[2024] Pass Key features of Professional-Cloud-DevOps-Engineer Course with Updated 166 Questions
Professional-Cloud-DevOps-Engineer Sample Practice Exam Questions 2024 Updated Verified
The Google Professional-Cloud-DevOps-Engineer exam is designed for professionals who have experience in cloud computing, DevOps, and software development. It covers a wide range of topics such as infrastructure automation, configuration management, continuous integration and delivery, and monitoring and logging. Professional-Cloud-DevOps-Engineer exam also includes hands-on experience with Google Cloud Platform tools and services, such as Kubernetes, Cloud Build, and Cloud Monitoring.
The Google Cloud Certified - Professional Cloud DevOps Engineer Exam certification exam tests the candidate's knowledge of DevOps principles, practices, and tools, as well as their ability to apply these concepts on the Google Cloud Platform. Professional-Cloud-DevOps-Engineer exam covers a wide range of topics, including continuous integration and delivery, infrastructure automation, monitoring and logging, security and compliance, and collaboration and communication.
NEW QUESTION # 97
You manage several production systems that run on Compute Engine in the same Google Cloud Platform (GCP) project. Each system has its own set of dedicated Compute Engine instances. You want to know how must it costs to run each of the systems. What should you do?
- A. Name each virtual machine (VM) after the system it runs. Set up a usage report export to a Cloud Storage bucket. Configure the bucket as a source in BigQuery to query costs based on VM name.
- B. Enrich all instances with metadata specific to the system they run. Configure Stackdriver Logging to export to BigQuery, and query costs based on the metadata.
- C. Assign all instances a label specific to the system they run. Configure BigQuery billing export and query costs per label.
- D. In the Google Cloud Platform Console, use the Cost Breakdown section to visualize the costs per system.
Answer: C
Explanation:
https://cloud.google.com/billing/docs/how-to/export-data-bigquery
NEW QUESTION # 98
You support a high-traffic web application and want to ensure that the home page loads in a timely manner. As a first step, you decide to implement a Service Level Indicator (SLI) to represent home page request latency with an acceptable page load time set to 100 ms. What is the Google-recommended way of calculating this SLI?
- A. Count the number of home page requests that load in under 100 ms, and then divide by the total number of home page requests.
- B. Buckelize Ihe request latencies into ranges, and then compute the percentile at 100 ms.
- C. Count the number of home page requests that load in under 100 ms. and then divide by the total number of all web application requests.
- D. Bucketize the request latencies into ranges, and then compute the median and 90th percentiles.
Answer: A
Explanation:
https://sre.google/workbook/implementing-slos/
In the SRE principles book, it's recommended treating the SLI as the ratio of two numbers: the number of good events divided by the total number of events. For example: Number of successful HTTP requests / total HTTP requests (success rate)
NEW QUESTION # 99
Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to a Kubernetes cluster in the production environment. The security auditor is concerned that developers or operators could circumvent automated testing and push code changes to production without approval. What should you do to enforce approvals?
- A. Use an Admission Controller to verify that incoming requests originate from approved sources.
- B. Enable binary authorization inside the Kubernetes cluster and configure the build pipeline as an attestor.
- C. Leverage Kubernetes Role-Based Access Control (RBAC) to restrict access to only approved users.
- D. Configure the build system with protected branches that require pull request approval.
Answer: B
Explanation:
The keywords here is "developers or operators". Option A the operators could push images to production without approval (operators could touch the cluster directly and the cluster cannot do any action against them). Rest same as francisco_guerra.
NEW QUESTION # 100
You support an application running on GCP and want to configure SMS notifications to your team for the most critical alerts in Stackdriver Monitoring. You have already identified the alerting policies you want to configure this for. What should you do?
- A. Configure a Slack notification for each alerting policy. Set up a Slack-to-SMS integration to send SMS messages when Slack messages are received. Ensure that your team members add their SMS/phone numbers to the external integration.
