Updated Nov-2025 Pass Professional-Cloud-DevOps-Engineer Exam - Real Practice Test Questions
Download Free Google Professional-Cloud-DevOps-Engineer Real Exam Questions
To prepare for the exam, candidates should have a solid understanding of cloud computing concepts and principles, as well as experience working with Google Cloud Platform services such as Compute Engine, Kubernetes Engine, Cloud Storage, and Cloud Pub/Sub. Additionally, candidates should have experience with DevOps methodologies and tools such as Git, Jenkins, and Ansible.
The Professional-Cloud-DevOps-Engineer certification exam covers a broad range of topics, including agile and Scrum methodologies, containerization, microservices, infrastructure as code, and monitoring and logging. Professional-Cloud-DevOps-Engineer exam consists of multiple-choice and multiple-select questions and requires candidates to demonstrate their knowledge of DevOps practices and how they can be applied on the Google Cloud Platform. Professional-Cloud-DevOps-Engineer exam duration is two hours, and the passing score is 70%.
NEW QUESTION # 48
Your team has an application built by using a Dockerfile. The build is executed from Cloud Build, and the resulting artifacts are stored in Artifact Registry. Your team is reporting that builds are slow. You need to increase build speed, while following Google-recommended practices. What should you do?
- A. Cache the container layers of the build process to Cloud Storage. Add the most frequently modified files to the earlier stages of the build process.
- B. Use the --cache-from parameter, and point to Artifact Registry. Add the most frequently modified files to the earlier stages of the build process.
- C. Use the --cache-from parameter, and point to Artifact Registry. Add the most frequently modified files to the later stages of the build process.
- D. Cache the container layers of the build process to Cloud Storage. Add the most frequently modified files to the later stages of the build process.
Answer: C
Explanation:
To speed up Docker builds, optimize layer caching. Google Cloud recommends using --cache-from with Artifact Registry, and placing frequently changed files late in the Dockerfile so earlier layers can be reused.
"Put instructions that are less likely to change (like installing packages) early in the Dockerfile, and more frequently changing lines (like copying app code) near the end."
- Dockerfile Best Practices
"Use the --cache-from argument to pull layers from previously built images in Artifact Registry."
- Cloud Build Docker Caching
This dramatically reduces build time by avoiding redundant rebuilds of static layers.
NEW QUESTION # 49
You are deploying an application to Cloud Run. The application requires a password to start. Your organization requires that all passwords are rotated every 24 hours, and your application must have the latest password. You need to deploy the application with no downtime. What should you do?
- A. Use Cloud Build to add your password into the application container at build time. Ensure that Artifact Registry is secured from public access.
- B. Store the password in Secret Manager and send the secret to the application by using environment variables.
- C. Store the password in Secret Manager and mount the secret as a volume within the application.
- D. Store the password directly in the code. Use Cloud Build to rebuild and deploy the application each time the password changes.
Answer: C
Explanation:
Explanation
The correct answer is B. Store the password in Secret Manager and mount the secret as a volume within the application.
Secret Manager is a service that allows you to securely store and manage sensitive data such as passwords, API keys, certificates, and tokens. You can use Secret Manager to rotate your secrets automatically or manually, and access them from your Cloud Run applications1.
There are two ways to use secrets from Secret Manager in Cloud Run:
As environment variables: You can set environment variables that point to secrets in Secret Manager.
Cloud Run will resolve the secrets at runtime and inject them into the environment of your application.
However, this method has some limitations, such as:
The environment variables are cached for up to 10 minutes, so you may not get the latest version of the secret immediately.
The environment variables are visible in plain text in the Cloud Console and the Cloud SDK, which may expose sensitive information.
The environment variables are limited to 4 KB of data, which may not be enough for some secrets.2 As file system volumes: You can mount secrets from Secret Manager as files in a volume within your application. Cloud Run will create a tmpfs volume and write the secrets as files in it. This method has some advantages, such as:
The files are updated every 30 seconds, so you can get the latest version of the secret faster.
The files are not visible in the Cloud Console or the Cloud SDK, which provides better security.
The files can store up to 64 KB of data, which allows for larger secrets.3 Therefore, for your use case, it is better to use the second method and mount the secret as a file system volume within your application. This way, you can ensure that your application has the latest password, and you can deploy it with no downtime.
To mount a secret as a file system volume in Cloud Run, you can use the following command:
gcloud beta run deploy SERVICE --image IMAGE_URL --update-secrets=/path/to/file=secretName:version where:
SERVICE is the name of your Cloud Run service.
