95 free Google Professional Cloud Developer practice questions from the CertStash pack of 379, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 95 free here, all 379 in the pack, and each step includes the one before it.
Get all 379 questions (US$39) · Download the first 10 as a PDF
Question 1
Your company has a BigQuery dataset named "Master" that keeps information about employee travel and expenses. This information is organized by employee department. That means employees should only be able to view information for their department. You want to apply a security framework to enforce this requirement with the minimum number of steps. What should you do?
Show answer and explanation
Correct answer: C. Create a dataset named Master dataset. Create a separate view for each department in the Master dataset. Give employees access to the specific view for their department.
Creating separate views for each department within the Master dataset is the minimum-steps approach to enforce row-level security. Views can filter records using WHERE clauses based on the user's department, and BigQuery's authorized views feature allows you to grant access at the view level rather than the underlying table. This avoids the complexity and cost of maintaining multiple datasets or data pipelines while achieving the same security objective.
Why the other options are wrong
- A. Creating multiple datasets and views adds unnecessary complexity when a single dataset with departmental views suffices.
- B. Data pipelines introduce operational overhead and redundant data storage; views provide the same access control without duplication.
- D. Separate tables per department require manual access management and don't scale well compared to view-based filtering.
Question 2
You want to upload files from an on-premises virtual machine to Google Cloud Storage as part of a data migration. These files will be consumed by Cloud DataProc Hadoop cluster in a GCP environment. Which command should you use?
Show answer and explanation
Correct answer: A. gsutil cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/
gsutil is the correct command-line tool for interacting with Google Cloud Storage. The cp command copies files, and the gs:// protocol specifies the Cloud Storage destination. This is the standard method for uploading files to GCS from on-premises systems, and the files will be accessible to Cloud Dataproc clusters.
Why the other options are wrong
- B. gcloud cp is not a valid gcloud command; gcloud does not have a direct cp subcommand for file operations.
- C. hadoop fs cp is for Hadoop distributed file systems, not for uploading to Cloud Storage from local machines.
- D. gcloud dataproc cp does not exist; Dataproc uses gsutil for Cloud Storage operations.
Question 3
You migrated your applications to Google Cloud Platform and kept your existing monitoring platform. You now find that your notification system is too slow for time critical problems. What should you do?
Show answer and explanation
Correct answer: C. Use Stackdriver to capture and alert on logs, then ship them to your existing platform.
Using Stackdriver to capture logs and alerts while shipping them to your existing monitoring platform allows you to leverage Stackdriver's faster alerting capabilities for time-critical problems without replacing your entire existing platform. This hybrid approach maintains your current infrastructure while improving notification speed.
Why the other options are wrong
- A. Replacing the entire monitoring platform is unnecessarily disruptive and doesn't preserve your existing investment.
- B. Installing Stackdriver agents alone does not solve the notification latency problem if you continue relying on the old platform for alerts.
- D. A/B testing is not a solution to slow notifications; it adds complexity without addressing the core issue.
Question 4
You have an application in production. It is deployed on Compute Engine virtual machine instances controlled by a managed instance group. Traffic is routed to the instances via a HTTP(s) load balancer. Your users are unable to access your application. You want to implement a monitoring technique to alert you when the application is unavailable. Which technique should you choose?
Show answer and explanation
Correct answer: B. Stackdriver uptime checks
Stackdriver uptime checks are specifically designed to monitor external application availability from outside Google Cloud infrastructure, simulating user access patterns and alerting when services become unavailable. While load balancer health checks and managed instance group health checks can detect instance-level failures, they operate at the infrastructure layer and may not catch application-level failures. Stackdriver uptime checks directly test the HTTP(S) endpoint from multiple global locations, providing true end-to-end availability monitoring.
Why the other options are wrong
- A. Smoke tests are manual or automated testing procedures, not continuous monitoring mechanisms.
- C. Load balancer health checks detect infrastructure issues but don't alert on application unavailability at the user-facing level.
- D. Managed instance group health checks only verify individual instance status, not overall application availability to users.
Question 5
You are load testing your server application. During the first 30 seconds, you observe that a previously inactive Cloud Storage bucket is now servicing 2000 write requests per second and 7500 read requests per second. Your application is now receiving intermittent 5xx and 429 HTTP responses from the Cloud Storage JSON API as the demand escalates. You want to decrease the failed responses from the Cloud Storage API. What should you do?
Show answer and explanation
Correct answer: D. Limit the upload rate from your application clients so that the dormant bucket's peak request rate is reached more gradually.
Cloud Storage has request rate limits per bucket, and the 5xx and 429 errors indicate rate limiting. Limiting the upload rate from client applications to reach the bucket's peak request rate more gradually allows the service to handle the load smoothly without triggering throttling. This approach respects the service's inherent capacity constraints while improving overall success rates during load testing.
Why the other options are wrong
- A. Distributing uploads across multiple buckets increases complexity and cost without addressing the fundamental rate-limiting issue.
- B. The JSON and XML APIs have equivalent rate limits; switching APIs won't resolve the throttling problem.
- C. Passing HTTP error codes back to clients doesn't reduce the actual failed requests; it merely reports the problem rather than solving it.
Question 6
Your application is controlled by a managed instance group. You want to share a large read-only data set between all the instances in the managed instance group. You want to ensure that each instance can start quickly and can access the data set via its filesystem with very low latency. You also want to minimize the total cost of the solution. What should you do?
Show answer and explanation
Correct answer: C. Move the data to a Compute Engine persistent disk, and attach the disk in read-only mode to multiple Compute Engine virtual machine instances.
Attaching a single persistent disk in read-only mode to multiple Compute Engine instances provides the lowest-latency filesystem access and minimizes cost by avoiding data duplication. All instances share one disk, reducing storage costs compared to snapshots and multiple disks. Read-only mode ensures data integrity, and filesystem-level access provides the very low latency required compared to object storage solutions.
Why the other options are wrong
- A. Cloud Storage FUSE introduces higher latency and requires network I/O compared to directly attached persistent disks.
- B. Copying data to boot disks via startup scripts duplicates the dataset across all instances, increasing total cost significantly.
- D. Creating multiple disks from snapshots duplicates the data and increases cost; read-only disk sharing is more economical.
Question 7
You are planning to migrate a MySQL database to the managed Cloud SQL database for Google Cloud. You have Compute Engine virtual machine instances that will connect with this Cloud SQL instance. You do not want to whitelist IPs for the Compute Engine instances to be able to access Cloud SQL. What should you do?
Show answer and explanation
Correct answer: A. Enable private IP for the Cloud SQL instance.
Enabling private IP for the Cloud SQL instance allows Compute Engine instances in the same VPC to connect securely without IP whitelisting. This is the recommended GCP approach for private, internal communication between managed services within a project.
Why the other options are wrong
- B. Whitelisting projects and instances is not the same as avoiding IP whitelisting; this approach still requires configuration of access controls.
- C. Cloud SQL uses database-level authentication and IAM roles, not IP-based roles tied to Compute Engine instances.
- D. Creating a VPN between projects adds unnecessary complexity when private IP within the same VPC is simpler and more efficient.
Question 8
Your website is deployed on Compute Engine. Your marketing team wants to test conversion rates between 3 different website designs. Which approach should you use?
Show answer and explanation
Correct answer: A. Deploy the website on App Engine and use traffic splitting.
App Engine supports traffic splitting, which allows you to deploy multiple versions and distribute user traffic between them to test conversion rates. This is the standard GCP feature for A/B testing and canary deployments on App Engine.
Why the other options are wrong
- B. Deploying as separate services would require manual traffic routing and does not provide built-in traffic splitting capabilities.
- C. Cloud Functions are designed for event-driven, serverless compute and do not support traffic splitting for testing.
- D. Cloud Functions as separate functions would require complex routing logic and is not suitable for website deployment or traffic splitting.
Question 9
You need to copy directory local-scripts and all of its contents from your local workstation to a Compute Engine virtual machine instance. Which command should you use?
Show answer and explanation
Correct answer: C. gcloud compute scp --project "my-gcp-project" --recurse ~/local-scripts/ gcp-instance-name:~/server-scripts/ --zone "us-east1-b"
gcloud compute scp is the correct command for copying files to Compute Engine instances. The --recurse flag copies directories and their contents. This command includes project and zone specifications, which are required for proper instance identification.
Why the other options are wrong
- A. gsutil is for Cloud Storage operations, not for copying files directly to Compute Engine instances.
- B. gsutil does not support copying to Compute Engine instances; it is only for Cloud Storage and the -R flag is also incorrect syntax for gsutil.
- D. gcloud compute mv is for moving or renaming resources within GCP, not for copying files from local workstations to instances.
Question 10
You are developing an HTTP API hosted on a Compute Engine virtual machine instance that needs to be invoked by multiple clients within the same Virtual Private Cloud (VPC). You want clients to be able to get the IP address of the service. What should you do?
Show answer and explanation
Correct answer: C. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url https://[INSTANCE_NAME].[ZONE].c. [PROJECT_ID].internal/.
For clients within the same VPC, Compute Engine's internal DNS service allows direct hostname resolution without requiring external IP addresses or load balancers. The internal DNS format [INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal enables secure, low-latency communication within the VPC without exposing the service to the public internet or incurring load balancer costs.
Why the other options are wrong
- A. Using external IP addresses and load balancing is unnecessary for internal VPC communication and adds cost.
- B. While technically functional, combining external IPs with Cloud DNS adds complexity and cost for an internal-only service.
- D. This format is not valid Compute Engine internal DNS syntax and doesn't represent actual instance addressing.
What people say about the full Professional Cloud Developer pack 5.0 from 1
Development tasks in questions were tricky, but the exam practice questions made me more familiar. I passed GCP‑Cloud Developer. The study resources were reliable and clear.
Question 11
You are writing a single-page web application with a user-interface that communicates with a third-party API for content using XMLHttpRequest. The data displayed on the UI by the API results is less critical than other data displayed on the same web page, so it is acceptable for some requests to not have the API data displayed in the UI. However, calls made to the API should not delay rendering of other parts of the user interface. You want your application to perform well when the API response is an error or a timeout. What should you do?
Show answer and explanation
Correct answer: B. Set the asynchronous option for your request to the API to true and omit the widget displaying the API results when a timeout or error is encountered.
Setting asynchronous requests to true allows the API call to run in the background without blocking the rendering of other UI elements. When an error or timeout occurs, the application should gracefully omit the API data widget, ensuring the page renders fully and responsively regardless of the API's behavior. Synchronous requests block rendering, exponential backoff delays user experience, and displaying errors doesn't solve the blocking issue.
Why the other options are wrong
- A. Synchronous requests (asynchronous=false) block the entire UI rendering until the API responds.
- C. Exponential backoff retries will still delay rendering and worsen user experience during outages.
- D. Displaying the error in the UI doesn't prevent the blocking behavior if requests are synchronous.
Question 12
You are building an API that will be used by Android and iOS apps. The API must: * Support HTTPs * Minimize bandwidth cost * Integrate easily with mobile apps Which API architecture should you use?
Show answer and explanation
Correct answer: C. gRPC-based APIs
gRPC-based APIs are the optimal choice for mobile applications because they use HTTP/2, which significantly reduces bandwidth consumption compared to REST, support HTTPS natively for security, and provide efficient binary serialization (Protocol Buffers). gRPC is specifically designed for low-bandwidth, high-performance communication between clients and servers. REST APIs require more bandwidth and overhead, MQTT is a messaging protocol not suited for request-response APIs, and SOAP is verbose and outdated.
Why the other options are wrong
- A. REST APIs use JSON/XML serialization, consuming more bandwidth than gRPC's binary Protocol Buffers format.
- B. MQTT is a publish-subscribe messaging protocol, not an RPC framework for synchronous API calls.
- D. SOAP is XML-based, verbose, and not designed for mobile-first or bandwidth-constrained environments.
Question 13
You have containerized a legacy application that stores its configuration on an NFS share. You need to deploy this application to Google Kubernetes Engine (GKE) and do not want the application serving traffic until after the configuration has been retrieved. What should you do?
Show answer and explanation
Correct answer: B. Create a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.
