Professional Cloud DevOps Engineer Free Practice Questions — Page 4
Question 31
You are running a web application that connects to an AlloyDB cluster by using a private IP address in your default VPC. You need to run a database schema migration in your CI/CD pipeline by using Cloud Build before deploying a new version of your application. You want to follow Google-recommended security practices. What should you do?
A. Set up a Cloud Build private pool to access the database through a static external IP address. Configure the database to only allow connections from this IP address. Execute the schema migration script in the private pool.
B. Create a service account that has permission to access the database. Configure Cloud Build to use this service account and execute the schema migration script in a private pool.
C. Add the database username and password to Secret Manager. When running the schema migration script, retrieve the username and password from Secret Manager.
D. Add the database username and encrypted password to the application configuration file. Use these credentials in Cloud Build to execute the schema migration script.
Show Answer
Correct Answer: B
Explanation: A private Cloud Build pool provides network connectivity to private IP resources such as AlloyDB. Using a dedicated service account for Cloud Build follows least-privilege IAM practices. Option A incorrectly relies on an external IP for a privately addressed database. Option C addresses secret storage but not the required private network access or Cloud Build identity. Option D is insecure because credentials should not be stored in application configuration files.
Question 32
You manage a critical API running on Cloud Run that serves an average of 10,000 requests per minute. You need to define service level objectives (SLOs) for availability and latency to ensure that the API meets user expectations, which include 99.9% availability and a maximum latency of 200 milliseconds for 95% of requests. You also need to ensure these SLOs are actively monitored and measured. What should you do?
A. Configure Cloud Monitoring to send alerts when average API latency exceeds 150 ms or the error rate surpasses 0.1%.
B. Prioritize latency as the only SLO, targeting 100 ms for 99% of requests.
C. Set SLOs for 99% availability at 99% and 500 ms latency for 90% of requests. Use Cloud Monitoring to track SLOs and alert on violations.
D. Set SLOs for the API by using availability and latency service level indicators. Use Cloud Monitoring to track SLOs and alert on violations.
Show Answer
Correct Answer: D
Explanation: The requirement is to define and monitor SLOs for both availability and latency. The correct approach is to use availability and latency SLIs to define the SLOs (e.g., 99.9% availability and 95% of requests under 200 ms), then use Cloud Monitoring's SLO features to track compliance and alert on SLO violations. The other options either use incorrect targets, focus on only one metric, or configure threshold alerts without properly defining and monitoring SLOs.
Question 33
You work for a company that offers a free photo processing application. You are designing the infrastructure for the backend service that processes the photos. The service:
• Uses Cloud Storage to store both unprocessed and processed photos.
• Can resume processing photos in the event of a failure.
• Is not suitable for containerization.
There is no SLO for the time taken to process a photo. You need to choose the most cost-effective solution for running the service. What should you do?
A. Deploy the service by using Cloud Run.
B. Deploy the service by using standard VMs with a 3-year committed use discount.
C. Deploy the service by using GKE.
D. Deploy the service by using Spot VMs.
Show Answer
Correct Answer: D
Explanation: The workload is not suitable for containerization, eliminating Cloud Run and making GKE an unnecessary and more expensive orchestration layer. The processing can resume after failures and has no time-based SLO, making it tolerant of interruptions. Spot VMs provide the lowest-cost compute for interruptible workloads. Standard VMs with a 3-year commitment are more expensive than Spot VMs for this fault-tolerant batch processing use case.
Question 34
You are troubleshooting a failed deployment in your CI/CD pipeline. The deployment logs indicate that the application container failed to start due to a missing environment variable. You need to identify the root cause and implement a solution within your CI/CD workflow to prevent this issue from recurring. What should you do?
A. Use a canary deployment strategy.
B. Implement static code analysis in the CI pipeline.
C. Run integration tests in the CI pipeline.
D. Enable Cloud Audit Logs for the deployment.
Show Answer
Correct Answer: C
Explanation: The failure is caused by a missing environment variable that only manifests when the application starts. Adding integration tests to the CI pipeline in an environment that mirrors deployment can validate required configuration (including environment variables) before deployment, preventing this class of issue. Canary deployments, static code analysis, and audit logs do not detect missing runtime environment configuration before release.
Question 35
You receive a Cloud Monitoring alert indicating potential malicious activity on a node in your Google Kubernetes Engine (GKE) cluster. The alert suggests a possible compromised container running on that node. You need to isolate this node to prevent further compromise while investigating the issue. You also want to minimize disruption to applications running on the cluster. What should you do?
A. Taint the suspicious node to prevent Pods that have interacted with it from being scheduled on other nodes in the cluster
B. Scale down the deployment associated with the compromised container to zero other nodes
C. Restart the node to disrupt the malicious activity, and force all Pods to be restructured on other nodes.
D. Cordon the node to prevent new Pods from being scheduled, the drain the node to safely remove existing Pods and reschedule them to other nodes.
Show Answer
Correct Answer: D
Explanation: Cordoning the node prevents any new Pods from being scheduled onto it, and draining safely evicts existing Pods so that they are rescheduled onto healthy nodes, minimizing application disruption while isolating the suspicious node for investigation. Tainting does not isolate an already-running workload, scaling a deployment to zero unnecessarily stops the application, and restarting the node is disruptive and can destroy forensic evidence.
Question 36
Your organization is running multiple Google Kubernetes Engine (GKE) clusters in a project. You need to design a highly-available solution to collect and query both domain-specific workload metrics and GKE default metrics across all clusters, while minimizing operational overhead. What should you do?
