You are designing a deployment technique for your applications on Google Cloud. As part of your deployment planning, you want to use live traffic to gather performance metrics for new versions of your applications. You need to test against the full production load before your applications are launched. What should you do?
-
A
Use A/B testing with blue/green deployment.
-
B
Use canary testing with continuous deployment.
-
C
Use canary testing with rolling updates deployment.
-
D
Use shadow testing with continuous deployment.
Reveal answer details
Close answer details
Your company operates in a highly regulated domain that requires you to store all organization logs for seven years. You want to minimize logging infrastructure complexity by using managed services. You need to avoid any future loss of log capture or stored logs due to misconfiguration or human error. What should you do?
-
A
Use Cloud Logging to configure an aggregated sink at the organization level to export all logs into a BigQuery dataset.
-
B
Use Cloud Logging to configure an aggregated sink at the organization level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.
-
C
Use Cloud Logging to configure an export sink at each project level to export all logs into a BigQuery dataset
-
D
Use Cloud Logging to configure an export sink at each project level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.
Reveal answer details
Close answer details
Your company runs services by using multiple globally distributed Google Kubernetes Engine (GKE) clusters. Your operations team has set up workload monitoring that uses Prometheus-based tooling for metrics, alerts, and generating dashboards. This setup does not provide a method to view metrics globally across all clusters. You need to implement a scalable solution to support global Prometheus querying and minimize management overhead. What should you do?
-
A
Configure Prometheus cross-service federation for centralized data access.
-
B
Configure workload metrics within Cloud Operations for GKE.
-
C
Configure Prometheus hierarchical federation for centralized data access.
-
D
Configure Google Cloud Managed Service for Prometheus.
Reveal answer details
Close answer details
Your Cloud Run application writes unstructured logs as text strings to Cloud Logging. You want to convert the unstructured logs to JSON-based structured logs. What should you do?
-
A
Modify the application to use Cloud Logging software development kit (SDK), and send log entries with a jsonPayload field.
-
B
Install a Fluent Bit sidecar container, and use a JSON parser.
-
C
Install the log agent in the Cloud Run container image, and use the log agent to forward logs to Cloud Logging.
-
D
Configure the log agent to convert log text payload to JSON payload.
Reveal answer details
Close answer details
Correct answerD
Explanationhttps://cloud.google.com/logging/docs/agent/logging/configuration#process-payload
You support a trading application written in Python and hosted on App Engine flexible environment. You want to customize the error information being sent to Stackdriver Error Reporting. What should you do?
-
A
Install the Stackdriver Error Reporting library for Python, and then run your code on a Compute Engine
VM.
-
B
Install the Stackdriver Error Reporting library for Python, and then run your code on Google Kubernetes Engine.
-
C
Install the Stackdriver Error Reporting library for Python, and then run your code on App Engine flexible environment.
-
D
Use the Stackdriver Error Reporting API to write errors from your application to ReportedErrorEvent, and then generate log entries with properly formatted error messages in Stackdriver Logging.
Reveal answer details
Close answer details
Correct answerD
ExplanationIf you're using the Error Reporting API, you can report error events from your application by writing them to ReportedErrorEvent. Doing this generates log entries with properly formatted error messages in Cloud Logging.
https://cloud.google.com/error-reporting/docs/formatting-error-messages
Your company has a Google Cloud resource hierarchy with folders for production, test, and development.
Your cyber security team needs to review your company's Google Cloud security posture to accelerate security issue identification and resolution. You need to centralize the logs generated by Google Cloud services from all projects only inside your production folder to allow for alerting and near-real time analysis. What should you do?
-
A
Enable the Workflows API and route all the logs to Cloud Logging.
-
B
Create a central Cloud Monitoring workspace and attach all related projects.
-
C
Create an aggregated log sink associated with the production folder that uses a Pub/Sub topic as the destination.
-
D
Create an aggregated log sink associated with the production folder that uses a Cloud Logging bucket as the destination.
Reveal answer details
Close answer details
Correct answerC
Explanationhttps://cloudplatform.googleblog.com/2015/06/Real-Time-Log-Streaming-and-Analysis-with-Google-Cloud-Platform-Logentries.html
You are building and running client applications in Cloud Run and Cloud Functions. Your client requires that all logs must be available for one year so that the client can import the logs into their logging service.
You must minimize required code changes. What should you do?
-
A
Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods.
-
B
Configure Identity and Access Management (IAM) policies to create a least privilege model on your
GKE clusters.