The correct approach is to use a PersistentVolumeClaim to mount the NFS share configuration into the GKE cluster, then access those files from the volume before starting the service. This follows Kubernetes best practices by treating configuration as persistent data separate from the container image, ensuring the application can retrieve current configuration on each deployment without rebuilding images. An ENTRYPOINT script can orchestrate waiting for configuration availability before starting the service.
Why the other options are wrong
- A. gsutil is for Cloud Storage, not NFS shares, and doesn't provide the persistent, mounted configuration pattern that Kubernetes expects.
- C. Baking configuration into the Docker image defeats the purpose of containerization and makes configuration updates require rebuilding and redeploying images.
- D. Mounting NFS at the node level creates tight coupling to infrastructure and doesn't leverage Kubernetes' abstraction layer; the configuration would not be reliably available across pod rescheduling.
Question 14
You are parsing a log file that contains three columns: a timestamp, an account number (a string), and a transaction amount (a number). You want to calculate the sum of all transaction amounts for each unique account number efficiently. Which data structure should you use?
Show answer and explanation
Correct answer: B. A hash table
A hash table provides optimal performance for this task, storing account numbers as keys and transaction sums as values. Each lookup and update operation is O(1) on average, enabling efficient aggregation of transactions by account. Linked lists and two-dimensional arrays require linear scans for lookups, resulting in poor performance. Comma-delimited strings require parsing and are unsuitable for structured data operations.
Why the other options are wrong
- A. A linked list requires O(n) traversal for each account lookup, making summation inefficient.
- C. A two-dimensional array also requires linear search through rows to find matching accounts.
- D. A comma-delimited string requires parsing and string manipulation, adding overhead and complexity.
Question 15
Your teammate has asked you to review the code below. Its purpose is to efficiently add a large number of small rows to a BigQuery table. Which improvement should you suggest your teammate make?
Show answer and explanation
Correct answer: A. Include multiple rows with each request.
The current code makes one API call per row, which is extremely inefficient for inserting large numbers of small rows. BigQuery's InsertAll API is specifically designed to accept multiple rows in a single request, dramatically reducing overhead, API call limits, and latency. Batching rows together into fewer, larger requests is the recommended best practice for bulk inserts. While parallel processing (option B) could provide some benefit, it would still suffer from the fundamental inefficiency of single-row requests multiplied across threads. Cloud Storage approaches (options C and D) are appropriate for very large bulk loads but add unnecessary complexity for moderately-sized datasets and incur additional latency from the storage layer.
Why the other options are wrong
- B. Using threads without batching rows still makes inefficient single-row API calls; the bottleneck is per-row requests, not sequential execution.
- C. Writing to Cloud Storage adds latency and complexity without addressing the core inefficiency of per-row inserts.
- D. Parallel Cloud Storage writes are unnecessarily complex and introduce storage overhead when direct batching is more efficient for small rows.
Question 16
You are writing a Compute Engine hosted application in project A that needs to securely authenticate to a Cloud Pub/Sub topic in project B. What should you do?
Show answer and explanation
Correct answer: B. Add the service account as a Cloud Pub/Sub publisher to project A. B. Configure the instances with a service account owned by project A. Add the service account as a publisher on the topic.
The correct approach is to configure Compute Engine instances in project A with a service account owned by project A. Then, grant this service account publisher permissions on the Cloud Pub/Sub topic in project B. This follows the principle of least privilege and uses service accounts as the secure authentication mechanism across projects.
Why the other options are wrong
- A. This option is incomplete and does not specify granting necessary permissions on the topic.
- C. Using a private key from project B is unnecessary and violates security best practices; service account impersonation via IAM is the proper method.
- D. While the service account from project A is correct, using private keys is not the recommended secure approach.
Question 17
Your web application is deployed to the corporate intranet. You need to migrate the web application to Google Cloud. The web application must be available only to company employees and accessible to employees as they travel. You need to ensure the security and accessibility of the web application while minimizing application changes. What should you do?
Show answer and explanation
Correct answer: B. Configure Identity-Aware Proxy to allow employees to access the application through its public IP address.
Identity-Aware Proxy (IAP) is specifically designed for this use case: it provides secure, authenticated access to applications for authorized users while minimizing application changes. IAP intercepts requests before they reach the application, performs authentication and authorization checks against corporate identity providers, and only forwards authenticated requests to the backend application. This approach is transparent to users and requires no application logic changes. Option A requires embedding authentication logic in the application, violating the minimal-changes requirement. Options C and D both require building and maintaining a proxy Compute Engine instance, adding operational complexity and not being the Google-recommended approach.
Why the other options are wrong
- A. Configuring the application itself to handle authentication requires significant application changes and doesn't follow the minimum-changes requirement.
- C. Building a custom proxy Compute Engine instance adds unnecessary operational overhead when IAP provides this functionality natively.
- D. Redirecting to a public IP after authentication on a proxy defeats the security purpose of restricting access to employees only and adds complexity.
Question 18
You want to view the memory usage of your application deployed on Compute Engine. What should you do?
Show answer and explanation
Correct answer: B. Install the Stackdriver Monitoring Agent.
The Stackdriver Monitoring Agent must be installed on Compute Engine instances to collect detailed memory usage metrics. The agent gathers OS-level metrics like memory, CPU, and disk usage which are then displayed in Cloud Monitoring. Without the agent, only basic VM metrics are available. The Metrics Explorer and GCP Console can display the data, but the agent must be installed first to collect it.
Why the other options are wrong
- A. The Stackdriver Client Library is for writing custom metrics from applications, not for collecting system memory metrics.
- C. The Metrics Explorer displays metrics but cannot collect them; the agent must be installed first to generate memory usage data.
- D. The GCP Console displays metrics but requires the agent to be installed first to collect detailed memory usage data.
Question 19
You are designing a schema for a Cloud Spanner customer database. You want to store a phone number array field in a customer table. You also want to allow users to search customers by phone number. How should you design this schema?
Show answer and explanation
Correct answer: D. Create a table named Customers as a parent table. Create a table named Phones, and interleave this table into the Customer table. Create an index on the phone number field in the Phones table.
Option D provides the optimal schema for both storing phone numbers and enabling efficient search queries. By creating a separate Phones table interleaved into the Customers parent table, you maintain referential integrity while allowing an index on the phone number field. This design enables fast lookups by phone number while avoiding the performance issues associated with searching within array fields. Interleaved tables in Cloud Spanner provide hierarchical storage that improves query performance for parent-child relationships.
Why the other options are wrong
- A. Array fields cannot be effectively indexed for search operations in Cloud Spanner.
- B. While this creates a separate table, it lacks indexing on the phone field which is needed for efficient search.
- C. Indexes on array fields are not effective for searching individual values within those arrays.
Question 20
Your application is built as a custom machine image. You have multiple unique deployments of the machine image. Each deployment is a separate managed instance group with its own template. Each deployment requires a unique set of configuration values. You want to provide these unique values to each deployment but use the same custom machine image in all deployments. You want to use out-of-the-box features of Compute Engine. What should you do?
Show answer and explanation
Correct answer: D. Place the unique configuration values in the instance template instance metadata.
Instance metadata is the built-in Compute Engine feature designed to pass unique configuration values to instances without modifying the machine image or template. Metadata can be set at the instance template level and accessed by instances at runtime via the metadata server. This approach allows the same custom image to be deployed across multiple managed instance groups while each receives unique configuration through their respective templates. Persistent disk requires manual setup for each instance. Bigtable adds unnecessary external dependencies. Startup scripts are less flexible than metadata for configuration management.
Why the other options are wrong
- A. Persistent disk requires manual configuration on each instance, defeating the purpose of managed instance groups.
- B. Cloud Bigtable adds unnecessary external dependencies when instance metadata provides this functionality natively.
- C. Startup scripts can be used but are less clean and flexible than the metadata service for configuration values.
Question 21
You are planning to deploy your application in a Google Kubernetes Engine (GKE) cluster. Your application can scale horizontally, and each instance of your application needs to have a stable network identity and its own persistent disk. Which GKE object should you use?
Show answer and explanation
Correct answer: B. StatefulSet
StatefulSet is the correct Kubernetes object for applications requiring stable network identities and persistent storage. StatefulSet maintains stable hostnames and associates each pod with a specific PersistentVolume, ensuring data persistence across pod restarts and scheduling. Deployment creates stateless replicas without persistent storage associations; ReplicaSet is a lower-level controller that Deployment uses; ReplicaController is the legacy predecessor to ReplicaSet. Only StatefulSet provides the combination of horizontal scaling with stable identity and persistent disk per instance.
Why the other options are wrong
- A. Deployment manages stateless replicas and doesn't provide stable network identity or persistent storage per instance.
- C. ReplicaSet is a lower-level controller that doesn't provide stable hostnames or persistent volume management.
- D. ReplicaController is deprecated and doesn't provide the advanced features required for stateful applications.
Question 22
You are developing a new application that has the following design requirements: • Creation and changes to the application infrastructure are versioned and auditable. • The application and deployment infrastructure uses Google-managed services as much as possible. • The application runs on a serverless compute platform. How should you design the application's architecture?
Show answer and explanation
Correct answer: A. 1. Store the application and infrastructure source code in a Git repository. 2. Use Cloud Build to deploy the application infrastructure with Terraform. 3. Deploy the application to a Cloud Function as a pipeline step.
This approach stores all infrastructure and application code in Git for versioning and auditability, uses Cloud Build (a Google-managed CI/CD service) with Terraform for infrastructure deployment, and deploys the application to Cloud Functions (a Google-managed serverless platform). This satisfies all three requirements: version control, Google-managed services, and serverless compute.
Why the other options are wrong
- B. Jenkins must be deployed and managed manually, violating the requirement to use Google-managed services as much as possible.
- C. Deployment Manager is less flexible than Terraform; more importantly, this option deploys to Compute Engine instances, which are not serverless.
- D. Using gcloud commands for infrastructure deployment doesn't provide the auditability and version control of Infrastructure as Code.
Question 23
You have an application deployed in production. When a new version is deployed, you want to ensure that all production traffic is routed to the new version of your application. You also want to keep the previous version deployed so that you can revert to it if there is an issue with the new version. Which deployment strategy should you use?
Show answer and explanation
Correct answer: A. Blue/green deployment
Blue/green deployment is the strategy that switches all production traffic to a new version while keeping the previous version fully deployed and ready. In this pattern, the blue environment runs the current production version while the green environment runs the new version. Once testing confirms the new version is working correctly, traffic is switched entirely to green. If issues arise, traffic can be immediately switched back to blue, enabling instant rollback without redeployment.
Why the other options are wrong
- B. Canary deployment gradually routes a small percentage of traffic to the new version, not routing all traffic immediately as required.
- C. Rolling deployment gradually replaces instances one at a time, not switching all traffic at once and not keeping the full previous version readily available.
- D. Recreate deployment terminates all instances of the old version before starting new instances, preventing quick rollback capability.
Question 24
You recently developed an application. You need to call the Cloud Storage API from a Compute Engine instance that doesn't have a public IP address. What should you do?
Show answer and explanation
Correct answer: D. Use Private Google Access
Private Google Access enables Compute Engine instances without public IP addresses to reach Google Cloud APIs and services, including Cloud Storage, using internal Google infrastructure. This is the direct solution for accessing Google Cloud APIs from instances without public IPs.
Why the other options are wrong
- A. Carrier Peering is for connecting with external carriers and ISPs, not for accessing Google Cloud services.
- B. VPC Network Peering connects two VPC networks but doesn't provide access to Google Cloud services for private instances.
- C. Shared VPC is for sharing networks across projects and doesn't solve the problem of private instances accessing Google Cloud APIs.
Question 25
Your company has a BigQuery data mart that provides analytics information to hundreds of employees. One user of wants to run jobs without interrupting important workloads. This user isn't concerned about the time it takes to run these jobs. You want to fulfill this request while minimizing cost to the company and the effort required on your part. What should you do?
Show answer and explanation
Correct answer: A. Ask the user to run the jobs as batch jobs.
BigQuery batch jobs are scheduled with lower priority and do not interrupt interactive workloads, running only when resources are available. This directly addresses the user's need to avoid disrupting important work while minimizing cost and administrative effort. Creating a separate project adds unnecessary complexity and cost, granting job.user role doesn't prevent interference, and manual scheduling is not scalable.
Why the other options are wrong
- B. A separate project increases costs and requires more management without solving the priority problem.
