Professional Cloud DevOps Engineer Free Practice Questions — Page 8
Question 71
You are investigating issues in your production application that runs on Google Kubernetes Engine (GKE). You determined that the source of the issue is a recently updated container image, although the exact change in code was not identified. The deployment is currently pointing to the latest tag. You need to update your cluster to run a version of the container that functions as intended. What should you do?
A. Create a new tag called stable that points to the previously working container, and change the deployment to point to the new tag.
B. Alter the deployment to point to the sha256 digest of the previously working container.
C. Build a new container from a previous Git tag, and do a rolling update on the deployment to the new container.
D. Apply the latest tag to the previous container image, and do a rolling update on the deployment.
Show Answer
Correct Answer: B
Explanation: Use the immutable sha256 digest of the last known-good image. Image tags such as 'latest' are mutable and can be repointed, making rollbacks unreliable. Referencing the digest guarantees GKE deploys the exact previously working image without needing to rebuild or retag it.
Question 72
You are developing reusable infrastructure as code modules. Each module contains integration tests that launch the module in a test project. You are using GitHub for source control. You need to continuously test your feature branch and ensure that all code is tested before changes are accepted. You need to implement a solution to automate the integration tests. What should you do?
A. Use a Jenkins server for CI/CD pipelines. Periodically run all tests in the feature branch.
B. Ask the pull request reviewers to run the integration tests before approving the code.
C. Use Cloud Build to run the tests. Trigger all tests to run after a pull request is merged.
D. Use Cloud Build to run tests in a specific folder. Trigger Cloud Build for every GitHub pull request.
Show Answer
Correct Answer: D
Explanation: The requirement is to continuously test feature branches and ensure all code is tested before changes are accepted. Cloud Build integrates with GitHub pull request triggers, allowing integration tests to run automatically for every PR before merge. Option C runs tests only after a pull request is merged, which is too late to gate acceptance. Option A is periodic rather than event-driven and doesn't leverage the stated GCP tooling. Option B is manual and does not automate testing.
Question 73
You are leading a DevOps project for your organization. The DevOps team is responsible for managing the service infrastructure and being on-call for incidents. The Software Development team is responsible for writing, submitting, and reviewing code. Neither team has any published SLOs. You want to design a new joint-ownership model for a service between the DevOps team and the Software Development team. Which responsibilities should be assigned to each team in the new joint-ownership model?
A.
B.
C.
D.
Show Answer
Correct Answer: D
Explanation: In a joint ownership model aligned with SRE/DevOps practices, the DevOps team continues to manage the service infrastructure and primary operational responsibilities, the Software Development team owns writing/submitting/reviewing code, and both teams share responsibility for defining and publishing SLOs. The distinguishing feature is that SLOs become a shared responsibility while existing domain expertise remains with each team.
Sources:
https://cloud.google.com/blog/products/devops-sre/how-to-design-good-slos-according-to-google-sres
https://cloud.google.com/service-mesh/docs/observability/design-slo
Question 74
You work for a global organization and are running a monolithic application on Compute Engine. You need to select the machine type for the application to use that optimizes CPU utilization by using the fewest number of steps. You want to use historical system metrics to identify the machine type for the application to use. You want to follow Google-recommended practices. What should you do?
A. Use the Recommender API and apply the suggested recommendations.
B. Create an Agent Policy to automatically install Ops Agent in all VMs.
C. Install the Ops Agent in a fleet of VMs by using the gcloud CLI.
D. Review the Cloud Monitoring dashboard for the VM and choose the machine type with the lowest CPU utilization.
Show Answer
Correct Answer: A
Explanation: The Compute Engine Machine Type Recommender analyzes historical CPU and memory utilization metrics and recommends more appropriate machine types. Using the Recommender API is the fewest-step, Google-recommended approach to optimize CPU utilization based on historical system metrics. Installing the Ops Agent only enables metric collection and does not itself recommend machine types, and manually reviewing Monitoring dashboards is not the recommended automated optimization approach.
Question 75
Your organization is using Helm to package containerized applications. Your applications reference both public and private charts. Your security team flagged that using a public Helm repository as a dependency is a risk. You want to manage all charts uniformly, with native access control and VPC Service Controls. What should you do?
A. Store public and private charts in OCI format by using Artifact Registry.
B. Store public and private charts by using GitHub Enterprise with Google Workspace as the identity provider.
C. Store public and private charts by using Git repository. Configure Cloud Build to synchronize contents of the repository into a Cloud Storage bucket. Connect Helm to the bucket by using https://[bucket].storage-googleapis.com/[helmchart] as the Helm repository.
D. Configure a Helm chart repository server to run in Google Kubernetes Engine (GKE) with Cloud Storage bucket as the storage backend.
Show Answer
Correct Answer: A
Explanation: Artifact Registry supports Helm charts in OCI format, allowing you to store both public and private charts in a single managed service with Google Cloud IAM for native access control and VPC Service Controls. The other options either lack native VPC Service Controls integration, require self-managed infrastructure, or are not the recommended managed solution.
