Google Professional Cloud Developer practice questions

1. Question 1 of 25

   Select 2

   Your company wants to expand their users outside the United States for their popular application. The company wants to ensure 99.999% availability of the database for their application and also wants to minimize the read latency for their users across the globe. Which two actions should they take? (Choose two.)

   • ACreate a multi-regional Cloud Spanner instance with "nam-asia-eur1" configuration.
   • BCreate a multi-regional Cloud Spanner instance with "nam3" configuration.
   • CCreate a cluster with at least 3 Spanner nodes.
   • DCreate a cluster with at least 1 Spanner node.
   • ECreate a minimum of two Cloud Spanner instances in separate regions with at least one node.
   • FCreate a Cloud Dataflow pipeline to replicate data across different databases.

   Show answer

   Correct answer: A, C

   How others answered

   • AC100%

   Explanation

   https://cloud.google.com/spanner/docs/instances Above link supports A for "users across the globe" as per qn https://cloud.google.com/spanner/docs/latency Above link supports C for "minimize the read latency "

   Adapted from community discussion by syu31svc · 2021-12-20 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. E

      emmet

      2020-11-27

      7 upvotes

      I think the answer should be A) + something. They wants 99.999% availability - only multi-regional instance fits this. To minimize read latency nam-asia-eur1 instance works best as it has replicas in Noth America, Europe and Asia regions. As for second answer - I do not have strong opinion.. As per documentation "Adding nodes gives each replica more CPU and RAM, which increases the replica's throughput" and they recommend to choose number of nodes to "keep high priority total CPU utilization under 65%". So nodes are not about SLA and read latency. From another hand spanner "Cloud Spanner automatically replicates your data between regions with strong consistency guarantees" so no DataFlow pipeline needed to replicate data, unless the app has other DBs and ETL between Spanner and that DBs.

   2. S

      saurabh1805

      2021-05-06

      9 upvotes

      The more number of node less read latency hence i will go with option A and C

   3. S

      syu31svc

      2021-12-20

      6 upvotes

      https://cloud.google.com/spanner/docs/instances Above link supports A for "users across the globe" as per qn https://cloud.google.com/spanner/docs/latency Above link supports C for "minimize the read latency "

   4. M

      maxdanny

      2023-01-22

      4 upvotes

      C because the number of nodes increases the computational capabilities ( queries for seconds and so minor latency), F to cover worldwide availability; A it's wrong because the configuration "nam-asia-eur1" not exist, Google suggests "nam-eur-asia1" o "nam-eur-asia3", D it's wrong because the number of nodes is too few; E is too expensive a solution

2. Question 2 of 25

   You are developing a web application that will be accessible over both HTTP and HTTPS and will run on Compute Engine instances. On occasion, you will need to SSH from your remote laptop into one of the Compute Engine instances to conduct maintenance on the app. How should you configure the instances while following Google-recommended best practices?

   • ASet up a backend with Compute Engine web server instances with a private IP address behind a TCP proxy load balancer.
   • BConfigure the firewall rules to allow all ingress traffic to connect to the Compute Engine web servers, with each server having a unique external IP address.
   • CConfigure Cloud Identity-Aware Proxy API for SSH access. Then configure the Compute Engine servers with private IP addresses behind an HTTP(s) load balancer for the application web traffic.
   • DSet up a backend with Compute Engine web server instances with a private IP address behind an HTTP(S) load balancer. Set up a bastion host with a public IP address and open firewall ports. Connect to the web instances using the bastion host.

   Show answer

   Correct answer: C

   How others answered

   • C82%
   • D18%

   Explanation

   D. is a recommended way to configure the instances while following Google-recommended best practices. This approach provides several benefits: The web server instances are only accessible through the load balancer and not directly via their private IP addresses, which improves security. The bastion host acts as a secure jump box that allows you to SSH into the web server instances, while only allowing incoming SSH connections on a specific IP address (the bastion host's public IP). The firewall rules on the web server instances can be configured to only allow connections from the bastion host's IP, further reducing the attack surface. It is a more recommended to have a bastion host that is authorized by your organization to connect to private instances this way it can provide a better security to your instances. And also in terms of compliance, it will also follow the best practices of your organization.

   Adapted from community discussion by omermahgoub · 2023-01-10 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. O

      omermahgoub

      2023-01-10

      3 upvotes

      D. is a recommended way to configure the instances while following Google-recommended best practices. This approach provides several benefits: The web server instances are only accessible through the load balancer and not directly via their private IP addresses, which improves security. The bastion host acts as a secure jump box that allows you to SSH into the web server instances, while only allowing incoming SSH connections on a specific IP address (the bastion host's public IP). The firewall rules on the web server instances can be configured to only allow connections from the bastion host's IP, further reducing the attack surface. It is a more recommended to have a bastion host that is authorized by your organization to connect to private instances this way it can provide a better security to your instances. And also in terms of compliance, it will also follow the best practices of your organization.

   2. O

      omermahgoub

      2023-01-10

      3 upvotes

      C is a valid approach, but it may not be the best option for all use cases. Cloud IAP allows you to control access to resources in your project by using identity and access management (IAM) roles, which is a good way to secure SSH access. However, this option does not address the issue of securing incoming web traffic, which is a separate concern. Configuring the servers with private IP addresses behind an HTTP(s) load balancer would help with securing the web traffic, but it does not provide an additional layer of security for SSH access. Additionally, it does not have the concept of secure jump host, which is a security best practice in protecting your instances from unwanted incoming connections.

   3. T

      thewalker

      2024-07-19

      1 upvote

      Option A: TCP Proxy Load Balancer Not Ideal for Web Applications: TCP load balancers are better suited for applications that use TCP protocols, not HTTP/HTTPS. SSH Access: While you could potentially use a TCP load balancer for SSH, it's not the recommended approach. Option B: Open Firewall Rules Major Security Risk: Exposing your web servers directly to the internet with public IP addresses is a significant security vulnerability. Option C: Cloud Identity-Aware Proxy (IAP) for SSH Not Designed for SSH: IAP is primarily designed for secure access to web applications, not for SSH. While you could potentially use IAP for SSH, it's not a standard or recommended practice.

   4. C

      closer89

      2023-04-21

      1 upvote

      i go for C https://cloud.google.com/compute/docs/connect/ssh-using-iap IAP TCP forwarding enables you to establish an encrypted tunnel over which you can forward SSH connections to VMs. When you connect to a VM that uses IAP, IAP wraps the SSH connection inside HTTPS before forwarding the connection to the VM. Then, IAP checks if the you have the required IAM permissions and if you do, grants access to the VM. If you need to connect to a VM that doesn't have external IP addresses and you can't use IAP, review the other methods listed in Connection options for internal-only VMs.

3. Question 3 of 25

   You are developing a microservice-based application that will be deployed on a Google Kubernetes Engine cluster. The application needs to read and write to a Spanner database. You want to follow security best practices while minimizing code changes. How should you configure your application to retrieve Spanner credentials?

   • AConfigure the appropriate service accounts, and use Workload Identity to run the pods.
   • BStore the application credentials as Kubernetes Secrets, and expose them as environment variables.
   • CConfigure the appropriate routing rules, and use a VPC-native cluster to directly connect to the database.
   • DStore the application credentials using Cloud Key Management Service, and retrieve them whenever a database connection is made.

   Show answer

   Correct answer: A

   How others answered

   • A76%
   • B24%

   Explanation

   https://cloud.google.com/blog/products/containers-kubernetes/introducing-workload-identity-better-authentication-for-your-gke-applications A Cloud IAM service account is an identity that an application can use to make requests to Google APIs. As an application developer, you could generate individual IAM service accounts for each application, and then download and store the keys as a Kubernetes secret that you manually rotate. Not only is this process burdensome, but service account keys only expire every 10 years (or until you manually rotate them). In the case of a breach or compromise, an unaccounted-for key could mean prolonged access for an attacker. This potential blind spot, plus the management overhead of key inventory and rotation, makes using service account keys as secrets a less than ideal method for authenticating GKE workloads.

   Adapted from community discussion by kinoko1330 · 2022-08-15 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Kubernetes documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. K

      kinoko1330

      2022-08-15

      Selected A8 upvotes

      https://cloud.google.com/blog/products/containers-kubernetes/introducing-workload-identity-better-authentication-for-your-gke-applications A Cloud IAM service account is an identity that an application can use to make requests to Google APIs. As an application developer, you could generate individual IAM service accounts for each application, and then download and store the keys as a Kubernetes secret that you manually rotate. Not only is this process burdensome, but service account keys only expire every 10 years (or until you manually rotate them). In the case of a breach or compromise, an unaccounted-for key could mean prolonged access for an attacker. This potential blind spot, plus the management overhead of key inventory and rotation, makes using service account keys as secrets a less than ideal method for authenticating GKE workloads.

