Google Professional Cloud DevOps Engineer practice questions

1. Question 1 of 25

   You support a Node.js application running on Google Kubernetes Engine (GKE) in production. The application makes several HTTP requests to dependent applications. You want to anticipate which dependent applications might cause performance issues. What should you do?

   • AInstrument all applications with Stackdriver Profiler.
   • BInstrument all applications with Stackdriver Trace and review inter-service HTTP requests.
   • CUse Stackdriver Debugger to review the execution of logic within each application to instrument all applications.
   • DModify the Node.js application to log HTTP request and response times to dependent applications. Use Stackdriver Logging to find dependent applications that are performing poorly.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Answer is B. The keyword is "make several requests to dependent app". So you need trace for it. Cloud Trace Find performance bottlenecks in production. Cloud Profiler Continuous CPU and heap profiling to improve performance and reduce costs.

   Adapted from community discussion by Manh · 2021-11-08 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. M

      Manh

      2021-11-08

      11 upvotes

      Answer is B. The keyword is "make several requests to dependent app". So you need trace for it. Cloud Trace Find performance bottlenecks in production. Cloud Profiler Continuous CPU and heap profiling to improve performance and reduce costs.

   2. F

      francisco_guerra

      2021-06-19

      8 upvotes

      The answer is B because the question says: "anticipate" Looks like A could be the answer but remember: You want to anticipate which dependent applications might cause performance issues. NO to optimize performance and reduce cost of computation of the application. Stackdriver Trace provides detailed insight into your application’s run time performance and latency in near real-time. The service continuously evaluates data from each traced request and checks for patterns that indicate performance bottlenecks. To remove the operational overhead for performance analysis, Stackdriver Trace automatically analyzes your application’s performance over time.

   3. J

      JonathanSJ

      2024-09-26

      Selected B4 upvotes

      B. Instrument all applications with Stackdriver Trace and review inter-service HTTP requests. Stackdriver Trace allows you to collect and analyze performance data for all the applications that make up your system, including the applications running on GKE. By instrumenting your application with Stackdriver Trace, you can see detailed performance information for each request, including the time spent in each component of your system, as well as any inter-service HTTP requests. This will allow you to identify which dependent applications might be causing performance issues, so that you can focus on optimizing those services specifically.

   4. A

      akg001

      2021-06-11

      5 upvotes

      After carefully reading the question and study, answer A is very close. Performance and cost management Cloud Profiler provides continuous profiling of resource consumption in your production applications, helping you identify and eliminate potential performance issues. Latency management Cloud Trace provides latency sampling and reporting for App Engine, including per-URL statistics and latency distributions please refer below URL : https://cloud.google.com/products/operations#all-features

2. Question 2 of 25

   You have a pool of application servers running on Compute Engine. You need to provide a secure solution that requires the least amount of configuration and allows developers to easily access application logs for troubleshooting. How would you implement the solution on GCP?

   • Aג€¢ Deploy the Stackdriver logging agent to the application servers. ג€¢ Give the developers the IAM Logs Viewer role to access Stackdriver and view logs.
   • Bג€¢ Deploy the Stackdriver logging agent to the application servers. ג€¢ Give the developers the IAM Logs Private Logs Viewer role to access Stackdriver and view logs.
   • Cג€¢ Deploy the Stackdriver monitoring agent to the application servers. ג€¢ Give the developers the IAM Monitoring Viewer role to access Stackdriver and view metrics.
   • Dג€¢ Install the gsutil command line tool on your application servers. ג€¢ Write a script using gsutil to upload your application log to a Cloud Storage bucket, and then schedule it to run via cron every 5 minutes. ג€¢ Give the developers the IAM Object Viewer access to view the logs in the specified bucket.

   Show answer

   Correct answer: A

   How others answered

   • A93%

   Explanation

   A roles/logging.viewer (Logs Viewer) gives you read-only access to all features of Logging, except Access Transparency logs and Data Access audit logs.

   Adapted from community discussion by devopsbatch · 2021-12-02 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. D

      devopsbatch

      2021-12-02

      27 upvotes

      A roles/logging.viewer (Logs Viewer) gives you read-only access to all features of Logging, except Access Transparency logs and Data Access audit logs.

   2. D

      danchoif2

      2022-02-28

      4 upvotes

      https://cloud.google.com/logging/docs/audit#access-control A is correct. B is incorrect because developers only need to access application logs, not private logs.

   3. R

      roastc

      2022-07-10

      3 upvotes

      Looks like answer A is correct. A logging agent is required to enable the custom logs pushed to Stackdriver https://cloud.google.com/logging/docs/agent/logging . Developers need only Log Viewer permission, which is enough in this case and Private Log viewer is a superset of log viewer permission with elevated permission to view the private data in logs. Which is not needed in this case.

   4. B

      buldas

      2022-08-16

      Selected A3 upvotes

      A. OK B. Logs Private Logs is for Data Logs C. Nope D. what?

3. Question 3 of 25

   Your company runs an ecommerce website built with JVM-based applications and microservice architecture in Google Kubernetes Engine (GKE). The application load increases during the day and decreases during the night. Your operations team has configured the application to run enough Pods to handle the evening peak load. You want to automate scaling by only running enough Pods and nodes for the load. What should you do?

   • AConfigure the Vertical Pod Autoscaler, but keep the node pool size static.
   • BConfigure the Vertical Pod Autoscaler, and enable the cluster autoscaler.
   • CConfigure the Horizontal Pod Autoscaler, but keep the node pool size static.
   • DConfigure the Horizontal Pod Autoscaler, and enable the cluster autoscaler.

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   To automate scaling for the JVM-based applications and microservices architecture in Google Kubernetes Engine (GKE), especially to handle varying loads throughout the day, the recommended approach is (Option D). This involves configuring the Horizontal Pod Autoscaler (HPA) to dynamically adjust the number of Pods based on application metrics. Additionally, enabling the cluster autoscaler allows for automatic scaling of the node pool, ensuring an adequate number of nodes to accommodate the varying workload. The HPA monitors resource utilization and adjusts the number of Pods, while the cluster autoscaler ensures that the underlying infrastructure scales up or down to meet the demand. This combined approach optimizes resource allocation, providing an efficient and automated solution for managing workload fluctuations in a cost-effective manner.

   Adapted from community discussion by xhilmi · 2024-06-06 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Kubernetes documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. X

      xhilmi

      2024-06-06

      Selected D3 upvotes

      To automate scaling for the JVM-based applications and microservices architecture in Google Kubernetes Engine (GKE), especially to handle varying loads throughout the day, the recommended approach is (Option D). This involves configuring the Horizontal Pod Autoscaler (HPA) to dynamically adjust the number of Pods based on application metrics. Additionally, enabling the cluster autoscaler allows for automatic scaling of the node pool, ensuring an adequate number of nodes to accommodate the varying workload. The HPA monitors resource utilization and adjusts the number of Pods, while the cluster autoscaler ensures that the underlying infrastructure scales up or down to meet the demand. This combined approach optimizes resource allocation, providing an efficient and automated solution for managing workload fluctuations in a cost-effective manner.

   2. P

      PrayasMohanty

      2024-04-11

      Selected D4 upvotes

      There is no Vertical Pod Autoscaler, and cluster autoscaler must be enabled. Therefor D appears the best answer.

   3. L

      LaxmanTiwari

      2024-06-20

      Selected D2 upvotes

      please read this how to use vertical pod autoscaler https://cloud.google.com/kubernetes-engine/docs/concepts/verticalpodautoscaler , so it suggest use Horizontal Pod Autoscaler (HPA) with the VPA to get the best of autoscaling.

   4. A

      activist

      2024-04-12

      3 upvotes

      You want to automate scaling by only running enough Pods and nodes for the load. Answer D answers this requirement.

4. Question 4 of 25

   You built a serverless application by using Cloud Run and deployed the application to your production environment. You want to identify the resource utilization of the application for cost optimization. What should you do?

   • AUse Cloud Trace with distributed tracing to monitor the resource utilization of the application.
   • BUse Cloud Profiler with Ops Agent to monitor the CPU and memory utilization of the application.
   • CUse Cloud Monitoring to monitor the container CPU and memory utilization of the application.
   • DUse Cloud Ops to create logs-based metrics to monitor the resource utilization of the application.

   Show answer

   Correct answer: C

   How others answered

   • C71%
   • B29%

   Only 71% agreed on this answer — treat it as contested rather than settled.