- C. The job.user role controls permissions but does not prevent jobs from competing with important workloads.
- D. Manual scheduling is cumbersome, error-prone, and adds ongoing administrative burden.
Question 26
You have written a Cloud Function that accesses other Google Cloud resources. You want to secure the environment using the principle of least privilege. What should you do?
Show answer and explanation
Correct answer: D. Create a new service account that has a custom IAM role to access the resources. The deployer is given permission to act as the new service account.
The principle of least privilege requires two components: the service account itself should have only the minimum necessary permissions (a custom IAM role, not Editor), and the deployer should have only the ability to use that account (iam.serviceAccounts.actAs permission), not to extract its credentials. This ensures the service account has restricted access to only required resources, and the deployer cannot misuse the account's credentials outside of Cloud Function execution.
Why the other options are wrong
- A. Editor role provides far more permissions than necessary, violating least privilege, and allowing token extraction enables credential exfiltration.
- B. While custom roles respect least privilege, allowing token extraction enables the deployer to use those credentials outside the intended Cloud Function context.
- C. Editor role grants excessive permissions beyond what the Cloud Function needs, violating least privilege principles.
Question 27
You have been tasked with planning the migration of your company's application from on-premises to Google Cloud. Your company's monolithic application is an ecommerce website. The application will be migrated to microservices deployed on Google Cloud in stages. The majority of your company's revenue is generated through online sales, so it is important to minimize risk during the migration. You need to prioritize features and select the first functionality to migrate. What should you do?
Show answer and explanation
Correct answer: A. Migrate the Product catalog, which has integrations to the frontend and product database.
The Product catalog is the optimal first microservice to migrate because it has the fewest dependencies and lowest risk to revenue. It integrates only with the frontend and product database, making it isolated and less likely to cascade failures. Payment processing directly impacts revenue transactions, order fulfillment affects customer satisfaction and returns, and the shopping cart is central to the revenue path; all are higher-risk choices. Starting with a lower-risk component builds confidence and processes before migrating revenue-critical functionality.
Why the other options are wrong
- B. Payment processing is directly involved in revenue generation and has multiple critical integrations, making it too risky as a first migration target.
- C. Order fulfillment affects customer satisfaction and retention and has complex dependencies with external shipping vendors, making it unsuitable for initial migration.
- D. The shopping cart is central to the revenue path and integrates with payment processing, inventory, and the database, making it a high-risk first target.
Question 28
Your code is running on Cloud Functions in project A. It is supposed to write an object in a Cloud Storage bucket owned by project B. However, the write call is failing with the error "403 Forbidden". What should you do to correct the problem?
Show answer and explanation
Correct answer: C. Grant the service-PROJECTA@gcf-admin-robot.iam.gserviceaccount.com service account the roles/storage.objectCreator role for the Cloud Storage bucket.
Cloud Functions runs under the service account service-PROJECTA@gcf-admin-robot.iam.gserviceaccount.com in project A. To allow this function to write objects to a Cloud Storage bucket in project B, that service account must be granted the roles/storage.objectCreator role for the bucket in project B. This is a cross-project permission scenario where the service account performing the action (not the user) needs the necessary permissions. Granting the user account these roles doesn't help because the function itself is the actor; the service account user role doesn't grant storage permissions; the Cloud Storage API is already enabled.
Why the other options are wrong
- A. The user account doesn't perform the write; the Cloud Function's service account does.
- B. The serviceAccountUser role allows impersonating a service account but doesn't grant storage permissions.
- D. The Cloud Storage API must already be enabled in project B for the function to interact with it at all; this doesn't address the permissions issue.
Question 29
You are using Cloud Build to build and test application source code stored in Cloud Source Repositories. The build process requires a build tool not available in the Cloud Build environment. What should you do?
Show answer and explanation
Correct answer: B. Build a custom cloud builder image and reference the image in your build steps.
Cloud Build supports custom builder images that can be created and stored in Container Registry, then referenced in build steps. This approach packages the required build tool in a Docker image, making it available during the build process in a reproducible and versioned manner. Downloading binaries from the internet during builds is unreliable and poses security risks, including the repository alongside source code creates maintenance issues, and feature requests do not solve immediate build needs.
Why the other options are wrong
- A. Downloading binaries during each build is unreliable, slow, and introduces security vulnerabilities.
- C. Storing binaries in the source repository bloats the repository and creates version management problems.
- D. Filing feature requests does not provide an immediate solution to the build process requirements.
Question 30
You have an analytics application that runs hundreds of queries on BigQuery every few minutes using BigQuery API. You want to find out how much time these queries take to execute. What should you do?
Show answer and explanation
Correct answer: D. Use Stackdriver Monitoring to plot query execution times.
Stackdriver Monitoring is the appropriate tool for plotting query execution times in BigQuery. It provides metrics and dashboards to track performance of BigQuery queries over time. Stackdriver Trace is designed for distributed tracing of API calls across services, not for tracking BigQuery query execution times specifically. Slot usage shows resource allocation but not execution time.
Why the other options are wrong
- A. Slot usage monitors resource allocation, not execution time.
- B. Stackdriver Trace is for distributed tracing of API calls, not BigQuery-specific query metrics.
- C. While Trace can show some timing information, it's not the primary tool for BigQuery query execution time monitoring; Monitoring is the dedicated solution.
Question 31
You are designing an application that will subscribe to and receive messages from a single Pub/Sub topic and insert corresponding rows into a database. Your application runs on Linux and leverages preemptible virtual machines to reduce costs. You need to create a shutdown script that will initiate a graceful shutdown. What should you do?
Show answer and explanation
Correct answer: A. Write a shutdown script that uses inter-process signals to notify the application process to disconnect from the database.
Using inter-process signals (like SIGTERM) to notify the application process is the standard Unix/Linux approach for graceful shutdown. The application can trap this signal and cleanly disconnect from the database, finish processing current messages, and shut down properly. This is the most direct, reliable, and efficient method for coordinating shutdown between the system and the application process.
Why the other options are wrong
- B. Broadcasting messages to users is not part of application shutdown logic and is impractical for automated infrastructure management on preemptible VMs.
- C. Polling a file every five minutes introduces unacceptable delay in shutdown and is unreliable; preemptible VMs may be terminated before the application polls the file.
- D. Publishing to Pub/Sub adds complexity and potential failure points; the application cannot guarantee it will process this message before preemption, defeating graceful shutdown goals.
Question 32
You are using Cloud Build to create a new Docker image on each source code commit to a Cloud Source Repositories repository. Your application is built on every commit to the master branch. You want to release specific commits made to the master branch in an automated method. What should you do?
Show answer and explanation
Correct answer: B. Create a build trigger on a Git tag pattern. Use a Git tag convention for new releases.
Creating a build trigger on a Git tag pattern allows automated releases when specific tags matching a release convention are pushed. This is the standard Git workflow for marking releases and provides automation without manual intervention. Git tags are specifically designed for marking release points and provide a clean separation between regular commits and release commits. Using a Git tag pattern is more reliable and maintainable than branch naming conventions because tags are immutable markers for specific commits.
Why the other options are wrong
- A. Manual triggering defeats the goal of automation for release builds.
- C. Git branch naming patterns are less reliable for releases; branches can be rebased or deleted. Tags are the proper Git mechanism for marking releases.
- D. Using a second repository adds unnecessary complexity and overhead when Git tags provide a simpler solution.
Question 33
You are deploying a single website on App Engine that needs to be accessible via the URL http://www.altostrat.com/. What should you do?
Show answer and explanation
Correct answer: A. Verify domain ownership with Webmaster Central. Create a DNS CNAME record to point to the App Engine canonical name ghs.googlehosted.com.
To map a custom domain to App Engine, you must first verify domain ownership through Webmaster Central (now Google Search Console), then create a DNS CNAME record pointing to ghs.googlehosted.com. The dispatch.yaml file is used for routing between multiple App Engine services, not for domain mapping. A records pointing to single IP addresses don't work for App Engine because it uses a global load balancing infrastructure without a single static IP.
Why the other options are wrong
- B. App Engine does not have a single global IP address; it uses global load balancing without static IPs.
- C. dispatch.yaml is for routing between multiple App Engine services, not for domain mapping to App Engine.
- D. dispatch.yaml cannot be used for custom domain mapping, and App Engine lacks a single global IP address.
Question 34
You are developing a JPEG image-resizing API hosted on Google Kubernetes Engine (GKE). Callers of the service will exist within the same GKE cluster. You want clients to be able to get the IP address of the service. What should you do?
Show answer and explanation
Correct answer: B. Define a GKE Service. Clients should use the service name in the URL to connect to the service.
In GKE, a Kubernetes Service provides internal DNS-based discovery for pods within the cluster. Clients should use the service name directly in the URL to connect to the service, which resolves to the cluster IP through Kubernetes' internal DNS. The Kubernetes DNS resolver automatically handles service discovery within the cluster without requiring manual IP address lookups or environment variables. Services provide a stable, load-balanced endpoint regardless of underlying pod changes.
Why the other options are wrong
- A. Cloud DNS is for external DNS resolution and is not the mechanism for internal cluster service discovery.
- C. GKE Endpoints are internal Kubernetes objects; clients do not query them directly, and environment variables are not the standard discovery method.
- D. GKE Endpoints are not exposed through Cloud DNS; Kubernetes DNS provides internal service discovery.
Question 35
You are developing a marquee stateless web application that will run on Google Cloud. The rate of the incoming user traffic is expected to be unpredictable, with no traffic on some days and large spikes on other days. You need the application to automatically scale up and down, and you need to minimize the cost associated with running the application. What should you do?
Show answer and explanation
Correct answer: A. Build the application in Python with Firestore as the database. Deploy the application to Cloud Run.
Cloud Run is purpose-built for stateless applications with unpredictable traffic patterns. It automatically scales from zero to handle spikes and back down to zero when idle, minimizing costs for variable workloads. Cloud Run charges only for actual execution time, making it ideal for applications with days of no traffic interspersed with large spikes. Firestore complements this as a serverless, auto-scaling database. This combination delivers both the required auto-scaling and cost minimization for the described use case.
Why the other options are wrong
- B. App Engine flexible environment maintains minimum running instances even with zero traffic, incurring unnecessary costs during idle periods.
- C. App Engine standard environment and CloudSQL require provisioned database capacity that cannot scale to zero, resulting in wasted costs during no-traffic days.
- D. Managed instance groups require provisioning minimum instances and do not scale to zero, keeping unnecessary resources running and increasing costs during idle periods.
Question 36
You are designing a deployment technique for your new applications on Google Cloud. As part of your deployment planning, you want to use live traffic to gather performance metrics for both new and existing applications. You need to test against the full production load prior to launch. What should you do?
Show answer and explanation
Correct answer: D. Use A/B testing with traffic mirroring during deployment
A/B testing with traffic mirroring during deployment allows you to send live production traffic to both the new and existing applications simultaneously, gathering real performance metrics under full production load without impacting users. Traffic mirroring duplicates requests to the new version while serving responses from the existing version, enabling thorough testing against production workloads before fully switching traffic. This is the only approach that explicitly allows testing against full production load while maintaining the current user experience.
Why the other options are wrong
- A. Canary deployment gradually shifts traffic to the new version but does not test the full production load against the new application simultaneously with the existing one.
- B. Blue/green deployment switches traffic between versions but does not use live traffic mirroring to gather metrics from both versions under full production load concurrently.
- C. Rolling updates deploy incrementally across instances but do not provide the mechanism to test full production load against the new version while maintaining the current version.
Question 37
You recently migrated a monolithic application to Google Cloud by breaking it down into microservices. One of the microservices is deployed using Cloud Functions. As you modernize the application, you make a change to the API of the service that is backward-incompatible. You need to support both existing callers who use the original API and new callers who use the new API. What should you do?
Show answer and explanation
Correct answer: C. Leave the original Cloud Function as-is and deploy a second Cloud Function with the new API. Use Cloud Endpoints to provide an API gateway that exposes a versioned API.
Cloud Endpoints provides an API gateway solution that allows you to expose multiple versions of an API under a single managed endpoint. You deploy the new Cloud Function with the new API alongside the original, and Cloud Endpoints routes requests to the appropriate function version based on versioning information (typically in the URL path or request header). This maintains backward compatibility for existing callers while supporting new callers on the new API, with centralized management, monitoring, and authentication.