   2. H

      htakami

      2022-03-26

      5 upvotes

      I assume that nobody read through the official docs and GCP Best practices for K8s and Cloud SQL. https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine#secrets "A database credentials Secret includes the name of the database user you are connecting as, and the user's database password." The best answer here is B, having K8s Secrets is the go-to method to configure and store sensitive information within a cluster such as Spanner credentials

   3. O

      omermahgoub

      2023-01-11

      1 upvote

      A. Configure the appropriate service accounts, and use Workload Identity to run the pods. Workload Identity is a way to associate Kubernetes service accounts with Google Cloud IAM service accounts, allowing your pods to authenticate to Google Cloud services using their IAM identity. This means that you don't have to store application credentials in your code or in Kubernetes Secrets, and you can manage the permissions of your application in Google Cloud IAM. You would need to create service account in cloud IAM and a Kubernetes service account and then map them to use Workload Identity. You can also use gcloud command line to map the Kubernetes service account to the desired IAM service account. Then in your application, you can use the Kubernetes service account to authenticate to Spanner, which will authenticate as the mapped IAM service account. This way you don't have to hardcode credentials in your code, and you can easily manage the permissions of your application using Google Cloud IAM.

   4. T

      TNT87

      2022-11-21

      1 upvote

      It cant be B because Because Secrets can be created independently of the Pods that use them, there is less risk of the Secret (and its data) being exposed during the workflow of creating, viewing, and editing Pods. Kubernetes, and applications that run in your cluster, can also take additional precautions with Secrets, such as avoiding writing secret data to nonvolatile storage. Secrets are similar to ConfigMaps but are specifically intended to hold confidential data. Caution: Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd. Additionally, anyone who is authorized to create a Pod in a namespace can use that access to read any Secret in that namespace; this includes indirect access such as the ability to create a Deployment.

4. Question 4 of 25

   You manage an application that runs in a Compute Engine instance. You also have multiple backend services executing in stand-alone Docker containers running in Compute Engine instances. The Compute Engine instances supporting the backend services are scaled by managed instance groups in multiple regions. You want your calling application to be loosely coupled. You need to be able to invoke distinct service implementations that are chosen based on the value of an HTTP header found in the request. Which Google Cloud feature should you use to invoke the backend services?

   • ATraffic Director
   • BService Directory
   • CAnthos Service Mesh
   • DInternal HTTP(S) Load Balancing

   Show answer

   Correct answer: A

   How others answered

   • A81%

   Explanation

   "the backend services are scaled by managed instance groups in multiple regions", the Internal load balancer is a regional service, so It's A in my opinion. - "An internal HTTP(S) load balancer routes internal traffic to the service running on the VM. Traffic Director works with Cloud Load Balancing to provide a managed ingress experience. You set up an external or internal load balancer, and then configure that load balancer to send traffic to your microservices."

   Adapted from community discussion by [Removed] · 2022-05-06 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. [

      [Removed]

      2022-05-06

      9 upvotes

      "the backend services are scaled by managed instance groups in multiple regions", the Internal load balancer is a regional service, so It's A in my opinion. - "An internal HTTP(S) load balancer routes internal traffic to the service running on the VM. Traffic Director works with Cloud Load Balancing to provide a managed ingress experience. You set up an external or internal load balancer, and then configure that load balancer to send traffic to your microservices."

   2. T

      thewalker

      2024-07-19

      Selected A2 upvotes

      Traffic Director: Traffic Director is a Google Cloud service designed for advanced traffic management across multiple regions and zones. It allows you to route traffic based on various criteria, including HTTP headers. This makes it ideal for loosely coupled applications where you want to dynamically choose backend services based on request attributes. How Traffic Director Works: Routing Rules: You define routing rules in Traffic Director that specify how traffic should be directed based on HTTP headers, path patterns, or other criteria. Backend Services: You associate backend services with your routing rules. These backend services can be managed instance groups, network endpoint groups (NEGs), or other supported backends. Traffic Distribution: When a request arrives, Traffic Director evaluates the routing rules and directs the traffic to the appropriate backend service based on the matching criteria.

   3. T

      thewalker

      2024-07-19

      2 upvotes

      Let's look at why the other options are less ideal: B. Service Directory: Service Directory is primarily used for service discovery, allowing applications to find and connect to services within a cluster or across multiple clusters. While it can be used for routing, it's not as robust as Traffic Director for advanced traffic management. C. Anthos Service Mesh: Anthos Service Mesh is a powerful service mesh solution that provides features like traffic management, security, and observability. However, it's typically used for microservices running in Kubernetes environments, not for stand-alone Docker containers in Compute Engine. D. Internal HTTP(S) Load Balancing: Internal Load Balancing is designed for routing traffic within a VPC network. While it can handle basic routing, it doesn't offer the advanced features and flexibility of Traffic Director for dynamic routing based on HTTP headers.

   4. O

      omermahgoub

      2023-01-11

      Selected A1 upvote

      Traffic Director provides global traffic management for service meshes and hybrid deployments. It allows you to configure routing rules based on the values of HTTP headers, so you can direct traffic to different service implementations based on the value of an HTTP header found in the request. With Traffic Director, you can route traffic to different services running in different regions, and it also supports automatic failover, so you can ensure high availability for your backend services. In your case, you can configure Traffic Director to inspect the value of an HTTP header in the request, and then route the traffic to the appropriate service implementation running in different regions. This allows your application to invoke the backend services in a loosely coupled way, and ensures that the backend services can scale independently of the calling application.

5. Question 5 of 25

   You have containerized a legacy application that stores its configuration on an NFS share. You need to deploy this application to Google Kubernetes Engine (GKE) and do not want the application serving traffic until after the configuration has been retrieved. What should you do?

   • AUse the gsutil utility to copy files from within the Docker container at startup, and start the service using an ENTRYPOINT script.
   • BCreate a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.
   • CUse the COPY statement in the Dockerfile to load the configuration into the container image. Verify that the configuration is available, and start the service using an ENTRYPOINT script.
   • DAdd a startup script to the GKE instance group to mount the NFS share at node startup. Copy the configuration files into the container, and start the service using an ENTRYPOINT script.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   It's not necessary to mount NFS to each node in GKE. Just create PVC point to shared NFS, mount to container, and use configuration in ENTRYPOINT. Vote B

   Adapted from community discussion by Ksamilosb · 2022-02-20 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Kubernetes documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. K

      Ksamilosb

      2022-02-20

      8 upvotes

      It's not necessary to mount NFS to each node in GKE. Just create PVC point to shared NFS, mount to container, and use configuration in ENTRYPOINT. Vote B

   2. T

      thewalker

      2024-07-19

      Selected B1 upvote

      The best answer here is B. Create a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume and start the service using an ENTRYPOINT script. [1] Here's why: PersistentVolumeClaim (PVC): A PVC is the Kubernetes way to request storage. By creating a PVC that points to your NFS share, you ensure that your pods have access to the configuration files. This approach is more robust and scalable than copying files at startup. ENTRYPOINT Script: An ENTRYPOINT script is the ideal way to handle the startup logic. You can use it to: Mount the PVC volume. Verify that the configuration files are present. Start your application's main process.

   3. O

      omermahgoub

      2023-01-11

      Selected B1 upvote

      B and D are the main candidate answers Option B: allows the application to be stateless and have no dependencies on the filesystem of the host. D: is a good solution since it allows the application to access its configuration as soon as the application starts, without having to copy the configuration files into the container. But the best option is B, because it allows the application to be stateless and have no dependencies on the filesystem of the host. This approach is more flexible, makes it easy to update the configuration files, and reduces the size of the container image.

   4. J

      jnas

      2023-07-19

      Selected B1 upvote

      https://cloud.google.com/kubernetes-engine/docs/concepts/persistent-volumes. PersistentVolume resources are used to manage durable storage in a cluster. In GKE, a PersistentVolume is typically backed by a persistent disk. You can also use other storage solutions like NFS. Filestore is a NFS solution on Google Cloud

6. Question 6 of 25

   Your development team has been asked to refactor an existing monolithic application into a set of composable microservices. Which design aspects should you implement for the new application? (Choose two.)

   • ADevelop the microservice code in the same programming language used by the microservice caller.
   • BCreate an API contract agreement between the microservice implementation and microservice caller.
   • CRequire asynchronous communications between all microservice implementations and microservice callers.
   • DEnsure that sufficient instances of the microservice are running to accommodate the performance requirements.
   • EImplement a versioning scheme to permit future changes that could be incompatible with the current interface.

   Show answer

   Correct answer: B

   How others answered

   • B72%
   • E28%

   Only 72% agreed on this answer — treat it as contested rather than settled.

   Explanation

   BE is the answer. https://cloud.google.com/architecture/migrating-a-monolithic-app-to-microservices-gke#api_contracts Each microservice should be invoked only from a set of interfaces. Each interface should in turn be clearly defined by a contract that can be implemented using an API definition language like the OpenAPI Initiative specification or RAML. Having well-defined API contracts and interfaces allows you to develop tests as a main component of your solution (for example, by applying test-driven development) against these API interfaces. https://cloud.google.com/architecture/migrating-a-monolithic-app-to-microservices-gke#versioning To give you flexibility in managing updates that might break existing clients, you should implement a versioning scheme for your microservices. Versioning lets you deploy updated versions of a microservice without affecting the clients that are using an existing version.

   Adapted from community discussion by zellck · 2022-12-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. Z

      zellck

      2022-12-20

      Selected B2 upvotes

      BE is the answer. https://cloud.google.com/architecture/migrating-a-monolithic-app-to-microservices-gke#api_contracts Each microservice should be invoked only from a set of interfaces. Each interface should in turn be clearly defined by a contract that can be implemented using an API definition language like the OpenAPI Initiative specification or RAML. Having well-defined API contracts and interfaces allows you to develop tests as a main component of your solution (for example, by applying test-driven development) against these API interfaces. https://cloud.google.com/architecture/migrating-a-monolithic-app-to-microservices-gke#versioning To give you flexibility in managing updates that might break existing clients, you should implement a versioning scheme for your microservices. Versioning lets you deploy updated versions of a microservice without affecting the clients that are using an existing version.

