PCDOE practice questions 141–150

1. Question 141 · 210 in bank

   You are running an application in a virtual machine (VM) using a custom Debian image. The image has the Stackdriver Logging agent installed. The VM has the cloud-platform scope. The application is logging information via syslog. You want to use Stackdriver Logging in the Google Cloud Platform Console to visualize the logs. You notice that syslog is not showing up in the "All logs" dropdown list of the Logs Viewer. What is the first thing you should do?

   • ALook for the agent's test log entry in the Logs Viewer.
   • BInstall the most recent version of the Stackdriver agent.
   • CVerify the VM service account access scope includes the monitoring.write scope.
   • DSSH to the VM and execute the following commands on your VM: ps ax | grep fluentd.

   Show answer

   Answer: D

   Explanation

   Between C and D, I think D Reason : When an instance is created, we can specify which service account the instance uses when calling Google Cloud APIs. The instance is automatically configured with access scope and one such access scope is monitoring.write (Link : https://cloud.google.com/compute/docs/access/service- read is to publish metric data and logging.write is to write compute engine logs. Considering above, I believe D as the answer (check whether the agent is running)

   Source: Adapted from community discussion — raf2121

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 142 · 210 in bank

   Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to a Kubernetes cluster in the production environment. The security auditor is concerned that developers or operators could circumvent automated testing and push code changes to production without approval. What should you do to enforce approvals?

   • AConfigure the build system with protected branches that require pull request approval.
   • BUse an Admission Controller to verify that incoming requests originate from approved sources.
   • CLeverage Kubernetes Role-Based Access Control (RBAC) to restrict access to only approved users.
   • DEnable binary authorization inside the Kubernetes cluster and configure the build pipeline as an attestor.

   Show answer

   Answer: D

   Explanation

   this question is a little bit strange, but first we need to remove the invalid answers B: Incorrect An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the object, but after the request is authenticated and authorized. (its for security but not "enforce approvals") C: Incorrect, we need to "enforce approvals" roles apply in the cluster and Ops always could push to production without approval. A: Incorrect, for me this answer sound well but this does not sound that an answer for a gcp exam and this do not enforce the use of the pipeline. D: Correct, they cannot push code to production without approval because their images are not signed.

   Source: Adapted from community discussion — francisco_guerra

   References

   • Google Cloud documentation

   Next question

3. Question 143 · 210 in bank

   You support a stateless web-based API that is deployed on a single Compute Engine instance in the europe-west2-a zone. The Service Level Indicator (SLI) for service availability is below the specified Service Level Objective (SLO). A postmortem has revealed that requests to the API regularly time out. The time outs are due to the API having a high number of requests and running out memory. You want to improve service availability. What should you do?

   • AChange the specified SLO to match the measured SLI
   • BMove the service to higher-specification compute instances with more memory
   • CSet up additional service instances in other zones and load balance the traffic between all instances
   • DSet up additional service instances in other zones and use them as a failover in case the primary instance is unavailable

   Show answer

   Answer: C

   Explanation

   C. Set up additional service instances in other zones and load balance the traffic between all instances This option will provide redundancy and increase the availability of the service by distributing the traffic across multiple instances. Additionally, if one instance goes down, the load balancer will redirect the traffic to the other healthy instances, minimizing the impact on the service availability.

   Source: Adapted from community discussion — JonathanSJ

   Next question

4. Question 144 · 210 in bank

   You are running a real-time gaming application on Compute Engine that has a production and testing environment. Each environment has their own Virtual Private Cloud (VPC) network. The application frontend and backend servers are located on different subnets in the environment's VPC. You suspect there is a malicious process communicating intermittently in your production frontend servers. You want to ensure that network traffic is captured for analysis. What should you do?

   • AEnable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 0.5.
   • BEnable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 1.0.
   • CEnable VPC Flow Logs on the testing and production VPC network frontend and backend subnets with a volume scale of 0.5. Apply changes in testing before production.
   • DEnable VPC Flow Logs on the testing and production VPC network frontend and backend subnets with a volume scale of 1.0. Apply changes in testing before production.

   Show answer

   Answer: B

   Explanation

   B. Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 1.0. VPC flow logs are a feature that allows you to capture network traffic data in your VPC network. To ensure that all network traffic is captured for analysis, you should enable VPC flow logs on the production VPC network frontend and backend subnets with a sample volume scale of 1.0. This will capture all network traffic data, including the potentially malicious process, for further analysis. Option A. Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 0.5 is not adequate, as it captures only half of the network traffic, there is a chance that the logs of the malicious process are not captured. Option C and D, Enable VPC Flow Logs on the testing and production VPC network frontend and backend subnets with a volume scale of 0.5/1.0. Apply changes in testing before production, is not necessary, it's important to have the logs in production environment to detect and mitigate the problem.

