Professional Cloud DevOps Engineer Free Practice Questions — Page 8
Question 71
You are deploying a Cloud Build job that deploys Terraform code when a Git branch is updated. While testing, you noticed that the job fails. You see the following error in the build logs:
Initializing the backend...
Error: Failed to get existing workspaces: querying Cloud Storage failed: googleapi: Error 403
You need to resolve the issue by following Google-recommended practices. What should you do?
A. Change the Terraform code to use local state.
B. Create a storage bucket with the name specified in the Terraform configuration.
C. Grant the roles/owner Identity and Access Management (IAM) role to the Cloud Build service account on the project.
D. Grant the roles/storage.objectAdmin Identity and Access Management (1AM) role to the Cloud Build service account on the state file bucket.
Show Answer
Correct Answer: D
Explanation: The 403 error occurs when Terraform tries to access its remote state stored in a Cloud Storage bucket and the Cloud Build service account lacks sufficient permissions. Google-recommended best practice is to grant least-privilege access. Assigning roles/storage.objectAdmin on the specific state bucket allows Cloud Build to read, write, and manage the Terraform state objects, resolving the error without over-privileging the service account.
Question 72
You are configuring Cloud Logging for a new application that runs on a Compute Engine instance with a public IP address. A user-managed service account is attached to the instance. You confirmed that the necessary agents are running on the instance but you cannot see any log entries from the instance in Cloud Logging. You want to resolve the issue by following Google-recommended practices. What should you do?
A. Export the service account key and configure the agents to use the key.
B. Update the instance to use the default Compute Engine service account.
C. Add the Logs Writer role to the service account.
D. Enable Private Google Access on the subnet that the instance is in.
Show Answer
Correct Answer: C
Explanation: Cloud Logging agents authenticate using the service account attached to the Compute Engine instance. Since a user-managed service account is already in use and the agents are running, the most likely issue is missing IAM permissions. Granting the Logs Writer (roles/logging.logWriter) role to that service account is the Google-recommended, least-privilege solution. Exporting keys is not recommended, switching to the default service account is unnecessary, and Private Google Access is not required because the instance has a public IP.
Question 73
Your company runs applications in Google Kubernetes Engine (GKE) that are deployed following a GitOps methodology. Application developers frequently create cloud resources to support their applications. You want to give developers the ability to manage infrastructure as code, while ensuring that you follow Google-recommended practices. You need to ensure that infrastructure as code reconciles periodically to avoid configuration drift. What should you do?
A. Install and configure Config Connector in Google Kubernetes Engine (GKE).
B. Configure Cloud Build with a Terraform builder to execute terraform plan and terraform apply commands.
C. Create a Pod resource with a Terraform docker image to execute terraform plan and terraform apply commands.
D. Create a Job resource with a Terraform docker image to execute terraform plan and terraform apply commands.
Show Answer
Correct Answer: A
Explanation: Config Connector lets developers manage Google Cloud resources declaratively using Kubernetes CRDs within GKE, which fits a GitOps model. Its controllers continuously reconcile the desired state defined in Git with the actual cloud resources, preventing configuration drift and aligning with Google‑recommended practices. The Terraform-based options execute imperatively and do not provide continuous reconciliation.
Question 74
You need to enforce several constraint templates across your Google Kubernetes Engine (GKE) clusters. The constraints include policy parameters, such as restricting the Kubernetes API. You must ensure that the policy parameters are stored in a GitHub repository and automatically applied when changes occur. What should you do?
A. Set up a GitHub action to trigger Cloud Build when there is a parameter change. In Cloud Build, run a gcloud CLI command to apply the change.
B. When there is a change in GitHub. use a web hook to send a request to Anthos Service Mesh, and apply the change.
C. Configure Anthos Config Management with the GitHub repository. When there is a change in the repository, use Anthos Config Management to apply the change.
D. Configure Config Connector with the GitHub repository. When there is a change in the repository, use Config Connector to apply the change.
Show Answer
Correct Answer: C
Explanation: Anthos Config Management (with Policy Controller) is designed to enforce constraint templates and constraints across GKE clusters using GitOps. By connecting ACM to a GitHub repository, policy parameters stored as Kubernetes manifests are continuously synced and automatically applied on change, providing centralized, auditable, and consistent policy enforcement. Other options do not provide native, declarative, cluster-wide policy enforcement for Kubernetes constraints.
Question 75
You need to introduce postmortems into your organization. You want to ensure that the postmortem process is well received. What should you do? (Choose two.)
A. Encourage new employees to conduct postmortems to team through practice.
B. Create a designated team that is responsible for conducting all postmortems.
C. Encourage your senior leadership to acknowledge and participate in postmortems.
D. Ensure that writing effective postmortems is a rewarded and celebrated practice.
E. Provide your organization with a forum to critique previous postmortems.
Show Answer
Correct Answer: C, D
Explanation: To ensure postmortems are well received, the organization must build a supportive, blameless culture. Senior leadership participation signals that postmortems are valued and safe, setting the tone for the entire organization. Rewarding and celebrating effective postmortems reinforces positive behavior and encourages teams to invest effort in learning and improvement rather than fear or blame.