   2. O

      omermahgoub

      2023-01-11

      Selected B1 upvote

      B. Guarantees that the two parties are communicating in a well-defined way, which makes the microservices more flexible, composable, and easy to understand. E. Allows to make changes to the service's API while still maintaining backward compatibility. With versioning, new and old consumers can continue to use the service without interruption as new features are added. On the other hand, developing the microservice code in the same programming language as the microservice caller does not promote loose coupling, and it may also increase the complexity of the system as it will depend on language-specific features. Asynchronous communications are also not always necessary and depend on the use case and requirement. Ensuring sufficient instances of the microservice are running can be done by using a scalability strategy such as Auto-scaling, and this is not a specific design aspect.

   3. _

      __rajan__

      2023-09-21

      Selected B2 upvotes

      BD : is the correct one here. Create an API contract agreement between the microservice implementation and microservice caller. This will help to ensure that the microservices are decoupled from each other, and that the caller can be updated without having to update the implementation. Ensure that sufficient instances of the microservice are running to accommodate the performance requirements. This is important because microservices are often scaled independently, and you need to make sure that each microservice can handle the expected load.

   4. T

      thewalker

      2024-07-19

      1 upvote

      Let's look at why the other options are less critical: A. Develop the microservice code in the same programming language used by the microservice caller. While using the same language can simplify initial development, it's not a strict requirement. Microservices can be written in different languages as long as they adhere to the API contract. C. Require asynchronous communications between all microservice implementations and microservice callers. Asynchronous communication is often beneficial for microservices, but it's not always necessary. Synchronous communication can be appropriate in some cases, especially for tightly coupled services. D. Ensure that sufficient instances of the microservice are running to accommodate the performance requirements. This is important for scaling and performance, but it's more of an operational concern than a design aspect. It's handled through deployment strategies and monitoring.

7. Question 7 of 25

   Your team develops services that run on Google Cloud. You want to process messages sent to a Pub/Sub topic, and then store them. Each message must be processed exactly once to avoid duplication of data and any data conflicts. You need to use the cheapest and most simple solution. What should you do?

   • AProcess the messages with a Dataproc job, and write the output to storage.
   • BProcess the messages with a Dataflow streaming pipeline using Apache Beam's PubSubIO package, and write the output to storage.
   • CProcess the messages with a Cloud Function, and write the results to a BigQuery location where you can run a job to deduplicate the data.
   • DRetrieve the messages with a Dataflow streaming pipeline, store them in Cloud Bigtable, and use another Dataflow streaming pipeline to deduplicate messages.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Answer is B https://cloud.google.com/blog/products/data-analytics/handling-duplicate-data-in-streaming-pipeline-using-pubsub-dataflow "...because Pub/Sub provides each message with a unique message_id, Dataflow uses it to deduplicate messages by default if you use the built-in Apache Beam PubSubIO"

   Adapted from community discussion by wrakky · 2024-01-04 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion3

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. W

      wrakky

      2024-01-04

      4 upvotes

      Answer is B https://cloud.google.com/blog/products/data-analytics/handling-duplicate-data-in-streaming-pipeline-using-pubsub-dataflow "...because Pub/Sub provides each message with a unique message_id, Dataflow uses it to deduplicate messages by default if you use the built-in Apache Beam PubSubIO"

   2. T

      TNT87

      2023-12-24

      Selected B1 upvote

      https://cloud.google.com/pubsub/docs/stream-messages-dataflow https://cloud.google.com/community/tutorials/pubsub-spring-dedup-messages https://cloud.google.com/blog/products/data-analytics/handling-duplicate-data-in-streaming-pipeline-using-pubsub-dataflow

   3. Z

      zellck

      2023-12-16

      Selected B1 upvote

      B is the answer. https://cloud.google.com/dataflow/docs/concepts/streaming-with-cloud-pubsub

8. Question 8 of 25

   You manage your company's ecommerce platform's payment system, which runs on Google Cloud. Your company must retain user logs for 1 year for internal auditing purposes and for 3 years to meet compliance requirements. You need to store new user logs on Google Cloud to minimize on-premises storage usage and ensure that they are easily searchable. You want to minimize effort while ensuring that the logs are stored correctly. What should you do?

   • AStore the logs in a Cloud Storage bucket with bucket lock turned on.
   • BStore the logs in a Cloud Storage bucket with a 3-year retention period.
   • CStore the logs in Cloud Logging as custom logs with a custom retention period.
   • DStore the logs in a Cloud Storage bucket with a 1-year retention period. After 1 year, move the logs to another bucket with a 2-year retention period.

   Show answer

   Correct answer: C

   How others answered

   • C88%

   Explanation

   The requirements say that the logs should be easily searchable. This is not easily achieved in Cloud Storage, so that eliminates A,B and D. That leaves C and the valid option. Note, that it's possible to configure Cloud Logging with a custom retention period. https://cloud.google.com/logging/docs/buckets#custom-retention

   Adapted from community discussion by micoams · 2023-12-19 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. M

      micoams

      2023-12-19

      Selected C9 upvotes

      The requirements say that the logs should be easily searchable. This is not easily achieved in Cloud Storage, so that eliminates A,B and D. That leaves C and the valid option. Note, that it's possible to configure Cloud Logging with a custom retention period. https://cloud.google.com/logging/docs/buckets#custom-retention

   2. Z

      zellck

      2023-12-22

      Selected C2 upvotes

      C is the correct answer instead. https://cloud.google.com/logging/docs/routing/overview#logs-retention Cloud Logging retains logs according to retention rules applying to the log bucket type where the logs are held. You can configure Cloud Logging to retain logs between 1 day and 3650 days. Custom retention rules apply to all the logs in a bucket, regardless of the log type or whether that log has been copied from another location.

   3. P

      purushi

      2024-08-06

      Selected C1 upvote

      Tricky question. Easily searchable is the key here. Cloud logging supports retaining the logs between 1 to 3650 (10 years max) and we can set custom retention period on the cloud logs.

   4. T

      telp

      2024-01-08

      Selected C1 upvote

      C is the correct answer because Cloud Logging to retain logs between 1 day and 3650 days

9. Question 9 of 25

   Your organization has recently begun an initiative to replatform their legacy applications onto Google Kubernetes Engine. You need to decompose a monolithic application into microservices. Multiple instances have read and write access to a configuration file, which is stored on a shared file system. You want to minimize the effort required to manage this transition, and you want to avoid rewriting the application code. What should you do?

   • ACreate a new Cloud Storage bucket, and mount it via FUSE in the container.
   • BCreate a new persistent disk, and mount the volume as a shared PersistentVolume.
   • CCreate a new Filestore instance, and mount the volume as an NFS PersistentVolume.
   • DCreate a new ConfigMap and volumeMount to store the contents of the configuration file.

   Show answer

   Correct answer: C

   How others answered

   • C83%
   • D17%

   Explanation

   A is incorrect, because Cloud Storage FUSE does not support concurrency and file locking. B is incorrect, because a persistent disk PersistentVolume is not read-write-many. It can only be read-write once or read-many. C is correct, because it’s the only managed, supported read-write-many storage option available for file-system access in Google Kubernetes Engine. D is incorrect, because the ConfigMap cannot be written to from the Pods. https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes https://cloud.google.com/filestore/docs/accessing-fileshares https://cloud.google.com/storage/docs/gcs-fuse

   Adapted from community discussion by x_cath · 2023-06-23 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Kubernetes documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Kubernetes documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

   1. X

      x_cath

      2023-06-23

      Selected C12 upvotes

      A is incorrect, because Cloud Storage FUSE does not support concurrency and file locking. B is incorrect, because a persistent disk PersistentVolume is not read-write-many. It can only be read-write once or read-many. C is correct, because it’s the only managed, supported read-write-many storage option available for file-system access in Google Kubernetes Engine. D is incorrect, because the ConfigMap cannot be written to from the Pods. https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes https://cloud.google.com/filestore/docs/accessing-fileshares https://cloud.google.com/storage/docs/gcs-fuse

   2. T

      TNT87

      2023-06-22

      Selected C3 upvotes

      Answer C An nfs volume allows an existing NFS (Network File System) share to be mounted into a Pod. Unlike emptyDir, which is erased when a Pod is removed, the contents of an nfs volume are preserved and the volume is merely unmounted. This means that an NFS volume can be pre-populated with data, and that data can be shared between pods

   3. U

      Underverse

      2023-06-20

      Selected C3 upvotes

      Generally ConfigMaps (D) are the right choice to store pod config-files, but: They are read-only, which does not match what is asked for here. If, as stated in the question, the application-parts need to be able to also write to that Configfile that should be on a shared file system, the only valid choice is a NFS PV.

   4. Z

      zellck

      2023-06-22

      Selected C2 upvotes

      C is the correct answer instead. https://kubernetes.io/docs/concepts/storage/volumes/#nfs An nfs volume allows an existing NFS (Network File System) share to be mounted into a Pod. Unlike emptyDir, which is erased when a Pod is removed, the contents of an nfs volume are preserved and the volume is merely unmounted. This means that an NFS volume can be pre-populated with data, and that data can be shared between pods. NFS can be mounted by multiple writers simultaneously.

