Professional Cloud DevOps Engineer Free Practice Questions — Page 5
Question 41
Your company runs applications in Google Kubernetes Engine (GKE). Several applications rely on ephemeral volumes. You noticed some applications were unstable due to the DiskPressure node condition on the worker nodes. You need to identify which Pods are causing the issue, but you do not have execute access to workloads and nodes. What should you do?
A. Check the node/ephemeral_storage/used_bytes metric by using Metrics Explorer.
B. Check the container/ephemeral_storage/used_bytes metric by using Metrics Explorer.
C. Locate all the Pods with emptyDir volumes. Use the df -h command to measure volume disk usage.
D. Locate all the Pods with emptyDir volumes. Use the df -sh * command to measure volume disk usage.
Show Answer
Correct Answer: B
Explanation: You need to identify which Pods are consuming ephemeral storage, but you do not have execute access to nodes or workloads. Node-level metrics such as node/ephemeral_storage/used_bytes only show aggregate usage per node and cannot attribute usage to specific Pods or containers. The container/ephemeral_storage/used_bytes metric, available in Metrics Explorer, breaks ephemeral storage usage down at the container (and thus Pod) level, allowing you to pinpoint which Pods are causing DiskPressure without shell access. Options C and D require direct command execution, which is not allowed in the scenario.
Question 42
As a Site Reliability Engineer, you support an application written in Go that runs on Google Kubernetes Engine (GKE) in production. After releasing a new version of the application, you notice the application runs for about 15 minutes and then restarts. You decide to add Cloud Profiler to your application and now notice that the heap usage grows constantly until the application restarts. What should you do?
A. Increase the CPU limit in the application deployment.
B. Add high memory compute nodes to the cluster.
C. Increase the memory limit in the application deployment.
D. Add Cloud Trace to the application, and redeploy.
Show Answer
Correct Answer: C
Explanation: The steadily increasing heap usage followed by a restart indicates the container is being OOM-killed due to hitting its memory limit. In GKE, this is addressed first by increasing the pod’s memory limit so the application has sufficient headroom. Increasing CPU or node type does not resolve an OOM condition, and Cloud Trace focuses on request latency rather than memory behavior. While a memory leak should be investigated later, the correct immediate action given the options is to increase the memory limit.
Question 43
You are configuring your CI/CD pipeline natively on Google Cloud. You want builds in a pre-production Google Kubernetes Engine (GKE) environment to be automatically load-tested before being promoted to the production GKE environment. You need to ensure that only builds that have passed this test are deployed to production. You want to follow Google-recommended practices. How should you configure this pipeline with Binary Authorization?
A. Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using their personal private key.
B. Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) with a service account JSON key stored as a Kubernetes Secret.
C. Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity.
D. Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using a key stored in Cloud Key Management Service (Cloud KMS).
Show Answer
Correct Answer: C
Explanation: Google-recommended practice for Binary Authorization is to automate attestations using managed identities and managed keys. Storing the signing key in Cloud KMS ensures secure key management, and authenticating via Workload Identity avoids long-lived service account keys or Kubernetes Secrets. This allows the pre-production GKE workload to securely create attestations after successful load tests, and Binary Authorization can then enforce that only those attested images are deployable to production.
Question 44
Your company operates in a highly regulated domain. Your security team requires that only trusted container images can be deployed to Google Kubernetes Engine (GKE). You need to implement a solution that meets the requirements of the security team while minimizing management overhead. What should you do?
A. Configure Binary Authorization in your GKE clusters to enforce deploy-time security policies.
B. Grant the roles/artifactregistry.writer role to the Cloud Build service account. Confirm that no employee has Artifact Registry write permission.
C. Use Cloud Run to write and deploy a custom validator. Enable an Eventarc trigger to perform validations when new images are uploaded.
D. Configure Kritis to run in your GKE clusters to enforce deploy-time security policies.
Show Answer
Correct Answer: A
Explanation: Binary Authorization is the managed Google Cloud service designed specifically to enforce deploy-time policies on GKE, ensuring that only trusted and attested container images can be deployed. It integrates natively with GKE, supports image signing and policy enforcement, and minimizes operational overhead compared to building custom validation systems or running additional in-cluster components.
Question 45
As part of your company's initiative to shift left on security, the InfoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the deployment of trusted and approved images. You need to determine how to satisfy the InfoSec team's goal of shifting left on security. What should you do?
A. Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images
B. Use Binary Authorization to attest images during your CI/CD pipeline
C. Configure Identity and Access Management (IAM) policies to create a least privilege model on your GKE clusters.
D. Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods
Show Answer
Correct Answer: B
Explanation: The requirement is to enforce guardrails that only trusted and approved container images can be deployed to GKE, as part of a shift-left security approach. Binary Authorization is designed for this purpose: it enforces admission-time policies on GKE that allow only images with valid attestations, typically generated during the CI/CD pipeline, to run. This prevents unapproved images from ever being deployed. The other options either focus on vulnerability scanning (A), access control (C), or runtime monitoring (D), none of which enforce image trust at deployment time.