Why the other options are wrong
- A. A load balancer cannot intelligently route requests to different functions based on API version compatibility.
- B. There is no automatic routing mechanism in Cloud Functions to distinguish between API versions or route calls to the correct function.
- D. Re-deploying a single function to support both versions requires complex versioning logic in the application code and doesn't cleanly separate concerns.
Question 38
Your operations team has asked you to create a script that lists the Cloud Bigtable, Memorystore, and Cloud SQL databases running within a project. The script should allow users to submit a filter expression to limit the results presented. How should you retrieve the data?
Show answer and explanation
Correct answer: D. Run gcloud bigtable instances list, gcloud redis instances list, and gcloud sql databases list. Use --filter flag with each command, and then display the results
Using gcloud commands with the --filter flag is the appropriate approach for querying GCP resources. Each gcloud command (bigtable instances list, redis instances list, sql databases list) supports native filtering through the --filter parameter, which applies filters at the API level before returning results. This is more efficient and the intended method for filtering GCP resources in scripts.
Why the other options are wrong
- A. Using direct API connections (HBase, Redis, MySQL) is inefficient, requires authentication to each database instance, and doesn't represent GCP database instances themselves, it queries the database contents rather than instance metadata.
- B. Using direct API connections and filtering application-side has the same fundamental issue as option A: it queries database contents rather than instance metadata.
- C. While gcloud commands work, applying filters within the application after retrieving all results is less efficient than using the native --filter flag available in gcloud commands.
Question 39
You are designing a resource-sharing policy for applications used by different teams in a Google Kubernetes Engine cluster. You need to ensure that all applications can access the resources needed to run. What should you do? (Choose two.)
Show answer and explanation
Correct answer: B, C. Create a namespace for each team, and attach resource quotas to each namespace; Create a LimitRange to specify the default compute resource requirements for each namespace.
Creating a namespace for each team with attached resource quotas ensures each team cannot exceed allocated resources. Creating a LimitRange in each namespace defines default compute resource requirements and constraints, preventing resource starvation. Together, these two mechanisms enforce fair resource allocation while ensuring all applications have necessary resources to function.
Why the other options are wrong
- A. While resource limits and requests are important, specifying them only in individual object specs doesn't prevent one team from consuming cluster resources.
- D. Kubernetes service accounts manage identity and permissions, not resource allocation, so they don't ensure resource sharing policy enforcement.
- E. Anthos Policy Controller enforces label annotations and policies but doesn't directly manage resource allocation; taints and tolerations schedule pods but don't define resource limits.
Question 40
You are deploying your application to a Compute Engine virtual machine instance with the Stackdriver Monitoring Agent installed. Your application is a unix process on the instance. You want to be alerted if the unix process has not run for at least 5 minutes. You are not able to change the application to generate metrics or logs. Which alert condition should you configure?
Show answer and explanation
Correct answer: C. Metric absence
Metric absence is the appropriate alert condition for detecting when a process stops running. Since the application cannot be modified to emit metrics or logs, you rely on the Stackdriver Monitoring Agent detecting the process and alerting when metrics from that process are absent for the specified duration (5 minutes).
Why the other options are wrong
- A. Uptime checks monitor HTTP endpoints, not whether specific Unix processes are running.
- B. Process health is not a standard Stackdriver alert condition type; the correct mechanism is metric absence.
- D. Metric threshold alerts trigger based on metric values exceeding a threshold, not on the absence of metrics from a process.
Question 41
Your company’s development teams want to use various open source operating systems in their Docker builds. When images are created in published containers in your company’s environment, you need to scan them for Common Vulnerabilities and Exposures (CVEs). The scanning process must not impact software development agility. You want to use managed services where possible. What should you do?
Show answer and explanation
Correct answer: A. Enable the Vulnerability scanning setting in the Container Registry.
Container Registry's built-in vulnerability scanning automatically scans published container images for CVEs without impacting development agility. It's a managed service requiring minimal setup that runs asynchronously on image push. Cloud Functions add latency to the build process. Disallowing open source images reduces flexibility. Cloud Monitoring is not designed for CVE detection.
Why the other options are wrong
- B. Cloud Functions triggered on check-in would slow development cycles and add latency to every commit.
- C. Restricting to commercial-only base images reduces flexibility and contradicts the requirement to use various open source OSes.
- D. Cloud Monitoring is for infrastructure metrics, not for CVE detection in container images.
Question 42
Your application takes an input from a user and publishes it to the user's contacts. This input is stored in a table in Cloud Spanner. Your application is more sensitive to latency and less sensitive to consistency. How should you perform reads from Cloud Spanner for this application?
Show answer and explanation
Correct answer: B. Perform stale reads using single-read methods.
Stale reads using single-read methods are the optimal approach for applications prioritizing latency over strong consistency. Stale reads allow the database to return slightly older data without waiting for the latest committed state, reducing latency significantly. Single-read methods are simpler and faster than transaction-based reads. Since the application is explicitly less sensitive to consistency, this read mode directly aligns with the latency requirement.
Why the other options are wrong
- A. Read-only transactions add latency overhead compared to single-read methods.
- C. Strong reads ensure consistency but incur higher latency, contrary to the latency priority.
- D. Read-write transactions are unnecessary for reads and introduce additional latency and complexity.
Question 43
You are developing a web application that will be accessible over both HTTP and HTTPS and will run on Compute Engine instances. On occasion, you will need to SSH from your remote laptop into one of the Compute Engine instances to conduct maintenance on the app. How should you configure the instances while following Google-recommended best practices?
Show answer and explanation
Correct answer: C. Configure Cloud Identity-Aware Proxy API for SSH access. Then configure the Compute Engine servers with private IP addresses behind an HTTP(s) load balancer for the application web traffic.
This solution combines two best practices: using Identity-Aware Proxy API for SSH access provides secure, auditable remote access without exposing SSH ports to the internet, and an HTTP(S) load balancer in front of private Compute Engine instances provides scalable, secure application traffic handling. IAP for SSH uses identity-based access control and integrates with Cloud Audit Logs. Private IP addresses eliminate direct internet exposure, and the load balancer handles HTTPS termination and distribution.
Why the other options are wrong
- A. TCP proxy load balancer doesn't provide the HTTPS capability needed for the web application traffic.
- B. Allowing all internet traffic and exposing unique external IPs for each instance violates security best practices and creates unnecessary attack surface.
- D. While bastion hosts are a valid approach, using IAP for SSH is the Google-recommended best practice as it eliminates the need to manage a separate bastion host and provides better audit logging.
Question 44
You configured your Compute Engine instance group to scale automatically according to overall CPU usage. However, your application's response latency increases sharply before the cluster has finished adding up instances. You want to provide a more consistent latency experience for your end users by changing the configuration of the instance group autoscaler. Which two configuration changes should you make? (Choose two.)
Show answer and explanation
Correct answer: B, D. Decrease the cool-down period for instances added to the group; Decrease the target CPU usage for the instance group autoscaler.
To reduce latency spikes before instances are added, you should decrease the cool-down period (option B) so the autoscaler can scale up faster in response to increased load, and decrease the target CPU usage (option D) so scaling begins at lower CPU thresholds, preventing the cluster from becoming overloaded before new instances arrive. A shorter cool-down period allows more frequent scaling decisions, while a lower target CPU threshold triggers scaling earlier in the load increase cycle. Together, these changes make the autoscaler more responsive and prevent the sharp latency increases caused by delayed scaling.
Why the other options are wrong
- A. Adding labels to the instance template does not affect autoscaler behavior or responsiveness.
- C. Increasing the target CPU usage would delay scaling further, making latency spikes worse, not better.
- E. Removing health checks would actually destabilize the system by allowing unhealthy instances to remain in the group.
Question 45
You have an HTTP Cloud Function that is called via POST. Each submission's request body has a flat, unnested JSON structure containing numeric and text data. After the Cloud Function completes, the collected data should be immediately available for ongoing and complex analytics by many users in parallel. How should you persist the submissions?
Show answer and explanation
Correct answer: B. Transform the POST request's JSON data, and stream it into BigQuery.
BigQuery is the optimal choice for this scenario. The requirement specifies that data must be immediately available for ongoing and complex analytics by many users in parallel. BigQuery is designed for exactly this use case: it supports concurrent analytical queries on large datasets, provides fast query performance through columnar storage, and integrates seamlessly with streaming data ingestion. Transforming and streaming POST data into BigQuery meets all requirements. Datastore (option A) is a NoSQL document database optimized for transactional workloads, not analytical queries at scale. Cloud SQL (option C) is a relational database with limited horizontal scalability for concurrent analytical queries. Cloud Storage (option D) would require additional transformation and querying tools, adding complexity and latency.
Why the other options are wrong
- A. Datastore is optimized for transactional access patterns, not for complex analytics queries across large datasets with many concurrent users.
- C. Cloud SQL has limited scalability for concurrent analytical workloads and is not designed for high-volume parallel analytics.
- D. Storing individual files in Cloud Storage requires additional ETL and querying infrastructure, adding complexity and latency not present with BigQuery's native streaming.
Question 46
Your application is logging to Stackdriver. You want to get the count of all requests on all /api/alpha/* endpoints. What should you do?
Show answer and explanation
Correct answer: A. Add a Stackdriver counter metric for path:/api/alpha/.
Stackdriver allows you to create custom metrics directly from logs using filter expressions. Adding a counter metric with a filter for path:/api/alpha/* creates a metric that automatically counts matching log entries in real time without manual processing. This provides immediate insights and enables alerting based on this metric.
Why the other options are wrong
- B. The endpoint field syntax is incorrect; path is the proper field name for matching URL patterns in Stackdriver logs.
- C. Exporting to Cloud Storage and manually counting is inefficient and introduces latency; native metrics are designed for this purpose.
- D. Exporting to Cloud Pub/Sub and counting requires additional pipeline infrastructure when Stackdriver metrics handle this natively.
Question 47
You are developing a corporate tool on Compute Engine for the finance department, which needs to authenticate users and verify that they are in the finance department. All company employees use G Suite. What should you do?
Show answer and explanation
Correct answer: A. Enable Cloud Identity-Aware Proxy on the HTTP(s) load balancer and restrict access to a Google Group containing users in the finance department. Verify the provided JSON Web Token within the application.
Cloud Identity-Aware Proxy integrates with G Suite to authenticate users and can restrict access based on Google Groups membership. This verifies users are in the finance department at the perimeter. The JSON Web Token provided by IAP contains identity information that can be verified within the application for additional authorization checks. This is the standard Google-recommended approach for G Suite-based access control.
Why the other options are wrong
- B. Client-side certificates are unnecessary when using IAP with G Suite integration and add unnecessary complexity.
- C. Cloud Armor restricts by IP address, which does not provide user-level authentication or group membership verification needed for finance department access control.
- D. Cloud Armor is designed for DDoS protection and IP-based restrictions, not user authentication; client certificates are also unnecessary with IAP.
Question 48
You developed a JavaScript web application that needs to access Google Drive's API and obtain permission from users to store files in their Google Drives. You need to select an authorization approach for your application. What should you do?
Show answer and explanation
Correct answer: D. Create an OAuth Client ID.
OAuth Client ID is the correct authorization mechanism for a web application that needs to obtain user permission to access Google Drive APIs on their behalf. OAuth allows users to grant specific permissions without sharing their credentials. API keys are for unauthenticated or simple authenticated access. SAML tokens are for enterprise single sign-on. Service accounts are for server-to-server authentication, not for delegating user permissions.
Why the other options are wrong
- A. API keys don't support user permission delegation required for accessing user Google Drives.
- B. SAML tokens are for enterprise identity federation, not for Google API authorization.
- C. Service accounts are for application-to-application authentication, not for user consent flows.
Question 49
Your company's development teams want to use Cloud Build in their projects to build and push Docker images to Container Registry. The operations team requires all Docker images to be published to a centralized, securely managed Docker registry that the operations team manages. What should you do?
Show answer and explanation
Correct answer: B. Create a separate project for the operations team that has Container Registry configured. Assign appropriate permissions to the Cloud Build service account in each developer team's project to allow access to the operation team's registry.
