Professional Cloud DevOps Engineer Free Practice Questions — Page 2
Question 11
You work for a company that manages highly sensitive user data. You are designing the Google Kubernetes Engine (GKE) infrastructure for your company, including several applications that will be deployed in development and production environments. Your design must protect data from unauthorized access from other applications, while minimizing the amount of management overhead required. What should you do?
A. Create one cluster for the organization with separate namespaces for each application and environment combination.
B. Create one cluster for each application with separate namespaces for production and development environments.
C. Create one cluster for each environment (development and production) with each application in its own namespace within each cluster.
D. Create one cluster for the organization with separate namespaces for each application.
Show Answer
Correct Answer: C
Explanation: Separating clusters by environment (development vs. production) provides a strong security boundary for highly sensitive data and reduces the blast radius of misconfigurations or breaches. Within each cluster, placing each application in its own namespace allows isolation using Kubernetes RBAC, network policies, and resource quotas, while avoiding the excessive cost and operational overhead of running a separate cluster per application. This approach balances security and manageability better than a single shared cluster or per-application clusters.
Question 12
You manage your company’s primary revenue-generating application. You have an error budget policy in place that freezes production deployments when the application is close to breaching its SLO. A number of issues have recently occurred, and the application has exhausted its error budget. You need to deploy a new release to the application that includes a feature urgently required by your largest customer. You have been told that the release has passed all unit tests. What should you do?
A. Delay the deployment of the feature until the error budget is replenished.
B. Re-run the unit tests, and start the deployment of the feature if the tests pass.
C. Start the deployment of the feature immediately.
D. Deploy the feature to a subset of users, and gradually roll out to all users if there are no errors reported.
Show Answer
Correct Answer: D
Explanation: The error budget is exhausted, so normal policy freezes deployments to protect reliability. However, SRE practices allow exceptions for urgent business needs if risk is carefully mitigated. A canary or gradual rollout exposes the change to a limited subset of users, enables close monitoring, and allows fast rollback if errors increase. This balances the critical customer requirement with reliability safeguards better than a full immediate deployment or ignoring the need entirely.
Question 13
Your company wants to implement a CD pipeline in Cloud Deploy for a web service deployed to GKE. The web service currently does not have any automated testing. The Quality Assurance team must manually verify any new releases of the web service before any production traffic is processed. You need to design the CD pipeline. What should you do?
A. Create a single pipeline stage, and use a standard deployment strategy.
B. Create a single pipeline stage, and use a canary deployment strategy.
C. Create two pipeline stages, and use a canary deployment strategy.
D. Create two pipeline stages, and use a standard deployment strategy.
Show Answer
Correct Answer: C
Explanation: The requirement for manual QA verification before serving production traffic implies a separate pre-production stage, so two pipeline stages are needed (QA and production). Because there is no automated testing, risk during production rollout should be minimized. A canary deployment allows gradual exposure of the new version to production traffic after manual approval, providing safer validation than a standard deployment that quickly shifts 100% of traffic. Therefore, two stages with a canary strategy best meet the requirements.
Question 14
Your company has recently experienced several production service issues. You need to create a Cloud Monitoring dashboard to troubleshoot the issues, and you want to use the dashboard to distinguish between failures in your own service and those caused by a Google Cloud service that you use. What should you do?
A. Create a log-based metric to track cloud service errors, and display the metric on the dashboard.
B. Create a logs widget to display system errors from Cloud Logging on the dashboard.
C. Create an alerting policy for the system error metrics.
D. Enable Personalized Service Health annotations on the dashboard.
Show Answer
Correct Answer: D
Explanation: Personalized Service Health annotations overlay Google Cloud service incidents directly on a Cloud Monitoring dashboard. This lets you quickly see whether an observed issue aligns with a Google-managed service problem or is isolated to your own application, which directly addresses the need to distinguish the source of failures.
Question 15
Your company uses Cloud Deploy with multiple delivery pipelines for deploying applications to different environments. Your development team currently lacks access to any of these pipelines. You need to grant the team access to only the development delivery pipeline, while following Google-recommended practices. What should you do?
A. In the Google Cloud console, grant the development team the roles/clouddeploy.operator role. Add deny conditions to all pipelines other than the development delivery pipeline.
B. In the Google Cloud console, create a custom IAM role with all clouddeploy.automations.* permissions and an allow policy for only the development delivery pipeline. Grant this IAM role to the development team.
C. Grant the development team the roles/clouddeploy.operator role in a policy file. Apply the policy file to the development target.
D. Grant the development team the roles/clouddeploy.developer role in a policy file. Apply this policy file to the development delivery pipeline.
Show Answer
Correct Answer: D
Explanation: Google-recommended practice is to grant the least-privileged predefined role at the narrowest resource scope. The roles/clouddeploy.developer role is intended for development teams, and applying it directly to the development delivery pipeline limits access to only that pipeline without affecting others.
