Google Professional Cloud DevOps Engineer Exam Questions Instant Access

Question 1

You work for a company that manages highly sensitive user data. You are designing the Google Kubernetes Engine (GKE) infrastructure for your company, including several applications that will be deployed in development and production environments. Your design must protect data from unauthorized access from other applications while minimizing the amount of management overhead required. What should you do?

ACreate one cluster for the organization with separate namespaces for each application and environment combination.

BCreate one cluster for each environment (development and production) with each application in its own namespace within each cluster.

CCreate one cluster for the organization with separate namespaces for each application.

DCreate one cluster for each application with separate namespaces for production and development environments.

Answer : B

Comprehensive and Detailed

For highly sensitive user data, you need to isolate applications while minimizing management overhead. The best practice is:

One GKE cluster per environment (Development and Production) This provides a clear separation of concerns and avoids security risks from running different environments in the same cluster.

Each application in its own namespace Namespaces provide logical isolation for different applications within the same cluster, reducing unauthorized access risks.

Why not other options?

A (Single cluster for org with multiple namespaces for apps & envs) Bad security practice because mixing production and development in the same cluster increases the risk of privilege escalation.

C (Single cluster for org with namespaces per app) Still mixes development and production in the same cluster, violating isolation requirements for sensitive data.

D (One cluster per app) High operational overhead; unnecessary complexity for small to medium-scale deployments.

Official Reference:

GKE Multi-Tenancy Best Practices

GKE Security Hardening

Question 2

You have a pool of application servers running on Compute Engine. You need to provide a secure solution that requires the least amount of configuration and allows developers to easily access application logs for troubleshooting. How would you implement the solution on GCP?

A* Deploy the Stackdriver logging agent to the application servers.* Give the developers the IAM Logs Viewer role to access Stackdriver and view logs.

B* Deploy the Stackdriver logging agent to the application servers.* Give the developers the IAM Logs Private Logs Viewer role to access Stackdriver and view logs.

C* Deploy the Stackdriver monitoring agent to the application servers.* Give the developers the IAM Monitoring Viewer role to access Stackdriver and view metrics.

D* Install the gsutil command line tool on your application servers.* Write a script using gsutil to upload your application log to a Cloud Storage bucket, and then schedule it to run via cron every 5 minutes.* Give the developers IAM Object Viewer access to view the logs in the specified bucket.

Answer : A

https://cloud.google.com/logging/docs/audit#access-control

Question 3

Your company wants to implement a CD pipeline in Cloud Deploy for a web service deployed to GKE. The web service currently does not have any automated testing. The Quality Assurance team must manually verify any new releases of the web service before any production traffic is processed. You need to design the CD pipeline. What should you do?

ACreate two pipeline stages, and use a canary deployment strategy.

BCreate a single pipeline stage, and use a standard deployment strategy.

CCreate a single pipeline stage, and use a canary deployment strategy.

DCreate two pipeline stages, and use a standard deployment strategy.

Answer : D

To allow manual QA approval, you need separate pipeline stages (e.g., staging production) and manual promotion between them.

'Cloud Deploy supports multi-stage pipelines where you can manually approve releases before promotion.'

--- Cloud Deploy Promotion

'Use a standard strategy when there are no automated tests or SLOs to support rollback decisions.'

--- Deployment Strategies

Canary is best used when automated health checks and metrics exist, which is not the case here.

Question 4

You are configuring connectivity across Google Kubernetes Engine (GKE) clusters in different VPCs You notice that the nodes in Cluster A are unable to access the nodes in Cluster B You suspect that the workload access issue is due to the network configuration You need to troubleshoot the issue but do not have execute access to workloads and nodes You want to identify the layer at which the network connectivity is broken What should you do?

AInstall a toolbox container on the node in Cluster A Confirm that the routes to Cluster B are configured appropriately

BUse Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster

CUse a debug container to run the traceroute command from Cluster A to Cluster B and from Cluster B to Cluster A Identify the common failure point

DEnable VPC Flow Logs in both VPCs and monitor packet drops

Answer : C

The best option for troubleshooting the issue without having execute access to workloads and nodes is to use Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B. Network Connectivity Center is a service that allows you to create, manage, and monitor network connectivity across Google Cloud, hybrid, and multi-cloud environments. You can use Network Connectivity Center to perform a Connectivity Test, which is a feature that allows you to test the reachability and latency between two endpoints, such as GKE clusters, VM instances, or IP addresses. By using Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B, you can identify the layer at which the network connectivity is broken, such as the firewall, routing, or load balancing.

Question 5

You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?

ACreate a Google service account.
Create a Kubernetes service account in a Workload Identity-enabled cluster.
Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation.
Map the Kubernetes service account to the workload.
Repeat for each workload.