Question 76
You recently noticed that one of your services has exceeded the error budget for the current rolling window period. Your company's product team is about to launch a new feature. You want to follow Site Reliability Engineering (SRE) practices. What should you do?
A. Notify the team about the lack of error budget and ensure that all their tests are successful so the launch will not further risk the error budget
B. Notify the team that their error budget is used up. Negotiate with the team for a launch freeze or tolerate a slightly worse user experience.
C. Escalate the situation and request additional error budget.
D. Look through other metrics related to the product and find SLOs with remaining error budget. Reallocate the error budgets and allow the feature launch.
Show Answer
Correct Answer: B
Explanation: In SRE, error budgets are the control mechanism that balances reliability and feature velocity. If the error budget for the current window is exhausted, the correct action is to inform stakeholders and slow or stop risk‑increasing changes. This typically means negotiating a launch freeze or making an explicit, business‑level decision to accept additional risk or degraded user experience. Requesting more error budget or reallocating it violates SRE principles, and simply relying on more testing does not address the policy breach.
Question 77
You need to create a Cloud Monitoring SLO for a service that will be published soon. You want to verify that requests to the service will be addressed in fewer than 300 ms at least 90% of the time per calendar month. You need to identify the metric and evaluation method to use. What should you do?
A. Select a latency metric for a request-based method of evaluation.
B. Select a latency metric for a window-based method of evaluation.
C. Select an availability metric for a request-based method of evaluation.
D. Select an availability metric for a window-based method of evaluation.
Show Answer
Correct Answer: A
Explanation: The objective specifies a latency target (requests handled in under 300 ms) and a proportion of requests meeting that target (90%) over a calendar month. Latency rules out availability metrics, and measuring the percentage of requests that meet a latency threshold is exactly what a request-based SLO evaluation does. Window-based evaluation measures the percentage of time windows that are good, not the percentage of requests.
Question 78
You are the Site Reliability Engineer responsible for managing your company's data services and products. You regularly navigate operational challenges, such as unpredictable data volume and high cost, with your company's data ingestion processes. You recently learned that a new data ingestion product will be developed in Google Cloud. You need to collaborate with the product development team to provide operational input on the new product. What should you do?
A. Deploy the prototype product in a test environment, run a load test, and share the results with the product development team.
B. When the initial product version passes the quality assurance phase and compliance assessments, deploy the product to a staging environment. Share error logs and performance metrics with the product development team.
C. When the new product is used by at least one internal customer in production, share error logs and monitoring metrics with the product development team.
D. Review the design of the product with the product development team to provide feedback early in the design phase.
Show Answer
Correct Answer: D
Explanation: As an SRE, the most effective way to provide operational input is to engage early. Reviewing the product design during the design phase allows you to influence architecture decisions around scalability, reliability, observability, and cost before they are costly to change. The other options provide feedback only after implementation or production use, which is reactive and less effective.
Question 79
You have deployed a fleet of Compute Engine instances in Google Cloud. You need to ensure that monitoring metrics and logs for the instances are visible in Cloud Logging and Cloud Monitoring by your company's operations and cyber security teams. You need to grant the required roles for the Compute Engine service account by using Identity and Access Management (IAM) while following the principle of least privilege. What should you do?
A. Grant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service accounts.
B. Grant the logging.admin and monitoring.editor roles to the Compute Engine service accounts.
C. Grant the logging.editor and monitoring.metricWriter roles to the Compute Engine service accounts.
D. Grant the logging.logWriter and monitoring.editor roles to the Compute Engine service accounts.
Show Answer
Correct Answer: A
Explanation: Compute Engine instances only need permission to write logs and metrics so that operations and security teams can view them in Cloud Logging and Cloud Monitoring. The least-privilege roles for this are roles/logging.logWriter (write log entries) and roles/monitoring.metricWriter (write metrics). The other options grant broader editor or admin permissions that are unnecessary.
Question 80
Your CTO has asked you to implement a postmortem policy on every incident for internal use. You want to define what a good postmortem is to ensure that the policy is successful at your company. What should you do? (Choose two.)
A. Ensure that all postmortems include what caused the incident, identify the person or team responsible for causing the incident, and how to prevent a future occurrence of the incident.
B. Ensure that all postmortems include what caused the incident, how the incident could have been worse, and how to prevent a future occurrence of the incident.
C. Ensure that all postmortems include the severity of the incident, how to prevent a future occurrence of the incident, and what caused the incident without naming internal system components.
D. Ensure that all postmortems include how the incident was resolved and what caused the incident without naming customer information.
E. Ensure that all postmortems include all incident participants in postmortem authoring and share postmortems as widely as possible.
Show Answer
Correct Answer: C, E
Explanation: A good postmortem culture is blameless, learning-focused, and widely shared. Option C aligns with this by emphasizing severity, root cause, and preventative actions without exposing sensitive internal details or blaming individuals. Option E reinforces best practice by involving all incident participants to capture complete context and by sharing postmortems broadly to maximize organizational learning. Options that assign blame, omit prevention, or focus on speculative or unnecessary details conflict with effective postmortem principles.
$19
Get all 199 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.