Font size
WorksheetsPCD-3
Total questions: 50
Worksheet time: 26mins
You are designing a resource-sharing policy for applications used by different teams in a Google Kubernetes Engine cluster. You need to ensure that all applications can access the resources needed to run. What should you do? (Choose two.)
Specify the resource limits and requests in the object specifications.
Create a namespace for each team, and attach resource quotas to each namespace.
Create a LimitRange to specify the default compute resource requirements for each namespace.
Create a Kubernetes service account (KSA) for each application, and assign each KSA to the namespace.
Use the Anthos Policy Controller to enforce label annotations on all namespaces. Use taints and tolerations to allow resource sharing for namespaces.
You are developing a new application that has the following design requirements:
✑ Creation and changes to the application infrastructure are versioned and auditable.
✑ The application and deployment infrastructure uses Google-managed services as much as possible.
✑ The application runs on a serverless compute platform.
How should you design the application's architecture?
1. Store the application and infrastructure source code in a Git repository. 2. Use Cloud Build to deploy the application infrastructure with Terraform. 3. Deploy the application to a Cloud Function as a pipeline step.
1. Deploy Jenkins from the Google Cloud Marketplace, and define a continuous integration pipeline in Jenkins. 2. Configure a pipeline step to pull the application source code from a Git repository. 3. Deploy the application source code to App Engine as a pipeline step.
1. Create a continuous integration pipeline on Cloud Build, and configure the pipeline to deploy the application infrastructure using Deployment Manager templates. 2. Configure a pipeline step to create a container with the latest application source code. 3. Deploy the container to a Compute Engine instance as a pipeline step.
1. Deploy the application infrastructure using gcloud commands. 2. Use Cloud Build to define a continuous integration pipeline for changes to the application source code. 3. Configure a pipeline step to pull the application source code from a Git repository, and create a containerized application. 4. Deploy the new container on Cloud Run as a pipeline step.
You are creating and running containers across different projects in Google Cloud. The application you are developing needs to access Google Cloud services from within Google Kubernetes Engine (GKE). What should you do?
Assign a Google service account to the GKE nodes.
Use a Google service account to run the Pod with Workload Identity.
Store the Google service account credentials as a Kubernetes Secret.
Use a Google service account with GKE role-based access control (RBAC).
You have containerized a legacy application that stores its configuration on an NFS share. You need to deploy this application to Google Kubernetes Engine (GKE) and do not want the application serving traffic until after the configuration has been retrieved. What should you do?
Use the gsutil utility to copy files from within the Docker container at startup, and start the service using an ENTRYPOINT script.
Create a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.
Use the COPY statement in the Dockerfile to load the configuration into the container image. Verify that the configuration is available, and start the service using an ENTRYPOINT script.
Add a startup script to the GKE instance group to mount the NFS share at node startup. Copy the configuration files into the container, and start the service using an ENTRYPOINT script.
Your team is developing a new application using a PostgreSQL database and Cloud Run. You are responsible for ensuring that all traffic is kept private on Google Cloud. You want to use managed services and follow Google-recommended best practices. What should you do?
1. Enable Cloud SQL and Cloud Run in the same project. 2. Configure a private IP address for Cloud SQL. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Configure Cloud Run to use the connector to connect to Cloud SQL.
1. Install PostgreSQL on a Compute Engine virtual machine (VM), and enable Cloud Run in the same project. 2. Configure a private IP address for the VM. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Configure Cloud Run to use the connector to connect to the VM hosting PostgreSQL.
1. Use Cloud SQL and Cloud Run in different projects. 2. Configure a private IP address for Cloud SQL. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Set up a VPN connection between the two projects. Configure Cloud Run to use the connector to connect to Cloud SQL.
1. Install PostgreSQL on a Compute Engine VM, and enable Cloud Run in different projects. 2. Configure a private IP address for the VM. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Set up a VPN connection between the two projects. Configure Cloud Run to use the connector to access the VM hosting PostgreSQL
You are developing an application that will allow clients to download a file from your website for a specific period of time. How should you design the application to complete this task while following Google-recommended best practices?
Configure the application to send the file to the client as an email attachment.
Generate and assign a Cloud Storage-signed URL for the file. Make the URL available for the client to download.
Create a temporary Cloud Storage bucket with time expiration specified, and give download permissions to the bucket. Copy the file, and send it to the client.