-
C
Use Binary Authorization to attest images during your CI/CD pipeline.
-
D
Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images.
Reveal answer details
Close answer details
You support a service that recently had an outage. The outage was caused by a new release that exhausted the service memory resources. You rolled back the release successfully to mitigate the impact on users. You are now in charge of the post-mortem for the outage. You want to follow Site Reliability Engineering practices when developing the post-mortem. What should you do?
-
A
Focus on developing new features rather than avoiding the outages from recurring.
-
B
Focus on identifying the contributing causes of the incident rather than the individual responsible for the cause.
-
C
Plan individual meetings with all the engineers involved. Determine who approved and pushed the new release to production.
-
D
Use the Git history to find the related code commit. Prevent the engineer who made that commit from working on production services.
Reveal answer details
Close answer details
Correct answerB
ExplanationAccording to Site Reliability Engineering (SRE) practices, the goal of a post-mortem is to identify the underlying causes of the incident in order to take steps to prevent it from happening again in the future.
This involves looking for patterns and issues in the system rather than looking for a specific person to blame. It's important to have a focus on learning and continuous improvement, rather than assigning blame.
Your organization wants to implement Site Reliability Engineering (SRE) culture and principles. Recently, a service that you support had a limited outage. A manager on another team asks you to provide a formal of what happened so they can action remediations. What should you do?
-
A
Develop a postmortem that includes the root causes, resolution, lessons learned, and a prioritized list of action items. Share it with the manager only.
-
B
Develop a postmortem that includes the root causes, resolution, lessons learned, and a prioritized list of action items. Share it on the engineering organization's document portal.
-
C
Develop a postmortem that includes the root causes, resolution, lessons learned, the list of people responsible, and a list of action items for each person. Share it with the manager only.
-
D
Develop a postmortem that includes the root causes, resolution, lessons learned, the list of people responsible, and a list of action items for each person. Share it on the engineering organization's document portal.
Reveal answer details
Close answer details
Question 10
Single choice
You have an application that runs in Google Kubernetes Engine (GKE). The application consists of several microservices that are deployed to GKE by using Deployments and Services. One of the microservices is experiencing an issue where a Pod returns 403 errors after the Pod has been running for more than five hours. Your development team is working on a solution, but the issue will not be resolved for a month. You need to ensure continued operations until the microservice is fixed. You want to follow Google-recommended practices and use the fewest number of steps. What should you do?
-
A
Create a cron job to terminate any Pods that have been running for more than five hours.
-
B
Add a HTTP liveness probe to the microservice's deployment.
-
C
Monitor the Pods, and terminate any Pods that have been running for more than five hours.
-
D
Configure an alert to notify you whenever a Pod returns 403 errors.
Reveal answer details
Close answer details
Question 11
Single choice
You are building the CI/CD pipeline for an application deployed to Google Kubernetes Engine (GKE). The application is deployed by using a Kubernetes Deployment, Service, and Ingress. The application team asked you to deploy the application by using the blue/green deployment methodology. You need to implement the rollback actions. What should you do?
-
A
Run the kubectl rollout undo command.
-
B
Delete the new container image, and delete the running Pods.
-
C
Update the Kubernetes Service to point to the previous Kubernetes Deployment.
-
D
Scale the new Kubernetes Deployment to zero.
Reveal answer details
Close answer details
Correct answerC
ExplanationThe point of using blue/green deployment is to have both blue & green versions deployed, and we chose the active one at service level, so rollback should only consist of updating the service to serve the other version.
Question 12
Single choice
You are the Site Reliability Engineer responsible for managing your company's data services and products.
You regularly navigate operational challenges, such as unpredictable data volume and high cost, with your company's data ingestion processes. You recently learned that a new data ingestion product will be developed in Google Cloud. You need to collaborate with the product development team to provide operational input on the new product. What should you do?
-
A
Deploy the prototype product in a test environment, run a load test, and share the results with the product development team.
-
B
When the initial product version passes the quality assurance phase and compliance assessments, deploy the product to a staging environment. Share error logs and performance metrics with the product development team.
-
C
When the new product is used by at least one internal customer in production, share error logs and monitoring metrics with the product development team.
-
D
Review the design of the product with the product development team to provide feedback early in the design phase.
Reveal answer details
Close answer details
Question 13
Single choice
You are building and running client applications in Cloud Run and Cloud Functions. Your client requires that all logs must be available for one year so that the client can import the logs into their logging service.
