10 free Google Professional Cloud DevOps Engineer practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 239 questions. Work through them, then open each answer to check your reasoning.
Get all 239 questions (US$39) · Download these 10 as a PDF
Question 1
You support a Node.js application running on Google Kubernetes Engine (GKE) in production. The application makes several HTTP requests to dependent applications. You want to anticipate which dependent applications might cause performance issues.
What should you do?
Show answer and explanation
Correct answer: B. Instrument all applications with Stackdriver Trace and review inter-service HTTP requests.
review inter-service HTTP requests. Stackdriver Trace is specifically designed to track requests across distributed systems and visualize inter-service HTTP calls with latency data. This directly identifies which dependent applications are causing performance bottlenecks by showing request flow and timing between services. Profiler is for CPU/memory analysis within single applications, Debugger is for step-through debugging, and custom logging lacks the distributed context tracing provides.
Why the other options are wrong
- A. Stackdriver Profiler analyzes CPU and memory usage within a single application, not inter-service request performance.
- C. Stackdriver Debugger is for inspecting code execution at breakpoints, not for identifying performance issues across services.
- D. Manual logging and Stackdriver Logging lack the automatic distributed tracing capabilities needed to efficiently identify cross-service bottlenecks.
Question 2
You created a Stackdriver chart for CPU utilization in a dashboard within your workspace project. You want to share the chart with your Site Reliability Engineering (SRE) team only. You want to ensure you follow the principle of least privilege.
What should you do?
Show answer and explanation
Correct answer: A. Share the workspace Project ID with the SRE team. Assign the SRE team the Monitoring Viewer IAM role in the workspace project.
Assign the SRE team the Monitoring Viewer IAM role in the workspace project. Access to Cloud Monitoring charts and dashboards is controlled by IAM on the workspace (scoping) project, so the correct approach is to tell the SRE team which project holds the dashboard and grant them a read-only Monitoring role. roles/monitoring.viewer is the least privileged predefined role that includes both reading dashboards and listing the time series data that the CPU chart renders. Restricting the grant to the SRE team keeps the chart visible only to them while avoiding any write or admin permissions.
Why the other options are wrong
- B. The Monitoring Dashboard Viewer role only allows reading dashboard configurations and does not include permission to read the metric data, so the team would not see the CPU utilization values.
- C. A chart shared by URL can be opened by anyone who obtains the link, so it is not an access control mechanism and does not limit visibility to the SRE team.
- D. This combines a link that anyone can open with a role that cannot read metric data, so it is both less secure and functionally insufficient.
Question 3
Your organization wants to implement Site Reliability Engineering (SRE) culture and principles. Recently, a service that you support had a limited outage. A manager on another team asks you to provide a formal explanation of what happened so they can action remediations.
What should you do?
Show answer and explanation
Correct answer: B. Develop a postmortem that includes the root causes, resolution, lessons learned, and a prioritized list of action items. Share it on the engineering organization's document portal.
resolution, lessons learned, and a prioritized list of action items. Share it on the engineering organization's document portal. SRE culture emphasizes blameless postmortems shared across the engineering organization to drive organizational learning and prevent future incidents. Publishing to the document portal ensures all engineers can learn from the incident and understand action items. Postmortems should not name individuals responsible (blameless culture) and should be shared widely rather than limited to one manager to maximize organizational benefit.
Why the other options are wrong
- A. Limiting postmortem sharing to a manager only prevents organizational learning and contradicts SRE principles of transparency and collaboration.
- C. Naming individuals responsible contradicts blameless postmortem principles and creates a blame culture rather than learning culture.
- D. While sharing widely is correct, naming individuals responsible contradicts blameless postmortem principles central to SRE culture.
Question 4
You have a set of applications running on a Google Kubernetes Engine (GKE) cluster, and you are using Stackdriver Kubernetes Engine Monitoring.
You are bringing a new containerized application required by your company into production. This application is written by a third party and cannot be modified or reconfigured. The application writes its log information to /var/log/app_messages.log, and you want to send these log entries to Stackdriver Logging.