IMAGE_URL is the URL of your container image.
/path/to/file is the path where you want to mount the secret file in your application.
secretName is the name of your secret in Secret Manager.
version is the version of your secret. You can use latest to get the most recent version.3 You can also use the Cloud Console to mount secrets as file system volumes. For more details, see Mounting secrets from Secret Manager.
References:
1: Overview | Secret Manager Documentation | Google Cloud
2: Using secrets as environment variables | Cloud Run Documentation | Google Cloud
3: Mounting secrets from Secret Manager | Cloud Run Documentation | Google Cloud
NEW QUESTION # 50
You need to build a CI/CD pipeline for a containerized application in Google Cloud Your development team uses a central Git repository for trunk-based development You want to run all your tests in the pipeline for any new versions of the application to improve the quality What should you do?
- A. 1. Trigger Cloud Build to build the application container and run unit tests with the container2. If unit tests are successful, deploy the application container to a testing environment, and run integration tests3. If the integration tests are successful the pipeline deploys the application container to the production environment After that, run acceptance tests
- B. 1. Install a Git hook to require developers to run unit tests before pushing the code to a central repository2. Trigger Cloud Build to build the application container Deploy the application container to a testing environment, and run integration tests3. If the integration tests are successful deploy the application container to your production environment. and run acceptance tests
- C. 1. Install a Git hook to require developers to run unit tests before pushing the code to a central repositoryIf all tests are successful build a container2. Trigger Cloud Build to deploy the application container to a testing environment, and run integrationtests and acceptance tests3. If all tests are successful tag the code as production ready Trigger Cloud Build to build and deploy the application container to the production environment
- D. 1. Trigger Cloud Build to run unit tests when the code is pushed If all unit tests are successful, build and push the application container to a central registry.2. Trigger Cloud Build to deploy the container to a testing environment, and run integration tests and acceptance tests3. If all tests are successful the pipeline deploys the application to the production environment and runs smoke tests
Answer: D
NEW QUESTION # 51
You support a production service that runs on a single Compute Engine instance. You regularly need to spend time on recreating the service by deleting the crashing instance and creating a new instance based on the relevant image. You want to reduce the time spent performing manual operations while following Site Reliability Engineering principles. What should you do?
- A. Add a Load Balancer in front of the Compute Engine instance and use health checks to determine the system status.
- B. Create a Managed Instance Group with a single instance and use health checks to determine the system status.
- C. Create a Stackdriver Monitoring dashboard with SMS alerts to be able to start recreating the crashed instance promptly after it has crashed.
- D. File a bug with the development team so they can find the root cause of the crashing instance.
Answer: B
NEW QUESTION # 52
You are managing the production deployment to a set of Google Kubernetes Engine (GKE) clusters. You want to make sure only images which are successfully built by your trusted CI/CD pipeline are deployed to production. What should you do?
- A. Enable Cloud Security Scanner on the clusters.
- B. Set up the Kubernetes Engine clusters as private clusters.
- C. Enable Vulnerability Analysis on the Container Registry.
- D. Set up the Kubernetes Engine clusters with Binary Authorization.
Answer: D
Explanation:
Explanation
https://cloud.google.com/binary-authorization/docs/overview
NEW QUESTION # 53
You have a set of applications running on a Google Kubernetes Engine (GKE) cluster, and you are using Stackdriver Kubernetes Engine Monitoring. You are bringing a new containerized application required by your company into production. This application is written by a third party and cannot be modified or reconfigured. The application writes its log information to /var/log/app_messages.log, and you want to send these log entries to Stackdriver Logging. What should you do?
- A. Install Kubernetes on Google Compute Engine (GCE> and redeploy your applications. Then customize the built-in Stackdriver Logging configuration to tail the log file in the application's pods and write to Stackdriver Logging.
- B. Use the default Stackdriver Kubernetes Engine Monitoring agent configuration.
- C. Deploy a Fluentd daemonset to GKE. Then create a customized input and output configuration to tail the log file in the application's pods and write to Slackdriver Logging.
- D. Write a script to tail the log file within the pod and write entries to standard output. Run the script as a sidecar container with the application's pod. Configure a shared volume between the containers to allow the script to have read access to /var/log in the application container.