Generate the HTTP cookies with time expiration specified. If the time is valid, copy the file from the Cloud Storage bucket, and make the file available for the client to download.
Your development team has been asked to refactor an existing monolithic application into a set of composable microservices. Which design aspects should you implement for the new application? (Choose two.)
Develop the microservice code in the same programming language used by the microservice caller.
Create an API contract agreement between the microservice implementation and microservice caller.
Require asynchronous communications between all microservice implementations and microservice callers.
Ensure that sufficient instances of the microservice are running to accommodate the performance requirements.
Implement a versioning scheme to permit future changes that could be incompatible with the current interface.
You deployed a new application to Google Kubernetes Engine and are experiencing some performance degradation. Your logs are being written to Cloud Logging, and you are using a Prometheus sidecar model for capturing metrics. You need to correlate the metrics and data from the logs to troubleshoot the performance issue and send real-time alerts while minimizing costs. What should you do?
Create custom metrics from the Cloud Logging logs, and use Prometheus to import the results using the Cloud Monitoring REST API.
Export the Cloud Logging logs and the Prometheus metrics to Cloud Bigtable. Run a query to join the results, and analyze in Google Data Studio.
Export the Cloud Logging logs and stream the Prometheus metrics to BigQuery. Run a recurring query to join the results, and send notifications using Cloud Tasks.
Export the Prometheus metrics and use Cloud Monitoring to view them as external metrics. Configure Cloud Monitoring to create log-based metrics from the logs, and correlate them with the Prometheus data.
You have been tasked with planning the migration of your company's application from on-premises to Google Cloud. Your company's monolithic application is an ecommerce website. The application will be migrated to microservices deployed on Google Cloud in stages. The majority of your company's revenue is generated through online sales, so it is important to minimize risk during the migration. You need to prioritize features and select the first functionality to migrate. What should you do?
Migrate the Product catalog, which has integrations to the frontend and product database.
Migrate Payment processing, which has integrations to the frontend, order database, and third-party payment vendor.
Migrate Order fulfillment, which has integrations to the order database, inventory system, and third-party shipping vendor.
Migrate the Shopping cart, which has integrations to the frontend, cart database, inventory system, and payment processing system.
Your team develops services that run on Google Kubernetes Engine. Your team's code is stored in Cloud Source Repositories. You need to quickly identify bugs in the code before it is deployed to production. You want to invest in automation to improve developer feedback and make the process as efficient as possible. What should you do?
Use Spinnaker to automate building container images from code based on Git tags.
Use Cloud Build to automate building container images from code based on Git tags.
Use Spinnaker to automate deploying container images to the production environment.
Use Cloud Build to automate building container images from code based on forked versions.
Your team is developing an application in Google Cloud that executes with user identities maintained by Cloud Identity. Each of your application's users will have an associated Pub/Sub topic to which messages are published, and a Pub/Sub subscription where the same user will retrieve published messages. You need to ensure that only authorized users can publish and subscribe to their own specific Pub/Sub topic and subscription. What should you do?
Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level.
Grant the user identity the pubsub.publisher and pubsub.subscriber roles at the project level.
Grant the user identity a custom role that contains the pubsub.topics.create and pubsub.subscriptions.create permissions.
Configure the application to run as a service account that has the pubsub.publisher and pubsub.subscriber roles.
You are evaluating developer tools to help drive Google Kubernetes Engine adoption and integration with your development environment, which includes VS Code and IntelliJ. What should you do?
Use Cloud Code to develop applications.
Use the Cloud Shell integrated Code Editor to edit code and configuration files.
Use a Cloud Notebook instance to ingest and process data and deploy models.
Use Cloud Shell to manage your infrastructure and applications from the command line.
You are developing an ecommerce web application that uses App Engine standard environment and Memorystore for Redis. When a user logs into the app, the application caches the user's information (e.g., session, name, address, preferences), which is stored for quick retrieval during checkout. While testing your application in a browser, you get a 502 Bad Gateway error. You have determined that the application is not connecting to Memorystore. What is the reason for this error?
Your Memorystore for Redis instance was deployed without a public IP address.
You configured your Serverless VPC Access connector in a different region than your App Engine instance.
The firewall rule allowing a connection between App Engine and Memorystore was removed during an infrastructure update by the DevOps team.
You configured your application to use a Serverless VPC Access connector on a different subnet in a different availability zone than your App Engine instance.
