Professional Cloud DevOps Engineer Free Practice Questions — Page 3
Question 21
You manage your company’s primary revenue-generating application. You have an error budget policy in place that freezes production deployments when the application is close to breaching its SLO. A number of issues have recently occurred, and the application has exhausted its error budget. You need to deploy a new release to the application that includes a feature urgently required by your largest customer. You have been told that the release has passed all unit tests. What should you do?
A. Delay the deployment of the feature until the error budget is replenished.
B. Re-run the unit tests, and start the deployment of the feature if the tests pass.
C. Start the deployment of the feature immediately.
D. Deploy the feature to a subset of users, and gradually roll out to all users if there are no errors reported.
Show Answer
Correct Answer: A
Explanation: The scenario explicitly states that the organization has an error budget policy that freezes production deployments when the application has exhausted its error budget. This release is a new feature, not a reliability fix. Passing unit tests does not eliminate production risk, and a canary rollout still constitutes a production deployment that violates the stated policy. Under the described policy, the correct action is to delay deployment until the error budget is replenished.
Sources:
https://cloud.google.com/monitoring/service-monitoring
https://cloud.google.com/monitoring/service-monitoring/alerting-on-budget-burn-rate
Question 22
Your company wants to implement a CD pipeline in Cloud Deploy for a web service deployed to GKE. The web service currently does not have any automated testing. The Quality Assurance team must manually verify any new releases of the web service before any production traffic is processed. You need to design the CD pipeline. What should you do?
A. Create a single pipeline stage, and use a standard deployment strategy.
B. Create a single pipeline stage, and use a canary deployment strategy.
C. Create two pipeline stages, and use a canary deployment strategy.
D. Create two pipeline stages, and use a standard deployment strategy.
Show Answer
Correct Answer: D
Explanation: Use two pipeline stages so the first stage serves as a pre-production/QA environment where the QA team can manually validate the release before promotion. Because there is no automated testing, the stated requirement is satisfied by a manual approval between stages. A standard deployment strategy is sufficient because no gradual production validation requirement is stated; the key requirement is manual QA before any production traffic is served. Canary primarily mitigates rollout risk but does not replace the required QA stage.
Question 23
Your company has recently experienced several production service issues. You need to create a Cloud Monitoring dashboard to troubleshoot the issues, and you want to use the dashboard to distinguish between failures in your own service and those caused by a Google Cloud service that you use. What should you do?
A. Create a log-based metric to track cloud service errors, and display the metric on the dashboard.
B. Create a logs widget to display system errors from Cloud Logging on the dashboard.
C. Create an alerting policy for the system error metrics.
D. Enable Personalized Service Health annotations on the dashboard.
Show Answer
Correct Answer: D
Explanation: Personalized Service Health annotations add Google Cloud service health events directly onto Cloud Monitoring dashboards. This allows you to correlate your application's issues with Google Cloud service incidents and distinguish failures caused by Google Cloud services from problems in your own service. Log-based metrics, log widgets, and alerting policies do not inherently identify or annotate Google Cloud service health events.
Question 24
Your company uses Cloud Deploy with multiple delivery pipelines for deploying applications to different environments. Your development team currently lacks access to any of these pipelines. You need to grant the team access to only the development delivery pipeline, while following Google-recommended practices. What should you do?
A. In the Google Cloud console, grant the development team the roles/clouddeploy.operator role. Add deny conditions to all pipelines other than the development delivery pipeline.
B. In the Google Cloud console, create a custom IAM role with all clouddeploy.automations.* permissions and an allow policy for only the development delivery pipeline. Grant this IAM role to the development team.
C. Grant the development team the roles/clouddeploy.operator role in a policy file. Apply the policy file to the development target.
D. Grant the development team the roles/clouddeploy.developer role in a policy file. Apply this policy file to the development delivery pipeline.
Show Answer
Correct Answer: D
Explanation: The predefined roles/clouddeploy.developer role is intended for development teams working with Cloud Deploy. Granting it directly on the development delivery pipeline scopes permissions to only that pipeline, following the principle of least privilege and Google-recommended IAM resource-level access practices. The operator role is broader than necessary, custom automation permissions do not match the required developer access, and applying IAM to a target does not appropriately scope access to managing the delivery pipeline.
Question 25
You are responsible for creating development environments for your company's development team. You want to create environments with identical IDEs for all developers while ensuring that these environments are not exposed to public networks. You need to choose the most cost-effective solution without impacting developer productivity. What should you do?
A. Create multiple Compute Engine VM instances with a public IP address and use a Public NAT gateway. Configure an instance schedule to shut down the VMs.
B. Create multiple Compute Engine VM instances without a public IP address. Configure an instance schedule to shut down the VMs.
C. Create a Cloud Workstations private cluster. Create a workstation configuration with an idieTimeour parameter.
D. Create a Cloud Workstations private cluster. Create a workstation configuration with a runningTimeout parameter.
Show Answer
Correct Answer: C
Explanation: Cloud Workstations is designed to provide standardized, managed development environments without exposing them to public networks by using a private cluster. Using idleTimeout automatically stops workstations only after they have been idle, reducing costs while avoiding interruptions during active development. In contrast, runningTimeout stops workstations after a fixed elapsed runtime even if they are actively in use, which can impact productivity. Compute Engine VMs would require more management and do not provide the same standardized managed IDE experience.
