Professional Cloud DevOps Engineer Free Practice Questions — Page 4
Question 31
You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?
A. 1. Create a Google service account. 2. Create a node pool, and set the Google service account as the default identity. 3. Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations. 4. Repeat for each workload.
B. 1. Create a Google service account. 2. Create a node pool without taints, and set the Google service account as the default identity. 3. Grant IAM permissions to the Google service account.
C. 1. Create a Google service account. 2. Create a Kubernetes service account in a Workload Identity-enabled cluster. 3. Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation. 4. Map the Kubernetes service account to the workload. 5. Repeat for each workload.
D. 1. Create a Google service account. 2. Create a service account key for the Google service account. 3. Create a Kubernetes secret with a service account key. 4. Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path. 5. Repeat for each workload.
Show Answer
Correct Answer: C
Explanation: The requirement is workload-level IAM with least privilege and avoidance of long-lived credentials. Google-recommended practice for this in GKE is Workload Identity. Option C uses a Workload Identity–enabled cluster, maps each Kubernetes service account to a dedicated Google service account via roles/iam.workloadIdentityUser and the iam.gke.io/gcp-service-account annotation, and assigns that KSA to the workload. This provides fine-grained, per-workload IAM impersonation without service account keys. The other options either grant permissions at the node level (A, B), violating least privilege, or rely on long-lived service account keys (D), which is explicitly discouraged.
Question 32
You have an application running in production on Cloud Run. Your team recently finished developing a new version (revision B) of the application. You want to test the new revision on 10% of your clients by using the least amount of effort. What should you do?
A. Deploy the new revision to the existing service without traffic allocated. Tag the revision and share the URL with 10% of your clients.
B. Create a new service, and deploy the new revisions on the new service. Deploy a new revision of the old application where the application routes a percentage of the traffic to the new service.
C. Create a new service, and deploy the new revision on that new service. Create a load balancer to split the traffic between the old service and the new service.
D. Deploy the new revision to the existing service without traffic allocated. Split the traffic between the old revision and the new revision.
Show Answer
Correct Answer: D
Explanation: Cloud Run supports traffic splitting between revisions of the same service. Deploying revision B to the existing service and allocating 10% of traffic to it requires minimal effort and no additional infrastructure, making it the simplest way to test the new version with a subset of clients.
Question 33
Your company stores a large volume of infrequently used data in Cloud Storage. The projects in your company's CustomerService folder access Cloud Storage frequently, but store very little data. You want to enable Data Access audit logging across the company to identify data usage patterns. You need to exclude the CustomerService folder projects from Data Access audit logging. What should you do?
A. Enable Data Access audit logging for Cloud Storage at the organization level, and configure exempted principals to include users of the CustomerService folder.
B. Enable Data Access audit logging for Cloud Storage at the organization level, with no additional configuration.
C. Enable Data Access audit logging for Cloud Storage for all projects and folders other than the CustomerService folder.
D. Enable Data Access audit logging for Cloud Storage for all projects and folders, and configure exempted principals to include users of the CustomerService folder.
Show Answer
Correct Answer: C
Explanation: To enable Data Access audit logging broadly while excluding a specific folder, you must avoid organization-level enablement because org-level settings cannot be selectively disabled for child folders or projects. Exempted principals only exclude users or service accounts, not entire folders or projects. Therefore, the correct approach is to enable Data Access audit logging on all folders and projects except the CustomerService folder, achieving company-wide coverage while excluding that folder.
Question 34
You need to define SLOs for a high-traffic web application. Customers are currently happy with the application performance and availability. Based on current measurement, the 90th percentile of latency is 160 ms and the 95th percentile of latency is 300 ms over a 28-day window. What latency SLO should you publish?
A. 90th percentile - 150 ms 95th percentile - 290 ms
B. 90th percentile - 160 ms 95th percentile - 300 ms
C. 90th percentile - 190 ms 95th percentile - 330 ms
D. 90th percentile - 300 ms 95th percentile - 450 ms
Show Answer
Correct Answer: C
Explanation: SLOs should be set slightly looser than current observed performance to create an error budget while preserving user happiness. Since current latency is p90=160 ms and p95=300 ms, publishing SLOs at higher thresholds provides operational headroom. Option B leaves no error budget, A is tighter than current performance, and D is unnecessarily lax. Therefore C is the appropriate latency SLO.
Question 35
Your company runs applications in Google Kubernetes Engine (GKE). Application developers frequently create cloud resources to support their applications. You need to give developers the ability to manage infrastructure as code while adhering to Google-recommended practices. You want to manage infrastructure as code through Kubernetes Custom Resource Definitions (CRDs) and ensure that your chosen setup can be supported by the Google Cloud Support Portal. What should you do?
A. Configure Cloud Build with a Terraform builder to execute the terraform plan and terraform apply commands.
B. Install and configure Crossplane in GKE.
C. Configure a GitHub Action with a Terraform builder to execute the terraform plan and terraform apply commands as part of the pull request process.
D. Install and configure Config Connector in GKE.
Show Answer
Correct Answer: D
Explanation: The requirement is to manage Google Cloud infrastructure as code via Kubernetes Custom Resource Definitions (CRDs) in GKE, following Google-recommended practices and with full support from the Google Cloud Support Portal. Config Connector is a Google-managed and officially supported solution that exposes Google Cloud resources as Kubernetes CRDs. It integrates natively with GKE and is explicitly designed for this use case. Terraform-based options (Cloud Build or GitHub Actions) do not use Kubernetes CRDs, and Crossplane, while CRD-based, is not Google’s officially recommended or fully supported solution for managing Google Cloud resources.
