PCD practice questions 121–130

1. Question 121 · 357 in bank

   Your team manages a Google Kubernetes Engine (GKE) cluster where an application is running. A different team is planning to integrate with this application. Before they start the integration, you need to ensure that the other team cannot make changes to your application, but they can deploy the integration on GKE. What should you do?

   • AUsing Identity and Access Management (IAM), grant the Viewer IAM role on the cluster project to the other team.
   • BCreate a new GKE cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team.
   • CCreate a new namespace in the existing cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team.
   • DCreate a new namespace in the existing cluster. Using Kubernetes role-based access control (RBAC), grant the Admin role on the new namespace to the other team.

   Show answer

   Answer: D

   Explanation

   D: You define permissions within a Role or ClusterRole object. A Role defines access to resources within a single Namespace, while a ClusterRole defines access to resources in the entire cluster. https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control

   Source: Adapted from community discussion — Pime13

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 122 · 357 in bank

   You have recently instrumented a new application with OpenTelemetry, and you want to check the latency of your application requests in Trace. You want to ensure that a specific request is always traced. What should you do?

   • AWait 10 minutes, then verify that Trace captures those types of requests automatically.
   • BWrite a custom script that sends this type of request repeatedly from your dev project.
   • CUse the Trace API to apply custom attributes to the trace.
   • DAdd the X-Cloud-Trace-Context header to the request with the appropriate parameters.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://cloud.google.com/trace/docs/setup#force-trace Cloud Trace doesn't sample every request. To force a specific request to be traced, add an X-Cloud-Trace-Context header to the request.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

3. Question 123 · 357 in bank

   You are trying to connect to your Google Kubernetes Engine (GKE) cluster using kubectl from Cloud Shell. You have deployed your GKE cluster with a public endpoint. From Cloud Shell, you run the following command:

   

   You notice that the kubectl commands time out without returning an error message. What is the most likely cause of this issue?

   • AYour user account does not have privileges to interact with the cluster using kubectl.
   • BYour Cloud Shell external IP address is not part of the authorized networks of the cluster.
   • CThe Cloud Shell is not part of the same VPC as the GKE cluster.
   • DA VPC firewall is blocking access to the cluster’s endpoint.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#cloud_shell If you want to use Cloud Shell to access the cluster, you must add the public IP address of your Cloud Shell to the cluster's list of authorized networks.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 124 · 357 in bank

   You plan to make a simple HTML application available on the internet. This site keeps information about FAQs for your application. The application is static and contains images, HTML, CSS, and Javascript. You want to make this application available on the internet with as few steps as possible. What should you do?

   • AUpload your application to Cloud Storage.
   • BUpload your application to an App Engine environment.
   • CCreate a Compute Engine instance with Apache web server installed. Configure Apache web server to host the application.
   • DContainerize your application first. Deploy this container to Google Kubernetes Engine (GKE) and assign an external IP address to the GKE pod hosting the application.

   Show answer

   Answer: A

   Next question

5. Question 125 · 357 in bank

   You are developing a web application that contains private images and videos stored in a Cloud Storage bucket. Your users are anonymous and do not have Google Accounts. You want to use your application-specific logic to control access to the images and videos. How should you configure access?

   • ACache each web application user's IP address to create a named IP table using Google Cloud Armor. Create a Google Cloud Armor security policy that allows users to access the backend bucket.
   • BGrant the Storage Object Viewer IAM role to allUsers. Allow users to access the bucket after authenticating through your web application.
   • CConfigure Identity-Aware Proxy (IAP) to authenticate users into the web application. Allow users to access the bucket after authenticating through IAP.
   • DGenerate a signed URL that grants read access to the bucket. Allow users to access the URL after authenticating through your web application.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://cloud.google.com/storage/docs/access-control/signed-urls#should-you-use In some scenarios, you might not want to require your users to have a Google account in order to access Cloud Storage, but you still want to control access using your application-specific logic. The typical way to address this use case is to provide a signed URL to a user, which gives the user read, write, or delete access to that resource for a limited time. You specify an expiration time when you create the signed URL. Anyone who knows the URL can access the resource until the expiration time for the URL is reached or the key used to sign the URL is rotated.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

6. Question 126 · 357 in bank

   You need to configure a Deployment on Google Kubernetes Engine (GKE). You want to include a check that verifies that the containers can connect to the database. If the Pod is failing to connect, you want a script on the container to run to complete a graceful shutdown. How should you configure the Deployment?