Answer: C
Explanation:
https://cloud.google.com/architecture/customizing-stackdriver-logs-fluentd Besides the list of default logs that the Logging agent streams by default, you can customize the Logging agent to send additional logs to Logging or to adjust agent settings by adding input configurations. The configuration definitions in these sections apply to the fluent-plugin-google-cloud output plugin only and specify how logs are transformed and ingested into Cloud Logging. https://cloud.google.com/logging/docs/agent/logging/configuration#configure
NEW QUESTION # 54
You are designing a system with three different environments: development, quality assurance (QA), and production.
Each environment will be deployed with Terraform and has a Google Kubemetes Engine (GKE) cluster created so that application teams can deploy their applications. Anthos Config Management will be used and templated to deploy infrastructure level resources in each GKE cluster. All users (for example, infrastructure operators and application owners) will use GitOps. How should you structure your source control repositories for both Infrastructure as Code (laC) and application code?
- A. Cloud Infrastructure (Terraform) repository is shared: different directories are different environments GKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: different overlay directories are different environments Application (app source code) repositories are separated:
different branches are different features - B. Cloud Infrastructure (Terraform) repository is shared: different branches are different environments GKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: different overlay directories are different environments Application (app source code) repository is shared:
different directories are different features - C. Cloud Infrastructure (Terraform) repository is shared: different directories are different environments GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated:
different branches are different environments Application (app source code) repositories are separated:
different branches are different features - D. Cloud Infrastructure (Terraform) repositories are separated: different branches are different environments GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated: different overlay directories are different environments Application (app source code) repositories are separated: different branches are different features
Answer: C
Explanation:
Explanation
The correct answer is B. Cloud Infrastructure (Terraform) repository is shared: different directories are different environments. GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated: different branches are different environments. Application (app source code) repositories are separated: different branches are different features.
This answer follows the best practices for using Terraform and Anthos Config Management with GitOps, as described in the following sources:
For Terraform, it is recommended to use a single repository for all environments, and use directories to separate them. This way, you can reuse the same Terraform modules and configurations across environments, and avoid code duplication and drift. You can also use Terraform workspaces to isolate the state files for each environment12.
For Anthos Config Management, it is recommended to use separate repositories for each environment, and use branches to separate the clusters within each environment. This way, you can enforce different policies and configurations for each environment, and use pull requests to promote changes across environments. You can also use Kustomize to create overlays for each cluster that apply specific patches or customizations34.
For application code, it is recommended to use separate repositories for each application, and use branches to separate the features or bug fixes for each application. This way, you can isolate the development and testing of each application, and use pull requests to merge changes into the main branch. You can also use tags or labels to trigger deployments to different environments5 .
References:
1: Best practices for using Terraform | Google Cloud
2: Terraform Recommended Practices - Part 1 | Terraform - HashiCorp Learn
3: Deploy Anthos on GKE with Terraform part 1: GitOps with Config Sync | Google Cloud Blog
4: Using Kustomize with Anthos Config Management | Anthos Config Management Documentation | Google Cloud
5: Deploy Anthos on GKE with Terraform part 3: Continuous Delivery with Cloud Build | Google Cloud Blog GitOps-style continuous delivery with Cloud Build | Cloud Build Documentation | Google Cloud
NEW QUESTION # 55
You encounter a large number of outages in the production systems you support. You receive alerts for all the outages that wake you up at night. The alerts are due to unhealthy systems that are automatically restarted within a minute. You want to set up a process that would prevent staff burnout while following Site Reliability Engineering practices. What should you do?
- A. Eliminate unactionable alerts.
- B. Create an incident report for each of the alerts.
- C. Distribute the alerts to engineers in different time zones.
- D. Redefine the related Service Level Objective so that the error budget is not exhausted.
Answer: A
Explanation:
Eliminate bad monitoring : Unactionable alerts (i.e., spam)https://cloud.google.com/blog/products
/management-tools/meeting-reliability-challenges-with-sre-principles
agree with kyubiblaze about having to remove unactionable items aka spam: "good monitoring alerts on actionable problems" @https://cloud.google.com/blog/products/management-tools/meeting-reliability- challenges-with-sre-principles
NEW QUESTION # 56
You need to define Service Level Objectives (SLOs) for a high-traffic multi-region web application.
Customers expect the application to always be available and have fast response times. Customers are currently happy with the application performance and availability. Based on current measurement, you observe that the
90th percentile of latency is 120ms and the 95th percentile of latency is 275ms over a 28-day window. What latency SLO would you recommend to the team to publish?