10. Question 10 of 25

    You are writing from a Go application to a Cloud Spanner database. You want to optimize your application’s performance using Google-recommended best practices. What should you do?

    • AWrite to Cloud Spanner using Cloud Client Libraries.
    • BWrite to Cloud Spanner using Google API Client Libraries
    • CWrite to Cloud Spanner using a custom gRPC client library.
    • DWrite to Cloud Spanner using a third-party HTTP client library.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A is correct BC are part of A D idk “Cloud Client Libraries are the recommended option for accessing Cloud APIs programmatically, where available. Cloud Client Libraries use the latest client library models” https://cloud.google.com/apis/docs/client-libraries-explained https://cloud.google.com/go/docs/reference

    Adapted from community discussion by melisargh · 2023-06-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google developer documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. M

       melisargh

       2023-06-12

       Selected A2 upvotes

       A is correct BC are part of A D idk “Cloud Client Libraries are the recommended option for accessing Cloud APIs programmatically, where available. Cloud Client Libraries use the latest client library models” https://cloud.google.com/apis/docs/client-libraries-explained https://cloud.google.com/go/docs/reference

    2. P

       purushi

       2024-02-07

       Selected A2 upvotes

       We should know what cloud client libraries are. Pl refer to https://cloud.google.com/apis/docs/cloud-client-libraries

    3. A

       alpha_canary

       2024-10-12

       Selected A1 upvote

       https://cloud.google.com/spanner/docs/reference/libraries#client-libraries-install-go:~:text=Although%20you%20can%20use%20Google%20Cloud%20APIs%20directly%20by%20making%20raw%20requests%20to%20the%20server%2C%20client%20libraries%20provide%20simplifications%20that%20significantly%20reduce%20the%20amount%20of%20code%20you%20need%20to%20write

    4. Z

       zellck

       2023-06-13

       Selected A2 upvotes

       A is the answer. https://cloud.google.com/spanner/docs/reference/libraries

11. Question 11 of 25

    You need to deploy resources from your laptop to Google Cloud using Terraform. Resources in your Google Cloud environment must be created using a service account. Your Cloud Identity has the roles/iam.serviceAccountTokenCreator Identity and Access Management (IAM) role and the necessary permissions to deploy the resources using Terraform. You want to set up your development environment to deploy the desired resources following Google-recommended best practices. What should you do?

    • A1. Download the service account’s key file in JSON format, and store it locally on your laptop. 2. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of your downloaded key file.
    • B1. Run the following command from a command line: gcloud config set auth/impersonate_service_account [email protected]. 2. Set the GOOGLE_OAUTH_ACCESS_TOKEN environment variable to the value that is returned by the gcloud auth print-access-token command.
    • C1. Run the following command from a command line: gcloud auth application-default login. 2. In the browser window that opens, authenticate using your personal credentials.
    • D1. Store the service account's key file in JSON format in Hashicorp Vault. 2. Integrate Terraform with Vault to retrieve the key file dynamically, and authenticate to Vault using a short-lived access token.

    Show answer

    Correct answer: B

    How others answered

    • B89%

    Explanation

    A&D assume that you download and store SA keys, which violates best practices, since you potentially loose control over what happens to those credentials and makes it impossible to track who actually uses the SA. D makes it even worse since it requires you to maintain you own secret management to minimize the risk. C does nothing that would give you the SA permissions you need. B follows best practices, since impersonation permissions can be managed transparently via IAM and via logs you can also see who impersonated/used the SA.

    Adapted from community discussion by Underverse · 2022-12-22 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. U

       Underverse

       2022-12-22

       Selected B5 upvotes

       A&D assume that you download and store SA keys, which violates best practices, since you potentially loose control over what happens to those credentials and makes it impossible to track who actually uses the SA. D makes it even worse since it requires you to maintain you own secret management to minimize the risk. C does nothing that would give you the SA permissions you need. B follows best practices, since impersonation permissions can be managed transparently via IAM and via logs you can also see who impersonated/used the SA.

    2. T

       TNT87

       2023-01-04

       Selected B4 upvotes

       https://cloud.google.com/blog/topics/developers-practitioners/using-google-cloud-service-account-impersonation-your-terraform-code Answer B not D

    3. M

       micoams

       2022-12-19

       Selected B2 upvotes

       I think it's option B. The question already says that you have the role for impersonating the service account. This means that option B is a viable, as you can impersonate that service account, and get a token that has the required level of access to create resources.

    4. A

       alpha_canary

       2024-04-13

       Selected B1 upvote

       https://cloud.google.com/docs/authentication/use-service-account-impersonation https://medium.com/bluetuple-ai/terraform-remote-state-on-gcp-d50e2f69b967

12. Question 12 of 25

    Your company uses Cloud Logging to manage large volumes of log data. You need to build a real-time log analysis architecture that pushes logs to a third-party application for processing. What should you do?

    • ACreate a Cloud Logging log export to Pub/Sub.
    • BCreate a Cloud Logging log export to BigQuery.
    • CCreate a Cloud Logging log export to Cloud Storage.
    • DCreate a Cloud Function to read Cloud Logging log entries and send them to the third-party application.

    Show answer

    Correct answer: A

    How others answered

    • A71%
    • B24%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    My answer is A. Third party service is the one responsible for analytics. From Google cloud we just need to push the log messages to a third party application for analytics that is the part of analytics architecture. Real time push means, I go with Pub-sub.

    Adapted from community discussion by purushi · 2024-02-07 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. J

       jcataluna

       2023-06-13

       Selected A4 upvotes

       A -> real-time to a third party app . pubsub.. !C-> GCS not realtime !B -> No third party

    2. P

       Pime13

       2023-08-28

       Selected A1 upvote

       https://cloud.google.com/logging/docs/export/configure_export_v2#overview https://cloud.google.com/logging/docs/export/pubsub: This document explains how you can find log entries that you routed from Cloud Logging to Pub/Sub topics, which occurs in near real-time. We recommend using Pub/Sub for integrating Cloud Logging logs with third-party software. When you route logs to a Pub/Sub topic, Logging publishes each log entry as a Pub/Sub message as soon as Logging receives that log entry. Routed logs are generally available within seconds of their arrival to Logging, with 99% of logs available in less than 60 seconds.

    3. A

       alpha_canary

       2024-10-13

       Selected A1 upvote

       A: Creating a Cloud Logging log export to Pub/Sub is the correct solution for this scenario. Pub/Sub is designed for real-time messaging and can push messages (in this case, log entries) to a third-party application for processing. B: While BigQuery is great for analyzing large volumes of data, it's not designed for real-time data pushing to third-party applications. D: Creating a Cloud Function to read log entries and send them to a third-party application could work, but it would add unnecessary complexity. Using Pub/Sub is a simpler and more efficient solution.

    4. P

       purushi

       2024-02-07

       Selected A2 upvotes

       My answer is A. Third party service is the one responsible for analytics. From Google cloud we just need to push the log messages to a third party application for analytics that is the part of analytics architecture. Real time push means, I go with Pub-sub.

13. Question 13 of 25

    Select 2

    You are deploying a microservices application to Google Kubernetes Engine (GKE) that will broadcast livestreams. You expect unpredictable traffic patterns and large variations in the number of concurrent users. Your application must meet the following requirements: • Scales automatically during popular events and maintains high availability • Is resilient in the event of hardware failures How should you configure the deployment parameters? (Choose two.)

    • ADistribute your workload evenly using a multi-zonal node pool.
    • BDistribute your workload evenly using multiple zonal node pools.
    • CUse cluster autoscaler to resize the number of nodes in the node pool, and use a Horizontal Pod Autoscaler to scale the workload.
    • DCreate a managed instance group for Compute Engine with the cluster nodes. Configure autoscaling rules for the managed instance group.
    • ECreate alerting policies in Cloud Monitoring based on GKE CPU and memory utilization. Ask an on-duty engineer to scale the workload by executing a script when CPU and memory usage exceed predefined thresholds.

    Show answer

    Correct answer: A, C

    How others answered

    • AC65%
    • BC35%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I don't know if I understood it wrong, but it seems that a multizonal cluster automatically has multizonal node pools, isn't that right? Link: https://cloud.google.com/kubernetes-engine/docs/concepts/node-pools

    Adapted from community discussion by angelica_santos · 2023-06-25 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. C

       closer89

       2023-10-23

       Selected A, C5 upvotes

       https://cloud.google.com/kubernetes-engine/docs/concepts/planning-scalability#choosing_multi-zonal_or_single-zone_node_pools

    2. A

       alpha_canary

       2024-10-13

       Selected A, C1 upvote

       A: https://cloud.google.com/kubernetes-engine/docs/concepts/planning-scalability#choosing_multi-zonal_or_single-zone_node_pools:~:text=To%20deploy%20a%20highly%20available%20application%2C%20distribute%20your%20workload%20across%20multiple%20compute%20zones%20in%20a%20region%20by%20using%20multi%2Dzonal%20node%20pools%20which%20distribute%20nodes%20uniformly%20across%20zones. C: https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-autoscaler#how_cluster_autoscaler_works https://cloud.google.com/kubernetes-engine/docs/concepts/horizontalpodautoscaler

    3. A

       angelica_santos

       2023-06-25

       2 upvotes

       I don't know if I understood it wrong, but it seems that a multizonal cluster automatically has multizonal node pools, isn't that right? Link: https://cloud.google.com/kubernetes-engine/docs/concepts/node-pools

    4. M

       Mark4321

       2023-07-05

       2 upvotes

       A says "using multi-zonal node pools" so I think it is not in contradiction with what you copied from the document. B is not reffering to multi-zonal pools at all.So I think it is A.