Question 76
Your application's performance in Google Cloud has degraded since the last release. You suspect that downstream dependencies might be causing some requests to take longer to complete. You need to investigate the issue with your application to determine the cause. What should you do?
A. Configure Error Reporting in your application.
B. Configure Google Cloud Managed Service for Prometheus in your application.
C. Configure Cloud Profiler in your application.
D. Configure Cloud Trace in your application.
Show Answer
Correct Answer: D
Explanation: Cloud Trace is designed to analyze request latency across distributed systems. It provides end-to-end request traces, making it possible to identify slow downstream dependencies and pinpoint performance bottlenecks introduced after a release. Error Reporting focuses on exceptions, Managed Service for Prometheus collects metrics, and Cloud Profiler identifies CPU and memory usage rather than request latency across services.
Question 77
Your organization is starting to containerize with Google Cloud. You need a fully managed storage solution for container images and Helm charts. You need to identify a storage solution that has native integration into existing Google Cloud services, including Google Kubernetes Engine (GKE), Cloud Run, VPC Service Controls, and Identity and Access Management (IAM). What should you do?
A. Use Docker to configure a Cloud Storage driver pointed at the bucket owned by your organization.
B. Configure an open source container registry server to run in GKE with a restrictive role-based access control (RBAC) configuration.
C. Configure Artifact Registry as an OCI-based container registry for both Helm charts and container images.
D. Configure Container Registry as an OCI-based container registry for container images.
Show Answer
Correct Answer: C
Explanation: Artifact Registry is Google Cloud's fully managed artifact storage service that supports OCI container images and Helm charts. It integrates natively with GKE, Cloud Run, IAM, and VPC Service Controls. Container Registry does not support Helm charts and is the older service, while the other options require self-management and lack the requested native managed integrations.
Question 78
You are monitoring a service that uses n2-standard-2 Compute Engine instances that serve large files. Users have reported that downloads are slow. Your Cloud Monitoring dashboard shows that your VMs are running at peak network throughput. You want to improve the network throughput performance. What should you do?
A. Add additional network interface controllers (NICs) to your VMs.
B. Deploy a Cloud NAT gateway and attach the gateway to the subnet of the VMs.
C. Change the machine type for your VMs to n2-standard-8.
D. Deploy the Ops Agent to export additional monitoring metrics.
Show Answer
Correct Answer: C
Explanation: Network throughput limits for Compute Engine scale with machine size (vCPU count). If the dashboard shows the VMs are already at peak network throughput, increasing the machine type (from n2-standard-2 to n2-standard-8) raises the available network bandwidth. Adding NICs does not increase the VM's total bandwidth limit, Cloud NAT does not improve throughput, and the Ops Agent only adds observability, not performance.
Question 79
You recently migrated an ecommerce application to Google Cloud. You now need to prepare the application for the upcoming peak traffic season. You want to follow Google-recommended practices. What should you do first to prepare for the busy season?
A. Migrate the application to Cloud Run, and use autoscaling.
B. Create a Terraform configuration for the application's underlying infrastructure to quickly deploy to additional regions.
C. Load test the application to profile its performance for scaling.
D. Pre-provision the additional compute power that was used last season, and expect growth.
Show Answer
Correct Answer: C
Explanation: The first recommended step is to load test the application to understand its performance characteristics under expected peak traffic, identify bottlenecks, and establish scaling behavior. This profiling informs autoscaling configuration, capacity planning, and any architectural changes. Migrating to Cloud Run (A) is unnecessary as a first step, Terraform for multi-region deployment (B) does not address performance readiness, and pre-provisioning based only on last season (D) is not a recommended first action without current performance data.
Question 80
You are deploying a Cloud Build job that deploys Terraform code when a Git branch is updated. While testing, you noticed that the job fails. You see the following error in the build logs:
Initializing the backend...
Error: Failed to get existing workspaces: querying Cloud Storage failed: googleapi: Error 403
You need to resolve the issue by following Google-recommended practices. What should you do?
A. Change the Terraform code to use local state.
B. Create a storage bucket with the name specified in the Terraform configuration.
C. Grant the roles/owner Identity and Access Management (IAM) role to the Cloud Build service account on the project.
D. Grant the roles/storage.objectAdmin Identity and Access Management (1AM) role to the Cloud Build service account on the state file bucket.
Show Answer
Correct Answer: D
Explanation: A 403 error when Terraform initializes a Google Cloud Storage backend indicates the Cloud Build service account lacks permission to access the state bucket. Following least-privilege best practices, grant the Cloud Build service account the Storage Object Admin role on the specific state bucket so Terraform can list, read, and write the state objects. Using local state is not recommended for CI/CD, creating the bucket alone does not fix authorization, and granting the broad Owner role violates least-privilege principles.
$19
Get all 208 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.