- A. 90th percentile - 150ms
95th percentile - 300ms - B. 90th percentile - 250ms
95th percentile - 400ms - C. 90th percentile - 100ms
95th percentile - 250ms - D. 90th percentile - 120ms
95th percentile - 275ms
Answer: A
Explanation:
https://sre.google/sre-book/service-level-objectives/
NEW QUESTION # 57
Your company runs an e-commerce business. The application responsible for payment processing has structured JSON logging with the following schema:
Capture and access of logs from the payment processing application is mandatory for operations, but the jsonPayload.user_email field contains personally identifiable information (PII). Your security team does not want the entire engineering team to have access to PII. You need to stop exposing PII to the engineering team and restrict access to security team members only. What should you do?
- A. Modify the application to toggle inclusion of user_email when the log_user_email environment variable is set to true. Restrict the engineering team members who can change the production environment variable by using the CODEOWNERS file.
- B. Apply the conditional role binding resource.name.extract("locations/global/buckets/(bucket)/") ==
"_Default" to the _Default bucket. - C. Apply a jsonPayload.user_email restricted field to the _Default bucket. Grant the Log Field Accessor role to the security team members.
- D. Apply a jsonPayload.user_email exclusion filter to the _Default bucket.
Answer: C
Explanation:
To restrict access to specific sensitive log fields (e.g. PII), Google Cloud offers Log field-level access control
. You can apply field-level restrictions and then assign the Log Field Accessor role only to trusted personnel.
"You can use field-level access control to restrict access to certain fields in your logs. For example, you can restrict access to jsonPayload.user_email."
- Cloud Logging Field-Level Access
"Grant the roles/logging.fieldAccessor role to principals that require access to these restricted fields."
- Log Field Accessor Role
This lets your operations team continue using logs while ensuring that PII is only visible to the security team
, fulfilling your compliance obligations.
NEW QUESTION # 58
Your company is developing applications that are deployed on Google Kubernetes Engine (GKE). Each team manages a different application. You need to create the development and production environments for each team, while minimizing costs. Different teams should not be able to access other teams' environments. What should you do?
- A. Create one GCP Project per team. In each project, create a cluster for Development and one for Production. Grant the teams IAM access to their respective clusters.
- B. Create one GCP Project per team. In each project, create a cluster with a Kubernetes namespace for Development and one for Production. Grant the teams IAM access to their respective clusters.
- C. Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Identity Aware Proxy so that each team can only access its own namespace.
- D. Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Kubernetes Role-based access control (RBAC) so that each team can only access its own namespace.
Answer: D
Explanation:
https://cloud.google.com/architecture/prep-kubernetes-engine-for-prod#roles_and_groups
NEW QUESTION # 59
You are configuring a Cl pipeline. The build step for your Cl pipeline integration testing requires access to APIs inside your private VPC network. Your security team requires that you do not expose API traffic publicly. You need to implement a solution that minimizes management overhead. What should you do?
- A. Use Cloud Build private pools to connect to the private VPC.
- B. Use Cloud Build as a pipeline runner. Configure External HTTP(S) Load Balancing with a Google Cloud Armor policy for API access.
- C. Use Spinnaker for Google Cloud to connect to the private VPC.
- D. Use Cloud Build as a pipeline runner. Configure Internal HTTP(S) Load Balancing for API access.
Answer: A
Explanation:
Cloud Build is a service that executes your builds on Google Cloud Platform infrastructure1. Cloud Build can be used as a pipeline runner for your CI pipeline, which is a process that automates the integration and testing of your code2. Cloud Build private pools are private, dedicated pools of workers that offer greater customization over the build environment, including the ability to access resources in a private VPC network3. A VPC network is a virtual network that provides connectivity for your Google Cloud resources and services. By using Cloud Build private pools, you can implement a solution that minimizes management overhead, as Cloud Build private pools are hosted and fully-managed by Cloud Build and scale up and down to zero, with no infrastructure to set up, upgrade, or scale3. You can also implement a solution that meets your security requirement, as Cloud Build private pools use network peering to connect into your private VPC network and do not expose API traffic publicly.
NEW QUESTION # 60
You are running a web application that connects to an AlloyDB cluster by using a private IP address in your default VPC. You need to run a database schema migration in your CI/CD pipeline by using Cloud Build before deploying a new version of your application. You want to follow Google-recommended security practices. What should you do?
- A. Create a service account that has permission to access the database. Configure Cloud Build to use this service account and execute the schema migration script in a private pool.
