Best Quality Professional-Cloud-DevOps-Engineer Exam Questions Google Test To Gain Brilliante Result!
Preparations of Professional-Cloud-DevOps-Engineer Exam 2026 Cloud DevOps Engineer Unlimited 208 Questions
NEW QUESTION # 27
You need to create a Cloud Monitoring SLO for a service that will be published soon. You want to verify that requests to the service will be addressed in fewer than 300 ms at least 90% Of the time per calendar month.
You need to identify the metric and evaluation method to use. What should you do?
- A. Select an availability metric for a request-based method of evaluation.
- B. Select a latency metric for a window-based method of evaluation.
- C. Select a latency metric for a request-based method of evaluation.
- D. Select an availability metric for a window-based method Of evaluation.
Answer: C
Explanation:
The correct answer is A. Select a latency metric for a request-based method of evaluation.
A latency metric measures how responsive your service is to users.For example, you can use thecloud.
googleapis.com/http/server/response_latenciesmetric to measure the latency of HTTP requests to your service1. A request-based method of evaluation counts the number of successful requests that meet a certain criterion, such as being below a latency threshold, and compares it to the number of all requests.For example, you can define an SLI as the ratio of requests with latency below 300 ms to all requests2. A request-based method of evaluation is suitable for measuring performance over time, such as per calendar month.You can set an SLO for the SLI to be at least 90%, which means that you expect 90% of the requests to have latency below 300 ms in a month3.
Reference:
Creating an SLO | Operations Suite | Google Cloud, Choosing a metric, Latency metric.Concepts in service monitoring | Operations Suite | Google Cloud, Service-level indicators, Request-based SLIs.Learn how to set SLOs - SRE tips | Google Cloud Blog, Setting SLOs.
NEW QUESTION # 28
You support the backend of a mobile phone game that runs on a Google Kubernetes Engine (GKE) cluster. The application is serving HTTP requests from users. You need to implement a solution that will reduce the network cost. What should you do?
- A. Configure your network services on the Standard Tier.
- B. Configure a Google Cloud HTTP Load Balancer as Ingress.
- C. Configure your Kubernetes duster as a Private Cluster.
- D. Configure the VPC as a Shared VPC Host project.
Answer: A
Explanation:
The Standard Tier network service offers lower network costs than the Premium Tier. This is the correct option to reduce the network cost for the application3.
NEW QUESTION # 29
A third-party application needs to have a service account key to work properly When you try to export the key from your cloud project you receive an error "The organization policy constraint larn.
disableServiceAccountKeyCreation is enforcedM You need to make the third-party application work while following Google-recommended security practices What should you do?
- A. Add a rule to set the iam.disableServiceAccountKeyCreation policy to off in your project and create a key.
- B. Disable the service account key creation policy at the project's folder, and download the default key
- C. Remove the iam.disableServiceAccountKeyCreation policy at the organization level, and create a key.
- D. Enable the default service account key. and download the key
Answer: A
Explanation:
The best option for making the third-party application work while following Google-recommended security practices is to add a rule to set the iam.disableServiceAccountKeyCreation policy to off in your project and create a key. The iam.disableServiceAccountKeyCreation policy is an organization policy that controls whether service account keys can be created in a project or organization. By default, this policy is set to on, which means that service account keys cannot be created. However, you can override this policy at a lower level, such as a project, by adding a rule to set it to off. This way, you can create a service account key for your project without affecting other projects or organizations. You should also follow the best practices for managing service account keys, such as rotating them regularly, storing them securely, and deleting them when they are no longer needed.
NEW QUESTION # 30
Your application artifacts are being built and deployed via a CI/CD pipeline. You want the CI/CD pipeline to securely access application secrets. You also want to more easily rotate secrets in case of a security breach. What should you do?
- A. Prompt developers for secrets at build time. Instruct developers to not store secrets at rest.
- B. Encrypt the secrets and store them in the source code repository. Store a decryption key in a separate repository and grant your pipeline access to it
- C. Store secrets in a separate configuration file on Git. Provide select developers with access to the configuration file.
- D. Store secrets in Cloud Storage encrypted with a key from Cloud KMS. Provide the CI/CD pipeline with access to Cloud KMS via IAM.
Answer: C
NEW QUESTION # 31
Your company wants to implement a CD pipeline in Cloud Deploy for a web service deployed to GKE. The web service currently does not have any automated testing. The Quality Assurance team must manually verify any new releases of the web service before any production traffic is processed. You need to design the CD pipeline. What should you do?
- A. Create a single pipeline stage, and use a canary deployment strategy.
- B. Create two pipeline stages, and use a canary deployment strategy.
- C. Create two pipeline stages, and use a standard deployment strategy.