14. Question 14 of 25

    You recently deployed a Go application on Google Kubernetes Engine (GKE). The operations team has noticed that the application's CPU usage is high even when there is low production traffic. The operations team has asked you to optimize your application's CPU resource consumption. You want to determine which Go functions consume the largest amount of CPU. What should you do?

    • ADeploy a Fluent Bit daemonset on the GKE cluster to log data in Cloud Logging. Analyze the logs to get insights into your application code’s performance.
    • BCreate a custom dashboard in Cloud Monitoring to evaluate the CPU performance metrics of your application.
    • CConnect to your GKE nodes using SSH. Run the top command on the shell to extract the CPU utilization of your application.
    • DModify your Go application to capture profiling data. Analyze the CPU metrics of your application in flame graphs in Profiler.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    D is the answer. https://cloud.google.com/profiler/docs/about-profiler Cloud Profiler is a statistical, low-overhead profiler that continuously gathers CPU usage and memory-allocation information from your production applications. It attributes that information to the source code that generated it, helping you identify the parts of your application that are consuming the most resources, and otherwise illuminating your applications performance characteristics.

    Adapted from community discussion by zellck · 2023-06-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. Z

       zellck

       2023-06-12

       Selected D2 upvotes

       D is the answer. https://cloud.google.com/profiler/docs/about-profiler Cloud Profiler is a statistical, low-overhead profiler that continuously gathers CPU usage and memory-allocation information from your production applications. It attributes that information to the source code that generated it, helping you identify the parts of your application that are consuming the most resources, and otherwise illuminating your applications performance characteristics.

    2. P

       Pime13

       2023-08-26

       Selected D2 upvotes

       https://cloud.google.com/profiler/docs Cloud Profiler is a statistical, low-overhead profiler that continuously gathers CPU usage and memory-allocation information from your production applications. It attributes that information to the application's source code, helping you identify the parts of the application consuming the most resources, and otherwise illuminating the performance characteristics of the code

    3. A

       alpha_canary

       2024-10-13

       Selected D1 upvote

       https://cloud.google.com/profiler/docs/profiling-go https://cloud.google.com/profiler/docs/interacting-flame-graph

    4. P

       purushi

       2024-02-07

       Selected D1 upvote

       Key here is flame graphs from the profiler. So using cloud profiler is the right choice.

15. Question 15 of 25

    You are deploying a microservices application to Google Kubernetes Engine (GKE). The application will receive daily updates. You expect to deploy a large number of distinct containers that will run on the Linux operating system (OS). You want to be alerted to any known OS vulnerabilities in the new containers. You want to follow Google-recommended best practices. What should you do?

    • AUse the gcloud CLI to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.
    • BEnable Container Analysis, and upload new container images to Artifact Registry. Review the vulnerability results before each deployment.
    • CEnable Container Analysis, and upload new container images to Artifact Registry. Review the critical vulnerability results before each deployment.
    • DUse the Container Analysis REST API to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.

    Show answer

    Correct answer: B

    How others answered

    • B90%

    Explanation

    B. Actually the tricky part for this question is: Is the Container Analysis enabled by default? Can Container Analysis be called on-demand via REST without specifically enabled it? By default GCP does not enable Container Analysis; that's why D is out.

    Adapted from community discussion by zanhsieh · 2024-06-23 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. P

       Pime13

       2024-02-20

       Selected B1 upvote

       https://cloud.google.com/artifact-registry/docs/analysis Vulnerability scanning can occur automatically or on-demand: When automatic scanning is enabled, scanning triggers automatically every time you push a new image to Artifact Registry or Container Registry. Vulnerability information is continuously updated when new vulnerabilities are discovered. When On-Demand Scanning is enabled, you must run a command to scan a local image or an image in Artifact Registry or Container Registry. On-Demand Scanning gives you more flexibility around when you scan containers. For example, you can scan a locally-built image and remediate vulnerabilities before storing it in a registry. Scanning results are available for up to 48 hours after the scan is completed, and vulnerability information is not updated after the scan.

    2. T

       TNT87

       2023-12-27

       Selected B1 upvote

       Container Analysis is a service that provides vulnerability scanning and metadata storage for containers. The scanning service performs vulnerability scans on images in Container Registry and Artifact Registry, then stores the resulting metadata and makes it available for consumption through an API. Metadata storage allows storing information from different sources, including vulnerability scanning, other Google Cloud services, and third-party providers. https://cloud.google.com/container-analysis/docs/container-analysis

    3. Z

       zanhsieh

       2024-06-23

       Selected B2 upvotes

       B. Actually the tricky part for this question is: Is the Container Analysis enabled by default? Can Container Analysis be called on-demand via REST without specifically enabled it? By default GCP does not enable Container Analysis; that's why D is out.

    4. K

       kisswd

       2023-12-04

       Selected B1 upvote

       "Container Analysis REST API" doesn't exist. https://cloud.google.com/container-analysis/docs/os-overview says: The Container Scanning API allows you to automate OS vulnerability detection, scanning each time you push an image to Container Registry or Artifact Registry. Enabling this API also triggers language package scans for Go and Java vulnerabilities (Preview).

16. Question 16 of 25

    Select 2

    You recently developed a new application. You want to deploy the application on Cloud Run without a Dockerfile. Your organization requires that all container images are pushed to a centrally managed container repository. How should you build your container using Google Cloud services? (Choose two.)

    • APush your source code to Artifact Registry.
    • BSubmit a Cloud Build job to push the image.
    • CUse the pack build command with pack CLI.
    • DInclude the --source flag with the gcloud run deploy CLI command.
    • EInclude the --platform=kubernetes flag with the gcloud run deploy CLI command.

    Show answer

    Correct answer: C, D

    How others answered

    • CD59%
    • BC18%
    • AB18%

    Only 59% agreed on this answer — treat it as contested rather than settled.

    Explanation

    C: “For example, use buildpacks to build the source code of your Cloud Run service into a container image.” - https://cloud.google.com/docs/buildpacks/build-application Also, https://cloud.google.com/blog/products/containers-kubernetes/google-cloud-now-supports-buildpacks D: “If no Dockerfile is present in the source code directory, Google Cloud's buildpacks automatically detects the language you are using and fetches the dependencies of the code to make a production-ready container image, using a secure base image managed by Google.” - https://cloud.google.com/run/docs/deploying-source-code

    Adapted from community discussion by wanrltw · 2024-06-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. X

       x_cath

       2023-06-12

       4 upvotes

       C and D. C: Google Cloud for buildpacks—an open-source technology that makes it fast and easy for you to create secure, production-ready container images from source code and without a Dockerfile. https://cloud.google.com/blog/products/containers-kubernetes/google-cloud-now-supports-buildpacks (also mentioned by TNT87) D: Deploying from source code. "This page describes how to deploy new services and new revisions to Cloud Run directly from source code using a single gcloud CLI command, gcloud run deploy with the --source flag." https://cloud.google.com/run/docs/deploying-source-code A is incorrect because Artifact Registry is for container images, not source code. B is incorrect because only the built image is needed to be deployed to Cloud Run. "A centrally managed container repository" can be somewhere outside of Google, so as the build tool. It doesn't necessary to be built on Cloud Build. E is irrelevant in this case, as K8S is not involved in this question.

    2. O

       omermahgoub

       2023-07-27

       3 upvotes

       Option C, Use the pack build command with pack CLI, is not correct because Cloud Run does not support the use of the pack CLI. Option D, Include the --source flag with the gcloud run deploy CLI command, is not correct because this flag is used to specify the source code location when deploying the application, not building the container. Option E, Include the --platform=kubernetes flag with the gcloud run deploy CLI command, is not correct because this flag is used to specify the platform when deploying the application on Kubernetes and not Cloud Run.

    3. W

       wanrltw

       2024-06-12

       Selected C, D2 upvotes

       C: “For example, use buildpacks to build the source code of your Cloud Run service into a container image.” - https://cloud.google.com/docs/buildpacks/build-application Also, https://cloud.google.com/blog/products/containers-kubernetes/google-cloud-now-supports-buildpacks D: “If no Dockerfile is present in the source code directory, Google Cloud's buildpacks automatically detects the language you are using and fetches the dependencies of the code to make a production-ready container image, using a secure base image managed by Google.” - https://cloud.google.com/run/docs/deploying-source-code

    4. Z

       zellck

       2023-06-14

       Selected C, D1 upvote

       CD is the answer. https://cloud.google.com/run/docs/deploying-source-code This page describes how to deploy new services and new revisions to Cloud Run directly from source code using a single gcloud CLI command, gcloud run deploy with the --source flag. Behind the scenes, this command uses Google Cloud's buildpacks and Cloud Build to automatically build container images from your source code without having to install Docker on your machine or set up buildpacks or Cloud Build.

17. Question 17 of 25

    You have an application running on Google Kubernetes Engine (GKE). The application is currently using a logging library and is outputting to standard output. You need to export the logs to Cloud Logging, and you need the logs to include metadata about each request. You want to use the simplest method to accomplish this. What should you do?