- B. Add the database username and encrypted password to the application configuration file. Use these credentials in Cloud Build to execute the schema migration script.
- C. Set up a Cloud Build private pool to access the database through a static external IP address. Configure the database to only allow connections from this IP address. Execute the schema migration script in the private pool.
- D. Add the database username and password to Secret Manager. When running the schema migration script, retrieve the username and password from Secret Manager.
Answer: A
Explanation:
To securely connect Cloud Build to an AlloyDB cluster using a private IP address and adhere to Google- recommended security practices, you need to address two main aspects:
Network Connectivity:Ensuring Cloud Build can reach the private IP of the AlloyDB cluster.
Authentication/Credential Management:Securely authenticating Cloud Build to the AlloyDB cluster.
Let's break down why Option B is the most suitable:
Cloud Build Private Pool:AlloyDB is accessed via a private IP in your VPC. Cloud Build's default build environment runs on Google-managed infrastructure outside your VPC and cannot directly access private IP addresses. To enable this, you must use aCloud Build private pool. A private pool can be configured with VPC peering to your default VPC, allowing build steps running within that pool to access resources like your AlloyDB cluster via their private IPs. Option B correctly includes "execute the schema migration script in a private pool." Service Account with Permissions (IAM Database Authentication):AlloyDB supports IAM database authentication. This is a Google-recommended security practice because it allows you to manage database access using Google Cloud's Identity and Access Management (IAM) rather than relying on traditional database passwords.
You would create a dedicated service account for Cloud Build (or use the private pool's service account).
This service account would be granted the necessary IAM roles to connect to the AlloyDB instance (e.g., roles
/alloydb.client) and a database-level IAM role for login (e.g., roles/alloydb.user or roles/alloydb.admin depending on the permissions needed for schema migration).
Cloud Build would then be configured to use this service account. The "permission to access the database" in Option B refers to these IAM permissions. This method avoids managing and distributing database passwords.
Analyzing the options:
A: Set up a Cloud Build private pool to access the database through a static external IP address...
While using a private pool is correct for network access, routing this through a staticexternalIP for a resource that has aprivateIP is generally not the first-choice secure pattern if direct private access is feasible. It adds complexity and a potential external exposure point, even if firewalled. The aim is to keep traffic within the private network as much as possible.
B: Create a service account that has permission to access the database. Configure Cloud Build to use this service account and execute the schema migration script in a private pool.
This option correctly combines the use of aprivate pool(for private IP network access) with aservice account having permissions(strongly implying IAM database authentication for AlloyDB, which is a best practice).
This is a secure and robust approach.
C: Add the database username and encrypted password to the application configuration file...
Storing credentials, even if "encrypted" (the method and key management for encryption are unspecified and problematic), in application configuration files checked into source control or packaged with the application is a significant security risk and not a recommended practice.
D: Add the database username and password to Secret Manager. When running the schema migration script, retrieve the username and password from Secret Manager.
UsingSecret Managerto store database usernames and passwords is a Google-recommended practiceifyou are using password-based authentication. However, this optionalonedoes not solve the network connectivity issue for Cloud Build to reach the private IP of AlloyDB. You would still need a private pool. While D is good for secret management, B offers a more comprehensive solution that includes both the network aspect and implies a more modern authentication method (IAM database auth). If the question forced a choice between only doing secure credential storage (D) or doing IAM auth + private networking (B), B is more complete for the overall task.
Conclusion:Option B is the most aligned with Google-recommended security practices as it addresses both the necessary private network connectivity via a Cloud Build private pool and promotes the use of IAM-based database authentication for AlloyDB, which is generally preferred over managing passwords.
References (General Concepts):
Cloud Build Private Pools for VPC Access:Google Cloud documentation for Cloud Build explicitly details using private pools to connect to resources in a VPC network.
See:https://www.google.com/search?q=https://cloud.google.com/build/docs/private-pools/accessing-private- resources-with-private-pools AlloyDB IAM Database Authentication:Google Cloud documentation for AlloyDB highlights IAM database authentication as a secure method.
See:https://www.google.com/search?q=https://cloud.google.com/alloydb/docs/iam-authentication Secret Manager:If password authentication were the only option, Secret Manager would be the recommended way to store those credentials.
See:https://cloud.google.com/secret-manager
Option B synergizes the benefits of private networking and modern IAM-based authentication for a comprehensive secure solution.