What should you do?
Show answer and explanation
Correct answer: D. Write a script to tail the log file within the pod and write entries to standard output. Run the script as a sidecar container with the application's pod. Configure a shared volume between the containers to allow the script to have read access to /var/log in the application container.
write entries to standard output. Run the script as a sidecar container with the application's pod. Configure a shared volume between the containers to allow the script to have read access to /var/log in the application container. The third-party application writes to a file rather than stdout and cannot be changed, so the supported pattern is a streaming sidecar container. Mount a shared volume at /var/log in both containers, have the sidecar tail /var/log/app_messages.log and echo each line to standard output, and the GKE node logging agent picks up that container output and ships it to Cloud Logging automatically. This needs no change to the application and no change to the managed logging pipeline.
Why the other options are wrong
- A. The default GKE logging agent collects container stdout/stderr and node system logs, so a file written inside the container filesystem is never collected.
- B. A node-level Fluentd DaemonSet reads the node's container log files and cannot reach a file inside another pod's container filesystem without a shared volume, and replacing the managed GKE logging configuration adds unsupported overhead.
- C. Rebuilding the platform as self-managed Kubernetes on Compute Engine is a major rework and still leaves the file-based log collection problem unsolved.
Question 5
You are running an application in a virtual machine (VM) using a custom Debian image. The image has the Stackdriver Logging agent installed.
The VM has the cloud-platform scope. The application is logging information via syslog. You want to use Stackdriver Logging in the Google Cloud Platform Console to visualize the logs. You notice that syslog is not showing up in the "All logs" dropdown list of the Logs Viewer.
What is the first thing you should do?
Show answer and explanation
Correct answer: D. SSH to the VM and execute the following commands on your VM: ps ax | grep fluentd.
on your VM: ps ax | grep fluentd. The first troubleshooting step is to verify that the Stackdriver Logging agent (Fluentd) is actually running on the VM. Checking if the Fluentd process is active determines whether the agent is operational before investigating configuration or permissions issues. If Fluentd isn't running, that's the root cause; if it is running, you can then investigate configuration or permissions problems.
Why the other options are wrong
- A. Looking for a test log entry assumes the agent is running correctly, but you first need to verify the agent process is active.
- B. Upgrading the agent is premature before determining if the current agent is even running.
- C. Verifying IAM scopes is a later troubleshooting step; first confirm the agent process itself is executing.
Question 6
You use a multiple step Cloud Build pipeline to build and deploy your application to Google Kubernetes Engine (GKE). You want to integrate with a third-party monitoring platform by performing a HTTP POST of the build information to a webhook. You want to minimize the development effort.
What should you do?
Show answer and explanation
Correct answer: D. Create a Cloud Pub/Sub push subscription to the Cloud Build cloud-builds PubSub topic to HTTP POST the build information to a webhook.
Cloud Build cloud-builds PubSub topic to HTTP POST the build information to a webhook. Cloud Pub/Sub push subscriptions to the cloud-builds topic provide automatic webhooks for build events with minimal development effort. Cloud Build automatically publishes build information to this topic, and a push subscription handles HTTP POST to the webhook automatically without custom code in the pipeline steps.
Why the other options are wrong
- A. Adding logic to each step increases complexity and maintenance burden across multiple build steps.
- B. Adding a new step requires writing custom code to format and POST the build information, more effort than using Pub/Sub.
- C. Creating logs-based metrics and alerts is more complex than direct Pub/Sub push subscriptions for this use case.
Question 7
You use Spinnaker to deploy your application and have created a canary deployment stage in the pipeline. Your application has an in-memory cache that loads objects at start time. You want to automate the comparison of the canary version against the production version.
How should you configure the canary analysis?
Show answer and explanation
Correct answer: A. Compare the canary with a new deployment of the current production version.
current production version. Comparing the canary against a fresh deployment of the current production version provides the most accurate comparison baseline. Both versions start in the same initial state, eliminating variables like in-memory cache state and runtime anomalies that would skew comparison results. This ensures performance differences are due to code changes, not deployment age or cache state.