    • AChange your application’s logging library to the Cloud Logging library, and configure your application to export logs to Cloud Logging.
    • BUpdate your application to output logs in JSON format, and add the necessary metadata to the JSON.
    • CUpdate your application to output logs in CSV format, and add the necessary metadata to the CSV.
    • DInstall the Fluent Bit agent on each of your GKE nodes, and have the agent export all logs from /var/log.

    Show answer

    Correct answer: A

    How others answered

    • A48%
    • B48%

    Only 48% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The answer is B since GKE is integrated with Cloud Logging by default. "By default, GKE clusters are natively integrated with Cloud Logging (and Monitoring). When you create a GKE cluster, both Monitoring and Cloud Logging are enabled by default." "GKE deploys a per-node logging agent that reads container logs, adds helpful metadata, and then sends the logs to the logs router, which sends the logs to Cloud Logging and any of the Logging sink destinations that you have configured. Cloud Logging stores logs for the duration that you specify or 30 days by default. Because Cloud Logging automatically collects standard output and error logs for containerized processes, you can start viewing your logs as soon as your application is deployed." Source: https://cloud.google.com/blog/products/management-tools/using-logging-your-apps-running-kubernetes-engine

    Adapted from community discussion by aldi22 · 2023-04-17 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. A

       aldi22

       2023-04-17

       12 upvotes

       The answer is B since GKE is integrated with Cloud Logging by default. "By default, GKE clusters are natively integrated with Cloud Logging (and Monitoring). When you create a GKE cluster, both Monitoring and Cloud Logging are enabled by default." "GKE deploys a per-node logging agent that reads container logs, adds helpful metadata, and then sends the logs to the logs router, which sends the logs to Cloud Logging and any of the Logging sink destinations that you have configured. Cloud Logging stores logs for the duration that you specify or 30 days by default. Because Cloud Logging automatically collects standard output and error logs for containerized processes, you can start viewing your logs as soon as your application is deployed." Source: https://cloud.google.com/blog/products/management-tools/using-logging-your-apps-running-kubernetes-engine

    2. M

       mrvergara

       2023-02-04

       Selected A4 upvotes

       Option D, installing the Fluent Bit agent on each of your GKE nodes, is not the most straightforward method for exporting logs to Cloud Logging, as it requires manual configuration and management of the Fluent Bit agent. While Fluent Bit can be used to collect and forward logs to Cloud Logging, it is typically used for more complex logging scenarios where custom log processing is required. Using the Cloud Logging library, as described in Option A, is a simpler and more direct method for exporting logs to Cloud Logging, as it eliminates the need to manage an additional log agent and provides a more integrated solution for logging in a GKE environment.

    3. S

       sac60

       2024-12-29

       1 upvote

       Correct answer A. Update your application to output logs in JSON format, and add the necessary metadata to the JSON. A is correct because it’s the easiest way to get a rich format into Cloud Logging. GKE automatically forwards logs sent to stdout to Cloud Logging. As long as it has the right JSON format, Cloud Logging will ingest the rich message B is not correct because it would require a lot of extra work to replace the library, and replicate the extra information (such as pod name) that the GKE logs exporter automatically provides. C is not correct because this is only needed for pods (normally special/privileged pods) that write directly to the GKE file system. D is not correct because Cloud Logging doesn’t support ingesting CSV. https://cloud.google.com/blog/products/management-tools/using-logging-your-apps-running-kubernetes-engine https://cloud.google.com/logging/docs/structured-logging#special-payload-fields

    4. D

       d_ella2001

       2024-07-13

       1 upvote

       Feedback B is correct because it’s the easiest way to get a rich format into Cloud Logging. GKE automatically forwards logs sent to stdout to Cloud Logging. As long as it has the right JSON format, Cloud Logging will ingest the rich message A is not correct because it would require a lot of extra work to replace the library, and replicate the extra information (such as pod name) that the GKE logs exporter automatically provides. D is not correct because this is only needed for pods (normally special/privileged pods) that write directly to the GKE file system. C is not correct because Cloud Logging doesn’t support ingesting CSV.

18. Question 18 of 25

    You are developing a new application. You want the application to be triggered only when a given file is updated in your Cloud Storage bucket. Your trigger might change, so your process must support different types of triggers. You want the configuration to be simple so that multiple team members can update the triggers in the future. What should you do?

    • AConfigure Cloud Storage events to be sent to Pub/Sub, and use Pub/Sub events to trigger a Cloud Build job that executes your application.
    • BCreate an Eventarc trigger that monitors your Cloud Storage bucket for a specific filename, and set the target as Cloud Run.
    • CConfigure a Cloud Function that executes your application and is triggered when an object is updated in Cloud Storage.
    • DConfigure a Firebase function that executes your application and is triggered when an object is updated in Cloud Storage.

    Show answer

    Correct answer: B

    How others answered

    • B67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B- is correct because Eventarc supports exible lters and you can create triggers based on lename patterns. Question is from Sample exam available on official GCP site. https://cloud.google.com/eventarc/docs/event-driven-architectures https://cloud.google.com/functions/docs/calling/storage https://cloud.google.com/storage/docs/reporting-changes https://cloud.google.com/build/docs/automating-builds/create-pubsub-triggers#gcs_build_trigger https://cloud.google.com/eventarc/docs/overview https://firebase.google.com/docs/functions/gcp-storage-events https://cloud.google.com/eventarc/docs/run/create-trigger#trigger-setup

    Adapted from community discussion by rglearn · 2024-06-29 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion3

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. P

       plutonians123

       2023-12-03

       Selected B3 upvotes

       Given the requirement in the question for a process that supports different types of triggers and allows for easy updating by multiple team members, Option B (Create an Eventarc trigger that monitors your Cloud Storage bucket for a specific filename, and set the target as Cloud Run) seems more relevant. This option offers greater flexibility for handling various types of triggers with Eventarc, which can be crucial if the application's triggering requirements change over time. Eventarc's ability to integrate with multiple Google Cloud services and route events to Cloud Run provides a robust and scalable solution for diverse event handling. This aligns well with the need for a versatile and easily updatable trigger mechanism.

    2. R

       rglearn

       2024-06-29

       Selected B3 upvotes

       B- is correct because Eventarc supports exible lters and you can create triggers based on lename patterns. Question is from Sample exam available on official GCP site. https://cloud.google.com/eventarc/docs/event-driven-architectures https://cloud.google.com/functions/docs/calling/storage https://cloud.google.com/storage/docs/reporting-changes https://cloud.google.com/build/docs/automating-builds/create-pubsub-triggers#gcs_build_trigger https://cloud.google.com/eventarc/docs/overview https://firebase.google.com/docs/functions/gcp-storage-events https://cloud.google.com/eventarc/docs/run/create-trigger#trigger-setup

    3. W

       wanrltw

       2023-12-18

       1 upvote

       Another requirement is to keep it as simple as possible. C is correct

19. Question 19 of 25

    Your application is logging to Stackdriver. You want to get the count of all requests on all /api/alpha/* endpoints. What should you do?

    • AAdd a Stackdriver counter metric for path:/api/alpha/.
    • BAdd a Stackdriver counter metric for endpoint:/api/alpha/*.
    • CExport the logs to Cloud Storage and count lines matching /api/alpha.
    • DExport the logs to Cloud Pub/Sub and count lines matching /api/alpha.

    Show answer

    Correct answer: B

    How others answered

    • B47%
    • A40%

    Only 47% agreed on this answer — treat it as contested rather than settled.

    Explanation

    ans: a https://cloud.google.com/logging/docs/view/basic-queries#searching_specific_fields https://cloud.google.com/monitoring/charts/metrics-selector#filter-option To match any US zone that ends with “a”, you could use the the regular expression ^us.*.a$.

    Adapted from community discussion by celia20200410 · 2021-07-20 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. W

       woriheck93

       2021-09-05

       17 upvotes

       Ans: B B have the correct endpoint /api/alpha/*, A only get one endpoint counter

    2. [

       [Removed]

       2022-04-19

       5 upvotes

       Ans should be B -> (https://cloud.google.com/blog/products/management-tools/cloud-logging-gets-regular-expression-support) path=~"/api/alpha/*"

    3. T

       thewalker

       2024-07-17

       1 upvote

       Why other options are less suitable: **B. Endpoint:/api/alpha/*: ** While this might seem like a good option, Stackdriver doesn't typically use the term "endpoint" for filtering. It primarily uses "path" for request path-based filtering. C. Export logs to Cloud Storage and count lines: This is a less efficient and more complex approach. You'd need to write custom code to parse the logs and count the matching lines, which adds overhead and potential for errors. D. Export logs to Cloud Pub/Sub and count lines: Similar to option C, this involves exporting logs and then processing them externally, which is less efficient than using Stackdriver metrics. In summary: Adding a Stackdriver counter metric with the path:/api/alpha/ filter is the most efficient and straightforward way to get the count of all requests on all /api/alpha/* endpoints.

    4. H

       hug_c0sm0s

       2021-03-17

       4 upvotes

       a bit confused about A / B, it seems they mean the same thing.