- B. Download and configure a third-party integration between Stackdriver Monitoring and an SMS gateway.
Ensure that your team members add their SMS/phone numbers to the external tool. - C. Select the Webhook notifications option for each alerting policy, and configure it to use a third-party integration tool. Ensure that your team members add their SMS/phone numbers to the external tool.
- D. Ensure that your team members set their SMS/phone numbers in their Stackdriver Profile. Select the SMS notification option for each alerting policy and then select the appropriate SMS/phone numbers from the list.
Answer: D
Explanation:
Explanation
https://cloud.google.com/monitoring/support/notification-options#creating_channels To configure SMS notifications, do the following:
In the SMS section, click Add new and follow the instructions. Click Save. When you set up your alerting policy, select the SMS notification type and choose a verified phone number from the list.
NEW QUESTION # 101
Your application services run in Google Kubernetes Engine (GKE). You want to make sure that only images from your centrally-managed Google Container Registry (GCR) image registry in the altostrat-images project can be deployed to the cluster while minimizing development time. What should you do?
- A. Use a Binary Authorization policy that includes the whitelist name pattern gcr.io/attostrat-images/.
- B. Add logic to the deployment pipeline to check that all manifests contain only images from gcr.io/altostrat-images.
- C. Create a custom builder for Cloud Build that will only push images to gcr.io/altostrat-images.
- D. Add a tag to each image in gcr.io/altostrat-images and check that this tag is present when the image is deployed.
Answer: A
NEW QUESTION # 102
Your application images are built using Cloud Build and pushed to Google Container Registry (GCR). You want to be able to specify a particular version of your application for deployment based on the release version tagged in source control. What should you do when you push the image?
- A. Reference the image digest in the source control tag.
- B. Use GCR digest versioning to match the image to the tag in source control.
- C. Supply the source control tag as a parameter within the image name.
- D. Use Cloud Build to include the release version tag in the application image.
Answer: C
Explanation:
Explanation
https://cloud.google.com/container-registry/docs/pushing-and-pulling
NEW QUESTION # 103
You use a multiple step Cloud Build pipeline to build and deploy your application to Google Kubernetes Engine (GKE). You want to integrate with a third-party monitoring platform by performing a HTTP POST of the build information to a webhook. You want to minimize the development effort. What should you do?
- A. Create a Cloud Pub/Sub push subscription to the Cloud Build cloud-builds PubSub topic to HTTP POST the build information to a webhook.
- B. Add a new step at the end of the pipeline in Cloud Build to HTTP POST the build information to a webhook.
- C. Use Stackdriver Logging to create a logs-based metric from the Cloud Build logs. Create an Alert with a Webhook notification type.
- D. Add logic to each Cloud Build step to HTTP POST the build information to a webhook.
Answer: A
NEW QUESTION # 104
You use Spinnaker to deploy your application and have created a canary deployment stage in the pipeline.
Your application has an in-memory cache that loads objects at start time. You want to automate the comparison of the canary version against the production version. How should you configure the canary analysis?
- A. Compare the canary with the existing deployment of the current production version.
- B. Compare the canary with the average performance of a sliding window of previous production versions.
- C. Compare the canary with a new deployment of the current production version.
- D. Compare the canary with a new deployment of the previous production version.
Answer: C
Explanation:
Explanation
https://cloud.google.com/architecture/automated-canary-analysis-kubernetes-engine-spinnaker
https://spinnaker.io/guides/user/canary/best-practices/#compare-canary-against-baseline-not-against-production
NEW QUESTION # 105
Your team is designing a new application for deployment into Google Kubernetes Engine (GKE). You need to set up monitoring to collect and aggregate various application-level metrics in a centralized location. You want to use Google Cloud Platform services while minimizing the amount of work required to set up monitoring. What should you do?
- A. Install the OpenTelemetry client libraries in the application, configure Stackdriver as the export destination for the metrics, and then observe the application's metrics in Stackdriver.