   Explanation

   For identifying the resource utilization of a serverless application deployed on Cloud Run for cost optimization, the recommended approach is to use Cloud Monitoring, as indicated by (Option C). Cloud Monitoring provides comprehensive monitoring capabilities, allowing you to track container CPU and memory utilization effectively. Specifically tailored for containerized environments like Cloud Run, Cloud Monitoring provides insights into key metrics, enabling you to analyze resource consumption, identify potential bottlenecks, and optimize costs based on observed utilization patterns. By monitoring container CPU and memory metrics, you gain valuable data for making informed decisions about resource allocation, ensuring efficient usage, and ultimately optimizing the cost of running the serverless application in your production environment.

   Adapted from community discussion by xhilmi · 2023-12-06 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. Y

      YushiSato

      2023-11-05

      Selected C7 upvotes

      Cloud Run integrates automatically with Cloud Monitoring and requires no setup or configuration. https://cloud.google.com/run/docs/monitoring?hl=ja

   2. X

      xhilmi

      2023-12-06

      Selected C3 upvotes

      For identifying the resource utilization of a serverless application deployed on Cloud Run for cost optimization, the recommended approach is to use Cloud Monitoring, as indicated by (Option C). Cloud Monitoring provides comprehensive monitoring capabilities, allowing you to track container CPU and memory utilization effectively. Specifically tailored for containerized environments like Cloud Run, Cloud Monitoring provides insights into key metrics, enabling you to analyze resource consumption, identify potential bottlenecks, and optimize costs based on observed utilization patterns. By monitoring container CPU and memory metrics, you gain valuable data for making informed decisions about resource allocation, ensuring efficient usage, and ultimately optimizing the cost of running the serverless application in your production environment.

   3. D

      devops_man

      2023-11-30

      5 upvotes

      As per documentation cloud profiler not supported for cloud run environment https://cloud.google.com/profiler/docs/about-profiler will go with C

   4. F

      filipemotta

      2024-08-27

      Selected C1 upvote

      Option C is the most appropriate choice as it directly addresses the need to monitor container CPU and memory utilization in Cloud Run. This will help you gather the necessary data for cost optimization effectively. Cloud Profiler more suited for debugging performance bottlenecks and less for high-level resource utilization monitoring across Cloud Run instances.

5. Question 5 of 25

   You support the backend of a mobile phone game that runs on a Google Kubernetes Engine (GKE) cluster. The application is serving HTTP requests from users. You need to implement a solution that will reduce the network cost. What should you do?

   • AConfigure the VPC as a Shared VPC Host project.
   • BConfigure your network services on the Standard Tier.
   • CConfigure your Kubernetes cluster as a Private Cluster.
   • DConfigure a Google Cloud HTTP Load Balancer as Ingress.

   Show answer

   Correct answer: B

   How others answered

   • B55%
   • D43%

   Only 55% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Ans is D A: No, Doest make sense B: Who says that we are using a premium tier? C: This does not help with the network cost? D: Ok :) Costs associated with a load balancer are charged to the project containing the load balancer components. Because of these benefits, container-native load balancing is the recommended solution for load balancing through Ingress. When NEGs are used with GKE Ingress, the Ingress controller facilitates the creation of all aspects of the L7 load balancer. This includes creating the virtual IP address, forwarding rules, health checks, firewall rules, and more. https://cloud.google.com/architecture/best-practices-for-running-cost-effective-kubernetes-applications-on-gke

   Adapted from community discussion by francisco_guerra · 2021-06-20 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. F

      francisco_guerra

      2021-06-20

      27 upvotes

      Ans is D A: No, Doest make sense B: Who says that we are using a premium tier? C: This does not help with the network cost? D: Ok :) Costs associated with a load balancer are charged to the project containing the load balancer components. Because of these benefits, container-native load balancing is the recommended solution for load balancing through Ingress. When NEGs are used with GKE Ingress, the Ingress controller facilitates the creation of all aspects of the L7 load balancer. This includes creating the virtual IP address, forwarding rules, health checks, firewall rules, and more. https://cloud.google.com/architecture/best-practices-for-running-cost-effective-kubernetes-applications-on-gke

   2. S

      syslog

      2021-06-22

      14 upvotes

      Who says that we aren't use the load balancer? I think it's B anyway, because you have to choose standard tier when "Cost is your main consideration, and you’re willing to trade-off some network performance" https://cloud.google.com/network-tiers

   3. L

      lxs

      2022-06-10

      9 upvotes

      It is B because premium tier is by default everywhere. Standard tier is cheaper. Why not D? This is single HTTP application. You don't know how many HTTP endpoints this app expose to Internet. If it is a single endpoint it does not matter if you create Service type Loadbalancer or Cluster IP-> Ingress. You still have one CLB in GCP, so cost is the same

   4. E

      exploregcp

      2021-07-22

      6 upvotes

      Ans is C. Private cluster has only private IP assigned to nodes. As this is backend service public IPs are not required. Public IPs are are chargable. https://cloud.google.com/architecture/prep-kubernetes-engine-for-prod#private_clusters D is not correct. Ingress traffic is not charged. Hence will not help in network cost saving.

6. Question 6 of 25

   Your company is using HTTPS requests to trigger a public Cloud Run-hosted service accessible at the https://booking-engine-abcdef.a.run.app URL. You need to give developers the ability to test the latest revisions of the service before the service is exposed to customers. What should you do?

   • ARun the gcloud run deploy booking-engine --no-traffic --tag dev command. Use the https://dev--booking-engine-abcdef.a.run.app URL for testing.
   • BRun the gcloud run services update-traffic booking-engine --to-revisions LATEST=1 command. Use the https://booking-engine-abcdef.a.run.app URL for testing.
   • CPass the curl –H “Authorization:Bearer $(gcloud auth print-identity-token)” auth token. Use the https://booking-engine-abcdef.a.run.app URL to test privately.
   • DGrant the roles/run.invoker role to the developers testing the booking-engine service. Use the https://booking-engine-abcdef.private.run.app URL for testing.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   To enable developers to test the latest revisions of a Cloud Run-hosted service before exposing it to customers, the recommended approach is to use the --no-traffic flag during deployment, as outlined in (Option A). By running the command gcloud run deploy booking-engine --no-traffic --tag dev, you deploy the service with no traffic routed to it initially. Subsequently, developers can test the latest revisions using the URL https://dev--booking-engine-abcdef.a.run.app. This allows for a controlled and private testing environment where developers can validate the service's functionality and behavior before making it publicly accessible. Utilizing a dedicated URL with the --tag option ensures that developers can interact with the specific version intended for testing, facilitating a smooth and secure testing process.

   Adapted from community discussion by xhilmi · 2024-12-06 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. F

      florian_cartron

      2024-10-09

      Selected A7 upvotes

      A, as it is possible to accept a tagged revision as explained here: https://cloud.google.com/run/docs/rollouts-rollbacks-traffic-migration#deploy-with-tags

   2. X

      xhilmi

      2024-12-06

      Selected A4 upvotes

      To enable developers to test the latest revisions of a Cloud Run-hosted service before exposing it to customers, the recommended approach is to use the --no-traffic flag during deployment, as outlined in (Option A). By running the command gcloud run deploy booking-engine --no-traffic --tag dev, you deploy the service with no traffic routed to it initially. Subsequently, developers can test the latest revisions using the URL https://dev--booking-engine-abcdef.a.run.app. This allows for a controlled and private testing environment where developers can validate the service's functionality and behavior before making it publicly accessible. Utilizing a dedicated URL with the --tag option ensures that developers can interact with the specific version intended for testing, facilitating a smooth and secure testing process.

   3. P

      PrayasMohanty

      2024-10-11

      Selected A4 upvotes

      It create a new deployment(revision) with no traffic to https://booking-engine-abcdef.a.run.app but the revision can be tested by developer at https://dev--booking-engine-abcdef.a.run.app as dev tag is associated with the deploymnet. Reference: https://cloud.google.com/sdk/gcloud/reference/run/deploy

   4. M

      mshafa

      2024-11-02

      1 upvote

      Answer is A. With option B: 100% of traffic will be route to the latest revision.

7. Question 7 of 25

   You are configuring connectivity across Google Kubernetes Engine (GKE) clusters in different VPCs. You notice that the nodes in Cluster A are unable to access the nodes in Cluster B. You suspect that the workload access issue is due to the network configuration. You need to troubleshoot the issue but do not have execute access to workloads and nodes. You want to identify the layer at which the network connectivity is broken. What should you do?

   • AInstall a toolbox container on the node in Cluster Confirm that the routes to Cluster B are configured appropriately.
   • BUse Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B.
   • CUse a debug container to run the traceroute command from Cluster A to Cluster B and from Cluster B to Cluster A. Identify the common failure point.
   • DEnable VPC Flow Logs in both VPCs, and monitor packet drops.

