PCDOE practice questions 121–130

1. Question 121 · 210 in bank

   Your team is designing a new application for deployment into Google Kubernetes Engine (GKE). You need to set up monitoring to collect and aggregate various application-level metrics in a centralized location. You want to use Google Cloud Platform services while minimizing the amount of work required to set up monitoring. What should you do?

   • APublish various metrics from the application directly to the Stackdriver Monitoring API, and then observe these custom metrics in Stackdriver.
   • BInstall the Cloud Pub/Sub client libraries, push various metrics from the application to various topics, and then observe the aggregated metrics in Stackdriver.
   • CInstall the OpenTelemetry client libraries in the application, configure Stackdriver as the export destination for the metrics, and then observe the application's metrics in Stackdriver.
   • DEmit all metrics in the form of application-specific log messages, pass these messages from the containers to the Stackdriver logging collector, and then observe metrics in Stackdriver.

   Show answer

   Answer: A

   Explanation

   C is correct, for A the installing of stackdriver library in the application is missing, without the lbrary custom metric cannot be created by the application

   Source: Adapted from community discussion — giammydell

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 122 · 210 in bank

   You support a production service that runs on a single Compute Engine instance. You regularly need to spend time on recreating the service by deleting the crashing instance and creating a new instance based on the relevant image. You want to reduce the time spent performing manual operations while following Site Reliability Engineering principles. What should you do?

   • AFile a bug with the development team so they can find the root cause of the crashing instance.
   • BCreate a Managed instance Group with a single instance and use health checks to determine the system status.
   • CAdd a Load Balancer in front of the Compute Engine instance and use health checks to determine the system status.
   • DCreate a Stackdriver Monitoring dashboard with SMS alerts to be able to start recreating the crashed instance promptly after it was crashed.

   Show answer

   Answer: B

   Explanation

   The best option for reducing the time spent performing manual operations while following Site Reliability Engineering principles would be B. Create a Managed instance Group with a single instance and use health checks to determine the system status. A Managed Instance Group (MIG) is a GCP service that automatically creates, scales, and deletes instances based on the policies that you set. By creating a MIG with a single instance, you can set up health checks to automatically detect when the instance is crashing and replace it with a new instance, without manual intervention. This ensures that the service is always available, and it can reduce the time spent recreating the service and also minimize the risk of human errors.

   Source: Adapted from community discussion — JonathanSJ

   References

   • Google Cloud documentation

   Next question

3. Question 123 · 210 in bank

   Your application artifacts are being built and deployed via a CI/CD pipeline. You want the CI/CD pipeline to securely access application secrets. You also want to more easily rotate secrets in case of a security breach. What should you do?

   • APrompt developers for secrets at build time. Instruct developers to not store secrets at rest.
   • BStore secrets in a separate configuration file on Git. Provide select developers with access to the configuration file.
   • CStore secrets in Cloud Storage encrypted with a key from Cloud KMS. Provide the CI/CD pipeline with access to Cloud KMS via IAM.
   • DEncrypt the secrets and store them in the source code repository. Store a decryption key in a separate repository and grant your pipeline access to it.

   Show answer

   Answer: C

   Explanation

   The best option for securing application secrets while making it easier to rotate them in case of a security breach would be: C. Store secrets in Cloud Storage encrypted with a key from Cloud KMS. Provide the CI/CD pipeline with access to Cloud KMS via IAM. By storing secrets in Cloud Storage, you can take advantage of the security features provided by the platform and encrypt them using Cloud KMS, a GCP service that allows you to create, manage, and use encryption keys. This way you can control who has access to the secrets, and you can easily rotate the encryption keys in case of a security breach. Additionally, you can use IAM to give the CI/CD pipeline the necessary permissions to access the secrets and use them during the deployment process, without the need to store them in the source code or give access to them to specific developers.