BCreate a Google service account.
Create a node pool, and set the Google service account as the default identity.
Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations.
Repeat for each workload.

CCreate a Google service account.
Create a service account key for the Google service account.
Create a Kubernetes secret with a service account key.
Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path.
Repeat for each workload.

DCreate a Google service account.
Create a node pool without taints, and set the Google service account as the default identity.
Grant IAM permissions to the Google service account.

Answer : A

Google Workload Identity is the recommended method to allow GKE workloads to securely access Google Cloud APIs using short-lived credentials without managing keys.

'Workload Identity is the recommended way to access Google Cloud services from GKE. It replaces the older method of using service account keys.'

--- Workload Identity Overview

'You can configure a Kubernetes service account to impersonate a Google Cloud service account by granting the roles/iam.workloadIdentityUser role and using the iam.gke.io/gcp-service-account annotation.'

--- Configure Workload Identity

This satisfies the customer's requirement for PoLP and avoids long-lived keys.

Question 6

Your company uses a CI/CD pipeline with Cloud Build and Artifact Registry to deploy container images to Google Kubernetes Engine (GKE). Images are tagged with the latest commit hash and promoted to production after successful testing in the development and pre-production environments. A recent production deployment caused the application to fail due to untested integration functionality, requiring a disruptive manual rollback. During the rollback, you noticed many old and unused container images accumulating in Artifact Registry. You need to improve rollout and rollback management and clean up the old container images. What should you do?

AAdopt Cloud Deploy for managing deployments, and schedule a Cloud Build job for container image cleanup.

BDeploy Cloud Service Mesh across the GKE clusters, and manually clean up Artifact Registry images.

CAdopt Cloud Deploy for managing deployments, and implement an Artifact Registry cleanup policy.

DSet up a rollback pipeline in Cloud Build, and implement an Artifact Registry cleanup policy.

Answer : C

Comprehensive and Detailed

Cloud Deploy is a GCP-native managed CI/CD tool for reliable and automated releases across environments.

Artifact Registry Cleanup Policy automates image retention and deletion of old images, reducing storage costs and avoiding clutter.

Rollback and rollback policies should be handled by Cloud Deploy, not manual interventions.

Why not other options?

A Cloud Build jobs for cleanup are not scalable or automated compared to Artifact Registry policies.

B Cloud Service Mesh is not related to deployment rollbacks or image cleanup.

D Cloud Deploy provides better rollback management than a custom rollback pipeline.

Official Reference:

Google Cloud Deploy Overview

Artifact Registry Cleanup Policy

Question 7

You manage a critical, user-facing application and have configured a service level objective (SLO) in Cloud Monitoring to track 99% availability over a 30-day rolling window. Recently, a series of minor issues have increased latency, causing the error budget to be consumed at an accelerated rate. You need to be proactively notified when the service is at risk of violating its SLO before the error budget is fully depleted. What should you do?

AIn Cloud Monitoring, create an alerting policy based on the SLO's error budget burn rate. Configure the alert to trigger when the current consumption rate is projected to exhaust the budget before the end of the 30-day compliance period.

BCreate a custom dashboard in Cloud Monitoring that visualizes the SLO compliance percentage and the remaining error budget. Configure the dashboard to send a scheduled daily report through email.

CConfigure a log-based metric in Cloud Monitoring that tracks the rate of application error logs. Create an alerting policy on this metric that triggers when the error rate shows a significant anomalous deviation from its historical baseline.

DIn Metrics Explorer, create an alerting policy based on the average request latency for the application's load balancer. Configure the alert to trigger if latency exceeds a predefined threshold.

Answer : A

Comprehensive and Detailed 150 to 200 words of Explanation From Google Cloud DevOps guides documents:

In Site Reliability Engineering (SRE), the most effective way to manage an SLO is through Burn Rate Alerting. According to Google Cloud's SRE documentation, a burn rate is the speed at which the error budget is being consumed relative to the SLO's compliance period. Relying on simple threshold alerts (Option D) or manual dashboard checks (Option B) often leads to 'alert fatigue' or missed signals because they do not account for the rate of depletion over time.

By creating an alerting policy in Cloud Monitoring specifically based on the burn rate, you can identify 'fast burns' (sudden outages) and 'slow burns' (gradual regressions like increased latency). The system calculates the projection; if the current rate of error budget consumption is high enough to exhaust the remaining budget before the end of the 30-day window, it triggers a proactive notification. This allows the team to intervene while they still have a portion of the error budget remaining, effectively preventing an SLO violation rather than merely reacting to one after the fact. This approach aligns perfectly with Google Cloud's recommended practices for automated, data-driven incident prevention.