Professional Cloud DevOps Engineer Free Practice Questions — Page 6
Question 51
As a Site Reliability Engineer, you support an application written in Go that runs on Google Kubernetes Engine (GKE) in production. After releasing a new version of the application, you notice the application runs for about 15 minutes and then restarts. You decide to add Cloud Profiler to your application and now notice that the heap usage grows constantly until the application restarts. What should you do?
A. Increase the CPU limit in the application deployment.
B. Add high memory compute nodes to the cluster.
C. Increase the memory limit in the application deployment.
D. Add Cloud Trace to the application, and redeploy.
Show Answer
Correct Answer: C
Explanation: The application's heap grows continuously until it restarts, which strongly indicates it is being terminated after reaching its configured memory limit (likely OOMKilled). Increasing the memory limit in the deployment is the appropriate operational response among the given options. Increasing CPU or node size does not directly address the container memory limit, and Cloud Trace is for request latency/distributed tracing rather than memory leak analysis; Cloud Profiler is already the correct tool for investigating heap growth.
Question 52
You are configuring your CI/CD pipeline natively on Google Cloud. You want builds in a pre-production Google Kubernetes Engine (GKE) environment to be automatically load-tested before being promoted to the production GKE environment. You need to ensure that only builds that have passed this test are deployed to production. You want to follow Google-recommended practices. How should you configure this pipeline with Binary Authorization?
A. Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using their personal private key.
B. Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) with a service account JSON key stored as a Kubernetes Secret.
C. Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity.
D. Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using a key stored in Cloud Key Management Service (Cloud KMS).
Show Answer
Correct Answer: C
Explanation: Binary Authorization uses attestations to gate deployment. Google-recommended practice is to automate attestation signing with a key protected in Cloud KMS and have the workload authenticate to Google Cloud using Workload Identity rather than long-lived service account JSON keys or manual human signing. This ensures only images that passed the load test receive the required attestation and can be deployed to production.
Question 53
Your company operates in a highly regulated domain. Your security team requires that only trusted container images can be deployed to Google Kubernetes Engine (GKE). You need to implement a solution that meets the requirements of the security team while minimizing management overhead. What should you do?
A. Configure Binary Authorization in your GKE clusters to enforce deploy-time security policies.
B. Grant the roles/artifactregistry.writer role to the Cloud Build service account. Confirm that no employee has Artifact Registry write permission.
C. Use Cloud Run to write and deploy a custom validator. Enable an Eventarc trigger to perform validations when new images are uploaded.
D. Configure Kritis to run in your GKE clusters to enforce deploy-time security policies.
Show Answer
Correct Answer: A
Explanation: Binary Authorization is the managed Google Cloud service designed to enforce deploy-time policies for GKE, ensuring that only trusted and attested container images can be deployed. It minimizes operational overhead compared with running and maintaining Kritis yourself. Granting Artifact Registry permissions alone does not enforce deployment trust, and a custom Cloud Run/Eventarc validator adds unnecessary management complexity.
Question 54
As part of your company's initiative to shift left on security, the InfoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the deployment of trusted and approved images. You need to determine how to satisfy the InfoSec team's goal of shifting left on security. What should you do?
A. Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images
B. Use Binary Authorization to attest images during your CI/CD pipeline
C. Configure Identity and Access Management (IAM) policies to create a least privilege model on your GKE clusters.
D. Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods
Show Answer
Correct Answer: B
Explanation: Binary Authorization enforces deployment policies so that only trusted, attested container images can be deployed to GKE. By integrating attestations into the CI/CD pipeline, you shift security left and implement guardrails before workloads reach the cluster. Container Analysis scans for vulnerabilities but does not enforce deployment, IAM addresses access control rather than image trust, and runtime tools like Falco or Twistlock detect issues after deployment.
Question 55
Your company processes IoT data at scale by using Pub/Sub, App Engine standard environment, and an application written in Go. You noticed that the performance inconsistently degrades at peak load. You could not reproduce this issue on your workstation. You need to continuously monitor the application in production to identify slow paths in the code. You want to minimize performance impact and management overhead. What should you do?
A. Use Cloud Monitoring to assess the App Engine CPU utilization metric.
B. Install a continuous profiling tool into Compute Engine. Configure the application to send profiling data to the tool.
C. Periodically run the go tool pprof command against the application instance. Analyze the results by using flame graphs.
D. Configure Cloud Profiler, and initialize the cloud.google.com/go/profiler library in the application.
Show Answer
Correct Answer: D
Explanation: Cloud Profiler is the managed, low-overhead continuous profiling service designed for production workloads, including App Engine standard environment with Go. Initializing the cloud.google.com/go/profiler library enables continuous CPU and heap profiling to identify performance bottlenecks with minimal performance impact and operational overhead. CPU utilization metrics alone do not identify slow code paths, running pprof manually is not continuous and adds operational burden, and installing a profiler on Compute Engine is unnecessary because Cloud Profiler is the managed solution.
Question 56
Your organization stores all application logs from multiple Google Cloud projects in a central Cloud Logging project. Your security team wants to enforce a rule that each project team can only view their respective logs and only the operations team can view all the logs. You need to design a solution that meets the security team s requirements while minimizing costs. What should you do?
A. Grant each project team access to the project _Default view in the central logging project. Grant togging viewer access to the operations team in the central logging project.