   Show answer

   Correct answer: B

   How others answered

   • B95%

   Explanation

   I suspect that there is a mistake in the issue and that the Network Intelligence Center is correct, not the Network Connectivity Center. https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/concepts/overview

   Adapted from community discussion by YushiSato · 2024-04-29 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. J

      Jason_Cloud_at

      2024-04-26

      Selected B9 upvotes

      I will got with B just to identify what happend in the network level

   2. Y

      YushiSato

      2024-04-29

      Selected B7 upvotes

      I suspect that there is a mistake in the issue and that the Network Intelligence Center is correct, not the Network Connectivity Center. https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/concepts/overview

   3. X

      xhilmi

      2024-06-06

      Selected B2 upvotes

      To identify and troubleshoot the network connectivity issue between Google Kubernetes Engine (GKE) clusters in different VPCs where nodes in Cluster A cannot access nodes in Cluster B, the recommended action is to use Network Connectivity Center, as stated in (Option B). By performing a Connectivity Test from Cluster A to Cluster B using Network Connectivity Center, you can assess the network path and identify potential issues affecting the connectivity. This diagnostic tool helps pinpoint where the connectivity breaks down, enabling you to analyze the network configuration and resolve any misconfigurations or obstacles that might be hindering communication between the clusters. This approach provides a focused and efficient way to troubleshoot the specific network layer where the connectivity issue occurs without requiring execute access to workloads and nodes in the clusters.

   4. R

      ReachTango73

      2024-04-12

      4 upvotes

      B as the Q says but do not have execute access to workloads and nodes… so can’t run toolbox

8. Question 8 of 25

   You are managing the production deployment to a set of Google Kubernetes Engine (GKE) clusters. You want to make sure only images which are successfully built by your trusted CI/CD pipeline are deployed to production. What should you do?

   • AEnable Cloud Security Scanner on the clusters.
   • BEnable Vulnerability Analysis on the Container Registry.
   • CSet up the Kubernetes Engine clusters as private clusters.
   • DSet up the Kubernetes Engine clusters with Binary Authorization.

   Show answer

   Correct answer: D

   How others answered

   • D95%

   Explanation

   D because binary authorization is deploy time security tool and it will allow only trusted and attested containers into GKE

   Adapted from community discussion by devopsbatch · 2021-12-02 · 28 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. D

      devopsbatch

      2021-12-02

      28 upvotes

      D because binary authorization is deploy time security tool and it will allow only trusted and attested containers into GKE

   2. J

      JonathanSJ

      2023-07-11

      Selected D5 upvotes

      D. Set up the Kubernetes Engine clusters with Binary Authorization. Binary Authorization is a feature of Google Kubernetes Engine that allows you to ensure that only containers that are verified to be from a trusted source are deployed to your clusters. It works by using a policy that checks the signatures of container images before they are deployed. You can configure Binary Authorization to require that all images are signed by a trusted certificate authority (CA) or that they are signed by a trusted key that you manage. This ensures that only images that have been successfully built by your trusted CI/CD pipeline are deployed to your production clusters.

   3. E

      exploregcp

      2022-01-22

      4 upvotes

      D https://cloud.google.com/binary-authorization/docs/overview

   4. W

      WakandaF

      2021-12-30

      3 upvotes

      erminology. Binary Authorization is a deploy time security service provided by Google that ensures that only trusted containers are deployed in our GKE cluster. It uses a policy driven model that allows us to configure security policies. Behind the scenes, this service talks to the Container Analysis service

9. Question 9 of 25

   You are monitoring a service that uses n2-standard-2 Compute Engine instances that serve large files. Users have reported that downloads are slow. Your Cloud Monitoring dashboard shows that your VMs are running at peak network throughput. You want to improve the network throughput performance. What should you do?

   • AAdd additional network interface controllers (NICs) to your VMs.
   • BDeploy a Cloud NAT gateway and attach the gateway to the subnet of the VMs.
   • CChange the machine type for your VMs to n2-standard-8.
   • DDeploy the Ops Agent to export additional monitoring metrics.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   https://cloud.google.com/compute/docs/general-purpose-machines#n2-standard "Neither additional virtual network interfaces (vNICs) nor additional IP addresses per vNIC increase ingress or egress bandwidth for a VM. For example, a C3 VM with 22 vCPUs is limited to 23 Gbps total egress bandwidth. If you configure the C3 VM with two vNICs, the VM is still limited to 23 Gbps total egress bandwidth, not 23 Gbps bandwidth per vNIC." https://cloud.google.com/compute/docs/network-bandwidth#vm-out-baseline:~:text=Neither%20additional%20virtual,bandwidth%20per%20vNIC.

   Adapted from community discussion by alpha_canary · 2024-08-17 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

   1. A

      alpha_canary

      2024-08-17

      Selected C3 upvotes

      https://cloud.google.com/compute/docs/general-purpose-machines#n2-standard "Neither additional virtual network interfaces (vNICs) nor additional IP addresses per vNIC increase ingress or egress bandwidth for a VM. For example, a C3 VM with 22 vCPUs is limited to 23 Gbps total egress bandwidth. If you configure the C3 VM with two vNICs, the VM is still limited to 23 Gbps total egress bandwidth, not 23 Gbps bandwidth per vNIC." https://cloud.google.com/compute/docs/network-bandwidth#vm-out-baseline:~:text=Neither%20additional%20virtual,bandwidth%20per%20vNIC.

   2. J

      Jason_Cloud_at

      2024-04-26

      Selected C4 upvotes

      Network throughput performance is often associated with the compute power of the virtual machines. Upgrading your VM instance type to one with more CPU and memory resources, like n2-standard-8, can significantly improve the network performance

   3. X

      xhilmi

      2024-06-08

      Selected C1 upvote

      Choose C. Changing the machine type to a higher-capacity will increases the available resources, including CPU, memory, and potentially network bandwidth. Options A and B are not directly related to improving network throughput for the existing VMs. Adding additional network interface controllers (NICs) (Option A) may not necessarily address network throughput limitations, and deploying a Cloud NAT gateway (Option B) is more relevant for outbound internet traffic rather than internal network communication. Option D (Deploy the Ops Agent to export additional monitoring metrics) is not directly related to improving network throughput. While it can provide additional monitoring metrics, addressing the reported slow download issue is better achieved by adjusting the resources allocated to the VMs.

   4. L

      lelele2023

      2024-05-02

      1 upvote

      this article also emphasises a higher specs of VM helps with egress traffic: "Outbound or egress traffic from a virtual machine is subject to maximum network egress throughput caps. These caps are dependent on the number of vCPUs that a virtual machine instance has. Each core is subject to a 2 Gbits/second (Gbps) cap for peak performance. Each additional core increases the network cap, up to a theoretical maximum of 16 Gbps for each virtual machine."

10. Question 10 of 25

    You support an e-commerce application that runs on a large Google Kubernetes Engine (GKE) cluster deployed on-premises and on Google Cloud Platform. The application consists of microservices that run in containers. You want to identify containers that are using the most CPU and memory. What should you do?

    • AUse Stackdriver Kubernetes Engine Monitoring.
    • BUse Prometheus to collect and aggregate logs per container, and then analyze the results in Grafana.
    • CUse the Stackdriver Monitoring API to create custom metrics, and then organize your containers using groups.
    • DUse Stackdriver Logging to export application logs to BigQuery, aggregate logs per container, and then analyze CPU and memory consumption.

    Show answer

    Correct answer: A

    How others answered

    • A69%
    • B25%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    * https://cloud.google.com/anthos/clusters/docs/on-prem GKE on-prem is also called Anthos clusters on VMware * https://cloud.google.com/anthos/clusters/docs/on-prem/concepts/logging-and-monitoring You have several logging and monitoring options for your Anthos clusters on VMware: + Cloud Logging and Cloud Monitoring, enabled by in-cluster agents deployed with Anthos clusters on VMware. + Prometheus and Grafana, disabled by default. + Validated configurations with third-party solutions. => it means, if not a special situation, the correct should be using the first option: Logging and Monitoring. In this case, we want metrics, so Monitoring (aka. Cloud Monitoring, Stackdriver Monitoring) should be used. We are talking about GKE, so we will use Kubernetest Engine Monitoring (https://cloud.google.com/kubernetes-engine-monitoring). Obviously, A is correct.

