Professional Cloud DevOps Engineer Free Practice Questions — Page 5
Question 41
You have an application running in production on Cloud Run. Your team recently finished developing a new version (revision B) of the application. You want to test the new revision on 10% of your clients by using the least amount of effort. What should you do?
A. Deploy the new revision to the existing service without traffic allocated. Tag the revision and share the URL with 10% of your clients.
B. Create a new service, and deploy the new revisions on the new service. Deploy a new revision of the old application where the application routes a percentage of the traffic to the new service.
C. Create a new service, and deploy the new revision on that new service. Create a load balancer to split the traffic between the old service and the new service.
D. Deploy the new revision to the existing service without traffic allocated. Split the traffic between the old revision and the new revision.
Show Answer
Correct Answer: D
Explanation: Cloud Run supports gradual traffic splitting between revisions of the same service. Deploy the new revision and then configure a 90%/10% traffic split between the existing and new revisions. This is built-in, requires no separate service or load balancer, and is the least operational effort. Tagging a revision creates a dedicated URL but does not automatically expose it to 10% of clients.
Question 42
Your company stores a large volume of infrequently used data in Cloud Storage. The projects in your company's CustomerService folder access Cloud Storage frequently, but store very little data. You want to enable Data Access audit logging across the company to identify data usage patterns. You need to exclude the CustomerService folder projects from Data Access audit logging. What should you do?
A. Enable Data Access audit logging for Cloud Storage at the organization level, and configure exempted principals to include users of the CustomerService folder.
B. Enable Data Access audit logging for Cloud Storage at the organization level, with no additional configuration.
C. Enable Data Access audit logging for Cloud Storage for all projects and folders other than the CustomerService folder.
D. Enable Data Access audit logging for Cloud Storage for all projects and folders, and configure exempted principals to include users of the CustomerService folder.
Show Answer
Correct Answer: C
Explanation: Data Access audit logging is inherited through the resource hierarchy. If you enable it at the organization level, you cannot disable it for a child folder or project. Exempted principals exclude specific identities, not entire folders or projects, and do not satisfy the requirement to exclude the CustomerService folder. Therefore, configure Data Access audit logging on all folders/projects where it is needed while leaving the CustomerService folder without the setting.
Question 43
You need to define SLOs for a high-traffic web application. Customers are currently happy with the application performance and availability. Based on current measurement, the 90th percentile of latency is 160 ms and the 95th percentile of latency is 300 ms over a 28-day window. What latency SLO should you publish?
A. 90th percentile - 150 ms 95th percentile - 290 ms
B. 90th percentile - 160 ms 95th percentile - 300 ms
C. 90th percentile - 190 ms 95th percentile - 330 ms
D. 90th percentile - 300 ms 95th percentile - 450 ms
Show Answer
Correct Answer: C
Explanation: An SLO should be based on what users consider acceptable while leaving room for an error budget. Since current performance already satisfies users, setting the SLO slightly less strict than current observed performance provides operational headroom without making the objective so relaxed that it loses value. Option C offers reasonable headroom; A is stricter than current performance, B leaves effectively no error budget, and D is excessively lenient.
Question 44
Your company runs applications in Google Kubernetes Engine (GKE). Application developers frequently create cloud resources to support their applications. You need to give developers the ability to manage infrastructure as code while adhering to Google-recommended practices. You want to manage infrastructure as code through Kubernetes Custom Resource Definitions (CRDs) and ensure that your chosen setup can be supported by the Google Cloud Support Portal. What should you do?
A. Configure Cloud Build with a Terraform builder to execute the terraform plan and terraform apply commands.
B. Install and configure Crossplane in GKE.
C. Configure a GitHub Action with a Terraform builder to execute the terraform plan and terraform apply commands as part of the pull request process.
D. Install and configure Config Connector in GKE.
Show Answer
Correct Answer: D
Explanation: The requirement is to manage Google Cloud infrastructure as Kubernetes Custom Resource Definitions (CRDs) in GKE while following Google-recommended practices and using a solution supported by Google Cloud Support. Config Connector is Google's native, fully supported Kubernetes add-on that exposes Google Cloud resources as Kubernetes CRDs. Terraform-based options do not use CRDs, and Crossplane, while CRD-based, is not Google's native supported solution for managing Google Cloud resources.
Question 45
Your company runs services on Google Cloud. Each team runs their applications in a dedicated project. New teams and projects are created regularly. Your security team requires that all logs are processed by a security information and event management (SIEM) system. The SIEM ingests logs by using Pub/Sub. You must ensure that all existing and future logs are scanned by the SIEM. What should you do?
A. Create an organization-level aggregated sink with a siem log bucket as the destination. Set an inclusion filter to include all logs.
B. Create a folder-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each folder.
C. Create an organization-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs.
D. Create a project-level logging sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each project.
Show Answer
Correct Answer: C
Explanation: An organization-level aggregated sink captures logs from all existing and future projects in the organization. Because the SIEM ingests logs via Pub/Sub, the sink destination should be a Pub/Sub topic. An inclusion filter matching all logs ensures comprehensive coverage. Folder-level or project-level sinks require ongoing maintenance, and a log bucket destination would not feed the SIEM directly via Pub/Sub.
Question 46
Your company uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices. What should you do?
A. Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.
B. Use the Terraform module so that Secret Manager can retrieve credentials.
C. Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE_CREDENTIALS environment variable on the Jenkins server.