Your team develops services that run on Google Cloud. You need to build a data processing service and will use Cloud Functions. The data to be processed by the function is sensitive. You need to ensure that invocations can only happen from authorized services and follow Googlerecommended best practices for securing functions. What should you do?
Enable Identity-Aware Proxy in your project. Secure function access using its permissions.
Create a service account with the Cloud Functions Viewer role. Use that service account to invoke the function.
Create a service account with the Cloud Functions Invoker role. Use that service account to invoke the function.
Create an OAuth 2.0 client ID for your calling service in the same project as the function you want to secure. Use those credentials to invoke the function.
You are deploying your applications on Compute Engine. One of your Compute Engine instances failed to launch. What should you do? (Choose two.
Determine whether your file system is corrupted.
Access Compute Engine as a different SSH user.
Troubleshoot firewall rules or routes on an instance.
Check whether your instance boot disk is completely full.
Check whether network traffic to or from your instance is being dropped.
Your web application is deployed to the corporate intranet. You need to migrate the web application to Google Cloud. The web application must be available only to company employees and accessible to employees as they travel. You need to ensure the security and accessibility of the web application while minimizing application changes. What should you do?
Configure the application to check authentication credentials for each HTTP(S) request to the application.
Configure Identity-Aware Proxy to allow employees to access the application through its public IP address.
Configure a Compute Engine instance that requests users to log in to their corporate account. Change the web application DNS to point to the proxy Compute Engine instance. After authenticating, the Compute Engine instance forwards requests to and from the web application.
Configure a Compute Engine instance that requests users to log in to their corporate account. Change the web application DNS to point to the proxy Compute Engine instance. After authenticating, the Compute Engine issues an HTTP redirect to a public IP address hosting the web application.
You have an application that uses an HTTP Cloud Function to process user activity from both desktop browser and mobile application clients. This function will serve as the endpoint for all metric submissions using HTTP POST. Due to legacy restrictions, the function must be mapped to a domain that is separate from the domain requested by users on web or mobile sessions. The domain for the Cloud Function is https://fn.example.com. Desktop and mobile clients use the domain https://www.example.com. You need to add a header to the function's HTTP response so that only those browser and mobile sessions can submit metrics to the Cloud Function. Which response header should you add?
Access-Control-Allow-Origin: *
Access-Control-Allow-Origin: https://*.example.com
Access-Control-Allow-Origin: https://fn.example.com
Access-Control-Allow-origin: https://www.example.com
You have an HTTP Cloud Function that is called via POST. Each submission's request body has a flat, unnested JSON structure containing numeric and text data. After the Cloud Function completes, the collected data should be immediately available for ongoing and complex analytics by many users in parallel. How should you persist the submissions?
Directly persist each POST request's JSON data into Datastore.
Transform the POST request's JSON data, and stream it into BigQuery.
Transform the POST request's JSON data, and store it in a regional Cloud SQL cluster.
Persist each POST request's JSON data as an individual file within Cloud Storage, with the file name containing the request identifier.
Your security team is auditing all deployed applications running in Google Kubernetes Engine. After completing the audit, your team discovers that some of the applications send traffic within the cluster in clear text. You need to ensure that all application traffic is encrypted as quickly as possible while minimizing changes to your applications and maintaining support from Google. What should you do?
Use Network Policies to block traffic between applications.
Install Istio, enable proxy injection on your application namespace, and then enable mTLS.
Define Trusted Network ranges within the application, and configure the applications to allow traffic only from those networks.
Use an automated process to request SSL Certificates for your applications from Let's Encrypt and add them to your applications.
You migrated some of your applications to Google Cloud. You are using a legacy monitoring platform deployed on-premises for both on-premises and cloud- deployed applications. You discover that your notification system is responding slowly to time-critical problems in the cloud applications. What should you do?
Replace your monitoring platform with Cloud Monitoring.
Install the Cloud Monitoring agent on your Compute Engine instances.
Migrate some traffic back to your old platform. Perform A/B testing on the two platforms concurrently.
Use Cloud Logging and Cloud Monitoring to capture logs, monitor, and send alerts. Send them to your existing platform.
You recently deployed your application in Google Kubernetes Engine, and now need to release a new version of your application. You need the ability to instantly roll back to the previous version in case there are issues with the new version. Which deployment model should you use?
Perform a rolling deployment, and test your new application after the deployment is complete.
Perform A/B testing, and test your application periodically after the new tests are implemented.