The correct approach creates a centralized Container Registry in the operations team's project and grants the Cloud Build service account in each development team's project the necessary permissions to push images to that central registry. This follows the principle of least privilege and leverages service accounts for secure, automatic authentication without storing credentials in repositories. Option A creates distributed registries defeating centralization; Option C exposes credentials in source repositories which is a security risk; Option D uses an unmaintained open-source solution instead of managed services.
Why the other options are wrong
- A. This creates multiple registries instead of the required centralized, securely managed registry.
- C. Storing service account keys in source code repositories is a critical security vulnerability.
- D. Running an open-source Docker Registry on Compute Engine requires manual management and lacks the security and management benefits of Container Registry.
Question 50
You want to create `fully baked` or `golden` Compute Engine images for your application. You need to bootstrap your application to connect to the appropriate database according to the environment the application is running on (test, staging, production). What should you do?
Show answer and explanation
Correct answer: D. When creating the Compute Engine instance, create a metadata item with a key of "DATABASE" and a value for the appropriate database connection string. In your application, query the metadata server for the "DATABASE" value, and use the value to connect to the appropriate database.
Using instance metadata to store environment-specific configuration like database connection strings is the standard Google Cloud pattern for golden images. The application queries the metadata server at runtime to retrieve the DATABASE metadata value, allowing a single image to be deployed across multiple environments with different database connections injected via metadata at instance creation time. This follows the principle of separating configuration from the image itself and enables dynamic environment-specific behavior.
Why the other options are wrong
- A. Embedding connection strings in the image defeats the purpose of golden images and requires building separate images per environment.
- B. Querying tags for this purpose is unconventional; tags are designed for organizational purposes, not configuration data, and lack the flexibility of metadata.
- C. Environment variables are not automatically populated from metadata; the application must explicitly query the metadata server to retrieve the value, not read it from environment variables.
Question 51
You migrated some of your applications to Google Cloud. You are using a legacy monitoring platform deployed on-premises for both on-premises and cloud-deployed applications. You discover that your notification system is responding slowly to time-critical problems in the cloud applications. What should you do?
Show answer and explanation
Correct answer: D. Use Cloud Logging and Cloud Monitoring to capture logs, monitor, and send alerts. Send them to your existing platform.
The optimal solution for a hybrid environment with a legacy on-premises monitoring platform is to use Cloud Logging and Cloud Monitoring to capture cloud application data and forward it to the existing platform. This approach maintains your current monitoring infrastructure investment, ensures consistent alerting across both environments, and integrates cloud and on-premises data in a single system. This avoids the disruption of completely replacing the monitoring platform and provides a gradual, manageable migration path. Option A requires immediate replacement of the entire monitoring platform. Option B only installs an agent without addressing the core problem of integration with the legacy system. Option C involves unnecessary A/B testing that doesn't solve the latency issue.
Why the other options are wrong
- A. Replacing the entire monitoring platform is disruptive and unnecessary when the legacy system can be enhanced with data from Cloud Monitoring.
- B. Installing the Cloud Monitoring agent alone does not address the integration with the legacy platform and the slow notification issue.
- C. A/B testing with traffic migration does not solve the notification latency problem and introduces operational complexity.
Question 52
You are running an application on App Engine that you inherited. You want to find out whether the application is using insecure binaries or is vulnerable to XSS attacks. Which service should you use?
Show answer and explanation
Correct answer: C. Cloud Security Scanner
Cloud Security Scanner is the dedicated tool for identifying security vulnerabilities in applications running on App Engine, including XSS attacks and insecure binaries. It automatically crawls web applications to detect common security issues. Stackdriver Debugger is for inspecting code state at runtime but not for vulnerability scanning. Cloud Armor protects against DDoS and application attacks at the network level. Stackdriver Error Reporting tracks application errors but doesn't scan for vulnerabilities.
Why the other options are wrong
- A. Cloud Armor is a DDoS protection and WAF service, not a vulnerability scanner.
- B. Stackdriver Debugger allows inspection of application state but doesn't scan for security vulnerabilities.
- D. Stackdriver Error Reporting tracks errors in applications but doesn't perform security vulnerability scanning.
Question 53
You recently deployed your application in Google Kubernetes Engine, and now need to release a new version of your application. You need the ability to instantly roll back to the previous version in case there are issues with the new version. Which deployment model should you use?
Show answer and explanation
Correct answer: C. Perform a blue/green deployment, and test your new application after the deployment is. complete.
Blue/green deployment maintains two identical production environments where one (blue) runs the current version and one (green) runs the new version. Traffic is switched to green after testing, allowing instant rollback by switching back to blue if issues arise. This meets the requirement for immediate rollback capability. Rolling deployments gradually replace instances and cannot instantly revert. Canary and A/B testing deployments are designed for gradual validation, not instant rollback.
Why the other options are wrong
- A. Rolling deployments gradually replace instances, making instant rollback impossible.
- B. A/B testing is for comparing versions with live traffic, not for instant rollback capability.
- D. Canary deployments gradually roll out to a subset of users, not providing instant rollback.
Question 54
You plan to make a simple HTML application available on the internet. This site keeps information about FAQs for your application. The application is static and contains images, HTML, CSS, and Javascript. You want to make this application available on the internet with as few steps as possible. What should you do?
Show answer and explanation
Correct answer: A. Upload your application to Cloud Storage.
Cloud Storage is the optimal solution for hosting static content (HTML, CSS, JavaScript, and images) with minimal configuration. It requires only uploading files and enabling static website hosting, making it the fastest path to internet availability. App Engine is unnecessary overhead for static sites, Compute Engine requires server management, and Kubernetes is far too complex for this use case.
Why the other options are wrong
- B. App Engine is designed for dynamic applications and adds unnecessary complexity for static content.
- C. Compute Engine requires instance management, OS patching, and Apache configuration, more effort than needed.
- D. Kubernetes and containerization are excessive complexity for a simple static website.
Question 55
Your App Engine standard configuration is as follows: service: production instance_class: B1 You want to limit the application to 5 instances. Which code snippet should you include in your configuration?
Show answer and explanation
Correct answer: D. basic_scaling: max_instances: 5 idle_timeout: 10m
Basic scaling is the appropriate choice for App Engine standard when you want to limit the maximum number of instances. The basic_scaling configuration uses max_instances to set the upper limit, and idle_timeout defines how long an instance can remain idle before shutting down. Manual scaling is used when you want a fixed number of instances regardless of load, while basic scaling automatically adjusts instances based on traffic but respects the max_instances limit. The max_instances parameter directly answers the requirement to limit the application to 5 instances.
Why the other options are wrong
- A. Manual scaling with a fixed instances count doesn't allow dynamic scaling and isn't the intended use case here.
- B. Manual scaling does not support max_instances; it uses a fixed instances value.
- C. Basic scaling requires max_instances rather than instances, and idle_timeout rather than min_pending_latency.
Question 56
Your data is stored in Cloud Storage buckets. Fellow developers have reported that data downloaded from Cloud Storage is resulting in slow API performance. You want to research the issue to provide details to the GCP support team. Which command should you run?
Show answer and explanation
Correct answer: B. gsutil perfdiag -o output.json gs://my-bucket
The gsutil perfdiag command is specifically designed to diagnose performance issues with Cloud Storage operations. It runs diagnostic tests and generates a detailed report that can be saved to a JSON file, making it ideal for investigating slow download performance and providing data to GCP support.
Why the other options are wrong
- A. gsutil test is not a valid command for diagnosing Cloud Storage performance issues.
- C. gcloud compute scp is used for transferring files to/from Compute Engine instances, not for diagnosing Cloud Storage performance.
- D. gcloud services test is not a valid command for diagnosing Cloud Storage performance.
Question 57
You are building a new API. You want to minimize the cost of storing and reduce the latency of serving images. Which architecture should you use?
Show answer and explanation
Correct answer: D. Cloud Content Delivery Network (CDN) backed by Cloud Storage
Cloud CDN backed by Cloud Storage provides both minimal storage costs and reduced latency for serving images globally. Cloud CDN caches content at edge locations worldwide, dramatically reducing latency for end users, while Cloud Storage provides cost-effective object storage. This combination is Google's recommended approach for distributing images at scale. App Engine and Compute Engine both require compute resources that increase costs, and Transfer Appliance is for data migration, not ongoing image serving.
Why the other options are wrong
- A. App Engine requires ongoing compute resources and doesn't provide the latency benefits of a global CDN.
- B. Compute Engine with Persistent Disk requires managing VM instances and doesn't provide CDN caching benefits.
- C. Transfer Appliance is designed for one-time data migration, not for serving images to end users.
Question 58
You work for a web development team at a small startup. Your team is developing a Node.js application using Google Cloud services, including Cloud Storage and Cloud Build. The team uses a Git repository for version control. Your manager calls you over the weekend and instructs you to make an emergency update to one of the company's websites, and you're the only developer available. You need to access Google Cloud to make the update, but you don't have your work laptop. You are not allowed to store source code locally on a non-corporate computer. How should you set up your developer environment?
Show answer and explanation
Correct answer: C. Use Cloud Shell and the built-in code editor for development. Send your source code updates as pull requests.
Cloud Shell provides a secure, browser-based development environment that allows you to access Google Cloud resources without storing source code locally on a non-corporate computer. The built-in code editor enables direct development, and pull requests can be submitted through the integrated Git workflow. This satisfies the requirement of not storing code locally while enabling emergency updates from any available computer.
Why the other options are wrong
- A. Using a public computer directly violates security best practices and allows source code to be stored on non-corporate hardware.
- B. Even with a virtual machine on a public computer, the source code would still be stored on non-corporate infrastructure, violating the constraint.
- D. Mounting Cloud Storage as a drive and editing files locally stores code on the public computer, and using it as a Git repository backend is an improper use of Cloud Storage.
Question 59
You are developing an application that will allow users to read and post comments on news articles. You want to configure your application to store and display user-submitted comments using Firestore. How should you design the schema to support an unknown number of comments and articles?
Show answer and explanation
Correct answer: A. Store each comment in a subcollection of the article.
Subcollections are the optimal way to store an unknown number of comments for each article in Firestore. This design scales efficiently, avoids Firestore's document size limits (1 MB), and allows querying comments independently without loading the entire article document. Subcollections are purpose-built for one-to-many relationships with unbounded child documents.
Why the other options are wrong
- B. Arrays have a practical size limit and performance degrades as array size grows; unsuitable for unknown comment counts.
- C. Storing comment keys in an array still limits scalability and requires fetching each comment separately after reading the article.
- D. Storing comment keys on user profiles doesn't establish the relationship between comments and articles, making it impossible to retrieve all comments for an article efficiently.
Question 60
Your application is deployed in a Google Kubernetes Engine (GKE) cluster. You want to expose this application publicly behind a Cloud Load Balancing HTTP(S) load balancer. What should you do?
Show answer and explanation
Correct answer: A. Configure a GKE Ingress resource.
To expose a GKE application publicly behind a Cloud Load Balancing HTTP(S) load balancer, you should configure a GKE Ingress resource. An Ingress resource in GKE automatically creates and manages a Google Cloud HTTP(S) Load Balancer, providing Layer 7 load balancing with features like URL-based routing and SSL termination. While a Service with type LoadBalancer creates a Network Load Balancer (Layer 4), an Ingress resource specifically provisions the Cloud Load Balancing HTTP(S) load balancer that the question requires. Ingress is the standard Kubernetes way to expose applications at Layer 7.
Why the other options are wrong
- B. A bare Service resource without LoadBalancer type does not expose the application publicly.
- C. Ingress does not have a type: LoadBalancer parameter; type is a Service attribute.
- D. A LoadBalancer Service creates a Network Load Balancer, not the Cloud Load Balancing HTTP(S) load balancer requested.
Question 61
Your security team is auditing all deployed applications running in Google Kubernetes Engine. After completing the audit, your team discovers that some of the applications send traffic within the cluster in clear text. You need to ensure that all application traffic is encrypted as quickly as possible while minimizing changes to your applications and maintaining support from Google. What should you do?
Show answer and explanation
Correct answer: B. Install Istio, enable proxy injection on your application namespace, and then enable mTLS.