    Adapted from community discussion by danchoif2 · 2022-03-02 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. D

       danchoif2

       2022-03-02

       22 upvotes

       * https://cloud.google.com/anthos/clusters/docs/on-prem GKE on-prem is also called Anthos clusters on VMware * https://cloud.google.com/anthos/clusters/docs/on-prem/concepts/logging-and-monitoring You have several logging and monitoring options for your Anthos clusters on VMware: + Cloud Logging and Cloud Monitoring, enabled by in-cluster agents deployed with Anthos clusters on VMware. + Prometheus and Grafana, disabled by default. + Validated configurations with third-party solutions. => it means, if not a special situation, the correct should be using the first option: Logging and Monitoring. In this case, we want metrics, so Monitoring (aka. Cloud Monitoring, Stackdriver Monitoring) should be used. We are talking about GKE, so we will use Kubernetest Engine Monitoring (https://cloud.google.com/kubernetes-engine-monitoring). Obviously, A is correct.

    2. R

       raf2121

       2022-02-08

       13 upvotes

       Point for discussion : Google highly recommends Google Logging and monitoring when running workloads only on GKE on-prem and GKE. For applications with component running on GKE on-prem and traditional on-premises infrastructure, other monitoring and logging solutions for an end-to-end view of application can be considered considering what is stated in the question "GKE cluster deployed on-premises and Google Cloud Platform", should "A" be the answer

    3. H

       helg

       2022-07-13

       6 upvotes

       we are talking about GKE and GKE on Premise so you need a multi cloud monitoring option not a GKE logging option like A

    4. R

       ralf_cc

       2021-12-17

       6 upvotes

       C - workload is only on GKE, https://cloud.google.com/anthos/clusters/docs/on-prem/1.0/concepts/logging-and-monitoring

11. Question 11 of 25

    You created a Stackdriver chart for CPU utilization in a dashboard within your workspace project. You want to share the chart with your Site Reliability Engineering (SRE) team only. You want to ensure you follow the principle of least privilege. What should you do?

    • AShare the workspace Project ID with the SRE team. Assign the SRE team the Monitoring Viewer IAM role in the workspace project.
    • BShare the workspace Project ID with the SRE team. Assign the SRE team the Dashboard Viewer IAM role in the workspace project.
    • CClick ג€Share chart by URLג€ and provide the URL to the SRE team. Assign the SRE team the Monitoring Viewer IAM role in the workspace project.
    • DClick ג€Share chart by URLג€ and provide the URL to the SRE team. Assign the SRE team the Dashboard Viewer IAM role in the workspace project.

    Show answer

    Correct answer: C

    How others answered

    • C65%
    • D17%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think it's C, because dashboard viewer "Read-only access to dashboard configurations." SRE team wants to view data, not configurations.

    Adapted from community discussion by syslog · 2021-06-07 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. S

       syslog

       2021-06-07

       18 upvotes

       I think it's C, because dashboard viewer "Read-only access to dashboard configurations." SRE team wants to view data, not configurations.

    2. D

       danchoif2

       2021-08-29

       12 upvotes

       I did a test and see that: The valid roles are: Monitoring Viewer and Monitoring Dashboard Configuration Viewer. You can only share chart by URL using Metrics explorer. With only Monitoring Dashboard Configuration Viewer role, user cannot see anything in Monitoring page. I create a custom role from Monitoring Dashboard Configuration Viewer role and add resourcemanager.projects.get permission. Now user can see list of custom dashboards and the charts in these custom dashboards. User cannot see standard GCP dashboards. User cannot see the the chart in Metrics explorer (using the shared URL). Opening the URL, user will see errors: "Invalid resource type" and "Invalid metric type". So even if I ignore the typo of Dashboard Viewer role in B and D, they are still incorrect answers. So only A and C are valid. But I think C is better because the question is: "You want to share the chart" not the whole dashboard.

    3. A

       akg001

       2021-06-07

       9 upvotes

       correct there is no such role - "dashboard viewer" the correct name is monitoring dashboard configuration viewer (and the permission is - Read-only access to dashboard configurations). so correct answer should be - C

    4. F

       francisco_guerra

       2024-09-26

       5 upvotes

       Ans: C this question is kind of weird because the role is: roles/monitoring.dashboardViewer "Monitoring Dashboard Configuration Viewer" but monitoring viewer its too much access so I tested in console https://cloud.google.com/iam/docs/understanding-roles with Dashboard Viewer I would´nt be allowed to see the chart URL with monitoring works fine Dashboard Viewer Provides read-only access to get and list information about all monitoring data and configurations.

12. Question 12 of 25

    You support a high-traffic web application with a microservice architecture. The home page of the application displays multiple widgets containing content such as the current weather, stock prices, and news headlines. The main serving thread makes a call to a dedicated microservice for each widget and then lays out the homepage for the user. The microservices occasionally fail; when that happens, the serving thread serves the homepage with some missing content. Users of the application are unhappy if this degraded mode occurs too frequently, but they would rather have some content served instead of no content at all. You want to set a Service Level Objective (SLO) to ensure that the user experience does not degrade too much. What Service Level Indicator (SLI) should you use to measure this?

    • AA quality SLI: the ratio of non-degraded responses to total responses.
    • BAn availability SLI: the ratio of healthy microservices to the total number of microservices.
    • CA freshness SLI: the proportion of widgets that have been updated within the last 10 minutes.
    • DA latency SLI: the ratio of microservice calls that complete in under 100 ms to the total number of microservice calls.

    Show answer

    Correct answer: A

    How others answered

    • A96%

    Explanation

    Ans: A Quality as an SLI Quality is a helpful SLI for complex services that are designed to fail gracefully by degrading when dependencies are slow or unavailable. The SLI for quality is defined as follows: The proportion of valid requests served without degradation of service. https://cloud.google.com/architecture/adopting-slos

    Adapted from community discussion by francisco_guerra · 2022-06-22 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. F

       francisco_guerra

       2022-06-22

       34 upvotes

       Ans: A Quality as an SLI Quality is a helpful SLI for complex services that are designed to fail gracefully by degrading when dependencies are slow or unavailable. The SLI for quality is defined as follows: The proportion of valid requests served without degradation of service. https://cloud.google.com/architecture/adopting-slos

    2. N

       not_thanos

       2022-12-17

       Selected A6 upvotes

       https://cloud.google.com/architecture/adopting-slos?hl=en#sli-quality Quality is a helpful SLI for complex services that are designed to fail gracefully by degrading when dependencies are slow or unavailable. The SLI for quality is defined as follows: The proportion of valid requests served without degradation of service. For example, a web page might load its main content from one datastore and load ancillary, optional assets from 100 other services and datastores. If one optional service is out of service or too slow, the page can still be rendered without the ancillary elements. By measuring the number of requests that are served a degraded response (that is, a response missing at least one backend service's response), you can report the ratio of requests that were bad. You might even track how many responses to the user were missing a response from a single backend, or were missing responses from multiple backends.

    3. J

       JonathanSJ

       2024-01-13

       Selected A3 upvotes

       A. A quality SLI: the ratio of non-degraded responses to total responses. Explanation: An SLI (Service Level Indicator) is a metric that is used to measure the performance of a service against a specific SLO (Service Level Objective). To measure the user experience of the web application, which is the main concern in this scenario, the most appropriate SLI would be a quality SLI: the ratio of non-degraded responses to total responses. This will give you a clear indication of how often users are experiencing a degraded mode of the web application, and it will allow you to set a specific SLO for the percentage of non-degraded responses that you want to achieve. An availability SLI (Option B) would measure the availability of the microservices, not the user experience of the web application. A freshness SLI (Option C) would measure the freshness of the content, not the user experience of the web application. A latency SLI (Option D) would measure the speed of the microservices, not the user experience of the web application.

    4. P

       PhilipKoku

       2023-02-12

       Selected A5 upvotes

       A - Quality SLI: Number of correct pages / Total number of pages served.

13. Question 13 of 25

    Your team is designing a new application for deployment into Google Kubernetes Engine (GKE). You need to set up monitoring to collect and aggregate various application-level metrics in a centralized location. You want to use Google Cloud Platform services while minimizing the amount of work required to set up monitoring. What should you do?

    • APublish various metrics from the application directly to the Stackdriver Monitoring API, and then observe these custom metrics in Stackdriver.
    • BInstall the Cloud Pub/Sub client libraries, push various metrics from the application to various topics, and then observe the aggregated metrics in Stackdriver.
    • CInstall the OpenTelemetry client libraries in the application, configure Stackdriver as the export destination for the metrics, and then observe the application's metrics in Stackdriver.
    • DEmit all metrics in the form of application-specific log messages, pass these messages from the containers to the Stackdriver logging collector, and then observe metrics in Stackdriver.

