Professional Cloud DevOps Engineer Free Practice Questions — Page 3
Question 21
You use Artifact Registry to store container images built with Cloud Build. You need to ensure that all existing and new images are continuously scanned for vulnerabilities. You also want to track who pushed each image to the registry. What should you do?
A. Configure Artifact Registry to automatically scan new images and periodically re-scan all images. Use Cloud Audit Logs to track image uploads and identify the user who pushed each image.
B. Configure Artifact Registry to send vulnerability scan results to a Cloud Storage bucket. Use a separate script to parse results and notify a security team.
C. Configure Artifact Registry to automatically re-scan images daily. Enable Cloud Audit Logs to track these scans, and use Logs Explorer to identify vulnerabilities.
D. Configure Artifact Registry to automatically trigger vulnerability scans for new image tags, and view scan results. Use Cloud Audit Logs to track image tag creation events.
Show Answer
Correct Answer: A
Explanation: Artifact Registry supports automatic vulnerability scanning for container images, including continuous scanning that covers newly pushed images and periodic re-scans of existing images. This satisfies the requirement to continuously assess vulnerabilities. Cloud Audit Logs record Artifact Registry write operations, allowing you to identify who pushed each image. The other options either add unnecessary components or do not fully address both continuous scanning and user attribution.
Question 22
You are running a web application that connects to an AlloyDB cluster by using a private IP address in your default VPC. You need to run a database schema migration in your CI/CD pipeline by using Cloud Build before deploying a new version of your application. You want to follow Google-recommended security practices. What should you do?
A. Set up a Cloud Build private pool to access the database through a static external IP address. Configure the database to only allow connections from this IP address. Execute the schema migration script in the private pool.
B. Create a service account that has permission to access the database. Configure Cloud Build to use this service account and execute the schema migration script in a private pool.
C. Add the database username and password to Secret Manager. When running the schema migration script, retrieve the username and password from Secret Manager.
D. Add the database username and encrypted password to the application configuration file. Use these credentials in Cloud Build to execute the schema migration script.
Show Answer
Correct Answer: B
Explanation: AlloyDB is accessed over a private IP, so Cloud Build must run in a private environment with VPC access (a private pool). Google‑recommended practice is to use IAM and service accounts rather than network allowlists or embedded credentials. By assigning a service account with the minimum required AlloyDB permissions to Cloud Build and running the migration from a private pool, you get private connectivity, least privilege, and no hard‑coded secrets. The other options either rely on external IPs or static credentials, which are not recommended.
Question 23
You manage a critical API running on Cloud Run that serves an average of 10,000 requests per minute. You need to define service level objectives (SLOs) for availability and latency to ensure that the API meets user expectations, which include 99.9% availability and a maximum latency of 200 milliseconds for 95% of requests. You also need to ensure these SLOs are actively monitored and measured. What should you do?
A. Configure Cloud Monitoring to send alerts when average API latency exceeds 150 ms or the error rate surpasses 0.1%.
B. Prioritize latency as the only SLO, targeting 100 ms for 99% of requests.
C. Set SLOs for 99% availability at 99% and 500 ms latency for 90% of requests. Use Cloud Monitoring to track SLOs and alert on violations.
D. Set SLOs for the API by using availability and latency service level indicators. Use Cloud Monitoring to track SLOs and alert on violations.
Show Answer
Correct Answer: D
Explanation: The requirement is to define and actively monitor SLOs that match user expectations for both availability (99.9%) and latency (200 ms for 95% of requests). Option D correctly describes setting explicit availability and latency SLOs using appropriate service level indicators (SLIs) and using Cloud Monitoring to measure and alert on SLO violations. The other options either ignore one SLO, use incorrect targets, or rely on simple thresholds rather than true SLO-based monitoring.
Question 24
You work for a company that offers a free photo processing application. You are designing the infrastructure for the backend service that processes the photos. The service:
• Uses Cloud Storage to store both unprocessed and processed photos.
• Can resume processing photos in the event of a failure.
• Is not suitable for containerization.
There is no SLO for the time taken to process a photo. You need to choose the most cost-effective solution for running the service. What should you do?
A. Deploy the service by using Cloud Run.
B. Deploy the service by using standard VMs with a 3-year committed use discount.
C. Deploy the service by using GKE.
D. Deploy the service by using Spot VMs.
Show Answer
Correct Answer: D
Explanation: The service can tolerate interruptions because it can resume processing from Cloud Storage and has no SLO for processing time. It is also not suitable for containerization, which rules out Cloud Run and makes GKE unnecessary overhead. For the lowest cost compute where interruptions are acceptable, Spot VMs are the most cost-effective option compared to standard VMs with long-term commitments.
Question 25
You are troubleshooting a failed deployment in your CI/CD pipeline. The deployment logs indicate that the application container failed to start due to a missing environment variable. You need to identify the root cause and implement a solution within your CI/CD workflow to prevent this issue from recurring. What should you do?
A. Use a canary deployment strategy.
B. Implement static code analysis in the CI pipeline.
C. Run integration tests in the CI pipeline.
D. Enable Cloud Audit Logs for the deployment.
Show Answer
Correct Answer: C
Explanation: The failure was caused by a missing environment variable, which is a runtime configuration issue. Adding integration tests to the CI pipeline allows the application to be started in an environment that mirrors production, validating that all required environment variables are present. This would catch the error before deployment and prevent recurrence.
Question 26
You receive a Cloud Monitoring alert indicating potential malicious activity on a node in your Google Kubernetes Engine (GKE) cluster. The alert suggests a possible compromised container running on that node. You need to isolate this node to prevent further compromise while investigating the issue. You also want to minimize disruption to applications running on the cluster. What should you do?