NEW QUESTION # 61
You need to create a Cloud Monitoring SLO for a service that will be published soon. You want to verify that requests to the service will be addressed in fewer than 300 ms at least 90% Of the time per calendar month.
You need to identify the metric and evaluation method to use. What should you do?
- A. Select an availability metric for a window-based method Of evaluation.
- B. Select a latency metric for a request-based method of evaluation.
- C. Select an availability metric for a request-based method of evaluation.
- D. Select a latency metric for a window-based method of evaluation.
Answer: B
Explanation:
The correct answer is A. Select a latency metric for a request-based method of evaluation.
A latency metric measures how responsive your service is to users.For example, you can use thecloud.
googleapis.com/http/server/response_latenciesmetric to measure the latency of HTTP requests to your service1. A request-based method of evaluation counts the number of successful requests that meet a certain criterion, such as being below a latency threshold, and compares it to the number of all requests.For example, you can define an SLI as the ratio of requests with latency below 300 ms to all requests2. A request-based method of evaluation is suitable for measuring performance over time, such as per calendar month.You can set an SLO for the SLI to be at least 90%, which means that you expect 90% of the requests to have latency below 300 ms in a month3.
Reference:
Creating an SLO | Operations Suite | Google Cloud, Choosing a metric, Latency metric.Concepts in service monitoring | Operations Suite | Google Cloud, Service-level indicators, Request-based SLIs.Learn how to set SLOs - SRE tips | Google Cloud Blog, Setting SLOs.
NEW QUESTION # 62
You are designing a system with three different environments: development, quality assurance (QA), and production.
Each environment will be deployed with Terraform and has a Google Kubemetes Engine (GKE) cluster created so that application teams can deploy their applications. Anthos Config Management will be used and templated to deploy infrastructure level resources in each GKE cluster. All users (for example, infrastructure operators and application owners) will use GitOps. How should you structure your source control repositories for both Infrastructure as Code (laC) and application code?
- A. Cloud Infrastructure (Terraform) repositories are separated: different branches are different environmentsGKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated:different overlay directories are different environmentsApplication (app source code) repositories are separated: different branches are different features
- B. Cloud Infrastructure (Terraform) repository is shared: different directories are different environmentsGKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: differentoverlay directories are different environmentsApplication (app source code) repositories are separated: different branches are different features
- C. Cloud Infrastructure (Terraform) repository is shared: different branches are different environmentsGKE Infrastructure (Anthos Config Management Kustomize manifests) repository is shared: differentoverlay directories are different environmentsApplication (app source code) repository is shared: different directories are different features
- D. Cloud Infrastructure (Terraform) repository is shared: different directories are different environmentsGKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated:different branches are different environmentsApplication (app source code) repositories are separated: different branches are different features
Answer: D
Explanation:
The correct answer is B. Cloud Infrastructure (Terraform) repository is shared: different directories are different environments. GKE Infrastructure (Anthos Config Management Kustomize manifests) repositories are separated: different branches are different environments. Application (app source code) repositories are separated: different branches are different features.
This answer follows the best practices for using Terraform and Anthos Config Management with GitOps, as described in the following sources:
For Terraform, it is recommended to use a single repository for all environments, and use directories to separate them. This way, you can reuse the same Terraform modules and configurations across environments, and avoid code duplication and drift.You can also use Terraform workspaces to isolate the state files for each environment12.
For Anthos Config Management, it is recommended to use separate repositories for each environment, and use branches to separate the clusters within each environment. This way, you can enforce different policies and configurations for each environment, and use pull requests to promote changes across environments.You can also use Kustomize to create overlays for each cluster that apply specific patches or customizations34.
For application code, it is recommended to use separate repositories for each application, and use branches to separate the features or bug fixes for each application. This way, you can isolate the development and testing of each application, and use pull requests to merge changes into the main branch.You can also use tags or labels to trigger deployments to different environments5.
References:
1:Best practices for using Terraform | Google Cloud
2: Terraform Recommended Practices - Part 1 | Terraform - HashiCorp Learn
3:Deploy Anthos on GKE with Terraform part 1: GitOps with Config Sync | Google Cloud Blog
4: Using Kustomize with Anthos Config Management | Anthos Config Management Documentation | Google Cloud
5: Deploy Anthos on GKE with Terraform part 3: Continuous Delivery with Cloud Build | Google Cloud Blog GitOps-style continuous delivery with Cloud Build | Cloud Build Documentation | Google Cloud
NEW QUESTION # 63
You are managing an application that exposes an HTTP endpoint without using a load balancer. The latency of the HTTP responses is important for the user experience. You want to understand what HTTP latencies all of your users are experiencing. You use Stackdriver Monitoring. What should you do?
