Professional Cloud DevOps Engineer Free Practice Questions — Page 2
Question 11
Your company is creating a new cloud-native Google Cloud organization. You expect this Google Cloud organization to first be used by a small number of departments and then expand to be used by a large number of departments. Each department has a large number of applications that range in size. You need to design the VPC network architecture. Your solution must minimize the amount of management required, while remaining flexible enough for development teams to quickly adapt to their evolving needs. What should you do?
A. Create a separate VPC for each department, and connect the VPCs with VPC Network Peering.
B. Create a separate VPC for each department. Use Private Service Connect to connect the VPCs.
C. Create a separate VPC for each application. Use Private Service Connect to connect the VPCs.
D. Create a separate VPC for each department, and connect the VPCs with Cloud VPN.
Show Answer
Correct Answer: A
Explanation: A separate VPC per department provides a good balance of isolation, scalability, and operational simplicity. VPC Network Peering is the appropriate native mechanism among the options for private, high-performance connectivity between departmental VPCs. Private Service Connect is intended for publishing and consuming services rather than general full-mesh VPC connectivity, and creating a VPC per application would add unnecessary management overhead. Cloud VPN is intended for encrypted connectivity (typically hybrid or between networks) and adds unnecessary operational complexity and cost for VPCs within the same organization.
Question 12
Your company is migrating its production systems to Google Cloud. You need to implement site reliability engineering (SRE) practices during the migration to minimize customer impact from potential future incidents. Which two SRE practices should you implement? (Choose two.)
A. Create up-to-date playbooks with instructions for debugging and mitigating issues.
B. Ensure that all teams can modify the production environment to resolve issues.
C. Create an alerting mechanism for your SRE team based on your system's internal behavior.
D. Automate common tasks to analyze key impact information and intelligently suggest mitigating actions for the on-call team.
E. Ensure that full autonomy and permissions are only granted to the on-call team.
Show Answer
Correct Answer: A, D
Explanation: SRE emphasizes reducing mean time to recovery through well-maintained runbooks/playbooks and reducing operational toil with automation. Up-to-date playbooks help responders diagnose and mitigate incidents consistently, while automating common analysis and suggesting mitigations improves incident response efficiency. Broad production access for all teams (B) violates least privilege, alerts should be based on user-impacting symptoms rather than only internal behavior (making C less aligned with SRE best practices), and restricting full autonomy only to the on-call team (E) is not a core SRE practice.
Question 13
You are deploying a new web application on Cloud Run in your Google Cloud project. You expect traffic to range from 10 requests per second during off-peak hours to 1000 requests per second during peak hours. You want to use autoscaling to efficiently handle the changes in traffic while ensuring that the autoscaler does not exceed your project's resource quotas. What should you do?
A. Manually adjust the number of instances based on observed traffic patterns throughout the day.
B. Define appropriate resource limits for the Cloud Run service, and ensure your project has sufficient resource quotas to accommodate the desired scaling range.
C. Configure the autoscaler to scale based on CPU utilization with a target of 80%.
D. Configure the autoscaler to scale based on request count, with a target of 500 requests per instance.
Show Answer
Correct Answer: B
Explanation: Cloud Run autoscales automatically based on incoming requests and other signals. To ensure scaling can handle variable traffic without exceeding project resource quotas, you should define appropriate service resource limits (such as maximum instances) and make sure your project quotas are sufficient for the intended scaling range. Manually adjusting instances defeats autoscaling, and specifying CPU or request targets is not the key control for respecting project quotas in Cloud Run.
Question 14
You manage a microservice that provides a public-facing API (Service A). Service A is time-critical and has a response SLO of 500 ms. Service A makes synchronous calls to internal API (Service B) that is known to become unreliable under heavy load, resulting in connection timeout errors or 500 errors. Service B is used to collect request information for the transactions processed by Service A. You need to mitigate the impact of Service B issues on your Service A users. What should you do?
A. Increase the size of the queue in front of the thread pool used by Service A instances.
B. Implement retry logic with exponential back-offs when calling Service
C. Implement a circuit breaker to store the request data in a database.
D. Implement rate limiting in Service A to limit the number of requests to Service B.
Show Answer
Correct Answer: C
Explanation: A circuit breaker prevents repeated slow/failing synchronous calls to the unreliable downstream service, protecting Service A's 500 ms SLO. When the circuit is open, Service A can use a fallback such as persisting the request information for later processing instead of blocking on Service B. Increasing queues increases latency, retries worsen latency and load under failure, and rate limiting does not directly isolate Service A from downstream failures.
Question 15
You recently created a Cloud Build pipeline for deploying Terraform code stored in a GitHub repository. You make Terraform code changes in short-lived branches and sometimes use tags during development. You tag releases with a semantic version when they are ready for deployment. You require your pipeline to apply the Terraform code whenever there is a new release, and you need to minimize operational overhead. What should you do?
A. Create a build trigger with the \d+\.\d+\.\d+ tag pattern.
B. Create a build trigger with the \d+\.\d+\.\d+ branch pattern.
C. Create a build trigger with the .* tag pattern.
D. Create a build trigger with the .* branch pattern.
Show Answer
Correct Answer: A
Explanation: Use a Cloud Build trigger based on tags, not branches, because deployments should occur only for releases. A tag regex of \\d+\\.\\d+\\.\\d+ matches semantic version tags such as 1.2.3, ensuring the pipeline applies Terraform only when a versioned release tag is created, minimizing operational overhead.