    Show answer

    Correct answer: A

    How others answered

    • A54%
    • C46%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    C is correct, for A the installing of stackdriver library in the application is missing, without the lbrary custom metric cannot be created by the application

    Adapted from community discussion by giammydell · 2022-04-29 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. G

       giammydell

       2022-04-29

       19 upvotes

       C is correct, for A the installing of stackdriver library in the application is missing, without the lbrary custom metric cannot be created by the application

    2. L

       Luvero

       2022-04-24

       14 upvotes

       You want to use Google Cloud Platform services while minimizing the amount of work required to set up monitoring. Hence A

    3. C

       celia20200410

       2022-01-21

       6 upvotes

       ANS: A https://cloud.google.com/kubernetes-engine/docs/concepts/custom-and-external-metrics#custom_metrics https://github.com/GoogleCloudPlatform/k8s-stackdriver/blob/master/custom-metrics-stackdriver-adapter/README.md Your application can report a custom metric to Cloud Monitoring. You can configure Kubernetes to respond to these metrics and scale your workload automatically. Before you can use custom metrics, you must enable Monitoring in your Google Cloud project and install the Stackdriver adapter on your cluster. After custom metrics are exported to Monitoring, they can trigger autoscaling events by Horizontal Pod Autoscaler to change the shape of the workload.

    4. F

       francisco_guerra

       2021-12-23

       5 upvotes

       Ans: A Your application can report a custom metric to Cloud Monitoring. You can configure Kubernetes to respond to these metrics and scale your workload automatically. For example, you can scale your application based on metrics such as queries per second, writes per second, network performance, latency when communicating with a different application, or other metrics that make sense for your workload. https://cloud.google.com/kubernetes-engine/docs/concepts/custom-and-external-metrics

14. Question 14 of 25

    Your team uses Cloud Build for all CI/CD pipelines. You want to use the kubectl builder for Cloud Build to deploy new images to Google Kubernetes Engine (GKE). You need to authenticate to GKE while minimizing development effort. What should you do?

    • AAssign the Container Developer role to the Cloud Build service account.
    • BSpecify the Container Developer role for Cloud Build in the cloudbuild.yaml file.
    • CCreate a new service account with the Container Developer role and use it to run Cloud Build.
    • DCreate a separate step in Cloud Build to retrieve service account credentials and pass these to kubectl.

    Show answer

    Correct answer: A

    How others answered

    • A81%
    • C19%

    Explanation

    The best option for authenticating to GKE while minimizing development effort would be A. Assign the Container Developer role to the Cloud Build service account. Google Cloud Build uses a default service account to run the build, this service account is automatically created by Cloud Build and it has the necessary permissions to access the resources used by the build. By assigning the Container Developer role to this service account, it will have the necessary permissions to deploy new images to GKE. This way you don't need to create a new service account or specify the role in the cloudbuild.yaml file. This is an easy and secure way to authenticate to GKE without adding extra steps to the CI/CD pipeline.

    Adapted from community discussion by JonathanSJ · 2023-07-13 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. T

       TNT87

       2022-03-03

       11 upvotes

       A https://cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts

    2. J

       JonathanSJ

       2023-07-13

       Selected A3 upvotes

       The best option for authenticating to GKE while minimizing development effort would be A. Assign the Container Developer role to the Cloud Build service account. Google Cloud Build uses a default service account to run the build, this service account is automatically created by Cloud Build and it has the necessary permissions to access the resources used by the build. By assigning the Container Developer role to this service account, it will have the necessary permissions to deploy new images to GKE. This way you don't need to create a new service account or specify the role in the cloudbuild.yaml file. This is an easy and secure way to authenticate to GKE without adding extra steps to the CI/CD pipeline.

    3. C

       cloudbee

       2022-07-02

       Selected A4 upvotes

       A should be the correct one. because assigning permission to cloud build service account will give permission to deploy while minimizing additional overhead.

    4. A

       akg001

       2021-12-13

       4 upvotes

       User managed service account in the option C can be used only for manual builds. As CI/CD is being used so assigning the permission to default build service account could be good idea. so it seems best answer is A https://cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts

15. Question 15 of 25

    You have a set of applications running on a Google Kubernetes Engine (GKE) cluster, and you are using Stackdriver Kubernetes Engine Monitoring. You are bringing a new containerized application required by your company into production. This application is written by a third party and cannot be modified or reconfigured. The application writes its log information to /var/log/app_messages.log, and you want to send these log entries to Stackdriver Logging. What should you do?

    • AUse the default Stackdriver Kubernetes Engine Monitoring agent configuration.
    • BDeploy a Fluentd daemonset to GKE. Then create a customized input and output configuration to tail the log file in the application's pods and write to Stackdriver Logging.
    • CInstall Kubernetes on Google Compute Engine (GCE) and redeploy your applications. Then customize the built-in Stackdriver Logging configuration to tail the log file in the application's pods and write to Stackdriver Logging.
    • DWrite a script to tail the log file within the pod and write entries to standard output. Run the script as a sidecar container with the application's pod. Configure a shared volume between the containers to allow the script to have read access to /var/log in the application container.

    Show answer

    Correct answer: B

    How others answered

    • B58%
    • D42%

    Only 58% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B is the answer. https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#custom_agents GKE's default logging agent provides a managed solution to deploy and manage the agents that send the logs for your clusters to Cloud Logging. Depending on your GKE cluster master version, either fluentd or fluentbit are used to collect logs. Common use cases include: - collecting additional logs not written to STDOUT or STDERR - customized log formatting

    Adapted from community discussion by zellck · 2024-09-26 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Kubernetes documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. F

       francisco_guerra

       2024-09-21

       6 upvotes

       Ans is B Besides the list of default logs that the Logging agent streams by default, you can customize the Logging agent to send additional logs to Logging or to adjust agent settings by adding input configurations. The configuration definitions in these sections apply to the fluent-plugin-google-cloud output plugin only and specify how logs are transformed and ingested into Cloud Logging.

    2. J

       JonathanSJ

       2023-01-11

       3 upvotes

       Option D is NOT the ideal choice as it would require creating and maintaining a custom script that would have to be deployed with the application's pod in order to tail the log file and write the entries to standard output. This would mean that you would need to take care of the maintenance of this script on every new deployment, update or scaling of the pod, and also the script would need to handle all the edge cases, errors and permissions issues by your own. Furthermore, this option doesn't use the Stackdriver Logging service, the script would be writing to standard output, which may not be as reliable and secure as writing to a centralized logging service such as Stackdriver Logging. This would also require additional setup and maintenance to route the standard output to a location where the logs can be analyzed, this would take additional development and maintenance effort that would be redundant when compared to the other options.

    3. Z

       zellck

       2024-09-26

       Selected B4 upvotes

       B is the answer. https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#custom_agents GKE's default logging agent provides a managed solution to deploy and manage the agents that send the logs for your clusters to Cloud Logging. Depending on your GKE cluster master version, either fluentd or fluentbit are used to collect logs. Common use cases include: - collecting additional logs not written to STDOUT or STDERR - customized log formatting

    4. J

       JonathanSJ

       2024-09-26

       Selected B1 upvote

       B. Deploy a Fluentd daemonset to GKE. Then create a customized input and output configuration to tail the log file in the application's pods and write to Stackdriver Logging. Stackdriver Kubernetes Engine Monitoring provides log collection and analysis for Kubernetes clusters running on GKE out of the box, but the default configuration doesn't include the ability to tail a specific log file. To collect log entries written to /var/log/app_messages.log, you can deploy a Fluentd daemonset to your GKE cluster. Fluentd is a log collector and forwarder that can be configured to tail a specific log file, in this case, /var/log/app_messages.log and send the log entries to Stackdriver Logging. By deploying a Fluentd daemonset, you can create a customized input and output configuration, you can use this configuration to tail the log file in the application's pods and write to Stackdriver Logging, this allows you to collect the logs from that specific application, ensuring that the logs are going to stackdriver and can be analyzed later on.

16. Question 16 of 25

    You manage an application that is writing logs to Stackdriver Logging. You need to give some team members the ability to export logs. What should you do?

    • AGrant the team members the IAM role of logging.configWriter on Cloud IAM.
    • BConfigure Access Context Manager to allow only these members to export logs.
    • CCreate and grant a custom IAM role with the permissions logging.sinks.list and logging.sink.get.
    • DCreate an Organizational Policy in Cloud IAM to allow only these members to create log exports.