Question 16
You are responsible for creating development environments for your company's development team. You want to create environments with identical IDEs for all developers while ensuring that these environments are not exposed to public networks. You need to choose the most cost-effective solution without impacting developer productivity. What should you do?
A. Create multiple Compute Engine VM instances with a public IP address and use a Public NAT gateway. Configure an instance schedule to shut down the VMs.
B. Create multiple Compute Engine VM instances without a public IP address. Configure an instance schedule to shut down the VMs.
C. Create a Cloud Workstations private cluster. Create a workstation configuration with an idieTimeour parameter.
D. Create a Cloud Workstations private cluster. Create a workstation configuration with a runningTimeout parameter.
Show Answer
Correct Answer: C
Explanation: Cloud Workstations provides centrally managed, identical IDE environments that are not exposed to public networks when deployed as a private cluster. Using the idleTimeout parameter is the most cost-effective choice because it automatically stops workstations only when they are inactive, preserving developer productivity. A runningTimeout could shut down an actively used workstation, disrupting work, and VM-based options add management overhead and potential network exposure.
Question 17
You work for a healthcare company and regulations require you to create all resources in a United States-based region. You attempted to create a secret in Secret Manager but received the following error message:
Constraint constraints/gcp.resourceLocations violated for [orgpolicy:projects/000000] attempting to create a secret in [global]
You need to resolve the error while remaining compliant with regulations. What should you do?
A. Remove the organization policy referenced in the error message.
B. Create the secret with an automatic replication policy.
C. Create the secret with a user-managed replication policy.
D. Add the global region to the organization policy referenced in the error message.
Show Answer
Correct Answer: C
Explanation: The error indicates an organization policy restricting resource locations to US-based regions. Creating a Secret Manager secret with automatic replication uses the global location, which violates the policy. A user-managed replication policy allows you to explicitly select US regions only, satisfying the regulatory requirement and resolving the constraint violation.
Question 18
You are deploying a new version of your application to a multi-zone Google Kubernetes Engine (GKE) cluster. The deployment is progressing smoothly, but you notice that some Pods in a specific zone are experiencing higher error rates. You need to selectively roll back the update for the Pods experiencing errors with minimal impact to users. What should you do?
A. Scale down the Pods in the affected zone. Redeploy the new version of the application.
B. Drain the affected nodes. Redeploy the new version of the application to the remaining nodes.
C. Modify the Deployment to use the Pod template from the previous version of your application. Perform a rolling update to replace the Pods in the affected zone.
D. Use the kubectl rollout undo command to roll back the entire deployment. Redeploy the new version of the application, excluding the affected zone.
Show Answer
Correct Answer: C
Explanation: You need a selective rollback with minimal user impact. Editing the Deployment to use the previous Pod template and performing a rolling update allows you to replace only the problematic Pods (e.g., constrained by zone via scheduling/affinity) while keeping the rest of the deployment running. Scaling down or draining nodes causes unnecessary disruption, and a full `kubectl rollout undo` rolls back the entire deployment rather than just the affected zone.
Question 19
You are configuring a Cl pipeline. The build step for your Cl pipeline integration testing requires access to APIs inside your private VPC network. Your security team requires that you do not expose API traffic publicly. You need to implement a solution that minimizes management overhead. What should you do?
A. Use Cloud Build private pools to connect to the private VPC.
B. Use Cloud Build to create a Compute Engine instance in the private VPC. Run the integration tests on the VM by using a startup script.
C. Use Cloud Build as a pipeline runner. Configure a cross-region internal Application Load Balancer for API access.
D. Use Cloud Build as a pipeline runner. Configure a global external Application Load Balancer with a Google Cloud Armor policy for API access.
Show Answer
Correct Answer: A
Explanation: Cloud Build private pools run builds on worker nodes that are attached to your private VPC, allowing direct access to private APIs without exposing traffic publicly. This meets the security requirement and minimizes management overhead compared to managing VMs or load balancers.
Question 20
You manage a retail website for your company. The website consists of several microservices running in a GKE Standard node pool with node autoscaling enabled. Each microservice has resource limits and a Horizontal Pod Autoscaler configured. During a busy period, you receive alerts for one of the microservices. When you check the Pods, half of them have the status OOMKilled, and the number of Pods is at the minimum autoscaling limit. You need to resolve the issue. What should you do?
A. Update the node pool to use a machine type with more memory.
B. Increase the maximum number of nodes in the node pool.
C. Increase the maximum replica limit of the Horizontal Pod Autoscaler.
D. Increase the memory resource limit of the microservice.
Show Answer
Correct Answer: D
Explanation: Pods are being OOMKilled, which means they are exceeding their configured memory limits. The Horizontal Pod Autoscaler is already at its minimum replica count, so scaling out is not occurring and would not address per-Pod memory exhaustion. Increasing node size or node count does not help if Pods are killed due to their own limits. The correct fix is to increase the memory resource limit for the microservice so each Pod has enough memory to run without being OOMKilled.
$19
Get all 199 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.