   Source: Adapted from community discussion — JonathanSJ

   References

   • Google Cloud documentation

   Next question

5. Question 145 · 210 in bank

   Your team of Infrastructure DevOps Engineers is growing, and you are starting to use Terraform to manage infrastructure. You need a way to implement code versioning and to share code with other team members. What should you do?

   • AStore the Terraform code in a version-control system. Establish procedures for pushing new versions and merging with the master.
   • BStore the Terraform code in a network shared folder with child folders for each version release. Ensure that everyone works on different files.
   • CStore the Terraform code in a Cloud Storage bucket using object versioning. Give access to the bucket to every team member so they can download the files.
   • DStore the Terraform code in a shared Google Drive folder so it syncs automatically to every team member's computer. Organize files with a naming convention that identifies each new version.

   Show answer

   Answer: A

   References

   • HashiCorp documentation

   Next question

6. Question 146 · 210 in bank

   You are using Stackdriver to monitor applications hosted on Google Cloud Platform (GCP). You recently deployed a new application, but its logs are not appearing on the Stackdriver dashboard. You need to troubleshoot the issue. What should you do?

   • AConfirm that the Stackdriver agent has been installed in the hosting virtual machine.
   • BConfirm that your account has the proper permissions to use the Stackdriver dashboard.
   • CConfirm that port 25 has been opened in the firewall to allow messages through to Stackdriver.
   • DConfirm that the application is using the required client library and the service account key has proper permissions.

   Show answer

   Answer: A

   Explanation

   Why do you complicate stuff. A is the answer. Why not D, because if A is not there D is useless. Question says you are using Stackdriver monitoring, not saying you have an agent installed already. You need the agent to export logs. So first thing you'll always see in the agent is there, and running. Next service account, next client libraries. I hope this clears your doubts.

   Source: Adapted from community discussion — KyubiBlaze

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 147 · 210 in bank

   Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to the production environment. A recent security audit alerted your team that the code pushed to production could contain vulnerabilities and that the existing tooling around virtual machine (VM) vulnerabilities no longer applies to the containerized environment. You need to ensure the security and patch level of all code running through the pipeline. What should you do?

   • ASet up Container Analysis to scan and report Common Vulnerabilities and Exposures.
   • BConfigure the containers in the build pipeline to always update themselves before release.
   • CReconfigure the existing operating system vulnerability software to exist inside the container.
   • DImplement static code analysis tooling against the Docker files used to create the containers.

   Show answer

   Answer: A

   Explanation

   A. Set up Container Analysis to scan and report Common Vulnerabilities and Exposures. To ensure the security and patch level of all code running through the pipeline, you should set up Container Analysis to scan and report Common Vulnerabilities and Exposures. Container Analysis is a service on GCP that allows you to scan and analyze container images for vulnerabilities, malware and other issues. This will help you identify vulnerabilities in your container images and take appropriate action to address them.

   Source: Adapted from community discussion — JonathanSJ

   References

   • Google Cloud documentation

   Next question

8. Question 148 · 210 in bank

   You use Cloud Build to build your application. You want to reduce the build time while minimizing cost and development effort. What should you do?

   • AUse Cloud Storage to cache intermediate artifacts.
   • BRun multiple Jenkins agents to parallelize the build.
   • CUse multiple smaller build steps to minimize execution time.
   • DUse larger Cloud Build virtual machines (VMs) by using the machine-type option.

   Show answer

   Answer: A

   Explanation

   Correct Answer is (D): Using custom virtual machine sizes In addition to the standard machine type, Cloud Build provides four high-CPU virtual machine types to run your builds. To increase the speed of your build, select a virtual machine with a higher CPU. Requesting a high-CPU machine may increase the startup time of your build as Cloud Build only starts these machines on demand. https://cloud.google.com/build/docs/speeding-up-builds

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 149 · 210 in bank

   You support a web application that is hosted on Compute Engine. The application provides a booking service for thousands of users. Shortly after the release of a new feature, your monitoring dashboard shows that all users are experiencing latency at login. You want to mitigate the impact of the incident on the users of your service. What should you do first?

   • ARoll back the recent release.
   • BReview the Stackdriver monitoring.
   • CUpsize the virtual machines running the login services.
   • DDeploy a new release to see whether it fixes the problem.

   Show answer

   Answer: A

   References

   • Google Cloud documentation

   Next question

10. Question 150 · 210 in bank

    You are deploying an application that needs to access sensitive information. You need to ensure that this information is encrypted and the risk of exposure is minimal if a breach occurs. What should you do?

    • AStore the encryption keys in Cloud Key Management Service (KMS) and rotate the keys frequently
    • BInject the secret at the time of instance creation via an encrypted configuration management system.
    • CIntegrate the application with a Single sign-on (SSO) system and do not expose secrets to the application.
    • DLeverage a continuous build pipeline that produces multiple versions of the secret for each instance of the application.

    Show answer

    Answer: A

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDOE practice, question 141. 210 questions available.