storage with the Terraform gcs backend.
C. Verify that the pipeline is storing and retrieving the terraform.tfstate file from a source control.
D. Update the pipeline to remove any existing infrastructure before you apply the latest configuration.
Show Answer
Correct Answer: B
Explanation: Terraform must use a shared remote state so each pipeline run knows the existing infrastructure instead of treating it as new. On Google Cloud, the recommended practice is to store terraform.tfstate in a Cloud Storage bucket using the Terraform GCS backend. This preserves state across CI/CD runs, enables collaboration and locking behavior, and prevents creation of duplicate infrastructure stacks. Storing state only in source control is not recommended, and deleting/recreating infrastructure on every change is inefficient and contrary to normal Terraform workflows.
Question 104
You are creating a CI/CD pipeline to perform Terraform deployments of Google Cloud resources. Your CI/CD tooling is running in Google Kubernetes Engine (GKE) and uses an ephemeral Pod for each pipeline run. You must ensure that the pipelines that run in the Pods have the appropriate Identity and Access Management (IAM) permissions to perform the Terraform deployments. You want to follow Google-recommended practices for identity management. What should you do? (Choose two.)
A. Create a new Kubernetes service account, and assign the service account to the Pods. Use Workload Identity to authenticate as the Google service account.
B. Create a new JSON service account key for the Google service account, store the key as a Kubernetes secret, inject the key into the Pods, and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.
C. Create a new Google service account, and assign the appropriate IAM permissions.
D. Create a new JSON service account key for the Google service account, store the key in the secret management store for the CI/CD tool, and configure Terraform to use this key for authentication.
E. Assign the appropriate IAM permissions to the Google service account associated with the Compute Engine VM instances that run the Pods.
Show Answer
Correct Answer: A, C
Explanation: Google recommends using Workload Identity for GKE workloads instead of long-lived service account keys. Create a dedicated Google service account with only the IAM permissions needed for Terraform, then bind it to a Kubernetes service account used by the CI/CD Pods via Workload Identity. Avoid JSON service account keys, and do not rely on the node VM's service account because it violates least privilege and broadens access.
Question 105
You are building an application that runs on Cloud Run. The application needs to access a third-party API by using an API key. You need to determine a secure way to store and use the API key in your application by following Google-recommended practices. What should you do?
A. Save the API key in Secret Manager as a secret. Reference the secret as an environment variable in the Cloud Run application.
B. Save the API key in Secret Manager as a secret key. Mount the secret key under the /sys/api_key directory, and decrypt the key in the Cloud Run application.
C. Save the API key in Cloud Key Management Service (Cloud KMS) as a key. Reference the key as an environment variable in the Cloud Run application.
D. Encrypt the API key by using Cloud Key Management Service (Cloud KMS), and pass the key to Cloud Run as an environment variable. Decrypt and use the key in Cloud Run.
Show Answer
Correct Answer: A
Explanation: Secret Manager is the Google-recommended service for storing application secrets such as third-party API keys. Cloud Run can securely inject a Secret Manager secret as an environment variable (or mount it as a volume). Option A correctly uses Secret Manager with environment variable injection. Option B is incorrect because it refers to a 'secret key' and mounting under /sys, which Cloud Run does not allow. Options C and D misuse Cloud KMS, which is intended for encryption key management rather than storing application secrets like API keys.
Question 106
Your company runs services by using multiple globally distributed Google Kubernetes Engine (GKE) clusters. Your operations team has set up workload monitoring that uses Prometheus-based tooling for metrics, alerts, and generating dashboards. This setup does not provide a method to view metrics globally across all clusters. You need to implement a scalable solution to support global Prometheus querying and minimize management overhead. What should you do?
A. Configure Prometheus cross-service federation for centralized data access.
B. Configure workload metrics within Cloud Operations for GKE.
C. Configure Prometheus hierarchical federation for centralized data access.
D. Configure Google Cloud Managed Service for Prometheus.
Show Answer
Correct Answer: D
Explanation: Google Cloud Managed Service for Prometheus is designed for scalable, fully managed Prometheus monitoring across multiple GKE clusters, projects, and even clouds. It provides global PromQL querying while minimizing operational overhead. Federation (cross-service or hierarchical) can aggregate metrics but requires managing Prometheus infrastructure and is less scalable than the managed service. Cloud Operations workload metrics alone do not provide the managed global Prometheus querying capability requested.
Question 107
Your company’s security team needs to have read-only access to Data Access audit logs in the _Required bucket. You want to provide your security team with the necessary permissions following the principle of least privilege and Google-recommended practices. What should you do?