You must minimize required code changes. What should you do?
-
A
Update all images in Cloud Run and all functions in Cloud Functions to send logs to both Cloud Logging and the client's logging service. Ensure that all the ports required to send logs are open in the
VPC firewall.
-
B
Create a Pub/Sub topic, subscription, and logging sink. Configure the logging sink to send all logs into the topic. Give your client access to the topic to retrieve the logs.
-
C
Create a storage bucket and appropriate VPC firewall rules. Update all images in Cloud Run and all functions in Cloud Functions to send logs to a file within the storage bucket.
-
D
Create a logs bucket and logging sink. Set the retention on the logs bucket to 365 days. Configure the logging sink to send logs to the bucket. Give your client access to the bucket to retrieve the logs.
Reveal answer details
Close answer details
Question 14
Single choice
You are monitoring a service that uses n2-standard-2 Compute Engine instances that serve large files.
Users have reported that downloads are slow. Your Cloud Monitoring dashboard shows that your VMs are running at peak network throughput. You want to improve the network throughput performance. What should you do?
-
A
Add additional network interface controllers (NICs) to your VMs.
-
B
Deploy a Cloud NAT gateway and attach the gateway to the subnet of the VMs.
-
C
Change the machine type for your VMs to n2-standard-8.
-
D
Deploy the Ops Agent to export additional monitoring metrics.
Reveal answer details
Close answer details
Question 15
Single choice
You currently store the virtual machine (VM) utilization logs in Stackdriver. You need to provide an easy-to-share interactive VM utilization dashboard that is updated in real time and contains information aggregated on a quarterly basis. You want to use Google Cloud Platform solutions. What should you do?
-
A
1. Export VM utilization logs from Stackdriver to BigQuery.
2. Create a dashboard in Data Studio.
3. Share the dashboard with your stakeholders.
-
B
1. Export VM utilization logs from Stackdriver to Cloud Pub/Sub.
2. From Cloud Pub/Sub, send the logs to a Security Information and Event Management (SIEM) system.
3. Build the dashboards in the SIEM system and share with your stakeholders.
-
C
1. Export VM utilization logs from Stackdriver to BigQuery.
2. From BigQuery, export the logs to a CSV file.
3. Import the CSV file into Google Sheets.
4. Build a dashboard in Google Sheets and share it with your stakeholders.
-
D
1. Export VM utilization logs from Stackdriver to a Cloud Storage bucket.
2. Enable the Cloud Storage API to pull the logs programmatically.
3. Build a custom data visualization application.
4. Display the pulled logs in a custom dashboard.
Reveal answer details
Close answer details
Question 16
Single choice
You support an application running on GCP and want to configure SMS notifications to your team for the most critical alerts in Stackdriver Monitoring. You have already identified the alerting policies you want to configure this for. What should you do?
-
A
Download and configure a third-party integration between Stackdriver Monitoring and an SMS gateway.
Ensure that your team members add their SMS/phone numbers to the external tool.
-
B
Select the Webhook notifications option for each alerting policy, and configure it to use a third-party integration tool. Ensure that your team members add their SMS/phone numbers to the external tool.
-
C
Ensure that your team members set their SMS/phone numbers in their Stackdriver Profile. Select the SMS notification option for each alerting policy and then select the appropriate SMS/phone numbers from the list.
-
D
Configure a Slack notification for each alerting policy. Set up a Slack-to-SMS integration to send SMS messages when Slack messages are received. Ensure that your team members add their SMS/phone numbers to the external integration.
Reveal answer details
Close answer details
Correct answerC
Explanationhttps://cloud.google.com/monitoring/support/notification-options#creating_channels
Question 17
Single choice
You have deployed a fleet of Compute Engine instances in Google Cloud. You need to ensure that monitoring metrics and logs for the instances are visible in Cloud Logging and Cloud Monitoring by your company's operations and cyber security teams. You need to grant the required roles for the Compute Engine service account by using Identity and Access Management (IAM) while following the principle of least privilege. What should you do?
-
A
Grant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service accounts.
-
B
Grant the logging.admin and monitoring.editor roles to the Compute Engine service accounts.
-
C
Grant the logging.editor and monitoring.metricWriter roles to the Compute Engine service accounts.
-
D
Grant the logging.logWriter and monitoring.editor roles to the Compute Engine service accounts.