A. Taint the suspicious node to prevent Pods that have interacted with it from being scheduled on other nodes in the cluster
B. Scale down the deployment associated with the compromised container to zero other nodes
C. Restart the node to disrupt the malicious activity, and force all Pods to be restructured on other nodes.
D. Cordon the node to prevent new Pods from being scheduled, the drain the node to safely remove existing Pods and reschedule them to other nodes.
Show Answer
Correct Answer: D
Explanation: Cordoning the node prevents any new Pods from being scheduled onto a potentially compromised node, immediately containing risk. Draining the node then safely evicts existing Pods and reschedules them onto healthy nodes, maintaining application availability while isolating the affected node for investigation. This is the standard, least-disruptive Kubernetes approach for node isolation during security incidents.
Question 27
Your organization is running multiple Google Kubernetes Engine (GKE) clusters in a project. You need to design a highly-available solution to collect and query both domain-specific workload metrics and GKE default metrics across all clusters, while minimizing operational overhead. What should you do?
A. Use Prometheus operator to install Prometheus in every cluster and scrape the metrics. Configure remote-write to one central Prometheus. Query the central Prometheus instance.
B. Enable managed collection on every GKE cluster. Query the metrics in BigQuery.
C. Use Prometheus operator to install Prometheus in every cluster and scrape the metrics. Ensure that a Thanos sidecar is enabled on every Prometheus instance. Configure Thanos in the central cluster. Query the central Thanos instance.
D. Enable managed collection on every GKE cluster. Query the metrics in Cloud Monitoring.
Show Answer
Correct Answer: D
Explanation: Using GKE managed collection integrates both default GKE metrics and Prometheus-compatible workload metrics into Cloud Monitoring automatically. This provides a highly available, fully managed, multi-cluster metrics backend with minimal operational overhead, avoiding the need to operate Prometheus, Thanos, or BigQuery pipelines yourself. Cloud Monitoring supports centralized querying, alerting, and dashboards across clusters, which best fits the requirements.
Question 28
Your company allows teams to self-manage Google Cloud projects, including project-level Identity and Access Management (IAM). You are concerned that the team responsible for the Shared VPC project might accidentally delete the project, so a lien has been placed on the project. You need to design a solution to restrict Shared VPC project deletion to those with the resourcemanager.projects.updateLiens permission at the organization level. What should you do?
A. Instruct teams to only perform IAM permission management as code with Terraform.
B. Enable VPC Service Controls for the container.googleapis.com API service.
C. Revoke the resourcemanager.projects.updateLiens permission from all users associated with the project.
D. Enable the compute.restrictXpnProjectLienRemoval organization policy constraint.
Show Answer
Correct Answer: D
Explanation: The requirement is to prevent accidental deletion of a Shared VPC host project while still allowing deletion only by identities that have the appropriate lien-related permission at the organization level. Google Cloud provides a specific organization policy constraint, compute.restrictXpnProjectLienRemoval, that restricts who can remove Shared VPC (XPN) project liens. Enabling this constraint ensures that only principals with resourcemanager.projects.updateLiens granted at the organization level can remove the lien and thereby delete the project. The other options do not technically enforce project deletion restrictions.
Question 29
You are configuring a Cl pipeline in Cloud Build When you test the pipeline, the following cloudbuild.yaml definition results in 5 minutes each on the foo step and bar step
The foo step and bar step are independent of each other. The baz step needs both the foo and bar steps to be completed before starting. You want to use parallelism to reduce build times What should you do?
A. Modify the build script to add - options: machineType: 'E2_HIGHCPU_8'
B. Modify the build script to add - options: machineType: 'E2_HIGHCPU_32'
C. Change the build script to:
D. Change the build script to:
Show Answer
Correct Answer: D
Explanation: To reduce build time, independent steps must run in parallel. In Cloud Build this is done by removing implicit dependencies and using waitFor. In option D, foo and bar have waitFor: ['-'], so they start at the same time, and baz uses waitFor: ['foo','bar'] to ensure it runs only after both complete. Changing machine type (A or B) does not introduce parallelism.
Question 30
Your company runs an ecommerce business. The application responsible for payment processing has structured JSON logging with the following schema:
Capture and access of logs from the payment processing application is mandatory for operations, but the jsonPayload.user_email field contains personally identifiable information (PII). Your security team does not want the entire engineering team to have access to PII. You need to stop exposing PII to the engineering team and restrict access to security team members only. What should you do?
A. Apply the conditional role binding resource.name.extract("locations/global/buckets/{bucket}/") == "_Default" to the _Default bucket.
B. Apply a jsonPayload.user_email restricted field to the _Default bucket. Grant the Log Field Accessor role to the security team members.
C. Apply a jsonPayload.user_email exclusion filter to the _Default bucket.
D. Modify the application to toggle inclusion of user_email when the LOG_USER_EMAIL environment variable is set to true. Restrict the engineering team members who can change the production environment variable by using the CODEOWNERS file.
Show Answer
Correct Answer: B
Explanation: The requirement is to keep collecting logs for operations while preventing most engineers from seeing PII, and allowing only the security team to access it. Cloud Logging supports field-level access control (field-level ACLs) using restricted fields. Marking jsonPayload.user_email as a restricted field on the log bucket ensures the field is stored but hidden from users without the appropriate permission. Granting the Log Field Accessor role to security team members allows only them to view the PII. Other options either do not control field-level access, remove the data entirely, or rely on application-level discipline rather than centralized, enforceable access control.
$19
Get all 199 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.