Google PROFESSIONAL-CLOUD-DEVELOPER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-DEVELOPER Online Questions & Answers

• Question 261:

  You recently developed a web application to transfer log data to a Cloud Storage bucket daily. Authenticated users will regularly review logs from the prior two weeks for critical events. After that, logs will be reviewed once annually by an external auditor. Data must be stored for a period of no less than 7 years. You want to propose a storage solution that meets these requirements and minimizes costs.

  What should you do? (Choose two.)

  A. Use the Bucket Lock feature to set the retention policy on the data.
  B. Run a scheduled job to set the storage class to Coldline for objects older than 14 days.
  C. Create a JSON Web Token (JWT) for users needing access to the Coldline storage buckets.
  D. Create a lifecycle management policy to set the storage class to Coldline for objects older than 14 days.
  E. Create a lifecycle management policy to set the storage class to Nearline for objects older than 14 days.
  A. Use the Bucket Lock feature to set the retention policy on the data.
  D. Create a lifecycle management policy to set the storage class to Coldline for objects older than 14 days.

• Question 262:

  You have an application deployed in Google Kubernetes Engine (GKE). You need to update the application to make authorized requests to Google Cloud managed services. You want this to be a one- time setup, and you need to follow security best practices of auto-rotating your security keys and storing them in an encrypted store. You already created a service account with appropriate access to the Google Cloud service.

  What should you do next?

  A. Assign the Google Cloud service account to your GKE Pod using Workload Identity.
  B. Export the Google Cloud service account, and share it with the Pod as a Kubernetes Secret.
  C. Export the Google Cloud service account, and embed it in the source code of the application.
  D. Export the Google Cloud service account, and upload it to HashiCorp Vault to generate a dynamic service account for your application.
  A. Assign the Google Cloud service account to your GKE Pod using Workload Identity.

• Question 263:

  You have containerized a legacy application that stores its configuration on an NFS share. You need to deploy this application to Google Kubernetes Engine (GKE) and do not want the application serving traffic until after the configuration has been retrieved.

  What should you do?

  A. Use the gsutil utility to copy files from within the Docker container at startup, and start the service using an ENTRYPOINT script.
  B. Create a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.
  C. Use the COPY statement in the Dockerfile to load the configuration into the container image. Verify that the configuration is available, and start the service using an ENTRYPOINT script.
  D. Add a startup script to the GKE instance group to mount the NFS share at node startup. Copy the configuration files into the container, and start the service using an ENTRYPOINT script.
  B. Create a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.

• Question 264:

  You are tasked with using C++ to build and deploy a microservice for an application hosted on Google Cloud. The code needs to be containerized and use several custom software libraries that your team has built. You do not want to maintain the underlying infrastructure of the application.

  How should you deploy the microservice?

  A. Use Cloud Functions to deploy the microservice.
  B. Use Cloud Build to create the container, and deploy it on Cloud Run.
  C. Use Cloud Shell to containerize your microservice, and deploy it on a Container-Optimized OS Compute Engine instance.
  D. Use Cloud Shell to containerize your microservice, and deploy it on standard GKE.
  B. Use Cloud Build to create the container, and deploy it on Cloud Run.

• Question 265:

  Your team has created an application that is hosted on a GKE cluster. You need to connect the application to a REST service that is deployed in two GKE clusters in two different regions.

  How should you set up the connection and health checks? (Choose two.)

  A. Use Cloud Service Mesh with sidecar proxies to connect the application to the REST service.
  B. Use Cloud Service Mesh with proxyless gRPC to connect the application to the REST service.
  C. Configure the REST service's firewall to allow health checks originating from the GKE service's IP ranges.
  D. Configure the REST service's firewall to allow health checks originating from the GKE control plane's IP ranges.
  E. Configure the REST service's firewall to allow health checks originating from the GKE check probe's IP ranges.
  A. Use Cloud Service Mesh with sidecar proxies to connect the application to the REST service.
  E. Configure the REST service's firewall to allow health checks originating from the GKE check probe's IP ranges.

  ---

  Explanation

  Use Cloud Service Mesh with sidecar proxies: Cloud Service Mesh (based on Istio) is an effective solution for connecting services across multiple GKE clusters and regions. The sidecar proxies can manage and secure traffic between the application and the REST service, providing features like traffic routing, observability, and resilience.

  Configure the REST service's firewall to allow health checks originating from the GKE check probe's IP ranges: Health checks for services deployed in GKE often originate from specific probe IP ranges. Configuring the firewall to allow these probes ensures that health checks can pass through to the REST service, allowing GKE to monitor the availability and health of the REST service effectively.

  Options involving proxyless gRPC and control plane IP ranges are not applicable for REST services and are not the best practices for managing firewall rules for health checks in this context.

• Question 266:

  Your application running on GKE needs to scale automatically based on CPU utilization.

  Which Kubernetes object should you configure?

  A. Vertical Pod Autoscaler
  B. Horizontal Pod Autoscaler
  C. DaemonSet
  D. StatefulSet
  B. Horizontal Pod Autoscaler

  ---

  Explanation

  The Horizontal Pod Autoscaler (HPA) automatically adjusts the number of pod replicas based on observed metrics such as CPU utilization. This is the recommended approach for scaling stateless workloads horizontally in GKE.

• Question 267:

  Your development team is using Cloud Build to promote a Node.js application built on App Engine from your staging environment to production. The application relies on several directories of photos stored in a Cloud Storage bucket named webphotos-staging in the staging environment. After the promotion, these photos must be available in a Cloud Storage bucket named webphotos-prod in the production environment. You want to automate the process where possible.

  What should you do?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

• Question 268:

  You manage a microservice-based ecommerce platform on Google Cloud that sends confirmation emails to a third-party email service provider using a Cloud Function. Your company just launched a marketing campaign, and some customers are reporting that they have not received order confirmation emails. You discover that the services triggering the Cloud Function are receiving HTTP 500 errors. You need to change the way emails are handled to minimize email loss.

  What should you do?

  A. Increase the Cloud Function's timeout to nine minutes.
  B. Configure the sender application to publish the outgoing emails in a message to a Pub/Sub topic. Update the Cloud Function configuration to consume the Pub/Sub queue.
  C. Configure the sender application to write emails to Memorystore and then trigger the Cloud Function. When the function is triggered, it reads the email details from Memorystore and sends them to the email service.
  D. Configure the sender application to retry the execution of the Cloud Function every one second if a request fails.
  B. Configure the sender application to publish the outgoing emails in a message to a Pub/Sub topic. Update the Cloud Function configuration to consume the Pub/Sub queue.

• Question 269:

  Your team is developing an application in Google Cloud that executes with user identities maintained by Cloud Identity. Each of your application's users will have an associated Pub/Sub topic to which messages are published, and a Pub/Sub subscription where the same user will retrieve published messages. You need to ensure that only authorized users can publish and subscribe to their own specific Pub/Sub topic and subscription.

  What should you do?

  

  A. Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level.
  B. Grant the user identity the pubsub.publisher and pubsub.subscriber roles at the project level.
  C. Grant the user identity a custom role that contains the pubsub.topics.create and permissions.pubsub.subscriptions.create
  D. Configure the application to run as a service account that has the pubsub.publisher and roles.pubsub.subscriber
  A. Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level.

• Question 270:

  You are running a web application on Google Kubernetes Engine that you inherited. You want to determine whether the application is using libraries with known vulnerabilities or is vulnerable to XSS attacks.

  Which service should you use?

  A. Google Cloud Armor
  B. Debugger
  C. Web Security Scanner
  D. Error Reporting
  C. Web Security Scanner