    Show answer

    Correct answer: A

    How others answered

    • A73%
    • C27%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    It's should be C. least privilege The question is ask about export log and does not mention about read and write log Option A give too many permission Logs Configuration Writer (roles/logging.configWriter) Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. logging.buckets.create logging.buckets.delete logging.buckets.get logging.buckets.list logging.buckets.undelete logging.buckets.update logging.cmekSettings.* logging.exclusions.* logging.locations.* logging.logMetrics.* logging.logServiceIndexes.* logging.logServices.* logging.logs.list logging.notificationRules.* logging.operations.* logging.sinks.* logging.views.create logging.views.delete logging.views.get logging.views.list logging.views.update resourcemanager.projects.get resourcemanager.projects.list

    Adapted from community discussion by Manh · 2022-11-11 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. G

       Goram113

       2022-12-11

       11 upvotes

       logging.sinks.create is needed to export logs - this is why C is wrong

    2. M

       Manh

       2022-11-11

       7 upvotes

       It's should be C. least privilege The question is ask about export log and does not mention about read and write log Option A give too many permission Logs Configuration Writer (roles/logging.configWriter) Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. logging.buckets.create logging.buckets.delete logging.buckets.get logging.buckets.list logging.buckets.undelete logging.buckets.update logging.cmekSettings.* logging.exclusions.* logging.locations.* logging.logMetrics.* logging.logServiceIndexes.* logging.logServices.* logging.logs.list logging.notificationRules.* logging.operations.* logging.sinks.* logging.views.create logging.views.delete logging.views.get logging.views.list logging.views.update resourcemanager.projects.get resourcemanager.projects.list

    3. N

       not_thanos

       2022-12-17

       4 upvotes

       Write answer is A as stated in the documentation here https://cloud.google.com/logging/docs/export/configure_export_v2#before-you-begin "Note that this guide describes creating and managing sinks at the Cloud project level, but you can create sinks (non-aggregated) for billing accounts, folders, and organizations. As you get started, ensure the following: You have a Google Cloud project with logs that you can see in the Logs Explorer. You have one of the following IAM roles for the source Cloud project from which you're routing logs. Owner (roles/owner) Logging Admin (roles/logging.admin) Logs Configuration Writer (roles/logging.configWriter) The permissions contained in these roles allow you to create, delete, or modify sinks. For information on setting IAM roles, see the Logging Access control guide."

    4. I

       irocketsoldier

       2022-11-19

       6 upvotes

       I understand that option A gives the ability to export logs, but isn't C the best option following the least privilege principle since the question only says that the team members needs to export logs and not to write them?

17. Question 17 of 25

    You are running an application in a virtual machine (VM) using a custom Debian image. The image has the Stackdriver Logging agent installed. The VM has the cloud-platform scope. The application is logging information via syslog. You want to use Stackdriver Logging in the Google Cloud Platform Console to visualize the logs. You notice that syslog is not showing up in the "All logs" dropdown list of the Logs Viewer. What is the first thing you should do?

    • ALook for the agent's test log entry in the Logs Viewer.
    • BInstall the most recent version of the Stackdriver agent.
    • CVerify the VM service account access scope includes the monitoring.write scope.
    • DSSH to the VM and execute the following commands on your VM: ps ax | grep fluentd.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Between C and D, I think D Reason : When an instance is created, we can specify which service account the instance uses when calling Google Cloud APIs. The instance is automatically configured with access scope and one such access scope is monitoring.write (Link : https://cloud.google.com/compute/docs/access/service- read is to publish metric data and logging.write is to write compute engine logs. Considering above, I believe D as the answer (check whether the agent is running)

    Adapted from community discussion by raf2121 · 2022-02-08 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. R

       raf2121

       2022-02-08

       12 upvotes

       Between C and D, I think D Reason : When an instance is created, we can specify which service account the instance uses when calling Google Cloud APIs. The instance is automatically configured with access scope and one such access scope is monitoring.write (Link : https://cloud.google.com/compute/docs/access/service- read is to publish metric data and logging.write is to write compute engine logs. Considering above, I believe D as the answer (check whether the agent is running)

    2. F

       francisco_guerra

       2021-12-19

       3 upvotes

       Ans is C Why?: A: Does not make sense at all B: the version it's not possible? C: Its OK because both (scope and service account) need access to write to logging D: Really? the question clearly says: "The image has the Stackdriver Logging agent installed." Explanation: Generally, you can just set the cloud-platform access scope to allow access to most of the Cloud APIs, then grant the service account only relevant IAM roles. The combination of access scopes granted to the virtual machine instance and the IAM roles granted to the service account determines the amount of access the service account has for that instance. The service account can execute API methods only if they are allowed by both the access scope and its IAM roles. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances Please do not try to confuse people if you put your explanation add the link

    3. S

       syslog

       2022-01-06

       5 upvotes

       I think it's D: https://cloud.google.com/logging/docs/agent/logging/troubleshooting#test-agent. Maybe the agent is installed but not running.

    4. C

       cetanx

       2022-03-13

       3 upvotes

       Agree. If you check here: https://cloud.google.com/logging/docs/agent/logging/troubleshooting#checklist You will see that first recommended troubleshooting step is to check if the agent is running or not... So it should be D. Also if you refer to Google Groups link provided as the answer, you will see that they first checked if the agent is running/installed.

18. Question 18 of 25

    You are using Stackdriver to monitor applications hosted on Google Cloud Platform (GCP). You recently deployed a new application, but its logs are not appearing on the Stackdriver dashboard. You need to troubleshoot the issue. What should you do?

    • AConfirm that the Stackdriver agent has been installed in the hosting virtual machine.
    • BConfirm that your account has the proper permissions to use the Stackdriver dashboard.
    • CConfirm that port 25 has been opened in the firewall to allow messages through to Stackdriver.
    • DConfirm that the application is using the required client library and the service account key has proper permissions.

    Show answer

    Correct answer: A

    How others answered

    • A78%

    Explanation

    Why do you complicate stuff. A is the answer. Why not D, because if A is not there D is useless. Question says you are using Stackdriver monitoring, not saying you have an agent installed already. You need the agent to export logs. So first thing you'll always see in the agent is there, and running. Next service account, next client libraries. I hope this clears your doubts.

    Adapted from community discussion by KyubiBlaze · 2022-07-16 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. K

       KyubiBlaze

       2022-07-16

       13 upvotes

       Why do you complicate stuff. A is the answer. Why not D, because if A is not there D is useless. Question says you are using Stackdriver monitoring, not saying you have an agent installed already. You need the agent to export logs. So first thing you'll always see in the agent is there, and running. Next service account, next client libraries. I hope this clears your doubts.

    2. N

       not_thanos

       2022-06-17

       Selected A5 upvotes

       A and D seems correct. I think D is less correct because since you are hosting on GCP, best practice is to not add a service account to the application itself but instead leverage the native logging capabilities of GCP's offerings like GKE, GCP, etc.

    3. H

       hfudjdn

       2022-05-13

       6 upvotes

       D - The question states that you are already using Stackdriver for the GCE instance (assuming the agent is already installed). However, the "new" application has issues shipping the logs

    4. J

       JonathanSJ

       2023-07-14

       Selected A2 upvotes

       A. Store the Terraform code in a version-control system. Establish procedures for pushing new versions and merging with the master. Using a version-control system such as Git, allows you to store different versions of the code and track changes that are made to it. This allows you to easily roll back to a previous version if necessary, and ensures that all team members are working on the same version of the code. It also allows team members to collaborate on the code and merge changes with the master version. This is the most effective way to share code and maintain versioning, as it provides a centralized location for all code and allows for easy collaboration and management of code changes.

19. Question 19 of 25

    You use Cloud Build to build your application. You want to reduce the build time while minimizing cost and development effort. What should you do?

    • AUse Cloud Storage to cache intermediate artifacts.
    • BRun multiple Jenkins agents to parallelize the build.
    • CUse multiple smaller build steps to minimize execution time.
    • DUse larger Cloud Build virtual machines (VMs) by using the machine-type option.

    Show answer

    Correct answer: A

    How others answered

    • A92%

    Explanation

    Correct Answer is (D): Using custom virtual machine sizes In addition to the standard machine type, Cloud Build provides four high-CPU virtual machine types to run your builds. To increase the speed of your build, select a virtual machine with a higher CPU. Requesting a high-CPU machine may increase the startup time of your build as Cloud Build only starts these machines on demand. https://cloud.google.com/build/docs/speeding-up-builds

    Adapted from community discussion by ESP_SAP · 2022-06-05 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. B

       bob_builder

       2022-06-16

       8 upvotes

       A - https://cloud.google.com/build/docs/speeding-up-builds#caching_directories_with_google_cloud_storage

    2. E

       ESP_SAP

       2022-06-05

       6 upvotes

       Correct Answer is (D): Using custom virtual machine sizes In addition to the standard machine type, Cloud Build provides four high-CPU virtual machine types to run your builds. To increase the speed of your build, select a virtual machine with a higher CPU. Requesting a high-CPU machine may increase the startup time of your build as Cloud Build only starts these machines on demand. https://cloud.google.com/build/docs/speeding-up-builds

    3. K

       KyubiBlaze

       2022-07-16

       4 upvotes

       A is correct choice. Why D is not correct, because even if you break steps into small chunks, you are just increasing the number of steps, and not solving the actual problem of reducing execution time. If step 1 takes 5min it will take 5min, if you break it down into three steps, combined Step 1+2+3 = 5min again, and they don't run in parallel. What did you solve? Nothing. If you cache ie. store intermediate artefacts in cloud storage, you do not need to recompile it in next steps, saves time and cost.