Perform a blue/green deployment, and test your new application after the deployment is. complete.
Perform a canary deployment, and test your new application periodically after the new version is deployed.
You developed a JavaScript web application that needs to access Google Drive's API and obtain permission from users to store files in their Google Drives. You need to select an authorization approach for your application. What should you do?
Create an API key.
Create a SAML token.
Create a service account.
Create an OAuth Client ID.
You manage an ecommerce application that processes purchases from customers who can subsequently cancel or change those purchases. You discover that order volumes are highly variable and the backend order-processing system can only process one request at a time. You want to ensure seamless performance for customers regardless of usage volume. It is crucial that customers' order update requests are performed in the sequence in which they were generated. What should you do?
Send the purchase and change requests over WebSockets to the backend.
Send the purchase and change requests as REST requests to the backend.
Use a Pub/Sub subscriber in pull mode and use a data store to manage ordering.
Use a Pub/Sub subscriber in push mode and use a data store to manage ordering.
Your company needs a database solution that stores customer purchase history and meets the following requirements: ✑ Customers can query their purchase immediately after submission. ✑ Purchases can be sorted on a variety of fields. ✑ Distinct record formats can be stored at the same time. Which storage option satisfies these requirements?
Firestore in Native mode
Cloud Storage using an object read
Cloud SQL using a SQL SELECT statement
Firestore in Datastore mode using a global query
You recently developed a new service on Cloud Run. The new service authenticates using a custom service and then writes transactional information to a Cloud Spanner database. You need to verify that your application can support up to 5,000 read and 1,000 write transactions per second while identifying any bottlenecks that occur. Your test infrastructure must be able to autoscale. What should you do?
Build a test harness to generate requests and deploy it to Cloud Run. Analyze the VPC Flow Logs using Cloud Logging.
Create a Google Kubernetes Engine cluster running the Locust or JMeter images to dynamically generate load tests. Analyze the results using Cloud Trace.
Create a Cloud Task to generate a test load. Use Cloud Scheduler to run 60,000 Cloud Task transactions per minute for 10 minutes. Analyze the results using Cloud Monitoring.
Create a Compute Engine instance that uses a LAMP stack image from the Marketplace, and use Apache Bench to generate load tests against the service. Analyze the results using Cloud Trace.
You are using Cloud Build for your CI/CD pipeline to complete several tasks, including copying certain files to Compute Engine virtual machines. Your pipeline requires a flat file that is generated in one builder in the pipeline to be accessible by subsequent builders in the same pipeline. How should you store the file so that all the builders in the pipeline can access it?
Store and retrieve the file contents using Compute Engine instance metadata.
Output the file contents to a file in /workspace. Read from the same /workspace file in the subsequent build step.
Use gsutil to output the file contents to a Cloud Storage object. Read from the same object in the subsequent build step.
Add a build argument that runs an HTTP POST via curl to a separate web server to persist the value in one builder. Use an HTTP GET via curl from the subsequent build step to read the value.
Your company’s development teams want to use various open source operating systems in their Docker builds. When images are created in published containers in your company’s environment, you need to scan them for Common Vulnerabilities and Exposures (CVEs). The scanning process must not impact software development agility. You want to use managed services where possible. What should you do?
Enable the Vulnerability scanning setting in the Container Registry.
Create a Cloud Function that is triggered on a code check-in and scan the code for CVEs.
Disallow the use of non-commercially supported base images in your development environment.
Use Cloud Monitoring to review the output of Cloud Build to determine whether a vulnerable version has been used.
You are configuring a continuous integration pipeline using Cloud Build to automate the deployment of new container images to Google Kubernetes Engine (GKE). The pipeline builds the application from its source code, runs unit and integration tests in separate steps, and pushes the container to Container Registry. The application runs on a Python web server. The Dockerfile is as follows:
FROM python:3.7-alpine - COPY . /app - WORKDIR /app - RUN pip install -r requirements.txt CMD [ "gunicorn", "-w 4", "main:app" ] You notice that Cloud Build runs are taking longer than expected to complete. You want to decrease the build time. What should you do? (Choose two.)
Select a virtual machine (VM) size with higher CPU for Cloud Build runs.
Deploy a Container Registry on a Compute Engine VM in a VPC, and use it to store the final images.
Cache the Docker image for subsequent builds using the -- cache-from argument in your build config file.