- D. Create a single pipeline stage, and use a standard deployment strategy.
Answer: C
Explanation:
To allow manual QA approval, you need separate pipeline stages (e.g., staging # production) and manual promotion between them.
"Cloud Deploy supports multi-stage pipelines where you can manually approve releases before promotion."
- Cloud Deploy Promotion
"Use a standard strategy when there are no automated tests or SLOs to support rollback decisions."
- Deployment Strategies
Canary is best used when automated health checks and metrics exist, which is not the case here.
NEW QUESTION # 32
Your team is designing a new application for deployment into Google Kubernetes Engine (GKE). You need to set up monitoring to collect and aggregate various application-level metrics in a centralized location. You want to use Google Cloud Platform services while minimizing the amount of work required to set up monitoring. What should you do?
- A. Install the OpenTelemetry client libraries in the application, configure Stackdriver as the export destination for the metrics, and then observe the application's metrics in Stackdriver.
- B. Emit all metrics in the form of application-specific log messages, pass these messages from the containers to the Stackdriver logging collector, and then observe metrics in Stackdriver.
- C. Publish various melrics from the application directly to the Slackdriver Monitoring API, and then observe these custom metrics in Stackdriver.
- D. Install the Cloud Pub/Sub client libraries, push various metrics from the application to various topics, and then observe the aggregated metrics in Stackdriver.
Answer: C
NEW QUESTION # 33
Your uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices- What should you do?
- A. Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE environment variable on the Jenkins server.
- B. Add the auth application-default command as a step in Jenkins before running the Terraform commands.
- C. Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.use the Terraform module so that Secret Manager can retrieve credentials.
Answer: C
Explanation:
The correct answer is C.
Confirming that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions is the best way to ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. This follows the Google-recommended practice of using service accounts to authenticate and authorize applications running on Google Cloud1. Service accounts are associated with private keys that can be used to generate access tokens for Google Cloud APIs2. By attaching a service account to the Jenkins VM instance, Terraform can use the Application Default Credentials (ADC) strategy to automatically find and use the service account credentials3.
Answer A is incorrect because the auth application-default command is used to obtain user credentials, not service account credentials. User credentials are not recommended for applications running on Google Cloud, as they are less secure and less scalable than service account credentials1.
Answer B is incorrect because it involves downloading and copying the secret key value of the service account, which is not a secure or reliable way of managing credentials. The secret key value should be kept private and not exposed to any other system or user2. Moreover, setting the GOOGLE environment variable on the Jenkins server is not a valid way of providing credentials to Terraform. Terraform expects the credentials to be either in a file pointed by the GOOGLE_APPLICATION_CREDENTIALS environment variable, or in a provider block with the credentials argument3.
Answer D is incorrect because it involves using the Terraform module for Secret Manager, which is a service that stores and manages sensitive data such as API keys, passwords, and certificates. While Secret Manager can be used to store and retrieve credentials, it is not necessary or sufficient for authorizing the Terraform Jenkins instance. The Terraform Jenkins instance still needs a service account with the appropriate IAM permissions to access Secret Manager and other Google Cloud resources.
NEW QUESTION # 34
You are on-call for an infrastructure service that has a large number of dependent systems. You receive an alert indicating that the service is failing to serve most of its requests and all of its dependent systems with hundreds of thousands of users are affected. As part of your Site Reliability Engineering (SRE) incident management protocol, you declare yourself Incident Commander (IC) and pull in two experienced people from your team as Operations Lead (OLJ and Communications Lead (CL). What should you do next?
- A. Contact the affected service owners and update them on the status of the incident.
- B. Look for ways to mitigate user impact and deploy the mitigations to production.
- C. Start a postmortem, add incident information, circulate the draft internally, and ask internal stakeholders for input.
- D. Establish a communication channel where incident responders and leads can communicate with each other.
Answer: B
Explanation:
Explanation
https://sre.google/sre-book/managing-incidents/
NEW QUESTION # 35
You are responsible for the reliability of a custom-built, distributed file storage service that your company uses internally. This service handles thousands of file uploads and downloads daily. You need to define a service level indicator (SLI) to measure the reliability of your service usage and configure alerts to be notified of potential issues. Which SLI should you use to measure the reliability of the service?
- A. Average request latency of API calls (e.g. get, put, list)
- B. Number of successful file uploads and downloads per minute
- C. Average size of objects stored in your service
- D. Ratio of successful API calls to the total number of attempted API calls
Answer: D
Explanation:
SLIs are quantitative measures of service behavior. For reliability, success rate (successful vs. total requests) is the most fundamental metric.
"The most common SLIs are request success rate, availability, and latency."