Reveal answer details
Close answer details
Question 18
Multiple choice
Your company follows Site Reliability Engineering practices. You are the Incident Commander for a new, customer-impacting incident. You need to immediately assign two incident management roles to assist you in an effective incident response. What roles should you assign? (Choose two.)
-
A
-
B
-
C
-
D
-
E
External Customer Communications Lead
Reveal answer details
Close answer details
Correct answersA, C
Explanationhttps://sre.google/workbook/incident-response/
Question 19
Single choice
Your team is designing a new application for deployment into Google Kubernetes Engine (GKE). You need to set up monitoring to collect and aggregate various application-level metrics in a centralized location. You want to use Google Cloud Platform services while minimizing the amount of work required to set up monitoring. What should you do?
-
A
Publish various metrics from the application directly to the Stackdriver Monitoring API, and then observe these custom metrics in Stackdriver.
-
B
Install the Cloud Pub/Sub client libraries, push various metrics from the application to various topics, and then observe the aggregated metrics in Stackdriver.
-
C
Install the OpenTelemetry client libraries in the application, configure Stackdriver as the export destination for the metrics, and then observe the application's metrics in Stackdriver.
-
D
Emit all metrics in the form of application-specific log messages, pass these messages from the containers to the Stackdriver logging collector, and then observe metrics in Stackdriver.
Reveal answer details
Close answer details
Correct answerA
Explanationhttps://cloud.google.com/trace/docs/setup
Question 20
Single choice
Your company runs an ecommerce website built with JVM-based applications and microservice architecture in Google Kubernetes Engine (GKE). The application load increases during the day and decreases during the night. Your operations team has configured the application to run enough Pods to handle the evening peak load. You want to automate scaling by only running enough Pods and nodes for the load. What should you do?
-
A
Configure the Vertical Pod Autoscaler, but keep the node pool size static.
-
B
Configure the Vertical Pod Autoscaler, and enable the cluster autoscaler.
-
C
Configure the Horizontal Pod Autoscaler, but keep the node pool size static.
-
D
Configure the Horizontal Pod Autoscaler, and enable the cluster autoscaler.
Reveal answer details
Close answer details
Question 21
Single choice
You have a set of applications running on a Google Kubernetes Engine (GKE) cluster, and you are using Stackdriver Kubernetes Engine Monitoring. You are bringing a new containerized application required by your company into production. This application is written by a third party and cannot be modified or reconfigured. The application writes its log information to /var/log/app_messages.log, and you want to send these log entries to Stackdriver Logging. What should you do?
-
A
Use the default Stackdriver Kubernetes Engine Monitoring agent configuration.
-
B
Deploy a Fluentd daemonset to GKE. Then create a customized input and output configuration to tail the log file in the application's pods and write to Stackdriver Logging.
-
C
Install Kubernetes on Google Compute Engine (GCE) and redeploy your applications. Then customize the built-in Stackdriver Logging configuration to tail the log file in the application's pods and write to Stackdriver Logging.
-
D
Write a script to tail the log file within the pod and write entries to standard output. Run the script as a sidecar container with the application's pod. Configure a shared volume between the containers to allow the script to have read access to /var/log in the application container.
Reveal answer details
Close answer details
Correct answerB
ExplanationReferences:
https://cloud.google.com/solutions/customizing-stackdriver-logs-fluentd
Question 22
Single choice
Your development team has created a new version of their service's API. You need to deploy the new versions of the API with the least disruption to third-party developers and end users of third-party installed applications. What should you do?
-
A
Introduce the new version of the API.
Announce deprecation of the old version of the API.
Deprecate the old version of the API.
Contact remaining users of the old API.
Provide best effort support to users of the old API.
Turn down the old version of the API.
-
B
Announce deprecation of the old version of the API.
Introduce the new version of the API.
Contact remaining users on the old API.
Deprecate the old version of the API.
Turn down the old version of the API.
Provide best effort support to users of the old API.
-
C
Announce deprecation of the old version of the API.
Contact remaining users on the old API.
Introduce the new version of the API.
Deprecate the old version of the API.
Provide best effort support to users of the old API.
Turn down the old version of the API.
-
D
Introduce the new version of the API.
Contact remaining users of the old API.
Announce deprecation of the old version of the API.
Deprecate the old version of the API.
Turn down the old version of the API.
Provide best effort support to users of the old API.
Reveal answer details
Close answer details
Question 23
Single choice
You work for a company that manages highly sensitive user data. You are designing the Google Kubernetes Engine (GKE) infrastructure for your company, including several applications that will be deployed in development and production environments. Your design must protect data from unauthorized access from other applications while minimizing the amount of management overhead required. What should you do?