Change the base image in the Dockerfile to ubuntu:latest, and install Python 3.7 using a package manager utility.
Store application source code on Cloud Storage, and configure the pipeline to use gsutil to download the source code.
You are building a CI/CD pipeline that consists of a version control system, Cloud Build, and Container Registry. Each time a new tag is pushed to the repository, a Cloud Build job is triggered, which runs unit tests on the new code builds a new Docker container image, and pushes it into Container Registry. The last step of your pipeline should deploy the new container to your production Google Kubernetes Engine (GKE) cluster. You need to select a tool and deployment strategy that meets the following requirements: • Zero downtime is incurred • Testing is fully automated • Allows for testing before being rolled out to users • Can quickly rollback if needed What should you do?
Trigger a Spinnaker pipeline configured as an A/B test of your new code and, if it is successful, deploy the container to production.
Trigger a Spinnaker pipeline configured as a canary test of your new code and, if it is successful, deploy the container to production.
Trigger another Cloud Build job that uses the Kubernetes CLI tools to deploy your new container to your GKE cluster, where you can perform a canary test.
Trigger another Cloud Build job that uses the Kubernetes CLI tools to deploy your new container to your GKE cluster, where you can perform a shadow test.
Your operations team has asked you to create a script that lists the Cloud Bigtable, Memorystore, and Cloud SQL databases running within a project. The script should allow users to submit a filter expression to limit the results presented. How should you retrieve the data?
Use the HBase API, Redis API, and MySQL connection to retrieve database lists. Combine the results, and then apply the filter to display the results
Use the HBase API, Redis API, and MySQL connection to retrieve database lists. Filter the results individually, and then combine them to display the results
Run gcloud bigtable instances list, gcloud redis instances list, and gcloud sql databases list. Use a filter within the application, and then display the results
Run gcloud bigtable instances list, gcloud redis instances list, and gcloud sql databases list. Use --filter flag with each command, and then display the results
You need to deploy a new European version of a website hosted on Google Kubernetes Engine. The current and new websites must be accessed via the same HTTP(S) load balancer's external IP address, but have different domain names. What should you do?
Define a new Ingress resource with a host rule matching the new domain
Modify the existing Ingress resource with a host rule matching the new domain
Create a new Service of type LoadBalancer specifying the existing IP address as the loadBalancerIP
Generate a new Ingress resource and specify the existing IP address as the kubernetes.io/ingress.global-static-ip-name annotation value
You are developing a single-player mobile game backend that has unpredictable traffic patterns as users interact with the game throughout the day and night. You want to optimize costs by ensuring that you have enough resources to handle requests, but minimize over-provisioning. You also want the system to handle traffic spikes efficiently. Which compute platform should you use?
Cloud Run
Compute Engine with managed instance groups
Compute Engine with unmanaged instance groups
Google Kubernetes Engine using cluster autoscaling
The development teams in your company want to manage resources from their local environments. You have been asked to enable developer access to each team’s Google Cloud projects. You want to maximize efficiency while following Google-recommended best practices. What should you do?
Add the users to their projects, assign the relevant roles to the users, and then provide the users with each relevant Project ID.
Add the users to their projects, assign the relevant roles to the users, and then provide the users with each relevant Project Number.
Create groups, add the users to their groups, assign the relevant roles to the groups, and then provide the users with each relevant Project ID.
Create groups, add the users to their groups, assign the relevant roles to the groups, and then provide the users with each relevant Project Number.
Your company’s product team has a new requirement based on customer demand to autoscale your stateless and distributed service running in a Google Kubernetes Engine (GKE) duster. You want to find a solution that minimizes changes because this feature will go live in two weeks. What should you do?
Deploy a Vertical Pod Autoscaler, and scale based on the CPU load.
Deploy a Vertical Pod Autoscaler, and scale based on a custom metric.
Deploy a Horizontal Pod Autoscaler, and scale based on the CPU toad
Deploy a Horizontal Pod Autoscaler, and scale based on a custom metric.
Your application is composed of a set of loosely coupled services orchestrated by code executed on Compute Engine. You want your application to easily bring up new Compute Engine instances that find and use a specific version of a service. How should this be configured?
Define your service endpoint information as metadata that is retrieved at runtime and used to connect to the desired service.
Define your service endpoint information as label data that is retrieved at runtime and used to connect to the desired service.
Define your service endpoint information to be retrieved from an environment variable at runtime and used to connect to the desired service.
