Google PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Online Questions & Answers

• Question 191:

  Your company operates in a highly regulated domain. Your security team requires that only trusted container images can be deployed to Google Kubernetes Engine (GKE). You need to implement a solution that meets the requirements of the security team while minimizing management overhead. What should you do?

  A. Configure Binary Authorization in your GKE clusters to enforce deploy-time security policies.
  B. Grant the roles/artifactregistry.writer role to the Cloud Build service account. Confirm that no employee has Artifact Registry write permission.
  C. Use Cloud Run to write and deploy a custom validator. Enable an Eventarc trigger to perform validations when new images are uploaded.
  D. Configure Kritis to run in your GKE clusters to enforce deploy-time security policies.
  A. Configure Binary Authorization in your GKE clusters to enforce deploy-time security policies.

• Question 192:

  You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?

  A. Create a Google service account. Create a Kubernetes service account in a Workload Identity-enabled cluster. Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation. Map the Kubernetes service account to the workload. Repeat for each workload.
  B. Create a Google service account. Create a node pool, and set the Google service account as the default identity. Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations. Repeat for each workload.
  C. Create a Google service account. Create a service account key for the Google service account. Create a Kubernetes secret with a service account key. Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path. Repeat for each workload.
  D. Create a Google service account. Create a node pool without taints, and set the Google service account as the default identity. Grant IAM permissions to the Google service account.
  A. Create a Google service account. Create a Kubernetes service account in a Workload Identity-enabled cluster. Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation. Map the Kubernetes service account to the workload. Repeat for each workload.