Question 16
Your company has an application deployed on Google Kubernetes Engine (GKE) consisting of 12 microservices. Multiple teams are working concurrently on various features across three envi-ronments: Dev, Staging, and Prod. Developers report dependency test failures and delayed re-leases due to deployments from multiple feature branches in the shared Dev GKE cluster.
You need to implement a cost-effective solution for developers to test their microservice features in a stable development environment isolated from other development activities. What should you do?
A. Automate CI pipelines by using Cloud Build for container image creation and Kubernetes manifest updates from main branch merge requests. Integrate with Config Sync to test new im-ages in dynamically created namespaces on the Dev GKE cluster with autoscaling enabled. Im-plement a post-test namespace cleanup routine.
B. Automate CI pipelines by using Cloud Build to create container images and update Kuber-netes manifests for each commit. Use Cloud Deploy for progressive delivery to Dev, Staging, and Prod GKE clusters. Enable Config Sync for consistent Kubernetes configurations across en-vironments.
C. Use Cloud Build to automate CI pipelines and update Kubernetes manifest files from feature branch commits. Integrate with Config Sync to test new images in dynamically created namespaces on the Dev GKE cluster with autoscaling enabled. Implement a post-test namespace cleanup routine.
D. Use Cloud Build to automate CI pipelines and update Kubernetes manifest files from feature branch commits. Integrate with Config Sync to test new images in dynamically created GKE Dev clusters for each feature branch, which are deleted upon merge request.
Show Answer
Correct Answer: C
Explanation: The goal is isolated, stable, and cost-effective testing for concurrent feature development. Creating dynamically generated namespaces within a shared Dev GKE cluster provides isolation at much lower cost than creating a cluster per feature branch. Triggering builds from feature branch commits enables early validation before merging. Option A waits for merges to the main branch, which does not address feature-branch conflicts early. Option B does not provide isolated development environments. Option D provides isolation but is significantly more expensive because it creates a GKE cluster per feature branch.
Question 17
You are deploying a new application on Google Kubernetes Engine (GKE) that processes personally identifiable information (PII). You need to configure Cloud Logging to collect logs from your application while ensuring that sensitive user information is not exposed. What should you do?
A. Implement log sampling to reduce the volume of logs collected.
B. Configure Cloud Data Loss Prevention to scan logs in real-time and redact PII before it's stored in Cloud Logging.
C. Disable Cloud Logging for the application to prevent sensitive data from being logged.
D. Store all logs in an encrypted Cloud Storage bucket with restricted access.
Show Answer
Correct Answer: B
Explanation: The goal is to collect application logs while preventing exposure of personally identifiable information. Using Cloud Data Loss Prevention (Sensitive Data Protection) to inspect and redact or mask PII before it is retained addresses that requirement. Log sampling only reduces volume, disabling logging prevents observability, and storing logs in an encrypted bucket protects access but does not prevent sensitive data from being logged.
Question 18
Your team is preparing to launch a new API in Cloud Run. The API uses an OpenTelemetry agent to send distributed tracing data to Cloud Trace to monitor the time each request takes. The team has noticed inconsistent trace collection. You need to resolve the issue. What should you do?
A. Use an HTTP health check.
B. Configure CPU to be always-allocated.
C. Increase the CPU limit in Cloud Run from 2 to 4.
D. Configure CPU to be allocated only during request processing.
Show Answer
Correct Answer: B
Explanation: Cloud Run throttles CPU when a request is not being processed unless CPU is configured to be always allocated. OpenTelemetry exporters often send telemetry asynchronously in the background after request handling. With CPU throttling, those background tasks may not run reliably, causing inconsistent trace collection. Configuring CPU to be always allocated allows the telemetry agent to export traces consistently.
Question 19
You are developing a Node.js utility on a workstation in Cloud Workstations by using Code OSS. The utility is a simple web page, and you have already confirmed that all necessary firewall rules are in place. You tested the application by starting it on port 3000 on your workstation in Cloud Workstations, but you need to be able to access the web page from your local machine. You need to follow Google-recommended security practices. What should you do?
A. Use a browser running on a bastion host VM.
B. Run the gcloud compute start-iap-tunnel command to the Cloud Workstations VM.
C. Allow public IP addresses in the Cloud Workstations configuration.
D. Click the preview link in the Code OSS panel.
Show Answer
Correct Answer: D
Explanation: Cloud Workstations integrates Code OSS with a built-in Preview feature that securely exposes locally running web applications (such as one listening on port 3000) to your local browser without assigning public IPs or creating manual tunnels. This aligns with Google-recommended security practices. Using an IAP tunnel to the workstation VM is not the standard mechanism for previewing web apps in Cloud Workstations, and allowing public IPs is unnecessary and less secure.
Question 20
You work for a company that manages highly sensitive user data. You are designing the Google Kubernetes Engine (GKE) infrastructure for your company, including several applications that will be deployed in development and production environments. Your design must protect data from unauthorized access from other applications, while minimizing the amount of management overhead required. What should you do?
A. Create one cluster for the organization with separate namespaces for each application and environment combination.
B. Create one cluster for each application with separate namespaces for production and development environments.
C. Create one cluster for each environment (development and production) with each application in its own namespace within each cluster.
D. Create one cluster for the organization with separate namespaces for each application.
Show Answer
Correct Answer: C
Explanation: Using separate clusters for development and production provides strong environment isolation, while placing each application in its own namespace within each cluster enables logical separation with Kubernetes RBAC and Network Policies. This balances security and minimizes management overhead compared with maintaining a separate cluster for every application. A single cluster for all environments provides weaker isolation between production and development.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.