- B. Emit all metrics in the form of application-specific log messages, pass these messages from the containers to the Stackdriver logging collector, and then observe metrics in Stackdriver.
- C. Install the Cloud Pub/Sub client libraries, push various metrics from the application to various topics, and then observe the aggregated metrics in Stackdriver.
- D. Publish various melrics from the application directly to the Slackdriver Monitoring API, and then observe these custom metrics in Stackdriver.
Answer: D
NEW QUESTION # 106
You support a high-traffic web application with a microservice architecture. The home page of the application displays multiple widgets containing content such as the current weather, stock prices, and news headlines.
The main serving thread makes a call to a dedicated microservice for each widget and then lays out the homepage for the user. The microservices occasionally fail; when that happens, the serving thread serves the homepage with some missing content. Users of the application are unhappy if this degraded mode occurs too frequently, but they would rather have some content served instead of no content at all. You want to set a Service Level Objective (SLO) to ensure that the user experience does not degrade too much. What Service Level Indicator {SLI) should you use to measure this?
- A. A latency SLI: the ratio of microservice calls that complete in under 100 ms to the total number of microservice calls
- B. An availability SLI: the ratio of healthy microservices to the total number of microservices
- C. A quality SLI: the ratio of non-degraded responses to total responses
- D. A freshness SLI: the proportion of widgets that have been updated within the last 10 minutes
Answer: B
Explanation:
Explanation
https://cloud.google.com/blog/products/gcp/available-or-not-that-is-the-question-cre-life-lessons
NEW QUESTION # 107
You are performing a semi-annual capacity planning exercise for your flagship service You expect a service user growth rate of 10% month-over-month for the next six months Your service is fully containerized and runs on a Google Kubemetes Engine (GKE) standard cluster across three zones with cluster autoscaling enabled You currently consume about 30% of your total deployed CPU capacity and you require resilience against the failure of a zone. You want to ensure that your users experience minimal negative impact as a result of this growth o' as a result of zone failure while you avoid unnecessary costs How should you prepare to handle the predicted growth?
- A. Verify the maximum node pool size enable a Horizontal Pod Autoscaler and then perform a load lest to verify your expected resource needs
- B. Because you deployed the service on GKE and are using a cluster autoscaler your GKE cluster will scale automatically regardless of growth rate
- C. Proactively add 80% more node capacity to account for six months of 10% growth rate and then perform a load test to ensure that you have enough capacity
- D. Because you are only using 30% of deployed CPU capacity there is significant headroom and you do not need to add any additional capacity for this rate of growth
Answer: A
Explanation:
Explanation
The best option for preparing to handle the predicted growth is to verify the maximum node pool size, enable a Horizontal Pod Autoscaler, and then perform a load test to verify your expected resource needs. The maximum node pool size is a parameter that specifies the maximum number of nodes that can be added to a node pool by the cluster autoscaler. You should verify that the maximum node pool size is sufficient to accommodate your expected growth rate and avoid hitting any quota limits. The Horizontal Pod Autoscaler is a feature that automatically adjusts the number of Pods in a deployment or replica set based on observed CPU utilization or custom metrics. You should enable a Horizontal Pod Autoscaler for your application to ensure that it runs enough Pods to handle the load. A load test is a test that simulates high user traffic and measures the performance and reliability of your application. You should perform a load test to verify your expected resource needs and identify any bottlenecks or issues.
NEW QUESTION # 108
You are creating a CI/CD pipeline in Cloud Build to build an application container image The application code is stored in GitHub Your company requires thai production image builds are only run against the main branch and that the change control team approves all pushes to the main branch You want the image build to be as automated as possible What should you do?