Istio with mutual TLS (mTLS) enabled is the Google-recommended solution for encrypting traffic between applications in a Kubernetes cluster with minimal application changes. Istio uses sidecar proxies that transparently encrypt traffic between pods without requiring application code modifications. Enabling proxy injection on the application namespace and activating mTLS achieves encryption quickly and transparently. Network Policies (option A) control traffic flow but do not encrypt it. Trusted Network ranges (option C) do not provide encryption. Let's Encrypt certificates (option D) require application changes and significant operational overhead. Istio is purpose-built for service mesh security in Kubernetes and is fully supported by Google.
Why the other options are wrong
- A. Network Policies control which traffic is allowed but do not encrypt traffic, failing to meet the encryption requirement.
- C. Configuring trusted networks restricts traffic flow but provides no encryption capability.
- D. Using Let's Encrypt requires embedding certificate management in applications and modifying application code, contradicting the minimal-changes requirement.
Question 62
You are evaluating developer tools to help drive Google Kubernetes Engine adoption and integration with your development environment, which includes VS Code and IntelliJ. What should you do?
Show answer and explanation
Correct answer: A. Use Cloud Code to develop applications.
Cloud Code is the purpose-built Google Cloud developer tool that integrates directly with VS Code and IntelliJ, providing Kubernetes-aware development features including debugging, testing, and deployment capabilities. It accelerates GKE adoption by bringing cloud-native development directly into developers' existing IDEs with intelligent support for containers and Kubernetes manifests.
Why the other options are wrong
- B. Cloud Shell's integrated editor is a web-based fallback tool, not designed for primary development in VS Code or IntelliJ.
- C. Cloud Notebooks are for data science workflows and model deployment, not for Kubernetes application development.
- D. Cloud Shell is a command-line tool for infrastructure management, not an IDE integration for application development in VS Code or IntelliJ.
Question 63
You have two tables in an ANSI-SQL compliant database with identical columns that you need to quickly combine into a single table, removing duplicate rows from the result set. What should you do?
Show answer and explanation
Correct answer: C. Use the UNION operator in SQL to combine the tables.
The UNION operator combines two result sets and automatically removes duplicate rows, which is exactly what is required. UNION performs implicit deduplication by comparing entire rows across both tables.
Why the other options are wrong
- A. JOIN combines tables based on a join condition, merging columns rather than appending rows, and does not remove duplicates by default.
- B. Nested WITH statements create temporary named result sets but do not by themselves combine tables or remove duplicates.
- D. UNION ALL combines tables but keeps all duplicates; it does not remove them as required.
Question 64
You have an application controlled by a managed instance group. When you deploy a new version of the application, costs should be minimized and the number of instances should not increase. You want to ensure that, when each new instance is created, the deployment only continues if the new instance is healthy. What should you do?
Show answer and explanation
Correct answer: B. Perform a rolling-action with maxSurge set to 0, maxUnavailable set to 1
A rolling update with maxSurge set to 0 and maxUnavailable set to 1 ensures that the number of instances never exceeds the current count (no surge) while one instance at a time is replaced. This means one instance is taken down for replacement, and deployment only continues once the new instance is healthy and running. This approach minimizes costs by not temporarily increasing instance count and ensures each new instance is verified as healthy before proceeding. The maxUnavailable parameter controls how many instances can be offline during the update.
Why the other options are wrong
- A. maxSurge set to 1 would temporarily increase the instance count, increasing costs contrary to the requirement.
- C. maxHealthy and maxUnhealthy are not valid parameters for rolling-action operations.
- D. maxHealthy and maxUnhealthy are not valid parameters for rolling-action operations in managed instance groups.
Question 65
Your company has created an application that uploads a report to a Cloud Storage bucket. When the report is uploaded to the bucket, you want to publish a message to a Cloud Pub/Sub topic. You want to implement a solution that will take a small amount to effort to implement. What should you do?
Show answer and explanation
Correct answer: A. Configure the Cloud Storage bucket to trigger Cloud Pub/Sub notifications when objects are modified.
Cloud Storage has built-in Pub/Sub notifications that publish a message to a topic whenever an object is created or changed. It is enabled with a single configuration command and needs no code, making it the lowest-effort solution.
Why the other options are wrong
- B. Building an App Engine application to receive files and publish messages requires far more code and effort than the native notification feature.
- C. A Cloud Function works but means writing and deploying code, which is more effort than enabling native Pub/Sub notifications.
- D. A GKE application requires a cluster and custom code, adding significant effort and operational overhead.
Question 66
You are using Cloud Build for your CI/CD pipeline to complete several tasks, including copying certain files to Compute Engine virtual machines. Your pipeline requires a flat file that is generated in one builder in the pipeline to be accessible by subsequent builders in the same pipeline. How should you store the file so that all the builders in the pipeline can access it?
Show answer and explanation
Correct answer: B. Output the file contents to a file in /workspace. Read from the same /workspace file in the subsequent build step.
The /workspace directory in Cloud Build is the standard shared workspace accessible across all build steps in a pipeline. Files written to /workspace by one builder are automatically available to subsequent builders, making this the simplest and most efficient approach. Instance metadata is for VM configuration. Cloud Storage adds latency and complexity. External web servers introduce unnecessary dependencies.
Why the other options are wrong
- A. Instance metadata is for configuration values, not for sharing build artifacts between steps.
- C. Using Cloud Storage adds unnecessary latency and complexity when /workspace provides direct file sharing.
- D. Using HTTP to communicate with an external server introduces network latency and unnecessary complexity.
Question 67
You are creating a web application that runs in a Compute Engine instance and writes a file to any user's Google Drive. You need to configure the application to authenticate to the Google Drive API. What should you do?
Show answer and explanation
Correct answer: A. Use an OAuth Client ID that uses the https://www.googleapis.com/auth/drive.file scope to obtain an access token for each user.
OAuth Client ID with the drive.file scope is the correct approach for user-facing applications where each user's data must be accessed on their behalf. The OAuth flow requests explicit user consent, and the scope restricts access to only the files the application creates. Service accounts represent applications, not individual users, making them unsuitable for per-user file access. Delegated domain-wide authority is for admin-level access within organizational domains.
Why the other options are wrong
- B. Delegated domain-wide authority is for admins managing organizational resources, not user personal files.
- C. App Engine service accounts represent the application itself, not individual users accessing their own Drive.
- D. Service accounts with delegated authority still do not work for user personal Google Drive access.
Question 68
Your teammate has asked you to review the code below, which is adding a credit to an account balance in Cloud Datastore. Which improvement should you suggest your teammate make?
Show answer and explanation
Correct answer: B. Get and put the entity in a transaction.
The code has a race condition vulnerability: it retrieves an account entity, modifies its balance, and writes it back without transactional protection. Between the get and put operations, another process could modify the same account, causing lost updates. Wrapping the get and put in a transaction ensures atomic execution, preventing concurrent modification issues and maintaining data consistency for financial operations.
Why the other options are wrong
- A. Ancestor queries improve query efficiency and consistency but do not address the fundamental race condition between the get and put operations in this credit function.
- C. Cloud Datastore is already strongly consistent for ancestor queries and transactions; this is not the core issue and would not solve the concurrent modification problem.
- D. Returning the account entity is appropriate for the caller to verify the operation succeeded; this is not the improvement needed.
Question 69
Your team develops services that run on Google Cloud. You need to build a data processing service and will use Cloud Functions. The data to be processed by the function is sensitive. You need to ensure that invocations can only happen from authorized services and follow Google-recommended best practices for securing functions. What should you do?
Show answer and explanation
Correct answer: C. Create a service account with the Cloud Functions Invoker role. Use that service account to invoke the function.
The Cloud Functions Invoker role is the Google-recommended minimal permission required to invoke a Cloud Function. By creating a service account with this specific role and using it to invoke the function, you follow the principle of least privilege and ensure only authorized services can invoke the function. This is the standard, best-practice approach for securing Cloud Functions invocations. Option A uses IAP, which is for HTTP-accessible resources but is not the primary mechanism for service-to-service authorization. Option B grants Viewer permissions, which do not allow invocation. Option D uses OAuth 2.0 client credentials, which is not the recommended approach for service-to-service authentication in GCP.
Why the other options are wrong
- A. Identity-Aware Proxy is primarily for protecting HTTP endpoints accessed by users, not for authorizing service-to-service invocations.
- B. The Cloud Functions Viewer role only permits reading function metadata, not invoking functions.
- D. OAuth 2.0 client credentials are not the recommended method for securing Cloud Functions; service account-based authorization is the GCP best practice.
Question 70
Your development team has been asked to refactor an existing monolithic application into a set of composable microservices. Which design aspects should you implement for the new application? (Choose two.)
Show answer and explanation
Correct answer: B, E. Create an API contract agreement between the microservice implementation and microservice caller; Implement a versioning scheme to permit future changes that could be incompatible with the current interface.
An API contract agreement establishes clear expectations between microservices and their callers, ensuring decoupled development and preventing breaking changes. A versioning scheme permits future interface changes while maintaining backward compatibility, allowing microservices to evolve independently without forcing all consumers to update simultaneously. These are foundational microservices principles that enable loose coupling and independent deployment cycles.
Why the other options are wrong
- A. Requiring the same programming language eliminates the polyglot benefit of microservices and prevents technology choices based on problem domain.
- C. Requiring asynchronous communication between all services is overly restrictive; synchronous communication is often appropriate and forcing asynchronous patterns adds unnecessary complexity.
- D. While capacity planning is important, it's an operational concern separate from core design aspects and doesn't address architectural decoupling principles.
Question 71
You are developing an internal application that will allow employees to organize community events within your company. You deployed your application on a single Compute Engine instance. Your company uses Google Workspace (formerly G Suite), and you need to ensure that the company employees can authenticate to the application from anywhere. What should you do?
Show answer and explanation
Correct answer: B. Add an HTTP(S) load balancer in front of the instance, and set up Identity-Aware Proxy (IAP). Configure the IAP settings to allow your company domain to access the website.
Identity-Aware Proxy (IAP) is the Google Cloud solution for providing secure access to applications using Google Workspace authentication. IAP sits in front of your application, intercepts requests, and validates user identity against Google Workspace before allowing access. This provides strong authentication with domain-based access control without requiring a VPN or exposing the instance directly to the internet. The load balancer ensures the application is highly available and can handle traffic from anywhere, while IAP restricts access to only authenticated Google Workspace users from your company domain.
Why the other options are wrong
- A. Restricting by proxy IP address is inflexible and doesn't provide user-level authentication or authorization.
- C. VPN tunneling is unnecessarily complex for remote employee access and doesn't leverage Google Workspace integration.
- D. Relying on a secret hash URL is insecure and doesn't provide proper authentication or audit trails.
Question 72
You are porting an existing Apache/MySQL/PHP application stack from a single machine to Google Kubernetes Engine. You need to determine how to containerize the application. Your approach should follow Google-recommended best practices for availability. What should you do?
Show answer and explanation
Correct answer: A. Package each component in a separate container. Implement readiness and liveness probes.
Packaging each component in a separate container with readiness and liveness probes follows Google-recommended best practices for Kubernetes and ensures high availability. Separate containers allow independent scaling, updates, and failure isolation for Apache, MySQL, and PHP components. Readiness probes ensure traffic only reaches containers ready to serve requests, while liveness probes detect and restart failed containers, enabling the orchestration platform to maintain availability automatically.
Why the other options are wrong
- B. A single container with a process management tool contradicts Kubernetes principles of container granularity and prevents the platform from managing component lifecycle independently.
- C. Using a script to orchestrate component launches creates a monolithic container that defeats Kubernetes orchestration benefits and complicates troubleshooting.
- D. A single container with bash spawning background jobs prevents Kubernetes from detecting component failures, monitoring individual components, or restarting failed services.
Question 73
You want to re-architect a monolithic application so that it follows a microservices model. You want to accomplish this efficiently while minimizing the impact of this change to the business. Which approach should you take?
Show answer and explanation
Correct answer: B. Replace the application's features with appropriate microservices in phases.
Replacing application features with appropriate microservices in phases (strangler fig pattern) minimizes business disruption while allowing incremental validation. This approach reduces risk compared to a complete refactor, maintains service availability throughout the transition, and allows the organization to learn and adapt as it progresses rather than committing to a monolithic rewrite.
Why the other options are wrong
- A. Deploying to Compute Engine with autoscaling addresses scaling but doesn't address the monolithic architecture problem.