Question 46
Your company processes IoT data at scale by using Pub/Sub, App Engine standard environment, and an application written in Go. You noticed that the performance inconsistently degrades at peak load. You could not reproduce this issue on your workstation. You need to continuously monitor the application in production to identify slow paths in the code. You want to minimize performance impact and management overhead. What should you do?
A. Use Cloud Monitoring to assess the App Engine CPU utilization metric.
B. Install a continuous profiling tool into Compute Engine. Configure the application to send profiling data to the tool.
C. Periodically run the go tool pprof command against the application instance. Analyze the results by using flame graphs.
D. Configure Cloud Profiler, and initialize the cloud.google.com/go/profiler library in the application.
Show Answer
Correct Answer: D
Explanation: The requirement is continuous profiling in production with minimal performance impact and low management overhead. Cloud Profiler is a managed service designed specifically for this purpose and supports Go applications running on App Engine standard. Initializing the cloud.google.com/go/profiler library enables low-overhead, always-on profiling to identify slow code paths under real production load. Other options either provide only coarse metrics, add significant overhead, or require manual and intrusive profiling.
Question 47
Your organization stores all application logs from multiple Google Cloud projects in a central Cloud Logging project. Your security team wants to enforce a rule that each project team can only view their respective logs and only the operations team can view all the logs. You need to design a solution that meets the security team s requirements while minimizing costs. What should you do?
A. Grant each project team access to the project _Default view in the central logging project. Grant togging viewer access to the operations team in the central logging project.
B. Create Identity and Access Management (IAM) roles for each project team and restrict access to the _Default log view in their individual Google Cloud project. Grant viewer access to the operations team in the central logging project.
C. Create log views for each project team and only show each project team their application logs. Grant the operations team access to the _AllLogs view in the central logging project.
D. Export logs to BigQuery tables for each project team. Grant project teams access to their tables. Grant logs writer access to the operations team in the central logging project.
Show Answer
Correct Answer: C
Explanation: Using Cloud Logging log buckets with custom log views allows fine-grained, view-level IAM control over centrally stored logs. By creating a separate log view per project that filters logs to that project, each team can be granted access only to its own logs, while the operations team can be granted access to the built-in _AllLogs view for full visibility. This meets the security isolation requirement and avoids additional storage or export costs, unlike BigQuery exports or duplicating logs.
Question 48
You are configuring a CI pipeline. The build step for your CI pipeline integration testing requires access to APIs inside your private VPC network. Your security team requires that you do not expose API traffic publicly. You need to implement a solution that minimizes management overhead. What should you do?
A. Use Cloud Build private pools to connect to the private VPC.
B. Use Spinnaker for Google Cloud to connect to the private VPC.
C. Use Cloud Build as a pipeline runner. Configure Internal HTTP(S) Load Balancing for API access.
D. Use Cloud Build as a pipeline runner. Configure External HTTP(S) Load Balancing with a Google Cloud Armor policy for API access.
Show Answer
Correct Answer: A
Explanation: The CI build needs private access to APIs inside a VPC without exposing traffic publicly and with minimal management overhead. Cloud Build private pools run build workers inside a customer-controlled VPC, allowing direct private network access to internal APIs while remaining fully managed by Google. This avoids public load balancers or additional platforms and meets the security requirement. Other options either add unnecessary complexity (Spinnaker) or require exposing services via load balancers.
Question 49
You are deploying an application to Cloud Run. The application requires a password to start. Your organization requires that all passwords are rotated every 24 hours, and your application must have the latest password. You need to deploy the application with no downtime. What should you do?
A. Store the password in Secret Manager and send the secret to the application by using environment variables.
B. Store the password in Secret Manager and mount the secret as a volume within the application.
C. Use Cloud Build to add your password into the application container at build time. Ensure that Artifact Registry is secured from public access.
D. Store the password directly in the code. Use Cloud Build to rebuild and deploy the application each time the password changes.
Show Answer
Correct Answer: B
Explanation: Cloud Run secrets mounted as volumes are read at runtime and always fetch the latest secret version from Secret Manager. This supports automatic password rotation without restarting or redeploying the service, enabling zero downtime. Environment variables are only resolved at container startup, so they would not pick up rotated secrets without a new revision.
Question 50
You deployed an application into a large Standard Google Kubernetes Engine (GKE) cluster. The application is stateless and multiple pods run at the same time. Your application receives inconsistent traffic. You need to ensure that the user experience remains consistent regardless of changes in traffic and that the resource usage of the cluster is optimized.
What should you do?
A. Configure a cron job to scale the deployment on a schedule
B. Configure a Horizontal Pod Autoscaler.
C. Configure a Vertical Pod Autoscaler
D. Configure cluster autoscaling on the node pool.
Show Answer
Correct Answer: B
Explanation: The application is stateless and experiences variable traffic, so scaling the number of pods based on demand is the correct approach. A Horizontal Pod Autoscaler automatically increases or decreases pod replicas based on metrics like CPU or request load, ensuring consistent user experience during traffic spikes while avoiding wasted resources during low traffic. Vertical Pod Autoscaling or cron-based scaling do not address real-time traffic variation, and cluster autoscaling alone does not manage application-level scaling.
$19
Get all 199 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.