- Google SRE Workbook: Implementing SLIs
"Availability SLIs often look like 'the fraction of requests that succeed.'"
- Google SRE Book
Option C directly maps to this definition and is the most accurate and measurable indicator of overall reliability.
NEW QUESTION # 36
You support a service with a well-defined Service Level Objective (SLO). Over the previous 6 months, your service has consistently met its SLO and customer satisfaction has been consistently high. Most of your service's operations tasks are automated and few repetitive tasks occur frequently. You want to optimize the balance between reliability and deployment velocity while following site reliability engineering best practices.
What should you do? (Choose two.)
- A. Make the service's SLO more strict.
- B. Shift engineering time to other services that need more reliability.
- C. Change the implementation of your Service Level Indicators (SLIs) to increase coverage.
- D. Increase the service's deployment velocity and/or risk.
- E. Get the product team to prioritize reliability work over new features.
Answer: B,D
Explanation:
Explanation
(https://sre.google/workbook/implementing-slos/#slo-decision-matrix)
NEW QUESTION # 37
You are configuring connectivity across Google Kubernetes Engine (GKE) clusters in different VPCs You notice that the nodes in Cluster A are unable to access the nodes in Cluster B You suspect that the workload access issue is due to the network configuration You need to troubleshoot the issue but do not have execute access to workloads and nodes You want to identify the layer at which the network connectivity is broken What should you do?
- A. Enable VPC Flow Logs in both VPCs and monitor packet drops
- B. Use a debug container to run the traceroute command from Cluster A to Cluster B and from Cluster B to Cluster A Identify the common failure point
- C. Install a toolbox container on the node in Cluster A Confirm that the routes to Cluster B are configured appropriately
- D. Use Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster
Answer: D
Explanation:
Explanation
The best option for troubleshooting the issue without having execute access to workloads and nodes is to use Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B. Network Connectivity Center is a service that allows you to create, manage, and monitor network connectivity across Google Cloud, hybrid, and multi-cloud environments. You can use Network Connectivity Center to perform a Connectivity Test, which is a feature that allows you to test the reachability and latency between two endpoints, such as GKE clusters, VM instances, or IP addresses. By using Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B, you can identify the layer at which the network connectivity is broken, such as the firewall, routing, or load balancing.
NEW QUESTION # 38
You are creating and assigning action items in a postmodern for an outage. The outage is over, but you need to address the root causes. You want to ensure that your team handles the action items quickly and efficiently.
How should you assign owners and collaborators to action items?
- A. Assign multiple owners for each item to guarantee that the team addresses items quickly
- B. Assign the team lead as the owner for all action items because they are in charge of the SRE team.
- C. Assign one owner for each action item and any necessary collaborators.
- D. Assign collaborators but no individual owners to the items to keep the postmortem blameless.
Answer: C
Explanation:
https://devops.com/when-it-disaster-strikes-part-3-conducting-a-blameless-post-mortem/
NEW QUESTION # 39
You are running a real-time gaming application on Compute Engine that has a production and testing environment. Each environment has their own Virtual Private Cloud (VPC) network. The application frontend and backend servers are located on different subnets in the environment's VPC. You suspect there is a malicious process communicating intermittently in your production frontend servers. You want to ensure that network traffic is captured for analysis. What should you do?
- A. Enable VPC Flow Logs on the testing and production VPC network frontend and backend subnets with a volume scale of 0.5. Apply changes in testing before production.
- B. Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 1.0.
- C. Enable VPC Flow Logs on the testing and production VPC network frontend and backend subnets with a volume scale of 1.0. Apply changes in testing before production.
- D. Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 0.5.
Answer: C
NEW QUESTION # 40
You have an application running in Google Kubernetes Engine. The application invokes multiple services per request but responds too slowly. You need to identify which downstream service or services are causing the delay. What should you do?
- A. Create a Dataflow pipeline to analyze service metrics in real time.
- B. Use a distributed tracing framework such as OpenTelemetry or Stackdriver Trace.
- C. Analyze VPC flow logs along the path of the request.
- D. Investigate the Liveness and Readiness probes for each service.
Answer: A
NEW QUESTION # 41
You support a web application that runs on App Engine and uses CloudSQL and Cloud Storage for data storage. After a short spike in website traffic, you notice a big increase in latency for all user requests, increase in CPU use, and the number of processes running the application. Initial troubleshooting reveals:
After the initial spike in traffic, load levels returned to normal but users still experience high latency.
Requests for content from the CloudSQL database and images from Cloud Storage show the same high latency.
No changes were made to the website around the time the latency increased.
There is no increase in the number of errors to the users.
You expect another spike in website traffic in the coming days and want to make sure users don't experience latency. What should you do?