- C. Single-effort complete refactoring carries high risk, may introduce significant downtime, and provides no gradual validation.
- D. Building a parallel application increases complexity and delays delivery; it doesn't leverage existing infrastructure or data.
Question 74
You want to notify on-call engineers about a service degradation in production while minimizing development time. What should you do?
Show answer and explanation
Correct answer: D. Use Stackdriver Monitoring to monitor resources and raise alerts.
Stackdriver Monitoring is purpose-built for monitoring resources, tracking metrics, and triggering alerts based on defined thresholds. It integrates directly with notification channels to alert on-call engineers about service degradation. Cloud Functions require custom code development, Cloud Pub/Sub is a messaging service not a monitoring tool, and Error Reporting handles application errors rather than resource degradation.
Why the other options are wrong
- A. Cloud Functions require custom development code and are not purpose-built for monitoring.
- B. Cloud Pub/Sub is a message queue, not a monitoring or alerting system.
- C. Error Reporting tracks application errors, not resource degradation or general service health.
Question 75
You are building a CI/CD pipeline that consists of a version control system, Cloud Build, and Container Registry. Each time a new tag is pushed to the repository, a Cloud Build job is triggered, which runs unit tests on the new code builds a new Docker container image, and pushes it into Container Registry. The last step of your pipeline should deploy the new container to your production Google Kubernetes Engine (GKE) cluster. You need to select a tool and deployment strategy that meets the following requirements: • Zero downtime is incurred • Testing is fully automated • Allows for testing before being rolled out to users • Can quickly rollback if needed What should you do?
Show answer and explanation
Correct answer: B. Trigger a Spinnaker pipeline configured as a canary test of your new code and, if it is successful, deploy the container to production.
Spinnaker configured for canary deployments meets all requirements: it enables automated testing before full production rollout, supports zero-downtime deployments by gradually shifting traffic to the new version, allows monitoring and validation before completion, and provides quick rollback capabilities if issues are detected. Canary testing is the optimal choice when you need to validate new code in production conditions with minimal risk exposure.
Why the other options are wrong
- A. A/B testing is designed for comparing user experiences between variants, not for safe staged rollouts with automated validation and quick rollback.
- C. Using Cloud Build with kubectl commands lacks the sophisticated deployment orchestration, traffic management, and automated rollback capabilities that Spinnaker provides.
- D. Shadow testing routes traffic to new versions without affecting users, but doesn't validate the deployment before shifting real traffic and doesn't support the canary strategy requested.
Question 76
You have a mixture of packaged and internally developed applications hosted on a Compute Engine instance that is running Linux. These applications write log records as text in local files. You want the logs to be written to Cloud Logging. What should you do?
Show answer and explanation
Correct answer: B. Install a Google version of fluentd on the Compute Engine instance.
Google provides a specialized version of fluentd that natively integrates with Cloud Logging. The Ops Agent (formerly the Stackdriver logging agent, based on fluentd) is the standard Google Cloud solution for collecting logs from Compute Engine instances and forwarding them to Cloud Logging. It handles local file log collection and streaming to Cloud Logging with minimal configuration, making it ideal for consolidating logs from multiple applications into Cloud Logging.
Why the other options are wrong
- A. Piping to syslog doesn't automatically forward logs to Cloud Logging; additional configuration would be needed.
- C. collectd is designed for metrics collection, not log aggregation and forwarding to Cloud Logging.
- D. Copying files to Cloud Storage once daily is not a real-time logging solution and doesn't integrate with Cloud Logging for centralized log management.
Question 77
You need to redesign the ingestion of audit events from your authentication service to allow it to handle a large increase in traffic. Currently, the audit service and the authentication system run in the same Compute Engine virtual machine. You plan to use the following Google Cloud tools in the new architecture: • Multiple Compute Engine machines, each running an instance of the authentication service • Multiple Compute Engine machines, each running an instance of the audit service • Pub/Sub to send the events from the authentication services. How should you set up the topics and subscriptions to ensure that the system can handle a large volume of messages and can scale efficiently?
Show answer and explanation
Correct answer: A. Create one Pub/Sub topic. Create one pull subscription to allow the audit services to share the messages.
Creating one Pub/Sub topic with one pull subscription enables all audit service instances to share messages from the queue efficiently. In pull subscriptions, multiple subscribers can consume from the same subscription, with Pub/Sub distributing messages among them. This provides natural load balancing and scaling: as audit service instances increase, they automatically share the incoming message load. A single topic-subscription pair is simpler, more cost-effective, and scales horizontally as you add more audit service instances without requiring topology changes.
Why the other options are wrong
- B. One subscription per audit service instance prevents load sharing and requires manual topology management as instances scale up or down.
- C. Push subscriptions require configuring endpoints and are less suitable for dynamic scaling than pull subscriptions, which audit services can scale independently.
- D. Multiple topics per authentication service and per-topic subscriptions create unnecessary complexity and fail to properly decouple the authentication and audit services.
- E. Multiple topics with push subscriptions to individual audit services creates tight coupling, prevents load balancing, and requires manual configuration changes when audit services scale.
Question 78
You are developing a microservice-based application that will be deployed on a Google Kubernetes Engine cluster. The application needs to read and write to a Spanner database. You want to follow security best practices while minimizing code changes. How should you configure your application to retrieve Spanner credentials?
Show answer and explanation
Correct answer: A. Configure the appropriate service accounts, and use Workload Identity to run the pods.
Workload Identity is Google Cloud's recommended best practice for securing pod-to-Google Cloud service credentials in GKE. It allows pods to use Kubernetes Service Accounts that are mapped to Google Cloud Service Accounts, enabling automatic credential injection without storing sensitive credentials in the cluster. This minimizes code changes (the application uses standard Google Cloud client libraries) and provides strong security through identity-based access control without secrets management complexity.
Why the other options are wrong
- B. Storing credentials as Kubernetes Secrets requires manual secret management and rotation, and exposes credentials in the cluster where they could be compromised.
- C. VPC-native clusters enable network connectivity but don't solve the credential retrieval problem; credentials must still be obtained securely.
- D. Using Cloud KMS for credential retrieval is more complex than necessary and requires additional code changes to decrypt credentials on every connection.
Question 79
You are developing an ecommerce web application that uses App Engine standard environment and Memorystore for Redis. When a user logs into the app, the application caches the user's information (e.g., session, name, address, preferences), which is stored for quick retrieval during checkout. While testing your application in a browser, you get a 502 Bad Gateway error. You have determined that the application is not connecting to Memorystore. What is the reason for this error?
Show answer and explanation
Correct answer: B. You configured your Serverless VPC Access connector in a different region than your App Engine instance.
App Engine standard environment cannot directly access resources in a VPC. A Serverless VPC Access connector is required to bridge this gap. The connector must be in the same region as the App Engine instance to function properly. If the connector is in a different region, the connection will fail, resulting in a 502 Bad Gateway error. Memorystore instances have private IP addresses by design (option A is incorrect), and firewall rules are not the issue here since the connector itself wouldn't be able to reach the resource (option C). The availability zone difference within a subnet (option D) is less critical than the region mismatch.
Why the other options are wrong
- A. Memorystore instances are designed to have only private IP addresses; this is standard and not the cause of the connectivity failure.
- C. While firewall rules are important, the primary issue with cross-region connector deployment would prevent connection establishment before firewall evaluation.
- D. Availability zone differences within the same region and subnet are not a blocking factor for Serverless VPC Access connectivity.
Question 80
Your team develops services that run on Google Kubernetes Engine. Your team's code is stored in Cloud Source Repositories. You need to quickly identify bugs in the code before it is deployed to production. You want to invest in automation to improve developer feedback and make the process as efficient as possible. What should you do?
Show answer and explanation
Correct answer: B. Use Cloud Build to automate building container images from code based on Git tags.
Cloud Build is the appropriate tool for automating container image builds directly from source code in Cloud Source Repositories based on Git events. It integrates natively with GKE and provides quick feedback to developers about build failures and code issues before deployment. This automation improves developer feedback cycles and catches bugs early in the development process, which is the stated goal.
Why the other options are wrong
- A. Spinnaker is a deployment automation tool, not a build tool, and doesn't help identify bugs in code before deployment.
- C. Spinnaker is for production deployment orchestration, not for identifying bugs before they reach production.
- D. Cloud Build based on forked versions doesn't provide the continuous feedback mechanism needed for efficient bug detection in the main development workflow.
Question 81
Your application is running on Compute Engine and is showing sustained failures for a small number of requests. You have narrowed the cause down to a single Compute Engine instance, but the instance is unresponsive to SSH. What should you do next?
Show answer and explanation
Correct answer: B. Enable and check the serial port output.
When a Compute Engine instance is unresponsive to SSH, the next diagnostic step is to enable and check the serial port output. Serial port output provides system logs and boot messages that reveal what is happening on the instance without requiring an active SSH connection. This helps identify kernel panics, boot failures, or other system-level issues causing the unresponsiveness. Once you understand the problem from the logs, you can take appropriate corrective action. Simply rebooting without diagnosis may not resolve underlying issues, and deleting or snapshotting should only occur after proper investigation.
Why the other options are wrong
- A. Rebooting without first diagnosing the problem may not fix underlying issues and could lose important state information.
- C. Deleting the instance is premature when diagnostic tools are available and the issue may be recoverable.
- D. Taking a snapshot before understanding the problem wastes time and resources when serial logs can reveal the issue immediately.
Question 82
You are using Cloud Build to build a Docker image. You need to modify the build to execute unit and run integration tests. When there is a failure, you want the build history to clearly display the stage at which the build failed. What should you do?
Show answer and explanation
Correct answer: D. Create a Cloud Build build config file with separate cloud builder steps to compile and execute unit and integration tests.
A Cloud Build configuration file with separate builder steps for unit and integration tests provides clear stage-by-stage failure visibility in the build history. Each step executes independently and reports its own status, allowing the build history to show exactly which stage failed. Adding RUN commands in the Dockerfile embeds tests in the image build process without clear reporting; a single build step combines all tests making it impossible to identify which test stage failed; spawning a separate pipeline obscures the relationship between stages and complicates the build history view.
Why the other options are wrong
- A. Adding tests to the Dockerfile doesn't provide stage-level failure reporting in the build history.
- B. A single build step combines unit and integration tests, preventing clear identification of which stage failed.
- C. Spawning a separate pipeline complicates the build history and doesn't clearly display the failure stage in a single cohesive view.
Question 83
Your team is developing an application in Google Cloud that executes with user identities maintained by Cloud Identity. Each of your application's users will have an associated Pub/Sub topic to which messages are published, and a Pub/Sub subscription where the same user will retrieve published messages. You need to ensure that only authorized users can publish and subscribe to their own specific Pub/Sub topic and subscription. What should you do?
Show answer and explanation
Correct answer: A. Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level.
The requirement is to ensure each user can only publish and subscribe to their own specific topic and subscription. This requires fine-grained, resource-level access control. Option A correctly specifies binding user identities to pubsub.publisher and pubsub.subscriber roles at the resource level, which allows granting permissions specific to each user's individual topic and subscription. This ensures users cannot access other users' topics or subscriptions. Project-level role grants (Option B) would give all users access to all topics and subscriptions in the project, violating the isolation requirement. Creating permissions (Option C) doesn't grant publish/subscribe access. Using a service account (Option D) would lose user identity isolation and prevent individual user access control.
Why the other options are wrong
- B. Project-level role assignment grants the same permissions to all users for all topics and subscriptions, failing to isolate access to each user's own resources.
- C. The ability to create topics and subscriptions does not grant publish and subscribe permissions to existing resources, and doesn't enforce per-user access restrictions.
- D. Running as a shared service account eliminates individual user identity tracking and prevents per-user access control to separate topics and subscriptions.
Question 84
You are developing an application that will be launched on Compute Engine instances into multiple distinct projects, each corresponding to the environments in your software development process (development, QA, staging, and production). The instances in each project have the same application code but a different configuration. During deployment, each instance should receive the application's configuration based on the environment it serves. You want to minimize the number of steps to configure this flow. What should you do?
Show answer and explanation
Correct answer: B. In each project, configure a metadata key "environment" whose value is the environment it serves. Use your deployment tool to query the instance metadata and configure the application based on the "environment" value.