A. Use Prometheus operator to install Prometheus in every cluster and scrape the metrics. Configure remote-write to one central Prometheus. Query the central Prometheus instance.
B. Enable managed collection on every GKE cluster. Query the metrics in BigQuery.
C. Use Prometheus operator to install Prometheus in every cluster and scrape the metrics. Ensure that a Thanos sidecar is enabled on every Prometheus instance. Configure Thanos in the central cluster. Query the central Thanos instance.
D. Enable managed collection on every GKE cluster. Query the metrics in Cloud Monitoring.
Show Answer
Correct Answer: D
Explanation: Managed Service for Prometheus managed collection on GKE collects both Kubernetes/GKE default metrics and Prometheus workload metrics with minimal operational overhead. Metrics are stored in Cloud Monitoring, which provides a highly available, managed backend for querying across multiple clusters. The Prometheus/Thanos options require significantly more operational management, and BigQuery is not the primary query backend for managed Prometheus metrics.
Question 37
Your company allows teams to self-manage Google Cloud projects, including project-level Identity and Access Management (IAM). You are concerned that the team responsible for the Shared VPC project might accidentally delete the project, so a lien has been placed on the project. You need to design a solution to restrict Shared VPC project deletion to those with the resourcemanager.projects.updateLiens permission at the organization level. What should you do?
A. Instruct teams to only perform IAM permission management as code with Terraform.
B. Enable VPC Service Controls for the container.googleapis.com API service.
C. Revoke the resourcemanager.projects.updateLiens permission from all users associated with the project.
D. Enable the compute.restrictXpnProjectLienRemoval organization policy constraint.
Show Answer
Correct Answer: D
Explanation: A Shared VPC host project is typically protected by a lien. The organization policy constraint compute.restrictXpnProjectLienRemoval prevents removal of the Shared VPC project lien except by principals with the required organization-level permission (resourcemanager.projects.updateLiens), thereby preventing accidental project deletion. Revoking the permission only at the project level is insufficient because the required control is at the organization level, and the other options do not enforce lien removal restrictions.
Question 38
You are configuring a Cl pipeline in Cloud Build When you test the pipeline, the following cloudbuild.yaml definition results in 5 minutes each on the foo step and bar step
The foo step and bar step are independent of each other. The baz step needs both the foo and bar steps to be completed before starting. You want to use parallelism to reduce build times What should you do?
A. Modify the build script to add - options: machineType: 'E2_HIGHCPU_8'
B. Modify the build script to add - options: machineType: 'E2_HIGHCPU_32'
C. Change the build script to:
D. Change the build script to:
Show Answer
Correct Answer: D
Explanation: To run independent Cloud Build steps in parallel, configure step dependencies with `waitFor`. Set the independent `foo` and `bar` steps to start immediately (using `waitFor: ['-']` as appropriate), and configure `baz` to wait for both `foo` and `bar` (for example, `waitFor: ['foo', 'bar']`). Increasing the machine type alone does not make sequential steps execute in parallel.
Question 39
Your company runs an ecommerce business. The application responsible for payment processing has structured JSON logging with the following schema:
Capture and access of logs from the payment processing application is mandatory for operations, but the jsonPayload.user_email field contains personally identifiable information (PII). Your security team does not want the entire engineering team to have access to PII. You need to stop exposing PII to the engineering team and restrict access to security team members only. What should you do?
A. Apply the conditional role binding resource.name.extract("locations/global/buckets/{bucket}/") == "_Default" to the _Default bucket.
B. Apply a jsonPayload.user_email restricted field to the _Default bucket. Grant the Log Field Accessor role to the security team members.
C. Apply a jsonPayload.user_email exclusion filter to the _Default bucket.
D. Modify the application to toggle inclusion of user_email when the LOG_USER_EMAIL environment variable is set to true. Restrict the engineering team members who can change the production environment variable by using the CODEOWNERS file.
Show Answer
Correct Answer: B
Explanation: Use Cloud Logging field-level access controls by configuring jsonPayload.user_email as a restricted field on the _Default log bucket, then grant the Logs Field Accessor role only to the security team. This preserves logging for operations while preventing other engineers from viewing the PII field. Conditional bucket bindings do not provide field-level protection, exclusion filters would remove the data entirely, and changing the application is unnecessary when Cloud Logging supports field-level ACLs.
Question 40
You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?
A. 1. Create a Google service account. 2. Create a node pool, and set the Google service account as the default identity. 3. Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations. 4. Repeat for each workload.
B. 1. Create a Google service account. 2. Create a node pool without taints, and set the Google service account as the default identity. 3. Grant IAM permissions to the Google service account.
C. 1. Create a Google service account. 2. Create a Kubernetes service account in a Workload Identity-enabled cluster. 3. Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation. 4. Map the Kubernetes service account to the workload. 5. Repeat for each workload.
D. 1. Create a Google service account. 2. Create a service account key for the Google service account. 3. Create a Kubernetes secret with a service account key. 4. Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path. 5. Repeat for each workload.
Show Answer
Correct Answer: C
Explanation: Workload Identity (now Workload Identity Federation for GKE) is Google's recommended approach for allowing GKE workloads to impersonate Google service accounts without long-lived service account keys. Creating a Kubernetes service account, binding it to a Google service account with the roles/iam.workloadIdentityUser role, annotating the Kubernetes service account with the target Google service account, and assigning that Kubernetes service account to the workload provides fine-grained, per-workload IAM permissions that follow the principle of least privilege. Node-level service accounts grant permissions too broadly, and service account keys are discouraged because they create long-lived credentials.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.