Define your service to use a fixed hostname and port to connect to the desired service. Replace the service at the endpoint with your new version.
You are developing a microservice-based application that will run on Google Kubernetes Engine (GKE). Some of the services need to access different Google Cloud APIs. How should you set up authentication of these services in the cluster following Google-recommended best practices? (Choose two.)
Use the service account attached to the GKE node.
Enable Workload Identity in the cluster via the gcloud command-line tool.
Access the Google service account keys from a secret management service.
Store the Google service account keys in a central secret management service.
Use gcloud to bind the Kubernetes service account and the Google service account using roles/iam.workloadIdentity.
Your development team has been tasked with maintaining a .NET legacy application. The application incurs occasional changes and was recently updated. Your goal is to ensure that the application provides consistent results while moving through the CI/CD pipeline from environment to environment. You want to minimize the cost of deployment while making sure that external factors and dependencies between hosting environments are not problematic. Containers are not yet approved in your organization. What should you do?
Rewrite the application using .NET Core, and deploy to Cloud Run. Use revisions to separate the environments.
Use Cloud Build to deploy the application as a new Compute Engine image for each build. Use this image in each environment.
Deploy the application using MS Web Deploy, and make sure to always use the latest, patched MS Windows Server base image in Compute Engine.
Use Cloud Build to package the application, and deploy to a Google Kubernetes Engine cluster. Use namespaces to separate the environments.
The new version of your containerized application has been tested and is ready to deploy to production on Google Kubernetes Engine. You were not able to fully load-test the new version in pre-production environments, and you need to make sure that it does not have performance problems once deployed. Your deployment must be automated. What should you do?
Use Cloud Load Balancing to slowly ramp up traffic between versions. Use Cloud Monitoring to look for performance issues.
Deploy the application via a continuous delivery pipeline using canary deployments. Use Cloud Monitoring to look for performance issues. and ramp up traffic as the metrics support it.
Deploy the application via a continuous delivery pipeline using blue/green deployments. Use Cloud Monitoring to look for performance issues, and launch fully when the metrics support it.
Deploy the application using kubectl and set the spec.updateStrategv.type to RollingUpdate. Use Cloud Monitoring to look for performance issues, and run the kubectl rollback command if there are any issues.
Users are complaining that your Cloud Run-hosted website responds too slowly during traffic spikes. You want to provide a better user experience during traffic peaks. What should you do?
Read application configuration and static data from the database on application startup.
Package application configuration and static data into the application image during build time
Perform as much work as possible in the background after the response has been returned to the user.
Ensure that timeout exceptions and errors cause the Cloud Run instance to exit quickly so a replacement instance can be started.
You are a developer working on an internal application for payroll processing. You are building a component of the application that allows an employee to submit a timesheet, which then initiates several steps:
• An email is sent to the employee and manager, notifying them that the timesheet was submitted.
• A timesheet is sent to payroll processing for the vendor's API.
• A timesheet is sent to the data warehouse for headcount planning.
These steps are not dependent on each other and can be completed in any order. New steps are being considered and will be implemented by different development teams. Each development team will implement the error handling specific to their step. What should you do?
Deploy a Cloud Function for each step that calls the corresponding downstream system to complete the required action.
Create a Pub/Sub topic for each step. Create a subscription for each downstream development team to subscribe to their step's topic.
Create a Pub/Sub topic for timesheet submissions. Create a subscription for each downstream development team to subscribe to the topic.
Create a timesheet microservice deployed to Google Kubernetes Engine. The microservice calls each downstream step and waits for a successful response before calling the next step.
You are designing an application that uses a microservices architecture. You are planning to deploy the application in the cloud and on-premises. You want to make sure the application can scale up on demand and also use managed services as much as possible. What should you do?
Deploy open source Istio in a multi-cluster deployment on multiple Google Kubernetes Engine (GKE) clusters managed by Anthos.
Create a GKE cluster in each environment with Anthos, and use Cloud Run for Anthos to deploy your application to each cluster.
Install a GKE cluster in each environment with Anthos, and use Cloud Build to create a Deployment for your application in each cluster.
Create a GKE cluster in the cloud and install open-source Kubernetes on-premises. Use an external load balancer service to distribute traffic across the two environments.
You want to migrate an on-premises container running in Knative to Google Cloud. You need to make sure that the migration doesn't affect your application's deployment strategy, and you want to use a fully managed service. Which Google Cloud service should you use to deploy your container?