Each environment already lives in its own project, so setting an "environment" key once in project-wide metadata makes it available to every instance in that project automatically. The deployment tool reads the value from the metadata server and applies the matching configuration. This takes one step per project instead of one per instance launch.
Why the other options are wrong
- A. Deriving the environment from the project name in a startup script relies on naming conventions and adds scripting work.
- C. Running a deployment tool in every project and pulling configuration files adds infrastructure and steps rather than minimising them.
- D. Setting custom metadata on every instance at each launch is repetitive, when project metadata achieves the same with a single setting.
Question 85
You support an application that uses the Cloud Storage API. You review the logs and discover multiple HTTP 503 Service Unavailable error responses from the API. Your application logs the error and does not take any further action. You want to implement Google-recommended retry logic to improve success rates. Which approach should you take?
Show answer and explanation
Correct answer: C. Retry each failure at increasing time intervals up to a maximum number of tries.
Implementing exponential backoff retry logic, retrying each failure at increasing time intervals up to a maximum number of tries, is Google's recommended approach for handling transient failures like HTTP 503 errors. This strategy prevents overwhelming a temporarily unavailable service by spacing out retry attempts with exponentially longer delays, giving the service time to recover. This is the standard pattern for resilient cloud applications dealing with service unavailability.
Why the other options are wrong
- A. Batching failures and retrying them together does not follow Google-recommended practices and delays recovery unnecessarily.
- B. Fixed time intervals do not account for service recovery time and can result in repeated failures against a service that needs exponentially more time to recover.
- D. Decreasing time intervals would increase load on an already struggling service, worsening the problem rather than solving it.
Question 86
You need to migrate an internal file upload API with an enforced 500-MB file size limit to App Engine. What should you do?
Show answer and explanation
Correct answer: C. Use signed URLs to upload files.
Signed URLs allow direct uploads to Cloud Storage from client applications, bypassing the App Engine instance and its 500-MB request size limit. This approach enables the API to accept larger files by directing uploads directly to Cloud Storage while maintaining security through time-limited, signed credentials. FTP and CPanel are not Google Cloud services, and converting to multipart upload does not solve the fundamental 500-MB constraint imposed by App Engine's request handling.
Why the other options are wrong
- A. FTP is not a supported mechanism for uploading to Google Cloud services.
- B. CPanel is not a Google Cloud service and is not applicable to App Engine deployments.
- D. Multipart upload is a protocol enhancement but does not circumvent App Engine's 500-MB request limit.
Question 87
You are using Cloud Build build to promote a Docker image to Development, Test, and Production environments. You need to ensure that the same Docker image is deployed to each of these environments. How should you identify the Docker image in your build?
Show answer and explanation
Correct answer: C. Use the digest of the Docker image.
Docker image digests (SHA256 hashes) provide immutable, content-addressable identification of a specific image. Unlike tags which can be reassigned, digests guarantee the exact same image is deployed across all environments. This ensures consistency and prevents accidental deployment of different images due to tag reuse or updates.
Why the other options are wrong
- A. The latest tag can change and does not guarantee the same image across environments.
- B. A unique name alone does not prevent tag reassignment to different images.
- D. Semantic version tags can be updated and reassigned, potentially deploying different images to different environments.
Question 88
You need to deploy a new European version of a website hosted on Google Kubernetes Engine. The current and new websites must be accessed via the same HTTP(S) load balancer's external IP address, but have different domain names. What should you do?
Show answer and explanation
Correct answer: B. Modify the existing Ingress resource with a host rule matching the new domain
Multiple domain names served from the same external IP address require modifying the existing Ingress resource to add a new host rule for the European domain. A single Ingress resource with multiple host rules can handle different domains pointing to the same load balancer's IP address. This approach reuses the existing load balancer and IP address while extending it to support the new domain.
Why the other options are wrong
- A. Defining a new separate Ingress resource would create a second load balancer with a different external IP address, violating the requirement to use the same IP address.
- C. Services of type LoadBalancer create their own external load balancers; you cannot specify an existing IP address to reuse in this manner.
- D. Creating a new Ingress resource would result in a separate load balancer and IP address, not sharing the existing load balancer as required.
Question 89
You recently developed a new service on Cloud Run. The new service authenticates using a custom service and then writes transactional information to a Cloud Spanner database. You need to verify that your application can support up to 5,000 read and 1,000 write transactions per second while identifying any bottlenecks that occur. Your test infrastructure must be able to autoscale. What should you do?
Show answer and explanation
Correct answer: B. Create a Google Kubernetes Engine cluster running the Locust or JMeter images to dynamically generate load tests. Analyze the results using Cloud Trace.
GKE running Locust or JMeter provides autoscaling load generation to simulate 5,000 reads and 1,000 writes per second while identifying bottlenecks. These tools are designed for distributed load testing and generate detailed performance metrics. Cloud Trace captures request tracing and performance data for analysis. Cloud Run test harnesses don't autoscale horizontally. Cloud Task/Scheduler lack load generation capabilities. Compute Engine with Apache Bench doesn't autoscale and lacks advanced metrics.
Why the other options are wrong
- A. Cloud Run doesn't easily autoscale for load generation, and VPC Flow Logs don't provide application performance insights.
- C. Cloud Task and Scheduler are not designed for load generation; this approach wouldn't generate sufficient concurrent load.
- D. Compute Engine with Apache Bench doesn't autoscale and lacks the sophisticated distributed load testing capabilities needed.
Question 90
You manage an ecommerce application that processes purchases from customers who can subsequently cancel or change those purchases. You discover that order volumes are highly variable and the backend order-processing system can only process one request at a time. You want to ensure seamless performance for customers regardless of usage volume. It is crucial that customers' order update requests are performed in the sequence in which they were generated. What should you do?
Show answer and explanation
Correct answer: C. Use a Pub/Sub subscriber in pull mode and use a data store to manage ordering.
Pub/Sub in pull mode with a data store for managing ordering ensures sequential processing of order requests despite variable volume. Pull mode gives the subscriber control over processing rate, preventing overwhelming the single-threaded backend. A data store maintains order state and ensures exactly-one processing semantics. WebSockets and REST don't handle ordering guarantees. Push mode would overwhelm the backend during spikes.
Why the other options are wrong
- A. WebSockets don't inherently guarantee message ordering or handle backend bottlenecks.
- B. REST requests lack ordering guarantees and would overwhelm the single-threaded backend during volume spikes.
- D. Push mode would immediately forward all messages to the backend, overwhelming the single-threaded processor during high volume.
Question 91
You have an application that uses an HTTP Cloud Function to process user activity from both desktop browser and mobile application clients. This function will serve as the endpoint for all metric submissions using HTTP POST. Due to legacy restrictions, the function must be mapped to a domain that is separate from the domain requested by users on web or mobile sessions. The domain for the Cloud Function is https://fn.example.com. Desktop and mobile clients use the domain https://www.example.com. You need to add a header to the function's HTTP response so that only those browser and mobile sessions can submit metrics to the Cloud Function. Which response header should you add?
Show answer and explanation
Correct answer: D. Access-Control-Allow-origin: https://www.example.com
The Access-Control-Allow-Origin header specifies which origins are permitted to make cross-origin requests to the resource. The requirement is to allow only browser and mobile sessions from https://www.example.com to submit metrics to the Cloud Function at https://fn.example.com. The correct response header must specify exactly https://www.example.com as the allowed origin. Option A uses a wildcard, which allows any origin and defeats the security purpose. Option B uses an incomplete wildcard pattern that is not valid CORS syntax. Option C specifies the function's own domain, which would not solve the cross-origin problem since requests originate from www.example.com.
Why the other options are wrong
- A. Using a wildcard allows any origin to make requests, eliminating the security restriction and allowing unauthorized domains.
- B. Wildcard subdomains like https://*.example.com are not valid CORS syntax; only a single specific origin or wildcard * is acceptable.
- C. Specifying the function's own domain does not address the cross-origin requirement; clients from www.example.com would still be blocked.
Question 92
You are deploying your application on a Compute Engine instance that communicates with Cloud SQL. You will use Cloud SQL Proxy to allow your application to communicate to the database using the service account associated with the application's instance. You want to follow the Google-recommended best practice of providing minimum access for the role assigned to the service account. What should you do?
Show answer and explanation
Correct answer: C. Assign the Cloud SQL Client role.
The Cloud SQL Client role provides the minimum permissions required for Cloud SQL Proxy to authenticate and connect to Cloud SQL instances on behalf of the application. This role grants only the necessary permissions (cloudsql.connect and related SQL operations) without the broad permissions of higher-level roles, following the principle of least privilege for service account authorization.
Why the other options are wrong
- A. Project Editor is far too permissive and grants access to resources well beyond Cloud SQL.
- B. Project Owner is the most privileged role and grants unrestricted access to all Google Cloud resources.
- D. Cloud SQL Editor grants permissions to modify Cloud SQL instances themselves, which is unnecessary for an application that only needs to connect to an existing database.
Question 93
Your analytics system executes queries against a BigQuery dataset. The SQL query is executed in batch and passes the contents of a SQL file to the BigQuery CLI. Then it redirects the BigQuery CLI output to another process. However, you are getting a permission error from the BigQuery CLI when the queries are executed. You want to resolve the issue. What should you do?
Show answer and explanation
Correct answer: A. Grant the service account BigQuery Data Viewer and BigQuery Job User roles.
To execute queries in BigQuery, the service account requires two essential roles: BigQuery Data Viewer to read the dataset and tables, and BigQuery Job User to submit and manage query jobs. The Data Viewer role provides read access to datasets and tables, while the Job User role permits the creation and execution of jobs. Data Editor is unnecessary since the requirement is only to execute read queries, not to modify data. Creating views or new datasets adds unnecessary complexity and doesn't resolve the underlying permission issue.
Why the other options are wrong
- B. Data Editor grants write/modification permissions which are not needed for read-only query execution.
- C. Creating a view doesn't solve the permission problem; the service account still needs proper IAM roles to query.
- D. Copying data to a new dataset is unnecessarily complex and doesn't address the core permission deficiency.
Question 94
Your team develops stateless services that run on Google Kubernetes Engine (GKE). You need to deploy a new service that will only be accessed by other services running in the GKE cluster. The service will need to scale as quickly as possible to respond to changing load. What should you do?
Show answer and explanation
Correct answer: C. Use a Horizontal Pod Autoscaler to scale the containers, and expose them via a ClusterIP Service.
For stateless services accessed only internally by other cluster services, a Horizontal Pod Autoscaler (HPA) scales the number of pods based on load metrics like CPU and memory, enabling rapid response to changing demand. A ClusterIP Service exposes the pods internally within the cluster with no external access needed, providing the appropriate network isolation and DNS service discovery for inter-service communication.
Why the other options are wrong
- A. Vertical Pod Autoscaler adjusts container resource requests/limits, not the number of pods, so it doesn't provide the rapid scaling response needed for load changes.
- B. Vertical Pod Autoscaler doesn't provide the scaling behavior needed, and NodePort is unnecessary for internal-only service access.
- D. Horizontal Pod Autoscaler is correct for scaling, but NodePort exposes the service on cluster nodes unnecessarily when internal-only access is required.
Question 95
Your company has deployed a new API to App Engine Standard environment. During testing, the API is not behaving as expected. You want to monitor the application over time to diagnose the problem within the application code without redeploying the application. Which tool should you use?
Show answer and explanation
Correct answer: D. Stackdriver Debug Logpoints
Stackdriver Debug Logpoints allow you to dynamically add logging to your running application without redeployment, capturing diagnostic information as the code executes. This is the only tool that enables real-time debugging without redeploying. Stackdriver Trace shows request latency across services, Stackdriver Monitoring tracks infrastructure metrics, and Stackdriver Debug Snapshots captures variable state at a point in time but doesn't provide continuous logging capability.
Why the other options are wrong
- A. Stackdriver Trace focuses on distributed tracing and request latency, not code-level diagnostics.
- B. Stackdriver Monitoring tracks system and application metrics but cannot dynamically inject logging into code.
- C. Stackdriver Debug Snapshots captures a single moment in time; logpoints provide continuous conditional logging.
That was 95 of 379.
The full Google Professional Cloud Developer pack has all 379 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 144 free as one PDF by email. Get the Half Pack →