-
A
Create one cluster for the organization with separate namespaces for each application and environment combination.
-
B
Create one cluster for each environment (development and production) with each application in its own
namespace within each cluster.
-
C
Create one cluster for the organization with separate namespaces for each application.
-
D
Create one cluster for each application with separate namespaces for production and development environments.
Reveal answer details
Close answer details
Question 24
Single choice
Your company uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices. What should you do?
-
A
Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.
-
B
Use the Terraform module so that Secret Manager can retrieve credentials.
-
C
Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE_CREDENTIALS environment variable on the Jenkins server.
-
D
Add the gcloud auth application-default login command as a step in Jenkins before running the Terraform commands.
Reveal answer details
Close answer details
Question 25
Single choice
Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to a Kubernetes cluster in the production environment. The security auditor is concerned that developers or operators could circumvent automated testing and push code changes to production without approval. What should you do to enforce approvals?
-
A
Configure the build system with protected branches that require pull request approval.
-
B
Use an Admission Controller to verify that incoming requests originate from approved sources.
-
C
Leverage Kubernetes Role-Based Access Control (RBAC) to restrict access to only approved users.
-
D
Enable binary authorization inside the Kubernetes cluster and configure the build pipeline as an attestor.
Reveal answer details
Close answer details
Correct answerD
Explanationhttps://cloud.google.com/binary-authorization
Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE) or Cloud Run. With Binary Authorization, you can require images to be signed by trusted authorities during the development process and then enforce signature validation when deploying. By enforcing validation, you can gain tighter control over your container environment by ensuring only verified images are integrated into the build-and-release process.
Question 26
Single choice
Your team is running microservices in Google Kubernetes Engine (GKE). You want to detect consumption of an error budget to protect customers and define release policies. What should you do?
-
A
Create SLIs from metrics. Enable Alert Policies if the services do not pass.
-
B
Use the metrics from Anthos Service Mesh to measure the health of the microservices.
-
C
Create a SLO. Create an Alert Policy on select_slo_burn_rate.
-
D
Create a SLO and configure uptime checks for your services. Enable Alert Policies if the services do not pass.
Reveal answer details
Close answer details
Question 27
Single choice
You encountered a major service outage that affected all users of the service for multiple hours. After several hours of incident management, the service returned to normal, and user access was restored. You need to provide an incident summary to relevant stakeholders following the Site Reliability Engineering recommended practices. What should you do first?
-
A
Call individual stakeholders to explain what happened.
-
B
Develop a post-mortem to be distributed to stakeholders.
-
C
Send the Incident State Document to all the stakeholders.
-
D
Require the engineer responsible to write an apology email to all stakeholders.
Reveal answer details
Close answer details
Correct answerB
Explanationhttps://sre.google/sre-book/postmortem-culture/
Question 28
Single choice
Your company is developing applications that are deployed on Google Kubernetes Engine (GKE). Each team manages a different application. You need to create the development and production environments for each team, while minimizing costs.
Different teams should not be able to access other teams environments. What should you do?
-
A
Create one GCP Project per team. In each project, create a cluster for Development and one for Production. Grant the teams IAM access to their respective clusters.
-
B
Create one GCP Project per team. In each project, create a cluster with a Kubernetes namespace for Development and one for Production. Grant the teams IAM access to their respective clusters.
-
C
Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Identity Aware Proxy so that each team can only
access its own namespace.
-
D
Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Kubernetes Role-based access control (RBAC) so that each team can only access its own namespace.
Reveal answer details
Close answer details
Correct answerD
Explanationhttps://cloud.google.com/architecture/prep-kubernetes-engine-for-prod#roles_and_groups
Question 29
Single choice
You are working with a government agency that requires you to archive application logs for seven years.
You need to configure Stackdriver to export and store the logs while minimizing costs of storage. What should you do?
-
A
Create a Cloud Storage bucket and develop your application to send logs directly to the bucket.
-
B
Develop an App Engine application that pulls the logs from Stackdriver and saves them in BigQuery.
-
C
Create an export in Stackdriver and configure Cloud Pub/Sub to store logs in permanent storage for seven years.
-
D
Create a sink in Stackdriver, name it, create a bucket on Cloud Storage for storing archived logs, and then select the bucket as the log export destination.
Reveal answer details
Close answer details
Correct answerD
Explanationhttps://cloud.google.com/logging/docs/routing/overview
|