20. Question 20 of 25

    Select 2

    Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Company Overview - HipLocal is a community application designed to facilitate communication between people in close proximity. It is used for event planning and organizing sporting events, and for businesses to connect with their local communities. HipLocal launched recently in a few neighborhoods in Dallas and is rapidly growing into a global phenomenon. Its unique style of hyper-local community communication and business outreach is in demand around the world. Executive Statement - We are the number one local community app; it's time to take our local community services global. Our venture capital investors want to see rapid growth and the same great experience for new local and virtual communities that come online, whether their members are 10 or 10000 miles away from each other. Solution Concept - HipLocal wants to expand their existing service, with updated functionality, in new regions to better serve their global customers. They want to hire and train a new team to support these regions in their time zones. They will need to ensure that the application scales smoothly and provides clear uptime data. Existing Technical Environment - HipLocal's environment is a mix of on-premises hardware and infrastructure running in Google Cloud Platform. The HipLocal team understands their application well, but has limited experience in global scale applications. Their existing technical environment is as follows: * Existing APIs run on Compute Engine virtual machine instances hosted in GCP. * State is stored in a single instance MySQL database in GCP. * Data is exported to an on-premises Teradata/Vertica data warehouse. * Data analytics is performed in an on-premises Hadoop environment. * The application has no logging. * There are basic indicators of uptime; alerts are frequently fired when the APIs are unresponsive. Business Requirements - HipLocal's investors want to expand their footprint and support the increase in demand they are seeing. Their requirements are: * Expand availability of the application to new regions. * Increase the number of concurrent users that can be supported. * Ensure a consistent experience for users when they travel to different regions. * Obtain user activity metrics to better understand how to monetize their product. * Ensure compliance with regulations in the new regions (for example, GDPR). * Reduce infrastructure management time and cost. * Adopt the Google-recommended practices for cloud computing. Technical Requirements - * The application and backend must provide usage metrics and monitoring. * APIs require strong authentication and authorization. * Logging must be increased, and data should be stored in a cloud analytics platform. * Move to serverless architecture to facilitate elastic scaling. * Provide authorized access to internal apps in a secure manner. HipLocal wants to reduce the number of on-call engineers and eliminate manual scaling. Which two services should they choose? (Choose two.)

    • AUse Google App Engine services.
    • BUse serverless Google Cloud Functions.
    • CUse Knative to build and deploy serverless applications.
    • DUse Google Kubernetes Engine for automated deployments.
    • EUse a large Google Compute Engine cluster for deployments.

    Show answer

    Correct answer: C, D

    How others answered

    • CD60%
    • AB33%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    App Engine cannot be a solution here as it limits the application to be in a single region. We need to note that the case study has explicitly mentioned that the application needs to be global, which means multi-regional. So, I will go with C & D.

    Adapted from community discussion by akshaychavan7 · 2022-07-05 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. A

       akshaychavan7

       2022-07-05

       Selected C, D3 upvotes

       App Engine cannot be a solution here as it limits the application to be in a single region. We need to note that the case study has explicitly mentioned that the application needs to be global, which means multi-regional. So, I will go with C & D.

    2. T

       thewalker

       2024-07-17

       1 upvote

       Let's look at why the other options are less ideal: A. Use Google App Engine services: App Engine is a good option for serverless applications, but it might not be as flexible as Cloud Functions for specific tasks like authentication or background processing. C. Use Knative to build and deploy serverless applications: Knative is a great option for building and deploying serverless applications, but it requires more configuration and management than Cloud Functions. E. Use a large Google Compute Engine cluster for deployments: While Compute Engine provides flexibility, it requires significant manual management for scaling and deployments, which goes against HipLocal's goals.

    3. S

       syu31svc

       2021-07-03

       2 upvotes

       https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed#apps_with_automatic_scaling A and B for sure; "eliminate manual scaling" as per what the qn states

    4. N

       nehaxlpb

       2022-07-28

       Selected C, D1 upvote

       https://cloud.google.com/kubernetes-engine/docs/concepts/traffic-management

21. Question 21 of 25

    Your application is running in multiple Google Kubernetes Engine clusters. It is managed by a Deployment in each cluster. The Deployment has created multiple replicas of your Pod in each cluster. You want to view the logs sent to stdout for all of the replicas in your Deployment in all clusters. Which command should you use?

    • Akubectl logs [PARAM]
    • Bgcloud logging read [PARAM]
    • Ckubectl exec ג€"it [PARAM] journalctl
    • Dgcloud compute ssh [PARAM] ג€"-command= ג€sudo journalctlג€

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Answer is A: To view the logs sent to stdout for all replicas in a Deployment in multiple clusters, the correct command to use would be kubectl logs [PARAM]. The gcloud logging read command reads log entries from the specified logs. It does not allow you to view the logs of specific replicas in a Deployment across multiple clusters. kubectl logs allows you to view the logs of a specific Pod or Deployment across multiple clusters. You can specify the Deployment name and the relevant parameters to view the logs of all replicas in the Deployment. For example, the following command would allow you to view the logs of all replicas in a Deployment named "my-deployment" in all clusters: kubectl logs -l app=my-deployment --all-containers

    Adapted from community discussion by omermahgoub · 2023-07-07 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Kubernetes documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. O

       omermahgoub

       2023-07-07

       6 upvotes

       Answer is A: To view the logs sent to stdout for all replicas in a Deployment in multiple clusters, the correct command to use would be kubectl logs [PARAM]. The gcloud logging read command reads log entries from the specified logs. It does not allow you to view the logs of specific replicas in a Deployment across multiple clusters. kubectl logs allows you to view the logs of a specific Pod or Deployment across multiple clusters. You can specify the Deployment name and the relevant parameters to view the logs of all replicas in the Deployment. For example, the following command would allow you to view the logs of all replicas in a Deployment named "my-deployment" in all clusters: kubectl logs -l app=my-deployment --all-containers

    2. C

       celia20200410

       2022-01-18

       3 upvotes

       B: gcloud logging read Using the "gcloud logging read" command, select the appropriate cluster, node, pod, and container logs. https://cloud.google.com/stackdriver/docs/solutions/gke/using-logs#accessing_your_logs However if you use "kubectl logs" to see logs on CLI, logs won’t be seen readable. It prints each line as a JSON object. https://medium.com/google-cloud/display-gke-logs-in-a-text-format-with-kubectl-db0169be0282

    3. S

       syu31svc

       2022-01-31

       3 upvotes

       Changing to B https://cloud.google.com/blog/products/management-tools/using-logging-your-apps-running-kubernetes-engine: "gcloud command line tool – Using the gcloud logging read command, select the appropriate cluster, node, pod and container logs."

    4. S

       StelSen

       2021-08-19

       3 upvotes

       Option: B. (Link1: https://cloud.google.com/blog/products/management-tools/finding-your-gke-logs, Link2: https://cloud.google.com/sdk/gcloud/reference/logging/read)

22. Question 22 of 25

    Your App Engine standard configuration is as follows: service: production instance_class: B1 You want to limit the application to 5 instances. Which code snippet should you include in your configuration?

    • Amanual_scaling: instances: 5 min_pending_latency: 30ms
    • Bmanual_scaling: max_instances: 5 idle_timeout: 10m
    • Cbasic_scaling: instances: 5 min_pending_latency: 30ms
    • Dbasic_scaling: max_instances: 5 idle_timeout: 10m

    Show answer

    Correct answer: D

    How others answered

    • D80%

    Explanation

    https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed: "A service with basic scaling is configured by setting the maximum number of instances in the max_instances parameter of the basic_scaling setting. The number of live instances scales with the processing volume." Answer is D

    Adapted from community discussion by syu31svc · 2021-07-10 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. S

       syu31svc

       2021-07-10

       3 upvotes

       https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed: "A service with basic scaling is configured by setting the maximum number of instances in the max_instances parameter of the basic_scaling setting. The number of live instances scales with the processing volume." Answer is D

    2. T

       thewalker

       2024-07-17

       1 upvote

       Let's break down why the other options are incorrect: A. manual_scaling: instances: 5 min_pending_latency: 30ms : While instances: 5 sets the number of instances, min_pending_latency is used for automatic scaling, which is not applicable in this case. C. basic_scaling: instances: 5 min_pending_latency: 30ms : basic_scaling is for automatic scaling based on request rate. You want manual scaling, so this is incorrect. D. basic_scaling: max_instances: 5 idle_timeout: 10m : Similar to option C, basic_scaling is not the correct scaling method for this scenario. In summary: Option B provides the correct configuration for limiting your App Engine Standard application to 5 instances using manual scaling.

    3. B

       Blitzer

       2024-12-12

       Selected D2 upvotes

       Per doc: https://cloud.google.com/appengine/docs/standard/reference/app-yaml?tab=java#scaling_elements basic_scaling: max_instances: 5 idle_timeout: 10m manual_scaling: instances: 5 Only basic_scaling (D) is proper answer here

    4. S

       santoshchauhan

       2024-03-08

       Selected D1 upvote

       Basic Scaling with max_instances (Option D): Basic scaling is suitable for applications that do not need to keep instances running all the time but may require instances to handle requests and then shut down when idle. The max_instances parameter sets the maximum number of instances, and idle_timeout specifies the amount of time that an instance can stay idle before it is shut down.

23. Question 23 of 25

    You are developing a corporate tool on Compute Engine for the finance department, which needs to authenticate users and verify that they are in the finance department. All company employees use G Suite. What should you do?