Choose 2 answers
- A. Create a trigger on the Cloud Build job Set the repository event setting to Pull request'
- B. Add the owners file to the Included files filter on the trigger
- C. Create a trigger on the Cloud Build job Set the repository event setting to Push to a branch
- D. Enable the Approval option on the trigger
- E. Configure a branch protection rule for the main branch on the repository
Answer: C,E
Explanation:
Explanation
The best options for creating a CI/CD pipeline in Cloud Build to build an application container image and ensuring that production image builds are only run against the main branch and that the change control team approves all pushes to the main branch are to create a trigger on the Cloud Build job, set the repository event setting to Push to a branch, and configure a branch protection rule for the main branch on the repository. A trigger is a resource that starts a build when an event occurs, such as a code change. By creating a trigger on the Cloud Build job and setting the repository event setting to Push to a branch, you can ensure that the image build is only run when code is pushed to a specific branch, such as the main branch. A branch protection rule is a rule that enforces certain policies on a branch, such as requiring reviews, status checks, or approvals before merging code. By configuring a branch protection rule for the main branch on the repository, you can ensure that the change control team approves all pushes to the main branch.
NEW QUESTION # 109
You are developing a strategy for monitoring your Google Cloud Platform (GCP) projects in production using Stackdriver Workspaces. One of the requirements is to be able to quickly identify and react to production environment issues without false alerts from development and staging projects. You want to ensure that you adhere to the principle of least privilege when providing relevant team members with access to Stackdriver Workspaces. What should you do?
- A. Grant relevant team members read access to all GCP production projects. Create Stackdriver workspaces inside each project.
- B. Choose an existing GCP production project to host the monitoring workspace. Attach the production projects to this workspace. Grant relevant team members read access to the Stackdriver Workspace.
- C. Grant relevant team members the Project Viewer IAM role on all GCP production projects. Create Slackdriver workspaces inside each project.
- D. Create a new GCP monitoring project, and create a Stackdriver Workspace inside it. Attach the production projects to this workspace. Grant relevant team members read access to the Stackdriver Workspace.
Answer: D
Explanation:
Explanation
"A Project can host many Projects and appear in many Projects, but it can only be used as the scoping project once. We recommend that you create a new Project for the purpose of having multiple Projects in the same scope."
NEW QUESTION # 110
You are performing a semi-annual capacity planning exercise for your flagship service. You expect a service user growth rate of 10% month-over-month over the next six months. Your service is fully containerized and runs on Google Cloud Platform (GCP), using a Google Kubernetes Engine (GKE) Standard regional cluster on three zones with cluster autoscaler enabled. You currently consume about 30% of your total deployed CPU capacity, and you require resilience against the failure of a zone. You want to ensure that your users experience minimal negative impact as a result of this growth or as a result of zone failure, while avoiding unnecessary costs. How should you prepare to handle the predicted growth?
- A. Verify the maximum node pool size, enable a horizontal pod autoscaler, and then perform a load test to verify your expected resource needs.
- B. Proactively add 60% more node capacity to account for six months of 10% growth rate, and then perform a load test to make sure you have enough.
- C. Because you are at only 30% utilization, you have significant headroom and you won't need to add any additional capacity for this rate of growth.
- D. Because you are deployed on GKE and are using a cluster autoscaler, your GKE cluster will scale automatically regardless of growth rate.
Answer: D
NEW QUESTION # 111
Your Cloud Run application writes unstructured logs as text strings to Cloud Logging. You want to convert the unstructured logs to JSON-based structured logs. What should you do?
- A. Modify the application to use Cloud Logging software development kit (SDK), and send log entries with a jsonPay10ad field.
- B. A Install a Fluent Bit sidecar container, and use a JSON parser.
- C. Install the log agent in the Cloud Run container image, and use the log agent to forward logs to Cloud Logging.
- D. Configure the log agent to convert log text payload to JSON payload.
Answer: A
Explanation:
The correct answer is D, Modify the application to use Cloud Logging software development kit (SDK), and send log entries with a jsonPayload field.