Question 26
You work for a healthcare company and regulations require you to create all resources in a United States-based region. You attempted to create a secret in Secret Manager but received the following error message:
Constraint constraints/gcp.resourceLocations violated for [orgpolicy:projects/000000] attempting to create a secret in [global]
You need to resolve the error while remaining compliant with regulations. What should you do?
A. Remove the organization policy referenced in the error message.
B. Create the secret with an automatic replication policy.
C. Create the secret with a user-managed replication policy.
D. Add the global region to the organization policy referenced in the error message.
Show Answer
Correct Answer: C
Explanation: Secret Manager automatic replication uses the logical 'global' location, which is blocked by an organization policy restricting resource locations to US regions. A user-managed replication policy lets you explicitly choose permitted US regions, satisfying both the organization policy and regulatory requirements.
Question 27
You are deploying a new version of your application to a multi-zone Google Kubernetes Engine (GKE) cluster. The deployment is progressing smoothly, but you notice that some Pods in a specific zone are experiencing higher error rates. You need to selectively roll back the update for the Pods experiencing errors with minimal impact to users. What should you do?
A. Scale down the Pods in the affected zone. Redeploy the new version of the application.
B. Drain the affected nodes. Redeploy the new version of the application to the remaining nodes.
C. Modify the Deployment to use the Pod template from the previous version of your application. Perform a rolling update to replace the Pods in the affected zone.
D. Use the kubectl rollout undo command to roll back the entire deployment. Redeploy the new version of the application, excluding the affected zone.
Show Answer
Correct Answer: C
Explanation: A Deployment's rollout is cluster-wide, not zone-specific, but the best available option is to revert the Pod template to the previous version and perform a rolling update, allowing replacement of affected Pods while minimizing disruption. Scaling down or draining nodes does not roll back the application version, and rollout undo reverts the entire Deployment rather than selectively addressing the affected Pods.
Question 28
You are configuring a Cl pipeline. The build step for your Cl pipeline integration testing requires access to APIs inside your private VPC network. Your security team requires that you do not expose API traffic publicly. You need to implement a solution that minimizes management overhead. What should you do?
A. Use Cloud Build private pools to connect to the private VPC.
B. Use Cloud Build to create a Compute Engine instance in the private VPC. Run the integration tests on the VM by using a startup script.
C. Use Cloud Build as a pipeline runner. Configure a cross-region internal Application Load Balancer for API access.
D. Use Cloud Build as a pipeline runner. Configure a global external Application Load Balancer with a Google Cloud Armor policy for API access.
Show Answer
Correct Answer: A
Explanation: Cloud Build private pools allow build workers to run within or with private connectivity to your VPC, enabling access to private APIs without exposing traffic publicly. This is the managed, recommended approach and minimizes operational overhead compared with provisioning Compute Engine instances or exposing services through load balancers.
Question 29
You manage a retail website for your company. The website consists of several microservices running in a GKE Standard node pool with node autoscaling enabled. Each microservice has resource limits and a Horizontal Pod Autoscaler configured. During a busy period, you receive alerts for one of the microservices. When you check the Pods, half of them have the status OOMKilled, and the number of Pods is at the minimum autoscaling limit. You need to resolve the issue. What should you do?
A. Update the node pool to use a machine type with more memory.
B. Increase the maximum number of nodes in the node pool.
C. Increase the maximum replica limit of the Horizontal Pod Autoscaler.
D. Increase the memory resource limit of the microservice.
Show Answer
Correct Answer: D
Explanation: OOMKilled indicates the containers are exceeding their configured memory limit. The HPA being at its minimum replica count suggests this is not a load-driven scaling issue. Increasing the pod memory resource limit addresses the immediate cause. Increasing node memory or node count does not help if the container's own memory limit is too low.
Question 30
You use Artifact Registry to store container images built with Cloud Build. You need to ensure that all existing and new images are continuously scanned for vulnerabilities. You also want to track who pushed each image to the registry. What should you do?
A. Configure Artifact Registry to automatically scan new images and periodically re-scan all images. Use Cloud Audit Logs to track image uploads and identify the user who pushed each image.
B. Configure Artifact Registry to send vulnerability scan results to a Cloud Storage bucket. Use a separate script to parse results and notify a security team.
C. Configure Artifact Registry to automatically re-scan images daily. Enable Cloud Audit Logs to track these scans, and use Logs Explorer to identify vulnerabilities.
D. Configure Artifact Registry to automatically trigger vulnerability scans for new image tags, and view scan results. Use Cloud Audit Logs to track image tag creation events.
Show Answer
Correct Answer: A
Explanation: Artifact Registry supports automatic vulnerability scanning for container images, including continuous scanning with periodic re-scans for newly disclosed vulnerabilities. Cloud Audit Logs record Artifact Registry write operations, allowing you to identify the principal who pushed each image. The other options either misuse Audit Logs for vulnerability detection, omit continuous scanning of existing images, or rely on unnecessary external processing.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.