    • AEnable Cloud Identity-Aware Proxy on the HTTP(s) load balancer and restrict access to a Google Group containing users in the finance department. Verify the provided JSON Web Token within the application.
    • BEnable Cloud Identity-Aware Proxy on the HTTP(s) load balancer and restrict access to a Google Group containing users in the finance department. Issue client-side certificates to everybody in the finance team and verify the certificates in the application.
    • CConfigure Cloud Armor Security Policies to restrict access to only corporate IP address ranges. Verify the provided JSON Web Token within the application.
    • DConfigure Cloud Armor Security Policies to restrict access to only corporate IP address ranges. Issue client side certificates to everybody in the finance team and verify the certificates in the application.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    https://cloud.google.com/armor/docs/security-policy-overview#:~:text=Google%20Cloud%20Armor%20security%20policies%20enable%20you%20to%20allow%20or,Private%20Cloud%20(VPC)%20networks.: "Google Cloud Armor security policies protect your application by providing Layer 7 filtering and by scrubbing incoming requests for common web attacks or other Layer 7 attributes to potentially block traffic before it reaches your load balanced backend services or backend buckets" C and D are wrong. https://cloud.google.com/endpoints/docs/openapi/authenticating-users-google-id: "To authenticate a user, a client application must send a JSON Web Token (JWT) in the authorization header of the HTTP request to your backend API" A is correct

    Adapted from community discussion by syu31svc · 2022-01-11 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. D

       donchick

       2021-06-22

       17 upvotes

       I'd say A(https://cloud.google.com/endpoints/docs/openapi/authenticating-users-google-id).

    2. S

       syu31svc

       2022-01-11

       5 upvotes

       https://cloud.google.com/armor/docs/security-policy-overview#:~:text=Google%20Cloud%20Armor%20security%20policies%20enable%20you%20to%20allow%20or,Private%20Cloud%20(VPC)%20networks.: "Google Cloud Armor security policies protect your application by providing Layer 7 filtering and by scrubbing incoming requests for common web attacks or other Layer 7 attributes to potentially block traffic before it reaches your load balanced backend services or backend buckets" C and D are wrong. https://cloud.google.com/endpoints/docs/openapi/authenticating-users-google-id: "To authenticate a user, a client application must send a JSON Web Token (JWT) in the authorization header of the HTTP request to your backend API" A is correct

    3. S

       santoshchauhan

       2024-09-08

       Selected A1 upvote

       A. Enable Cloud Identity-Aware Proxy (IAP) on the HTTP(s) load balancer and restrict access to a Google Group containing users in the finance department. Verify the provided JSON Web Token within the application. Cloud IAP allows you to manage access to your web applications running on Compute Engine by verifying a user’s identity and determining if that user should be allowed to access the application. You can integrate Cloud IAP with Google Groups to restrict access to specific groups within your G Suite domain, such as a group for the finance department. When a user authenticates via Cloud IAP, a JSON Web Token (JWT) is issued that can be used within your application to further verify the user's identity and departmental membership.

    4. W

       woriheck93

       2022-03-05

       3 upvotes

       A IAP and JWT https://cloud.google.com/iap/docs/signed-headers-howto#securing_iap_headers

24. Question 24 of 25

    Select 2

    Your team develops services that run on Google Kubernetes Engine. You need to standardize their log data using Google-recommended practices and make the data more useful in the fewest number of steps. What should you do? (Choose two.)

    • ACreate aggregated exports on application logs to BigQuery to facilitate log analytics.
    • BCreate aggregated exports on application logs to Cloud Storage to facilitate log analytics.
    • CWrite log output to standard output (stdout) as single-line JSON to be ingested into Cloud Logging as structured logs.
    • DMandate the use of the Logging API in the application code to write structured logs to Cloud Logging.
    • EMandate the use of the Pub/Sub API to write structured data to Pub/Sub and create a Dataflow streaming pipeline to normalize logs and write them to BigQuery for analytics.

    Show answer

    Correct answer: A, C

    How others answered

    • AC48%
    • CD33%
    • AD19%

    Only 48% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A & C: Option A to “make the data more useful”, as BigQuery will allow us to use big data analysis capabilities on the stored logs: https://cloud.google.com/logging/docs/export/aggregated_sinks#supported-destinations Option C to “to standardize their log data” creating structured logs: https://cloud.google.com/kubernetes-engine/docs/concepts/about-logs#best_practices Option D is also a viable solution but C is preferred, considering the “fewest number of steps” requirement. Choosing C and D together makes no sense, as both aim to achieve the same goal.

    Adapted from community discussion by wanrltw · 2023-11-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. S

       santoshchauhan

       2024-03-08

       Selected A, C3 upvotes

       C. Writing log output to standard output (stdout) as single-line JSON: This is a recommended practice for containerized applications running on Kubernetes. Kubernetes captures everything written to stdout and stderr and routes it to its logging agent (in this case, Cloud Logging in GKE). By structuring logs as single-line JSON, you enable Cloud Logging to ingest them as structured logs, which are more queryable and readable. This approach is efficient and does not require any changes in the application to use specific logging APIs. A. Create aggregated exports on application logs to BigQuery: Exporting logs to BigQuery allows for powerful analytics capabilities. BigQuery is well-suited for running fast, SQL-like queries on large datasets. By exporting logs to BigQuery, you can perform more complex analyses and gain deeper insights from your log data.

    2. _

       __rajan__

       2023-09-20

       Selected A, C2 upvotes

       Option A: Create aggregated exports on application logs to BigQuery. This will facilitate log analytics by exporting application logs to BigQuery, which is a fully-managed, serverless data warehouse. BigQuery allows you to perform advanced analytics on your log data, including running complex queries and visualizing the results. Option C: Write log output to standard output (stdout) as single-line JSON to be ingested into Cloud Logging as structured logs. This approach involves writing log output to standard output in a specific format (single-line JSON) that can be easily ingested by Cloud Logging. By using structured logs, you can take advantage of advanced querying and filtering capabilities provided by Cloud Logging.

    3. N

       NapFalg

       2022-09-04

       4 upvotes

       https://cloud.google.com/logging/docs/structured-logging If you're using Google Kubernetes Engine or the App Engine flexible environment, you can write structured logs as JSON objects serialized on a single line to stdout or stderr. The Logging agent then sends the structured logs to Cloud Logging as the jsonPayload of the LogEntry structure. This point to C

    4. T

       TNT87

       2022-11-14

       4 upvotes

       https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#best_practices Answer is A, C. In best practices i dnt see anything to do with D

25. Question 25 of 25

    Select 2

    You have decided to migrate your Compute Engine application to Google Kubernetes Engine. You need to build a container image and push it to Artifact Registry using Cloud Build. What should you do? (Choose two.)

    • ARun gcloud builds submit in the directory that contains the application source code.
    • BRun gcloud run deploy app-name --image gcr.io/$PROJECT_ID/app-name in the directory that contains the application source code.
    • CRun gcloud container images add-tag gcr.io/$PROJECT_ID/app-name gcr.io/$PROJECT_ID/app-name:latest in the directory that contains the application source code.
    • DIn the application source directory, create a file named cloudbuild.yaml that contains the following contents:
    • EIn the application source directory, create a file named cloudbuild.yaml that contains the following contents:

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    To build a container image and push it to Artifact Registry using Cloud Build, you should: Run gcloud builds submit in the directory that contains the application source code. This command will trigger Cloud Build to build the container image and push it to Artifact Registry. In the application source directory, create a file named cloudbuild.yaml that contains the instructions for building and pushing the container image. The file should contain the following steps: steps: -name: 'grc.io/cloud-builders/docker' args: ['build','-t','grc.io/$PROJECT_ID','app-name','.'] -name: 'grc.io/cloud-builders/docker' args: ['push','grc.io/$PROJECT_ID/app-name'] This file will be used by Cloud Build to build and push the container image.

    Adapted from community discussion by omermahgoub · 2024-01-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCD or CertExamHQ.

    1. O

       omermahgoub

       2024-01-06

       2 upvotes

       To build a container image and push it to Artifact Registry using Cloud Build, you should: Run gcloud builds submit in the directory that contains the application source code. This command will trigger Cloud Build to build the container image and push it to Artifact Registry. In the application source directory, create a file named cloudbuild.yaml that contains the instructions for building and pushing the container image. The file should contain the following steps: steps: -name: 'grc.io/cloud-builders/docker' args: ['build','-t','grc.io/$PROJECT_ID','app-name','.'] -name: 'grc.io/cloud-builders/docker' args: ['push','grc.io/$PROJECT_ID/app-name'] This file will be used by Cloud Build to build and push the container image.

    2. P

       p4

       2023-01-22

       Selected A, D3 upvotes

       A to submit cloud build https://cloud.google.com/sdk/gcloud/reference/builds/submit D describes the cloud build steps (docker build + push)

    3. O

       omermahgoub

       2024-01-06

       2 upvotes

       B is incorrect because it uses the gcloud run deploy command, which is used to deploy a container image to Cloud Run, not to Artifact Registry. C is incorrect because it uses the gcloud container images add-tag command, which is used to add a tag to an existing container image in Container Registry, not to build and push a new container image to Artifact Registry. E is incorrect because it uses the gcloud app deploy command, which is used to deploy an application to App Engine, not to build and push a container image to Artifact Registry.

    4. Z

       zellck

       2023-12-21

       Selected A, D2 upvotes

       AD is the answer. https://cloud.google.com/build/docs/building/build-containers#store-images

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 1 of 25