Why the other options are wrong
- B. Comparing against the previous version contradicts the purpose of canary analysis, which is to validate the new version against current production.
- C. The existing production deployment has been running with a warm cache and production traffic patterns, making it an invalid comparison baseline.
- D. Averaging over previous versions obscures whether the canary performs better or worse compared to the current version in production.
Question 8
You support a high-traffic web application and want to ensure that the home page loads in a timely manner. As a first step, you decide to implement a Service Level Indicator (SLI) to represent home page request latency with an acceptable page load time set to 100 ms. What is the Google-recommended way of calculating this SLI?
Show answer and explanation
Correct answer: C. Count the number of home page requests that load in under 100 ms, and then divide by the total number of home page requests.
under 100 ms, and then divide by the total number of home page requests. Google's recommended SLI calculation for latency is the ratio of requests meeting the latency threshold to total requests in scope. This measure (good requests / total requests) aligns with user experience and is directly actionable for SLOs. It counts home page requests under 100ms divided by all home page requests, reflecting the proportion of time users experience acceptable performance.
Why the other options are wrong
- A. Computing a single percentile at the threshold point doesn't capture the proportion of users experiencing acceptable performance.
- B. Computing median and 90th percentile provides distribution information but doesn't measure the proportion meeting a specific threshold.
- D. Dividing by all web application requests dilutes the metric since home page load time is independent of overall application request volume.
Question 9
You deploy a new release of an internal application during a weekend maintenance window when there is minimal user tragic. After the window ends, you learn that one of the new features isn't working as expected in the production environment. After an extended outage, you roll back the new release and deploy a fix.
You want to modify your release process to reduce the mean time to recovery so you can avoid extended outages in the future.
What should you do? (Choose two.)
Show answer and explanation
Correct answer: B, E
B. Adopt the blue/green deployment strategy when releasing new code via a CD server. E. Configure a CI server. Add a suite of unit tests to your code and have your CI server run them on commit and verify any changes. Mean time to recovery is minimized by enabling quick rollback and fast detection of issues in production. Blue/green deployment (B) allows instantaneous rollback to the previous version if issues are detected, dramatically reducing recovery time. Automated integration tests run by a CI server (E) catch defects before they reach production, reducing the likelihood of outages in the first place. Code review (A) and linting (C) improve code quality but don't directly address recovery time, while local testing (D) is unreliable for catching production environment issues.
Why the other options are wrong
- A. Code review improves quality but doesn't reduce recovery time once an issue reaches production.
- C. Linting prevents defects but doesn't enable fast rollback or recovery.
- D. Local testing cannot replicate production environment conditions and doesn't improve recovery time.
Question 10
You have a pool of application servers running on Compute Engine. You need to provide a secure solution that requires the least amount of configuration and allows developers to easily access application logs for troubleshooting.
How would you implement the solution on GCP?
Show answer and explanation
Correct answer: A. "¢ Deploy the Stackdriver logging agent to the application servers. "¢ Give the developers the IAM Logs Viewer role to access Stackdriver and view logs.
application servers. "¢ Give the developers the IAM Logs Viewer role to access Stackdriver and view logs. Installing the Cloud Logging agent on the Compute Engine instances is the minimal- configuration way to stream application logs into Cloud Logging, where developers can search and filter them. roles/logging.viewer gives read-only access to logs while excluding Data Access and other private log entries, which satisfies both the security requirement and ease of troubleshooting. No custom scripts or storage plumbing are needed.
Why the other options are wrong
- B. Private Logs Viewer is a superset of Logs Viewer that additionally exposes Data Access and other private log entries, granting developers more access than they need.
- C. The monitoring agent ships metrics rather than log entries, and Monitoring Viewer gives no access to application logs.
- D. A cron and gsutil upload pipeline is custom work to build and maintain, delays log availability, and loses the search, filtering and alerting features of Cloud Logging.
That was 10 of 239.
The full Google Professional Cloud DevOps Engineer pack has all 239 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.