D. Add the gcloud auth application-default login command as a step in Jenkins before running the Terraform commands.
Show Answer
Correct Answer: A
Explanation: Google-recommended practice is to avoid long-lived service account keys. When Terraform runs on a Google Cloud VM, it can use the attached service account via Application Default Credentials. Attach a service account with the minimum required IAM roles to the Jenkins VM. Option C relies on downloading and managing a service account key, which Google recommends avoiding. Option D is intended for user credentials, not automated CI/CD, and B is not the standard authorization mechanism.
Question 47
Your company is planning a large marketing event for an online retailer during the holiday shopping season. You are expecting your web application to receive a large volume of traffic in a short period. You need to prepare your application for potential failures during the event. What should you do? (Choose two.)
A. Configure Anthos Service Mesh on the application to identify issues on the topology map.
B. Ensure that relevant system metrics are being captured with Cloud Monitoring, and create alerts at levels of interest.
C. Review your increased capacity requirements and plan for the required quota management.
D. Monitor latency of your services for average percentile latency.
E. Create alerts in Cloud Monitoring for all common failures that your application experiences.
Show Answer
Correct Answer: B, C
Explanation: The best preparation for a predictable traffic surge is to ensure observability and capacity readiness. Capturing key system metrics with Cloud Monitoring and configuring meaningful alerts enables rapid detection of issues during the event (B). Reviewing expected load and planning quota increases ahead of time helps prevent resource exhaustion and API quota limits under peak demand (C). Anthos Service Mesh is only applicable if it is already part of the architecture and is not a general prerequisite. Monitoring only average percentile latency is too narrow compared with broader system health monitoring. Creating alerts for all common failures is less appropriate than alerting on relevant metrics and thresholds, as indiscriminate alerts can create unnecessary noise.
Question 48
You are designing a system with three different environments: development, quality assurance (QA), and production. Each environment will be deployed with Terraform and has a Google Kubernetes Engine (GKE) cluster created so that application teams can deploy their applications. Anthos Config Management will be used and templated to deploy infrastructure level resources in each GKE cluster. All users (for example, infrastructure operators and application owners) will use GitOps. How should you structure your source control repositories for both Infrastructure as Code (IaC) and application code?
A. • Cloud Infrastructure (Terraform) repository is shared: different directories are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: different overlay directories are different environments • Application (app source code) repositories are separated: different branches are different features
B. • Cloud Infrastructure (Terraform) repository is shared: different directories are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated: different branches are different environments • Application (app source code) repositories are separated: different branches are different features
C. • Cloud Infrastructure (Terraform) repository is shared: different branches are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: different overlay directories are different environments • Application (app source code) repository is shared: different directories are different features
D. • Cloud Infrastructure (Terraform) repositories are separated: different branches are different environments • GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated: different overlay directories are different environments • Application (app source code) repositories are separated: different branches are different
Show Answer
Correct Answer: A
Explanation: GitOps and Anthos Config Management best practices favor using a shared repository with directory/folder-based environment separation rather than long-lived branches. For Terraform, a shared repository with per-environment directories is a common and maintainable pattern. For Anthos Config Management with Kustomize, environment-specific overlays in directories are the recommended approach. Application source code is typically kept in separate repositories per application, with branches used for feature development rather than representing environments.
Question 49
You are designing a new Google Cloud organization for a client. Your client is concerned with the risks associated with long-lived credentials created in Google Cloud. You need to design a solution to completely eliminate the risks associated with the use of JSON service account keys while minimizing operational overhead. What should you do?
A. Apply the constraints/iam.disableServiceAccountKevCreation constraint to the organization.
B. Use custom versions of predefined roles to exclude all iam.serviceAccountKeys.* service account role permissions.
C. Apply the constraints/iam.disableServiceAccountKeyUpload constraint to the organization.
D. Grant the roles/iam.serviceAccountKeyAdmin IAM role to organization administrators only.
Show Answer
Correct Answer: A
Explanation: Applying the organization policy constraint to disable service account key creation prevents creation of user-managed JSON service account keys across the organization, eliminating the use of long-lived JSON keys while requiring minimal ongoing operational effort. Removing permissions via custom roles is incomplete, disabling key upload does not stop key creation, and restricting the Key Admin role alone does not eliminate the risk.
Question 50
Your company runs applications in Google Kubernetes Engine (GKE). Several applications rely on ephemeral volumes. You noticed some applications were unstable due to the DiskPressure node condition on the worker nodes. You need to identify which Pods are causing the issue, but you do not have execute access to workloads and nodes. What should you do?
A. Check the node/ephemeral_storage/used_bytes metric by using Metrics Explorer.
B. Check the container/ephemeral_storage/used_bytes metric by using Metrics Explorer.
C. Locate all the Pods with emptyDir volumes. Use the df -h command to measure volume disk usage.
D. Locate all the Pods with emptyDir volumes. Use the df -sh * command to measure volume disk usage.
Show Answer
Correct Answer: B
Explanation: You need to identify which Pods are consuming ephemeral storage without shell access to nodes or workloads. The container/ephemeral_storage/used_bytes metric in Cloud Monitoring can be filtered and grouped by Kubernetes resource labels to pinpoint the containers/Pods responsible. The node-level metric only shows aggregate usage per node and cannot identify the offending Pods. The options using df require execute access, which the scenario explicitly says you do not have.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.