    4. J

       job_search83

       2022-04-26

       5 upvotes

       A, caching, https://cloud.google.com/build/docs/speeding-up-builds

20. Question 20 of 25

    You support a web application that runs on App Engine and uses CloudSQL and Cloud Storage for data storage. After a short spike in website traffic, you notice a big increase in latency for all user requests, increase in CPU use, and the number of processes running the application. Initial troubleshooting reveals: ✑ After the initial spike in traffic, load levels returned to normal but users still experience high latency. ✑ Requests for content from the CloudSQL database and images from Cloud Storage show the same high latency. ✑ No changes were made to the website around the time the latency increased. ✑ There is no increase in the number of errors to the users. You expect another spike in website traffic in the coming days and want to make sure users don't experience latency. What should you do?

    • AUpgrade the GCS buckets to Multi-Regional.
    • BEnable high availability on the CloudSQL instances.
    • CMove the application from App Engine to Compute Engine.
    • DModify the App Engine configuration to have additional idle instances.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Correct Answer is D: Scaling App Engine scales the number of instances automatically in response to processing volume. This scaling factors in the automatic_scaling settings that are provided on a per-version basis in the configuration file. A service with basic scaling is configured by setting the maximum number of instances in the max_instances parameter of the basic_scaling setting. The number of live instances scales with the processing volume. You configure the number of instances of each version in that service's configuration file. The number of instances usually corresponds to the size of a dataset being held in memory or the desired throughput for offline work. You can adjust the number of instances of a manually-scaled version very quickly, without stopping instances that are currently running, using the Modules API set_num_instances function. https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed

    Adapted from community discussion by ESP_SAP · 2022-06-03 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. E

       ESP_SAP

       2022-06-03

       10 upvotes

       Correct Answer is D: Scaling App Engine scales the number of instances automatically in response to processing volume. This scaling factors in the automatic_scaling settings that are provided on a per-version basis in the configuration file. A service with basic scaling is configured by setting the maximum number of instances in the max_instances parameter of the basic_scaling setting. The number of live instances scales with the processing volume. You configure the number of instances of each version in that service's configuration file. The number of instances usually corresponds to the size of a dataset being held in memory or the desired throughput for offline work. You can adjust the number of instances of a manually-scaled version very quickly, without stopping instances that are currently running, using the Modules API set_num_instances function. https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed

    2. M

       MBA_1

       2022-05-05

       6 upvotes

       D is correct - https://cloud.google.com/appengine/docs/standard/python/config/appref max_idle_instances Optional. The maximum number of idle instances that App Engine should maintain for this version. Specify a value from 1 to 1000. If not specified, the default value is automatic, which means App Engine will manage the number of idle instances. Keep the following in mind: A high maximum reduces the number of idle instances more gradually when load levels return to normal after a spike. This helps your application maintain steady performance through fluctuations in request load, but also raises the number of idle instances (and consequent running costs) during such periods of heavy load.

    3. N

       Nik22

       2022-04-27

       2 upvotes

       A. Upgrade the GCS buckets to Multi-Regional. B. Enable high availability on the CloudSQL instances. C. Move the application from App Engine to Compute Engine. D. Modify the App Engine configuration to have additional idle instances. There is nothing in the question that talks about region. If I assume that bucket is created in the region where the app is deployed B - Gives redundancy. I don't see how this can improve the latency C - Does not make any sense D - Additional instance, would reduce the CPU Time & memory. I would go with D. But not too sure.

    4. N

       NXD

       2022-04-30

       3 upvotes

       D is correct to me. A: wrong – because increase in latency for all user requests, not for specific region. So B: wrong – problem affects both database and GCS C: wrong increase in CPU use, and the number of processes running the application => problem is that CPU is not enough to run application processes.

21. Question 21 of 25

    You support a trading application written in Python and hosted on App Engine flexible environment. You want to customize the error information being sent to Stackdriver Error Reporting. What should you do?

    • AInstall the Stackdriver Error Reporting library for Python, and then run your code on a Compute Engine VM.
    • BInstall the Stackdriver Error Reporting library for Python, and then run your code on Google Kubernetes Engine.
    • CInstall the Stackdriver Error Reporting library for Python, and then run your code on App Engine flexible environment.
    • DUse the Stackdriver Error Reporting API to write errors from your application to ReportedErrorEvent, and then generate log entries with properly formatted error messages in Stackdriver Logging.

    Show answer

    Correct answer: D

    How others answered

    • D69%
    • C31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    @TNT87 - Answer is C, the link you shared has a pip install in the beginning which means Python requires installing library first. pip install --upgrade google-cloud-error-reporting

    Adapted from community discussion by muk5658 · 2022-05-24 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. M

       muk5658

       2022-05-24

       20 upvotes

       @TNT87 - Answer is C, the link you shared has a pip install in the beginning which means Python requires installing library first. pip install --upgrade google-cloud-error-reporting

    2. I

       iamzeah

       2023-01-23

       Selected D4 upvotes

       If you're using the Error Reporting API, you can report error events from your application by writing them to ReportedErrorEvent. Doing this generates log entries with properly formatted error messages in Cloud Logging. https://cloud.google.com/error-reporting/docs/formatting-error-messages

    3. D

       DoodleDo

       2023-06-06

       3 upvotes

       Ans C There are two things asked here. One is Error Reporting enabled for App Engine Flex. It is based on this source - Ans D Error Reporting Auto Enabled for App Engine Flex - Source - https://cloud.google.com/error-reporting/docs/setup/app-engine-flexible-environment Second the question asks about customize error (not formatting the error). If you'd like to customize the error information being sent to Error Reporting, you can use the instrumentation libraries available for a number of languages: Source - https://cloud.google.com/error-reporting/docs/setup/app-engine-flexible-environment For formatting the error then use option D - Source - https://cloud.google.com/error-reporting/docs/formatting-error-messages

    4. P

       pradoUA

       2023-04-24

       Selected D4 upvotes

       The question ask: "You want to customize the error information being sent", hence for me the answer is D

22. Question 22 of 25

    Some of your production services are running in Google Kubernetes Engine (GKE) in the eu-west-1 region. Your build system runs in the us-west-1 region. You want to push the container images from your build system to a scalable registry to maximize the bandwidth for transferring the images to the cluster. What should you do?

    • APush the images to Google Container Registry (GCR) using the gcr.io hostname.
    • BPush the images to Google Container Registry (GCR) using the us.gcr.io hostname.
    • CPush the images to Google Container Registry (GCR) using the eu.gcr.io hostname.
    • DPush the images to a private image registry running on a Compute Engine instance in the eu-west-1 region.

    Show answer

    Correct answer: C

    How others answered

    • C90%

    Explanation

    To maximize the bandwidth for transferring the images to the cluster, one needs the the registry to be closer to the production or system where it needs to be deployed. I would go with C, since the production system is in Europe.

    Adapted from community discussion by Nik22 · 2021-10-26 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. N

       Nik22

       2021-10-26

       18 upvotes

       To maximize the bandwidth for transferring the images to the cluster, one needs the the registry to be closer to the production or system where it needs to be deployed. I would go with C, since the production system is in Europe.

    2. M

       MBA_1

       2021-11-05

       4 upvotes

       It's C - because of GDPR compliance. Hostname Storage location gcr.io Stores images in data centers in the United States asia.gcr.io Stores images in data centers in Asia eu.gcr.io Stores images in data centers within member states of the European Union us.gcr.io Stores images in data centers in the United States

    3. M

       mudot

       2022-11-08

       4 upvotes

       Appeard in 7/11/2022 exam the answers were different in the exam. they are like a) us-docker.pkg.dev , b)europe-docker.pkg.dev c)europe-west1-docker.dev.pkg 4)private registry. answer : europe-docker.pkg.dev

    4. Z

       zellck

       2022-10-23

       Selected C3 upvotes

       C is the answer. https://cloud.google.com/container-registry/docs/pushing-and-pulling#add-registry - eu.gcr.io -> Stores images in data centers within member states of the European Union

23. Question 23 of 25

    You are ready to deploy a new feature of a web-based application to production. You want to use Google Kubernetes Engine (GKE) to perform a phased rollout to half of the web server pods. What should you do?