   Source: Adapted from community discussion — JonathanSJ

   References

   • Google Cloud documentation

   Next question

4. Question 124 · 210 in bank

   Your company follows Site Reliability Engineering practices. You are the person in charge of Communications for a large, ongoing incident affecting your customer-facing applications. There is still no estimated time for a resolution of the outage. You are receiving emails from internal stakeholders who want updates on the outage, as well as emails from customers who want to know what is happening. You want to efficiently provide updates to everyone affected by the outage. What should you do?

   • AFocus on responding to internal stakeholders at least every 30 minutes. Commit to ג€next updateג€ times.
   • BProvide periodic updates to all stakeholders in a timely manner. Commit to a ג€next updateג€ time in all communications.
   • CDelegate the responding to internal stakeholder emails to another member of the Incident Response Team. Focus on providing responses directly to customers.
   • DProvide all internal stakeholder emails to the Incident Commander, and allow them to manage internal communications. Focus on providing responses directly to customers.

   Show answer

   Answer: B

   Explanation

   Ans: B (the communication lead CAN'T delegate) When disaster strikes, the person who declares the incident typically steps into the IC role and directs the high-level state of the incident. The IC concentrates on the 3Cs and does the following: Commands and coordinates the incident response, delegating roles as needed. By default, the IC assumes all roles that have not been delegated yet. Communicates effectively. Stays in control of the incident response. Works with other responders to resolve the incident. https://sre.google/workbook/incident-response/

   Source: Adapted from community discussion — francisco_guerra

   Next question

5. Question 125 · 210 in bank

   Your team uses Cloud Build for all CI/CD pipelines. You want to use the kubectl builder for Cloud Build to deploy new images to Google Kubernetes Engine (GKE). You need to authenticate to GKE while minimizing development effort. What should you do?

   • AAssign the Container Developer role to the Cloud Build service account.
   • BSpecify the Container Developer role for Cloud Build in the cloudbuild.yaml file.
   • CCreate a new service account with the Container Developer role and use it to run Cloud Build.
   • DCreate a separate step in Cloud Build to retrieve service account credentials and pass these to kubectl.

   Show answer

   Answer: A

   Explanation

   The best option for authenticating to GKE while minimizing development effort would be A. Assign the Container Developer role to the Cloud Build service account. Google Cloud Build uses a default service account to run the build, this service account is automatically created by Cloud Build and it has the necessary permissions to access the resources used by the build. By assigning the Container Developer role to this service account, it will have the necessary permissions to deploy new images to GKE. This way you don't need to create a new service account or specify the role in the cloudbuild.yaml file. This is an easy and secure way to authenticate to GKE without adding extra steps to the CI/CD pipeline.

   Source: Adapted from community discussion — JonathanSJ

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 126 · 210 in bank

   You support an application that stores product information in cached memory. For every cache miss, an entry is logged in Stackdriver Logging. You want to visualize how often a cache miss happens over time. What should you do?

   • ALink Stackdriver Logging as a source in Google Data Studio. Filter the logs on the cache misses.
   • BConfigure Stackdriver Profiler to identify and visualize when the cache misses occur based on the logs.
   • CCreate a logs-based metric in Stackdriver Logging and a dashboard for that metric in Stackdriver Monitoring.
   • DConfigure BigQuery as a sink for Stackdriver Logging. Create a scheduled query to filter the cache miss logs and write them to a separate table.

   Show answer

   Answer: C

   Explanation

   Ans: C Exam passed and taken on 19/12/2022, 50/50 from this dump without buying the full access and looking for 'devops' word here: https://www.examtopics.com/discussions/google/1/

   Source: Adapted from community discussion — floppino

   References

   • Google Cloud documentation

   Next question

7. Question 127 · 210 in bank

   You need to deploy a new service to production. The service needs to automatically scale using a Managed Instance Group (MIG) and should be deployed over multiple regions. The service needs a large number of resources for each instance and you need to plan for capacity. What should you do?