- A. * In your application, create a metric with a metricKind set to CUMULATIVE and a valueType set to DOUBLE.
* In Stackdriver's Metrics Explorer, use a Line graph to visualize the metric. - B. * In your application, create a metric with a metricKind set to DELTA and a valueType set to DOUBLE.
* In Stackdriver's Metrics Explorer, use a Slacked Bar graph to visualize the metric. - C. * In your application, create a metric with a metricKind set to gauge and a valueType set to distribution.
* In Stackdriver's Metrics Explorer, use a Heatmap graph to visualize the metric. - D. * In your application, create a metric with a metricKind. set toMETRlc_KIND_UNSPECIFIEDanda valueType set to INT64.
* In Stackdriver's Metrics Explorer, use a Stacked Area graph to visualize the metric.
Answer: C
Explanation:
https://sre.google/workbook/implementing-slos/
https://cloud.google.com/architecture/adopting-slos/
Latency is commonly measured as a distribution. Given a distribution, you can measure various percentiles.
For example, you might measure the number of requests that are slower than the historical 99th percentile.
NEW QUESTION # 64
Your team has recently deployed an NGINX-based application into Google Kubernetes Engine (GKE) and has exposed it to the public via an HTTP Google Cloud Load Balancer (GCLB) ingress. You want to scale the deployment of the application's frontend using an appropriate Service Level Indicator (SLI). What should you do?
- A. Configure the horizontal pod autoscaler to use the average response time from the Liveness and Readiness probes.
- B. Configure the vertical pod autoscaler in GKE and enable the cluster autoscaler to scale the cluster as pods expand.
- C. Install the Stackdriver custom metrics adapter and configure a horizontal pod autoscaler to use the number of requests provided by the GCLB.
- D. Expose the NGINX stats endpoint and configure the horizontal pod autoscaler to use the request metrics exposed by the NGINX deployment.
Answer: C
Explanation:
https://cloud.google.com/kubernetes-engine/docs/tutorials/autoscaling-metrics The Google Cloud HTTP Load Balancer (GCLB) provides metrics on the number of requests and the response latency for each backend service. These metrics can be used as custom metrics for the horizontal pod autoscaler (HPA) to scale the deployment based on the load. This is the correct solution to use an appropriate SLI for scaling.
NEW QUESTION # 65
Your company wants to implement a CD pipeline in Cloud Deploy for a web service deployed to GKE. The web service currently does not have any automated testing. The Quality Assurance team must manually verify any new releases of the web service before any production traffic is processed. You need to design the CD pipeline. What should you do?
- A. Create two pipeline stages, and use a canary deployment strategy.
- B. Create a single pipeline stage, and use a standard deployment strategy.
- C. Create a single pipeline stage, and use a canary deployment strategy.
- D. Create two pipeline stages, and use a standard deployment strategy.
Answer: D
Explanation:
To allow manual QA approval, you need separate pipeline stages (e.g., staging # production) and manual promotion between them.
"Cloud Deploy supports multi-stage pipelines where you can manually approve releases before promotion."
- Cloud Deploy Promotion
"Use a standard strategy when there are no automated tests or SLOs to support rollback decisions."
- Deployment Strategies
Canary is best used when automated health checks and metrics exist, which is not the case here.
NEW QUESTION # 66
You need to enforce several constraint templates across your Google Kubernetes Engine (GKE) clusters. The constraints include policy parameters, such as restricting the Kubernetes API. You must ensure that the policy parameters are stored in a GitHub repository and automatically applied when changes occur. What should you do?
- A. Set up a GitHub action to trigger Cloud Build when there is a parameter change. In Cloud Build, run a gcloud CLI command to apply the change.
- B. Configure Anthos Config Management with the GitHub repository. When there is a change in the repository, use Anthos Config Management to apply the change.
- C. Configure Config Connector with the GitHub repository. When there is a change in the repository, use Config Connector to apply the change.
- D. When there is a change in GitHub, use a web hook to send a request to Anthos Service Mesh, and apply the change.
Answer: B
Explanation:
The correct answer is C. Configure Anthos Config Management with the GitHub repository. When there is a change in the repository, use Anthos Config Management to apply the change.