Cloud Run
Compute Engine
Google Kubernetes Engine
App Engine flexible environment
This architectural diagram depicts a system that streams data from thousands of devices. You want to ingest data into a pipeline, store the data, and analyze the data using SQL statements. Which Google Cloud services should you use for steps 1, 2, 3, and 4?
A. 1. App Engine 2. Pub/Sub 3. BigQuery 4. Firestore
B. 1. Dataflow
2. Pub/Sub
3. Firestore
4. BigQuery
C. 1. Pub/Sub
2. Dataflow
3. BigQuery
4. Firestore
D. 1. Pub/Sub
2. Dataflow
3. Firestore
4. BigQuery
Your company just experienced a Google Kubernetes Engine (GKE) API outage due to a zone failure. You want to deploy a highly available GKE architecture that minimizes service interruption to users in the event of a future zone failure. What should you do?
Deploy Zonal clusters
Deploy Regional clusters
Deploy Multi-Zone clusters
Deploy GKE on-premises clusters
Your team develops services that run on Google Cloud. You want to process messages sent to a Pub/Sub topic, and then store them. Each message must be processed exactly once to avoid duplication of data and any data conflicts. You need to use the cheapest and most simple solution. What should you do?
Process the messages with a Dataproc job, and write the output to storage.
Process the messages with a Dataflow streaming pipeline using Apache Beam's PubSubIO package, and write the output to storage.
Process the messages with a Cloud Function, and write the results to a BigQuery location where you can run a job to deduplicate the data.
Retrieve the messages with a Dataflow streaming pipeline, store them in Cloud Bigtable, and use another Dataflow streaming pipeline to deduplicate messages.
You are running a containerized application on Google Kubernetes Engine. Your container images are stored in Container Registry. Your team uses CI/CD practices. You need to prevent the deployment of containers with known critical vulnerabilities. What should you do?
A. • Use Web Security Scanner to automatically crawl your application • Review your application logs for scan results, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed
B. • Use Web Security Scanner to automatically crawl your application • Review the scan results in the scan details page in the Cloud Console, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed
C. • Enable the Container Scanning API to perform vulnerability scanning • Review vulnerability reporting in Container Registry in the Cloud Console, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed
D. • Enable the Container Scanning API to perform vulnerability scanning • Programmatically review vulnerability reporting through the Container Scanning API, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed
You have an on-premises application that authenticates to the Cloud Storage API using a user-managed service account with a user-managed key. The application connects to Cloud Storage using Private Google Access over a Dedicated Interconnect link. You discover that requests from the application to access objects in the Cloud Storage bucket are failing with a 403 Permission Denied error code. What is the likely cause of this issue?
The folder structure inside the bucket and object paths have changed.
The permissions of the service account’s predefined role have changed.
The service account key has been rotated but not updated on the application server.
The Interconnect link from the on-premises data center to Google Cloud is experiencing a temporary outage.
You are using the Cloud Client Library to upload an image in your application to Cloud Storage. Users of the application report that occasionally the upload does not complete and the client library reports an HTTP 504 Gateway Timeout error. You want to make the application more resilient to errors. What changes to the application should you make?
Write an exponential backoff process around the client library call.
Write a one-second wait time backoff process around the client library call.
Design a retry button in the application and ask users to click if the error occurs.
Create a queue for the object and inform the users that the application will try again in 10 minutes.
You are building a mobile application that will store hierarchical data structures in a database. The application will enable users working offline to sync changes when they are back online. A backend service will enrich the data in the database using a service account. The application is expected to be very popular and needs to scale seamlessly and securely. Which database and IAM role should you use?
Use Cloud SQL, and assign the roles/cloudsql.editor role to the service account.
Use Bigtable, and assign the roles/bigtable.viewer role to the service account.
Use Firestore in Native mode and assign the roles/datastore.user role to the service account.
Use Firestore in Datastore mode and assign the roles/datastore.viewer role to the service account.
Your application is deployed on hundreds of Compute Engine instances in a managed instance group (MIG) in multiple zones. You need to deploy a new instance template to fix a critical vulnerability immediately but must avoid impact to your service. What setting should be made to the MIG after updating the instance template?
Set the Max Surge to 100%.
Set the Update mode to Opportunistic.
Set the Maximum Unavailable to 100%.
Set the Minimum Wait time to 0 seconds.