A. Assign the roles/logging.viewer role to each member of the security team.
B. Assign the roles/logging.viewer role to a group with all the security team members.
C. Assign the roles/logging.privateLogViewer role to each member of the security team.
D. Assign the roles/logging.privateLogViewer role to a group with all the security team members.
Show Answer
Correct Answer: D
Explanation: Data Access audit logs are considered private logs and require the roles/logging.privateLogViewer role to view. Following least-privilege and Google IAM best practices, grant the role to a Google Group rather than directly to individual users for simpler, centralized access management.
Question 108
You are currently planning how to display Cloud Monitoring metrics for your organization’s Google Cloud projects. Your organization has three folders and six projects:
You want to configure Cloud Monitoring dashboards to only display metrics from the projects within one folder. You need to ensure that the dashboards do not display metrics from projects in the other folders. You want to follow Google-recommended practices. What should you do?
A. Create a single new scoping project.
B. Create new scoping projects for each folder.
C. Use the current app-one-prod project as the scoping project.
D. Use the current app-one-dev, app-one-staging, and app-one-prod projects as the scoping project for each folder.
Show Answer
Correct Answer: B
Explanation: To isolate Cloud Monitoring dashboards so they only display metrics from projects within a single folder, create a dedicated scoping project for each folder and add only the projects in that folder as monitored projects. Google recommends using a new or otherwise empty project as the scoping project rather than repurposing an application project. A single scoping project would aggregate multiple folders, and using existing application projects as scoping projects is not the recommended practice.
Question 109
You want to share a Cloud Monitoring custom dashboard with a partner team. What should you do?
A. Provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard.
B. Export the metrics to BigQuery. Use Looker Studio to create a dashboard, and share the dashboard with the partner team.
C. Copy the Monitoring Query Language (MQL) query from the dashboard, and send the ML query to the partner team.
D. Download the JSON definition of the dashboard, and send the JSON file to the partner team.
Show Answer
Correct Answer: D
Explanation: To share a Cloud Monitoring custom dashboard so another team can recreate it in their own environment, export/download the dashboard's JSON definition and send it to them. The JSON contains the full dashboard configuration (layout, widgets, queries) and can be imported. A dashboard URL is primarily for viewing the existing dashboard with appropriate IAM access, not for portable sharing across projects. MQL alone does not capture the dashboard configuration, and exporting to BigQuery/Looker Studio is unnecessary for this purpose.
Question 110
You use Terraform to manage an application deployed to a Google Cloud environment. The application runs on instances deployed by a managed instance group. The Terraform code is deployed by using a CI/CD pipeline. When you change the machine type on the instance template used by the managed instance group, the pipeline fails at the terraform apply stage with the following error message:
You need to update the instance template and minimize disruption to the application and the number of pipeline runs.
What should you do?
A. Delete the managed instance group, and recreate it after updating the instance template.
B. Add a new instance template, update the managed instance group to use the new instance template, and delete the old instance template.
C. Remove the managed instance group from the Terraform state file, update the instance template, and reimport the managed instance group.
D. Set the create_before_destroy meta-argument to true in the lifecycle block on the instance template.
Show Answer
Correct Answer: D
Explanation: Changing the machine type on a Google Compute Engine instance template requires replacing the instance template because it is immutable. By default, Terraform may attempt to destroy the old template before creating the new one, which can fail if the managed instance group still references it. Setting lifecycle { create_before_destroy = true } on the instance template ensures the new template is created first, then the managed instance group can be updated to reference it, and finally the old template is removed. This minimizes application disruption and completes the change in a single Terraform apply run without manual state manipulation or deleting the managed instance group.
Question 111
You are running a web application deployed to a Compute Engine managed instance group. Ops Agent is installed on all instances. You recently noticed suspicious activity from a specific IP address. You need to configure Cloud Monitoring to view the number of requests from that specific IP address with minimal operational overhead. What should you do?
A. Configure the Ops Agent with a logging receiver. Create a logs-based metric. B Create a script to scrape the web server log. Export the IP address request metrics to the Cloud Monitoring API.
C. Update the application to export the IP address request metrics to the Cloud Monitoring API.
D. Configure the Ops Agent with a metrics receiver.
Show Answer
Correct Answer: A
Explanation: The correct approach is to collect the web server logs with the Ops Agent's logging pipeline and create a logs-based metric that counts requests matching the suspicious IP address. Cloud Monitoring can then chart and alert on that metric. This requires no application changes or custom scraping scripts, minimizing operational overhead. A metrics receiver collects existing metrics, not request counts extracted from log entries.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.