Question 36
Your company runs services on Google Cloud. Each team runs their applications in a dedicated project. New teams and projects are created regularly. Your security team requires that all logs are processed by a security information and event management (SIEM) system. The SIEM ingests logs by using Pub/Sub. You must ensure that all existing and future logs are scanned by the SIEM. What should you do?
A. Create an organization-level aggregated sink with a siem log bucket as the destination. Set an inclusion filter to include all logs.
B. Create a folder-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each folder.
C. Create an organization-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs.
D. Create a project-level logging sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each project.
Show Answer
Correct Answer: C
Explanation: An organization-level aggregated logging sink captures logs from all existing and future projects automatically. Since the SIEM ingests logs via Pub/Sub, the sink destination must be a Pub/Sub topic. Setting the sink at the organization level avoids per-project or per-folder management and ensures complete coverage as new teams and projects are created.
Question 37
Your company uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices. What should you do?
A. Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.
B. Use the Terraform module so that Secret Manager can retrieve credentials.
C. Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE_CREDENTIALS environment variable on the Jenkins server.
D. Add the gcloud auth application-default login command as a step in Jenkins before running the Terraform commands.
Show Answer
Correct Answer: A
Explanation: Google-recommended practice for workloads running on Google Cloud is to use the VM’s attached service account with appropriate IAM permissions, avoiding long‑lived service account keys. Terraform running on a Jenkins VM can automatically use Application Default Credentials provided by the attached service account. Options involving downloading and managing service account keys or interactive gcloud login are less secure and not recommended for CI/CD automation.
Question 38
Your company is planning a large marketing event for an online retailer during the holiday shopping season. You are expecting your web application to receive a large volume of traffic in a short period. You need to prepare your application for potential failures during the event. What should you do? (Choose two.)
A. Configure Anthos Service Mesh on the application to identify issues on the topology map.
B. Ensure that relevant system metrics are being captured with Cloud Monitoring, and create alerts at levels of interest.
C. Review your increased capacity requirements and plan for the required quota management.
D. Monitor latency of your services for average percentile latency.
E. Create alerts in Cloud Monitoring for all common failures that your application experiences.
Show Answer
Correct Answer: B, C
Explanation: To prepare for potential failures during a short period of very high traffic, you should focus on visibility and capacity. Capturing relevant system metrics and setting up Cloud Monitoring alerts ensures you can quickly detect and respond to issues as they occur. In addition, reviewing expected traffic increases and planning for capacity and quota management helps prevent failures caused by resource exhaustion. Other options are either optional optimizations or risk creating noise without improving readiness.
Question 39
You are designing a system with three different environments: development, quality assurance (QA), and production. Each environment will be deployed with Terraform and has a Google Kubernetes Engine (GKE) cluster created so that application teams can deploy their applications. Anthos Config Management will be used and templated to deploy infrastructure level resources in each GKE cluster. All users (for example, infrastructure operators and application owners) will use GitOps. How should you structure your source control repositories for both Infrastructure as Code (IaC) and application code?
A. • Cloud Infrastructure (Terraform) repository is shared: different directories are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: different overlay directories are different environments • Application (app source code) repositories are separated: different branches are different features
B. • Cloud Infrastructure (Terraform) repository is shared: different directories are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated: different branches are different environments • Application (app source code) repositories are separated: different branches are different features
C. • Cloud Infrastructure (Terraform) repository is shared: different branches are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: different overlay directories are different environments • Application (app source code) repository is shared: different directories are different features
D. • Cloud Infrastructure (Terraform) repositories are separated: different branches are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated: different overlay directories are different environments • Application (app source code) repositories are separated: different branches are different
Show Answer
Correct Answer: A
Explanation: Option A follows GitOps and Google Anthos best practices. For Terraform, using a single shared repository with separate directories per environment avoids branch drift and makes environment differences explicit. For Anthos Config Management with Kustomize, a shared repository with base + overlay directories per environment is the recommended and documented pattern. Application source code is best kept in separate repositories per app, with branches used for feature development rather than environment separation, which aligns with standard CI/CD and GitOps workflows.
Question 40
You are designing a new Google Cloud organization for a client. Your client is concerned with the risks associated with long-lived credentials created in Google Cloud. You need to design a solution to completely eliminate the risks associated with the use of JSON service account keys while minimizing operational overhead. What should you do?
A. Apply the constraints/iam.disableServiceAccountKevCreation constraint to the organization.
B. Use custom versions of predefined roles to exclude all iam.serviceAccountKeys.* service account role permissions.
C. Apply the constraints/iam.disableServiceAccountKeyUpload constraint to the organization.
D. Grant the roles/iam.serviceAccountKeyAdmin IAM role to organization administrators only.
Show Answer
Correct Answer: A
Explanation: Applying the organization policy constraint `constraints/iam.disableServiceAccountKeyCreation` prevents the creation of user-managed (JSON) service account keys across the organization. This completely eliminates the risk of long-lived service account credentials while requiring minimal operational overhead, as workloads can use short-lived credentials via Workload Identity or Google-managed keys instead.
$19
Get all 199 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.