   • AUse the n1-highcpu-96 machine type in the configuration of the MIG.
   • BMonitor results of Stackdriver Trace to determine the required amount of resources.
   • CValidate that the resource requirements are within the available quota limits of each region.
   • DDeploy the service in one region and use a global load balancer to route traffic to this region.

   Show answer

   Answer: C

   Explanation

   C. Validate that the resource requirements are within the available quota limits of each region. It is important to ensure that the resource requirements are within the available quota limits in each region before deploying the service, to avoid exceeding the limits and causing problems. This is essential to ensure that the service is deployed correctly and has the necessary capacity to handle the load.

   Source: Adapted from community discussion — JonathanSJ

   References

   • Google Cloud documentation

   Next question

8. Question 128 · 210 in bank

   You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields. All PII entries begin with the text userinfo. You want to capture these log entries in a secure location for later review and prevent them from leaking to Stackdriver Logging. What should you do?

   • ACreate a basic log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
   • BUse a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, and then copy the entries to a Cloud Storage bucket.
   • CCreate an advanced log filter matching userinfo, configure a log export in the Stackdriver console with Cloud Storage as a sink, and then configure a log exclusion with userinfo as a filter.
   • DUse a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, create an advanced log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.

   Show answer

   Answer: B

   Explanation

   Im not pretty sure but Ans B Prevent them form leaking to Stackdriver logging A: Incorrect, Leaking to Stackdriver B: Correct, not leaking to Stackdriver & fluentD C: Incorrect, Leaking D: If we removed why we need to create a filter matching there will not be logs with userinfo?

   Source: Adapted from community discussion — francisco_guerra

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 129 · 210 in bank

   You have a CI/CD pipeline that uses Cloud Build to build new Docker images and push them to Docker Hub. You use Git for code versioning. After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline. You need to resolve the issue following Site Reliability Engineering practices. What should you do?

   • ADisable the CI pipeline and revert to manually building and pushing the artifacts.
   • BChange the CI pipeline to push the artifacts is Container Registry instead of Docker Hub.
   • CUpload the configuration YAML file to Cloud Storage and use Error Reporting to identify and fix the issue.
   • DRun a Git compare between the previous and current Cloud Build Configuration files to find and fix the bug.

   Show answer

   Answer: D

   Explanation

   "After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline"- means something wrong on the recent change not with the image registry. correct answer should be - D

   Source: Adapted from community discussion — akg001

   References

   • Google Cloud documentation

   Next question

10. Question 130 · 210 in bank

    You have a set of applications running on a Google Kubernetes Engine (GKE) cluster, and you are using Stackdriver Kubernetes Engine Monitoring. You are bringing a new containerized application required by your company into production. This application is written by a third party and cannot be modified or reconfigured. The application writes its log information to /var/log/app_messages.log, and you want to send these log entries to Stackdriver Logging. What should you do?

    • AUse the default Stackdriver Kubernetes Engine Monitoring agent configuration.
    • BDeploy a Fluentd daemonset to GKE. Then create a customized input and output configuration to tail the log file in the application's pods and write to Stackdriver Logging.
    • CInstall Kubernetes on Google Compute Engine (GCE) and redeploy your applications. Then customize the built-in Stackdriver Logging configuration to tail the log file in the application's pods and write to Stackdriver Logging.
    • DWrite a script to tail the log file within the pod and write entries to standard output. Run the script as a sidecar container with the application's pod. Configure a shared volume between the containers to allow the script to have read access to /var/log in the application container.

    Show answer

    Answer: B

    Explanation

    B is the answer. https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#custom_agents GKE's default logging agent provides a managed solution to deploy and manage the agents that send the logs for your clusters to Cloud Logging. Depending on your GKE cluster master version, either fluentd or fluentbit are used to collect logs. Common use cases include: - collecting additional logs not written to STDOUT or STDERR - customized log formatting

    Source: Adapted from community discussion — zellck

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Kubernetes documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDOE practice, question 121. 210 questions available.