Cloud Logging SDKs are libraries that allow you to write structured logs from your Cloud Run application. You can use the SDKs to create log entries with a jsonPayload field, which contains a JSON object with the properties of your log entry. The jsonPayload field allows you to use advanced features of Cloud Logging, such as filtering, querying, and exporting logs based on the properties of your log entry1.
To use Cloud Logging SDKs, you need to install the SDK for your programming language, and then use the SDK methods to create and send log entries to Cloud Logging. For example, if you are using Node.js, you can use the following code to write a structured log entry with a jsonPayload field2:
// Imports the Google Cloud client library
const {Logging} = require('@google-cloud/logging');
// Creates a client
const logging = new Logging();
// Selects the log to write to
const log = logging.log('my-log');
// The data to write to the log
const text = 'Hello, world!';
const metadata = {
// Set the Cloud Run service name and revision as labels
labels: {
service_name: process.env.K_SERVICE || 'unknown',
revision_name: process.env.K_REVISION || 'unknown',
},
// Set the log entry payload type and value
jsonPayload: {
message: text,
timestamp: new Date(),
},
};
// Prepares a log entry
const entry = log.entry(metadata);
// Writes the log entry
await log.write(entry);
console.log(`Logged: ${text}`);
Using Cloud Logging SDKs is the best way to convert unstructured logs to structured logs, as it provides more flexibility and control over the format and content of your log entries.
Using a Fluent Bit sidecar container is not a good option, as it adds complexity and overhead to your Cloud Run application. Fluent Bit is a lightweight log processor and forwarder that can be used to collect and parse logs from various sources and send them to different destinations3. However, Cloud Run does not support sidecar containers, so you would need to run Fluent Bit as part of your main container image. This would require modifying your Dockerfile and configuring Fluent Bit to read logs from supported locations and parse them as JSON. This is more cumbersome and less reliable than using Cloud Logging SDKs.
Using the log agent in the Cloud Run container image is not possible, as the log agent is not supported on Cloud Run. The log agent is a service that runs on Compute Engine or Google Kubernetes Engine instances and collects logs from various applications and system components. However, Cloud Run does not allow you to install or run any agents on its underlying infrastructure, as it is a fully managed service that abstracts away the details of the underlying platform.
Storing the password directly in the code is not a good practice, as it exposes sensitive information and makes it hard to change or rotate the password. It also requires rebuilding and redeploying the application each time the password changes, which adds unnecessary work and downtime.
Reference:
1: Writing structured logs | Cloud Run Documentation | Google Cloud
2: Write structured logs | Cloud Run Documentation | Google Cloud
3: Fluent Bit - Fast and Lightweight Log Processor & Forwarder
4: Logging Best Practices for Serverless Applications - Google Codelabs
5: About the logging agent | Cloud Logging Documentation | Google Cloud
6: Cloud Run FAQ | Google Cloud
NEW QUESTION # 112
You have a CI/CD pipeline that uses Cloud Build to build new Docker images and push them to Docker Hub. You use Git for code versioning. After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline. You need to resolve the issue following Site Reliability Engineering practices. What should you do?
- A. Upload the configuration YAML file to Cloud Storage and use Error Reporting to identify and fix the issue.
- B. Disable the CI pipeline and revert to manually building and pushing the artifacts.
- C. Run a Git compare between the previous and current Cloud Build Configuration files to find and fix the bug.
- D. Change the CI pipeline to push the artifacts to Container Registry instead of Docker Hub.
Answer: C
Explanation:
"After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline"- means something wrong on the recent change not with the image registry.
NEW QUESTION # 113
You need to define Service Level Objectives (SLOs) for a high-traffic multi-region web application. Customers expect the application to always be available and have fast response times. Customers are currently happy with the application performance and availability. Based on current measurement, you observe that the 90th percentile of latency is 120ms and the 95th percentile of latency is 275ms over a 28-day window. What latency SLO would you recommend to the team to publish?