According to the web search results, Anthos Config Management is a service that lets you manage the configuration of your Google Kubernetes Engine (GKE) clusters from a single source of truth, such as a GitHub repository1. Anthos Config Management can enforce several constraint templates across your GKE clusters by using Policy Controller, which is a feature that integrates the Open Policy Agent (OPA) Constraint Framework into Anthos Config Management2. Policy Controller can apply constraints that include policy parameters, such as restricting the Kubernetes API3. To use Anthos Config Management and Policy Controller, you need to configure them with your GitHub repository and enable the sync mode4. When there is a change in the repository, Anthos Config Management will automatically sync and apply the change to your GKE clusters5.
The other options are incorrect because they do not use Anthos Config Management and Policy Controller.
Option A is incorrect because it uses a GitHub action to trigger Cloud Build, which is a service that executes your builds on Google Cloud Platform infrastructure6. Cloud Build can run a gcloud CLI command to apply the change, but it does not use Anthos Config Management or Policy Controller. Option B is incorrect because it uses a web hook to send a request to Anthos Service Mesh, which is a service that provides a uniform way to connect, secure, monitor, and manage microservices on GKE clusters7. Anthos Service Mesh can apply the change, but it does not use Anthos Config Management or Policy Controller. Option D is incorrect because it uses Config Connector, which is a service that lets you manage Google Cloud resources through Kubernetes configuration. Config Connector can apply the change, but it does not use Anthos Config Management or Policy Controller.
Reference:
Anthos Config Management documentation, Overview. Policy Controller, Policy Controller. Constraint template library, Constraint template library. Installing Anthos Config Management, Installing Anthos Config Management. Syncing configurations, Syncing configurations. Cloud Build documentation, Overview.
Anthos Service Mesh documentation, Overview. [Config Connector documentation], Overview.
NEW QUESTION # 67
You support a web application that runs on App Engine and uses CloudSQL and Cloud Storage for data storage. After a short spike in website traffic, you notice a big increase in latency for all user requests, increase in CPU use, and the number of processes running the application. Initial troubleshooting reveals:
After the initial spike in traffic, load levels returned to normal but users still experience high latency.
Requests for content from the CloudSQL database and images from Cloud Storage show the same high latency.
No changes were made to the website around the time the latency increased.
There is no increase in the number of errors to the users.
You expect another spike in website traffic in the coming days and want to make sure users don't experience latency. What should you do?
- A. Enable high availability on the CloudSQL instances.
- B. Move the application from App Engine to Compute Engine.
- C. Modify the App Engine configuration to have additional idle instances.
- D. Upgrade the GCS buckets to Multi-Regional.
Answer: C
Explanation:
Explanation
Scaling App Engine scales the number of instances automatically in response to processing volume. This scaling factors in the automatic_scaling settings that are provided on a per-version basis in the configuration file. A service with basic scaling is configured by setting the maximum number of instances in the max_instances parameter of the basic_scaling setting. The number of live instances scales with the processing volume. You configure the number of instances of each version in that service's configuration file. The number of instances usually corresponds to the size of a dataset being held in memory or the desired throughput for offline work. You can adjust the number of instances of a manually-scaled version very quickly, without stopping instances that are currently running, using the Modules API set_num_instances function.
https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed
https://cloud.google.com/appengine/docs/standard/python/config/appref
max_idle_instances Optional. The maximum number of idle instances that App Engine should maintain for this version. Specify a value from 1 to 1000. If not specified, the default value is automatic, which means App Engine will manage the number of idle instances. Keep the following in mind: A high maximum reduces the number of idle instances more gradually when load levels return to normal after a spike. This helps your application maintain steady performance through fluctuations in request load, but also raises the number of idle instances (and consequent running costs) during such periods of heavy load.
NEW QUESTION # 68
......
The Google Professional-Cloud-DevOps-Engineer exam is designed for professionals who have experience in cloud computing, DevOps, and software development. It covers a wide range of topics such as infrastructure automation, configuration management, continuous integration and delivery, and monitoring and logging. Professional-Cloud-DevOps-Engineer exam also includes hands-on experience with Google Cloud Platform tools and services, such as Kubernetes, Cloud Build, and Cloud Monitoring.
Professional-Cloud-DevOps-Engineer Dumps 100 Pass Guarantee With Latest Demo: https://lead2pass.testpassed.com/Professional-Cloud-DevOps-Engineer-pass-rate.html