- A. Upgrade the GCS buckets to Multi-Regional.
- B. Enable high availability on the CloudSQL instances.
- C. Move the application from App Engine to Compute Engine.
- D. Modify the App Engine configuration to have additional idle instances.
Answer: B
NEW QUESTION # 42
You created a Stackdriver chart for CPU utilization in a dashboard within your workspace project. You want to share the chart with your Site Reliability Engineering (SRE) team only. You want to ensure you follow the principle of least privilege. What should you do?
- A. Click "Share chart by URL" and provide the URL to the SRE team. Assign the SRE team the Monitoring Viewer IAM role in the workspace project.
- B. Share the workspace Project ID with the SRE team. Assign the SRE team the Monitoring Viewer IAM role in the workspace project.
- C. Share the workspace Project ID with the SRE team. Assign the SRE team the Dashboard Viewer IAM role in the workspace project.
- D. Click "Share chart by URL" and provide the URL to the SRE team. Assign the SRE team the Dashboard Viewer IAM role in the workspace project.
Answer: A
Explanation:
https://cloud.google.com/monitoring/access-control
NEW QUESTION # 43
Some of your production services are running in Google Kubernetes Engine (GKE) in the eu-west-1 region.
Your build system runs in the us-west-1 region. You want to push the container images from your build system to a scalable registry to maximize the bandwidth for transferring the images to the cluster. What should you do?
- A. Push the images to Google Container Registry (GCR) using the eu.gcr.io hostname.
- B. Push the images to a private image registry running on a Compute Engine instance in the eu-west-1 region.
- C. Push the images to Google Container Registry (GCR) using the gcr.io hostname.
- D. Push the images to Google Container Registry (GCR) using the us.gcr.io hostname.
Answer: A
Explanation:
Hostname Storage location gcr.io Stores images in data centers in the United States asia.gcr.io Stores images in data centers in Asia eu.gcr.io Stores images in data centers within member states of the European Union us.
gcr.io Stores images in data centers in the United States
NEW QUESTION # 44
Your organization uses a change advisory board (CAB) to approve all changes to an existing service You want to revise this process to eliminate any negative impact on the software delivery performance What should you do?
Choose 2 answers
- A. Batch changes into larger but less frequent software releases
- B. Ensure that the team's development platform enables developers to get fast feedback on the impact of their changes
- C. Let developers merge their own changes but ensure that the team's deployment platform can roll back changes if any issues are discovered
- D. Move to a peer-review based process for individual changes that is enforced at code check-in time and supported by automated tests
- E. Replace the CAB with a senior manager to ensure continuous oversight from development to deployment
Answer: B,D
Explanation:
Explanation
A change advisory board (CAB) is a traditional way of approving changes to a service, but it can slow down the software delivery performance and introduce bottlenecks. A better way to improve the speed and quality of changes is to use a peer-review based process for individual changes that is enforced at code check-in time and supported by automated tests. This way, developers can get fast feedback on the impact of their changes and catch any errors or bugs before they reach production. Additionally, the team's development platform should enable developers to get fast feedback on the impact of their changes, such as using Cloud Code, Cloud Build, or Cloud Debugger.
NEW QUESTION # 45
Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to the production environment. A recent security audit alerted your team that the code pushed to production could contain vulnerabilities and that the existing tooling around virtual machine (VM) vulnerabilities no longer applies to the containerized environment. You need to ensure the security and patch level of all code running through the pipeline. What should you do?
- A. Implement static code analysis tooling against the Docker files used to create the containers.
- B. Configure the containers in the build pipeline to always update themselves before release.
- C. Reconfigure the existing operating system vulnerability software to exist inside the container.
- D. Set up Container Analysis to scan and report Common Vulnerabilities and Exposures.
Answer: D
NEW QUESTION # 46
......
Google Professional-Cloud-DevOps-Engineer (Google Cloud Certified - Professional Cloud DevOps Engineer) Certification Exam is a highly sought-after certification in the technology industry. Google Cloud Certified - Professional Cloud DevOps Engineer Exam certification is aimed at professionals who are involved in the development, deployment, and management of cloud-based applications, services, and infrastructure. Professional-Cloud-DevOps-Engineer exam is designed to test the candidate's knowledge and skills in various areas such as cloud architecture, automation, security, compliance, and monitoring.
Focus on Professional-Cloud-DevOps-Engineer All-in-One Exam Guide For Quick Preparation: https://www.guidetorrent.com/Professional-Cloud-DevOps-Engineer-pdf-free-download.html
Professional-Cloud-DevOps-Engineer All-in-One Exam Guide For Quick Preparation: https://drive.google.com/open?id=1ujbu9h9IU0nSpA_f20opg6Q9N4ksm_t8