    • AUse a partitioned rolling update.
    • BUse Node taints with NoExecute.
    • CUse a replica set in the deployment specification.
    • DUse a stateful set with parallel pod management policy.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A is the answer. https://cloud.google.com/kubernetes-engine/docs/how-to/updating-apps#partitioning_a_rollingupdate Partitioning is useful if you want to stage an update, roll out a canary, or perform a phased roll out.

    Adapted from community discussion by zellck · 2023-10-23 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Kubernetes documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. Z

       zellck

       2023-10-23

       Selected A4 upvotes

       A is the answer. https://cloud.google.com/kubernetes-engine/docs/how-to/updating-apps#partitioning_a_rollingupdate Partitioning is useful if you want to stage an update, roll out a canary, or perform a phased roll out.

    2. J

       JonathanSJ

       2024-01-15

       2 upvotes

       B. Using Node taints with NoExecute could be used to prevent pods from being scheduled on certain nodes, but it would not be the best option for a phased rollout as it does not allow for a specific percentage or number of pods to be updated. C. A replica set in the deployment specification is used for ensuring that a specified number of replicas of a pod are running at any given time, but it does not provide a way to perform a phased rollout. D. A stateful set with parallel pod management policy is used for managing stateful applications, but it also does not provide a way to perform a phased rollout. The option A, Using a partitioned rolling update, allows you to specify the percentage of pods that should be updated at a time, so it is the best option for performing a phased rollout.

    3. J

       JonathanSJ

       2024-01-15

       Selected A2 upvotes

       A partitioned rolling update allows you to control the percentage of pods that are updated at a time, which allows you to perform a phased rollout. This way you can incrementally test and monitor the new feature, before it is deployed to all the pods. This approach is useful when you want to minimize the risk of introducing new bugs or breaking changes in your production environment, it allows you to have more control over the process, and it's less likely to cause service disruption, or to have all the pods down at the same time.

    4. A

       AzureDP900

       2023-10-25

       1 upvote

       A is right https://cloud.google.com/kubernetes-engine/docs/concepts/statefulset#partitioning_rolling_updates Partitioning is useful if you want to stage an update, roll out a canary, or perform a phased roll out. When you partition an update, all Pods with an ordinal greater than or equal to the partition value are updated when you update the StatefulSet’s Pod specification. Pods with an ordinal less than the partition value are not updated and, even if they are deleted, are recreated using the previous version of the specification. If the partition value is greater than the number of replicas, the updates are not propagated to the Pods.

24. Question 24 of 25

    You have an application running in Google Kubernetes Engine. The application invokes multiple services per request but responds too slowly. You need to identify which downstream service or services are causing the delay. What should you do?

    • AAnalyze VPC flow logs along the path of the request.
    • BInvestigate the Liveness and Readiness probes for each service.
    • CCreate a Dataflow pipeline to analyze service metrics in real time.
    • DUse a distributed tracing framework such as OpenTelemetry or Stackdriver Trace.

    Show answer

    Correct answer: D

    How others answered

    • D86%

    Explanation

    D is the answer. https://cloud.google.com/trace/docs/overview Cloud Trace, a distributed tracing system for Google Cloud, helps you understand how long it takes your application to handle incoming requests from users or other applications, and how long it takes to complete operations like RPC calls performed when handling the requests.

    Adapted from community discussion by zellck · 2023-10-23 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. J

       JonathanSJ

       2024-01-15

       Selected D2 upvotes

       D. Use a distributed tracing framework such as OpenTelemetry or Stackdriver Trace. Distributed tracing allows you to trace the path of a request as it travels through multiple services and identify where delays may be occurring. This can provide detailed information about the request and response timings for each service, making it easier to pinpoint which services are causing delays in your application. OpenTelemetry and Stackdriver Trace are both available on GCP, and provide easy integration with Kubernetes and other GCP services.

    2. Z

       zellck

       2023-10-23

       Selected D2 upvotes

       D is the answer. https://cloud.google.com/trace/docs/overview Cloud Trace, a distributed tracing system for Google Cloud, helps you understand how long it takes your application to handle incoming requests from users or other applications, and how long it takes to complete operations like RPC calls performed when handling the requests.

    3. P

       pradoUA

       2023-10-21

       Selected D2 upvotes

       Cloud Trace is a distributed tracing system that collects latency data from your applications and displays it in the Google Cloud Console.

    4. T

       TNT87

       2022-12-07

       2 upvotes

       https://cloud.google.com/architecture/processing-logs-at-scale-using-dataflow?hl=en Kindly read this and say why is C wrong

25. Question 25 of 25

    Your team deploys applications to three Google Kubernetes Engine (GKE) environments: development, staging, and production. You use GitHub repositories as your source of truth. You need to ensure that the three environments are consistent. You want to follow Google-recommended practices to enforce and install network policies and a logging DaemonSet on all the GKE clusters in those environments. What should you do?

    • AUse Google Cloud Deploy to deploy the network policies and the DaemonSet. Use Cloud Monitoring to trigger an alert if the network policies and DaemonSet drift from your source in the repository.
    • BUse Google Cloud Deploy to deploy the DaemonSet and use Policy Controller to configure the network policies. Use Cloud Monitoring to detect drifts from the source in the repository and Cloud Functions to correct the drifts.
    • CUse Cloud Build to render and deploy the network policies and the DaemonSet. Set up Config Sync to sync the configurations for the three environments.
    • DUse Cloud Build to render and deploy the network policies and the DaemonSet. Set up a Policy Controller to enforce the configurations for the three environments.

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • C50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Option C is not as effective as Option D because it does not enforce the network policies and DaemonSet configurations. This means that unauthorized changes could still be made to the configurations. Config Sync is a tool that can be used to synchronize Kubernetes configurations across multiple clusters. However, it does not prevent unauthorized changes from being made to the configurations. Policy Controller is a tool that can be used to enforce Kubernetes configurations. It does this by monitoring the Kubernetes API for changes to the configurations and automatically reverting unauthorized changes. Therefore, Option D is a more secure and reliable option for ensuring that the network policies and DaemonSet are enforced and installed consistently across the three environments.

    Adapted from community discussion by ManishKS · 2023-10-01 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDOE or CertExamHQ.

    1. M

       ManishKS

       2023-10-01

       9 upvotes

       Option C is not as effective as Option D because it does not enforce the network policies and DaemonSet configurations. This means that unauthorized changes could still be made to the configurations. Config Sync is a tool that can be used to synchronize Kubernetes configurations across multiple clusters. However, it does not prevent unauthorized changes from being made to the configurations. Policy Controller is a tool that can be used to enforce Kubernetes configurations. It does this by monitoring the Kubernetes API for changes to the configurations and automatically reverting unauthorized changes. Therefore, Option D is a more secure and reliable option for ensuring that the network policies and DaemonSet are enforced and installed consistently across the three environments.

    2. M

       medox89

       2024-02-04

       3 upvotes

       Option C is the right one." Cloud Build: Ideal for building and deploying software artifacts based on your GitHub repositories, your chosen source of truth. Renders your network policies and DaemonSet configurations, ensuring consistency before deployment. Config Sync: Designed for configuration management across GKE clusters. Continuously synchronizes your rendered configurations (network policies and DaemonSet) from GitHub to all three environments (development, staging, production). Provides automated drift detection and remediation, ensuring consistency remains enforced.

    3. X

       xhilmi

       2023-12-06

       Selected D1 upvote

       Option D is the recommended approach for ensuring consistency across the three Google Kubernetes Engine (GKE) environments—development, staging, and production—while adhering to Google-recommended practices. By using Cloud Build to render and deploy network policies and a DaemonSet, and implementing Policy Controller, you can enforce configurations uniformly across environments. Policy Controller ensures that the deployed configurations align with your desired state, providing a consistent and policy-driven approach. This method leverages the declarative nature of Kubernetes configurations, facilitating configuration management. Overall, Option D combines infrastructure-as-code principles with policy enforcement to maintain consistency and enhance manageability across GKE clusters in different environments.

    4. S

       surfer111

       2024-08-11

       2 upvotes

       Its a toss up here. C hits all the keywords in "https://cloud.google.com/kubernetes-engine/enterprise/config-sync/docs/overview" - source of truth, gitops, but does not talk about enforcement. However, policy controller is a subset of configsync and it does handle enforcement. "Constraints can be applied directly to your clusters using the Kubernetes API, or distributed to a set of clusters from a centralized source, like a Git repository, by using Config Sync." https://cloud.google.com/kubernetes-engine/enterprise/policy-controller/docs/overview#constraints Really seems like a trick question leading you to D when C is the right answer with the knowledge that you would configure policy controller as a sub step when setting up config sync for your gitops.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDOE practice, question 1 of 25