- A. 90th percentile - 150ms
95th percentile - 300ms - B. 90th percentile - 120ms
95th percentile - 275ms - C. 90th percentile - 250ms
95th percentile - 400ms - D. 90th percentile - 100ms
95th percentile - 250ms
Answer: B
NEW QUESTION # 114
You are managing an application that runs in Compute Engine The application uses a custom HTTP server to expose an API that is accessed by other applications through an internal TCP/UDP load balancer A firewall rule allows access to the API port from 0.0.0-0/0. You need to configure Cloud Logging to log each IP address that accesses the API by using the fewest number of steps What should you do Bret?
- A. Enable logging on the firewall rule
- B. Install the Ops Agent on the Compute Engine instances.
- C. Enable VPC Flow Logs on the subnet
- D. Enable Packet Mirroring on the VPC
Answer: A
Explanation:
Explanation
The best option for configuring Cloud Logging to log each IP address that accesses the API by using the fewest number of steps is to enable logging on the firewall rule. A firewall rule is a rule that controls the traffic to and from your Compute Engine instances. You can enable logging on a firewall rule to capture information about the traffic that matches the rule, such as source and destination IP addresses, protocols, ports, and actions. You can use Cloud Logging to view and export the firewall logs to other destinations, such as BigQuery, for further analysis.
NEW QUESTION # 115
You support a trading application written in Python and hosted on App Engine flexible environment. You want to customize the error information being sent to Stackdriver Error Reporting. What should you do?
- A. Install the Stackdriver Error Reporting library for Python, and then run your code on App Engine flexible environment.
- B. Use the Stackdriver Error Reporting API to write errors from your application to ReportedErrorEvent, and then generate log entries with properly formatted error messages in Stackdriver Logging.
- C. Install the Stackdriver Error Reporting library for Python, and then run your code on a Compute Engine VM.
- D. Install the Stackdriver Error Reporting library for Python, and then run your code on Google Kubernetes Engine.
Answer: A
NEW QUESTION # 116
You are configuring Cloud Logging for a new application that runs on a Compute Engine instance with a public IP address.
A user-managed service account is attached to the instance.
You confirmed that the necessary agents are running on the instance but you cannot see any log entries from the instance in Cloud Logging. You want to resolve the issue by following Google-recommended practices.
What should you do?
- A. Enable Private Google Access on the subnet that the instance is in.
- B. Add the Logs Writer role to the service account.
- C. Export the service account key and configure the agents to use the key.
- D. Update the instance to use the default Compute Engine service account.
Answer: B
Explanation:
To use Cloud Logging, the service account attached to the Compute Engine instance must have the necessary permissions to write log entries. The Logs Writer role (roles/logging.logWriter) provides this permission. You can grant this role to the user-managed service account at the project, folder, or organization level1.
Private Google Access is not required for Cloud Logging, as it allows instances without external IP addresses to access Google APIs and services2. The default Compute Engine service account already has the Logs Writer role, but it is not a recommended practice to use it for user applications3. Exporting the service account key and configuring the agents to use the key is not a secure way of authenticating the service account, as it exposes the key to potential compromise4.
Explanation:
The correct answer is
Reference:
1: Access control with IAM | Cloud Logging | Google Cloud
2: Private Google Access overview | VPC | Google Cloud
3: Service accounts | Compute Engine Documentation | Google Cloud
4: Best practices for securing service accounts | IAM Documentation | Google Cloud
NEW QUESTION # 117
......
Google Professional-Cloud-DevOps-Engineer exam is designed for individuals who have experience in DevOps and are looking to enhance their skills in cloud-based DevOps. Google Cloud Certified - Professional Cloud DevOps Engineer Exam certification is ideal for DevOps engineers, software developers, system administrators, and IT professionals who want to improve their knowledge of DevOps practices on the Google Cloud platform.
The New Professional-Cloud-DevOps-Engineer 2024 Updated Verified Study Guides & Best Courses: https://examtorrent.actualcollection.com/Professional-Cloud-DevOps-Engineer-exam-questions.html