B. Create Identity and Access Management (IAM) roles for each project team and restrict access to the _Default log view in their individual Google Cloud project. Grant viewer access to the operations team in the central logging project.
C. Create log views for each project team and only show each project team their application logs. Grant the operations team access to the _AllLogs view in the central logging project.
D. Export logs to BigQuery tables for each project team. Grant project teams access to their tables. Grant logs writer access to the operations team in the central logging project.
Show Answer
Correct Answer: C
Explanation: Custom log views are the Cloud Logging feature designed for fine-grained access control within a centralized logging project. Create a separate log view for each project that filters only that project's application logs, then grant each project team access only to its corresponding view. Grant the operations team access to the _AllLogs view so they can see all centralized logs. Option A exposes all logs in the _Default view, option B does not solve access control within the centralized logging project because IAM on source projects does not restrict centralized log bucket contents, and option D adds unnecessary BigQuery export costs and complexity.
Question 57
You are configuring a CI pipeline. The build step for your CI pipeline integration testing requires access to APIs inside your private VPC network. Your security team requires that you do not expose API traffic publicly. You need to implement a solution that minimizes management overhead. What should you do?
A. Use Cloud Build private pools to connect to the private VPC.
B. Use Spinnaker for Google Cloud to connect to the private VPC.
C. Use Cloud Build as a pipeline runner. Configure Internal HTTP(S) Load Balancing for API access.
D. Use Cloud Build as a pipeline runner. Configure External HTTP(S) Load Balancing with a Google Cloud Armor policy for API access.
Show Answer
Correct Answer: A
Explanation: Cloud Build private pools are designed to run builds with private network connectivity to resources inside a VPC. They allow CI integration tests to access private APIs without exposing traffic publicly and are fully managed, minimizing operational overhead. Spinnaker is a CD tool rather than the appropriate networking solution, and using internal or external load balancers with standard Cloud Build adds unnecessary complexity or violates the requirement to avoid public exposure.
Question 58
You are deploying an application to Cloud Run. The application requires a password to start. Your organization requires that all passwords are rotated every 24 hours, and your application must have the latest password. You need to deploy the application with no downtime. What should you do?
A. Store the password in Secret Manager and send the secret to the application by using environment variables.
B. Store the password in Secret Manager and mount the secret as a volume within the application.
C. Use Cloud Build to add your password into the application container at build time. Ensure that Artifact Registry is secured from public access.
D. Store the password directly in the code. Use Cloud Build to rebuild and deploy the application each time the password changes.
Show Answer
Correct Answer: B
Explanation: Mount the secret from Secret Manager as a volume. In Cloud Run, secrets exposed as environment variables are resolved when the container instance starts, so rotated values are not picked up by already-running instances. Mounted secret volumes fetch the current secret value when read, making them suitable for frequent secret rotation without requiring a redeployment or causing downtime. Options C and D embed the secret into the image or code, which is insecure and requires rebuilds/redeployments.
Question 59
You deployed an application into a large Standard Google Kubernetes Engine (GKE) cluster. The application is stateless and multiple pods run at the same time. Your application receives inconsistent traffic. You need to ensure that the user experience remains consistent regardless of changes in traffic and that the resource usage of the cluster is optimized.
What should you do?
A. Configure a cron job to scale the deployment on a schedule
B. Configure a Horizontal Pod Autoscaler.
C. Configure a Vertical Pod Autoscaler
D. Configure cluster autoscaling on the node pool.
Show Answer
Correct Answer: B
Explanation: A Horizontal Pod Autoscaler (HPA) is the appropriate choice for a stateless application with variable traffic because it automatically adjusts the number of pod replicas based on CPU utilization or other metrics, maintaining performance during traffic spikes while reducing replicas when demand drops. Vertical Pod Autoscaler changes resource requests for individual pods rather than replica count, cluster autoscaling only adjusts node capacity in response to scheduling needs, and a cron-based schedule cannot react to unpredictable traffic.
Question 60
You have an application that runs on Cloud Run. You want to use live production traffic to test a new version of the application, while you let the quality assurance team perform manual testing. You want to limit the potential impact of any issues while testing the new version, and you must be able to roll back to a previous version of the application if needed. How should you deploy the new version? (Choose two.)
A. Deploy the application as a new Cloud Run service.
B. Deploy a new Cloud Run revision with a tag and use the --no-traffic option.
C. Deploy a new Cloud Run revision without a tag and use the --no-traffic option.
D. Deploy the new application version and use the --no-traffic option. Route production traffic to the revision’s URL.
E. Deploy the new application version, and split traffic to the new version.
Show Answer
Correct Answer: B, E
Explanation: Use a tagged revision deployed with --no-traffic so QA can manually test it via the tag URL without receiving default production traffic. Then use Cloud Run traffic splitting to send a controlled percentage of live production traffic to the new revision, enabling canary testing and easy rollback by shifting traffic back if problems occur. Creating a separate service is unnecessary, deploying without a tag makes QA access harder, and routing production traffic directly to a revision URL is not the standard Cloud Run rollout mechanism for controlled production traffic.
Sources:
https://www.marks4sure.com/professional-cloud-devops-engineer-google-cloud-certified-professional-cloud-devops-engineer-exam-questions.html
https://www.theserverside.com/blog/Coffee-Talk-Java-News-Stories-and-Opinions/GCP-Google-Certified-DevOps-Engineer-Practice-Exams
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.