   • ACreate two jobs: one that checks whether the container can connect to the database, and another that runs the shutdown script if the Pod is failing.
   • BCreate the Deployment with a livenessProbe for the container that will fail if the container can't connect to the database. Configure a Prestop lifecycle handler that runs the shutdown script if the container is failing.
   • CCreate the Deployment with a PostStart lifecycle handler that checks the service availability. Configure a PreStop lifecycle handler that runs the shutdown script if the container is failing.
   • DCreate the Deployment with an initContainer that checks the service availability. Configure a Prestop lifecycle handler that runs the shutdown script if the Pod is failing.

   Show answer

   Answer: B

   References

   • Google Cloud documentation
   • Kubernetes documentation
   • Kubernetes documentation

   Next question

7. Question 127 · 357 in bank

   You are responsible for deploying a new API. That API will have three different URL paths: • https://yourcompany.com/students • https://yourcompany.com/teachers • https://yourcompany.com/classes You need to configure each API URL path to invoke a different function in your code. What should you do?

   • ACreate one Cloud Function as a backend service exposed using an HTTPS load balancer.
   • BCreate three Cloud Functions exposed directly.
   • CCreate one Cloud Function exposed directly.
   • DCreate three Cloud Functions as three backend services exposed using an HTTPS load balancer.

   Show answer

   Answer: D

   Explanation

   D. The differences between B and D are: 1. Cost: 3 Cloud Function exposed directly (B) will create 3 endpoints / load balancers, whereas D only exposed one load balancer. 2. Scalability: exposing directly with endpoint or instance itself would cause scalability problem - can't upscale the endpoint instance fast enough. 3. Handling service-to-service call: In B, all services rely on external DNS resolution, which is slower. In D, it has chance that cross-service call can be resolved internally.

   Source: Adapted from community discussion — zanhsieh

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 128 · 357 in bank

   You are deploying a microservices application to Google Kubernetes Engine (GKE). The application will receive daily updates. You expect to deploy a large number of distinct containers that will run on the Linux operating system (OS). You want to be alerted to any known OS vulnerabilities in the new containers. You want to follow Google-recommended best practices. What should you do?

   • AUse the gcloud CLI to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.
   • BEnable Container Analysis, and upload new container images to Artifact Registry. Review the vulnerability results before each deployment.
   • CEnable Container Analysis, and upload new container images to Artifact Registry. Review the critical vulnerability results before each deployment.
   • DUse the Container Analysis REST API to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.

   Show answer

   Answer: B

   Explanation

   B. Actually the tricky part for this question is: Is the Container Analysis enabled by default? Can Container Analysis be called on-demand via REST without specifically enabled it? By default GCP does not enable Container Analysis; that's why D is out.

   Source: Adapted from community discussion — zanhsieh

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 129 · 357 in bank

   You are a developer at a large organization. You have an application written in Go running in a production Google Kubernetes Engine (GKE) cluster. You need to add a new feature that requires access to BigQuery. You want to grant BigQuery access to your GKE cluster following Google-recommended best practices. What should you do?

   • ACreate a Google service account with BigQuery access. Add the JSON key to Secret Manager, and use the Go client library to access the JSON key.
   • BCreate a Google service account with BigQuery access. Add the Google service account JSON key as a Kubernetes secret, and configure the application to use this secret.
   • CCreate a Google service account with BigQuery access. Add the Google service account JSON key to Secret Manager, and use an init container to access the secret for the application to use.
   • DCreate a Google service account and a Kubernetes service account. Configure Workload Identity on the GKE cluster, and reference the Kubernetes service account on the application Deployment.

   Show answer

   Answer: D

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 130 · 357 in bank

    You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant access to your application following the principle of least privilege. What should you do?

    • ACreate a user-managed service account with a custom Identity and Access Management (IAM) role.
    • BCreate a user-managed service account with the Storage Admin Identity and Access Management (IAM) role.
    • CCreate a user-managed service account with the Project Editor Identity and Access Management (IAM) role.
    • DUse the default service account linked to the Cloud Run revision in production.

    Show answer

    Answer: A

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 121. 357 questions available.