PCDOE practice questions 21–30

1. Question 21 · 210 in bank

   You are building the CI/CD pipeline for an application deployed to Google Kubernetes Engine (GKE). The application is deployed by using a Kubernetes Deployment, Service, and Ingress. The application team asked you to deploy the application by using the blue/green deployment methodology. You need to implement the rollback actions. What should you do?

   • ARun the kubectl rollout undo command.
   • BDelete the new container image, and delete the running Pods.
   • CUpdate the Kubernetes Service to point to the previous Kubernetes Deployment.
   • DScale the new Kubernetes Deployment to zero.

   Show answer

   Answer: C

   Explanation

   The point of using blue/green deployment is to have both blue & green versions deployed, and we chose the active one at service level, so rollback should only consist of updating the service to serve the other version.

   Source: Adapted from community discussion — florian_cartron

   Next question

2. Question 22 · 210 in bank

   You are building and running client applications in Cloud Run and Cloud Functions. Your client requires that all logs must be available for one year so that the client can import the logs into their logging service. You must minimize required code changes. What should you do?

   • AUpdate all images in Cloud Run and all functions in Cloud Functions to send logs to both Cloud Logging and the client's logging service. Ensure that all the ports required to send logs are open in the VPC firewall.
   • BCreate a Pub/Sub topic, subscription, and logging sink. Configure the logging sink to send all logs into the topic. Give your client access to the topic to retrieve the logs.
   • CCreate a storage bucket and appropriate VPC firewall rules. Update all images in Cloud Run and all functions in Cloud Functions to send logs to a file within the storage bucket.
   • DCreate a logs bucket and logging sink. Set the retention on the logs bucket to 365 days. Configure the logging sink to send logs to the bucket. Give your client access to the bucket to retrieve the logs.

   Show answer

   Answer: D

   Explanation

   Choose Option D. Creating a logs bucket and logging sink, is the recommended approach to meet the client's requirement of retaining logs for one year while minimizing code changes. By configuring a logging sink to send logs to a bucket and setting the retention period on the bucket to 365 days, you leverage Google Cloud's managed logging and storage services. This approach abstracts the log storage from your applications running in Cloud Run and Cloud Functions, ensuring that logs are retained for the specified duration without requiring modifications to individual codebases. Additionally, providing your client access to the designated bucket allows them to retrieve the logs seamlessly. It's a centralized and efficient solution that aligns with best practices for log management in oogle Cloud.

   Source: Adapted from community discussion — xhilmi

   Next question

3. Question 23 · 210 in bank

   You encountered a major service outage that affected all users of the service for multiple hours. After several hours of incident management, the service returned to normal, and user access was restored. You need to provide an incident summary to relevant stakeholders following the Site Reliability Engineering recommended practices. What should you do first?

   • ACall individual stakeholders to explain what happened.
   • BDevelop a post-mortem to be distributed to stakeholders.
   • CSend the Incident State Document to all the stakeholders.
   • DRequire the engineer responsible to write an apology email to all stakeholders.

   Show answer

   Answer: B

   Explanation

   Don't understand why the A shows as the right answer. BBBBBBB of course. Does anyone know, why so many questions here choose the wrong item as correct answer? But also shows the percent of vote (most of time are right) as well. So confuse.

   Source: Adapted from community discussion — [Removed]

   Next question

4. Question 24 · 210 in bank

   You have an application that runs in Google Kubernetes Engine (GKE). The application consists of several microservices that are deployed to GKE by using Deployments and Services. One of the microservices is experiencing an issue where a Pod returns 403 errors after the Pod has been running for more than five hours. Your development team is working on a solution, but the issue will not be resolved for a month. You need to ensure continued operations until the microservice is fixed. You want to follow Google-recommended practices and use the fewest number of steps. What should you do?

   • ACreate a cron job to terminate any Pods that have been running for more than five hours.
   • BAdd a HTTP liveness probe to the microservice's deployment.
   • CMonitor the Pods, and terminate any Pods that have been running for more than five hours.
   • DConfigure an alert to notify you whenever a Pod returns 403 errors.

   Show answer

   Answer: B

   Explanation

   Liveness probes are used to monitor the health of containers inside pods. They can identify application instances that have failed, even if the pod appears to be operational, If a liveness probe detects an unhealthy state, Kubernetes kills the container and tries to redeploy it. If the probe succeeds, no action is taken and no events are logged.

   Source: Adapted from community discussion — Jason_Cloud_at

   Next question

5. Question 25 · 210 in bank

   You want to share a Cloud Monitoring custom dashboard with a partner team. What should you do?

   • AProvide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard.
   • BExport the metrics to BigQuery. Use Looker Studio to create a dashboard, and share the dashboard with the partner team.
   • CCopy the Monitoring Query Language (MQL) query from the dashboard, and send the ML query to the partner team.
   • DDownload the JSON definition of the dashboard, and send the JSON file to the partner team.

   Show answer

   Answer: A

   Explanation

   Should be A it looks like: https://cloud.google.com/monitoring/charts/share-dashboards#owner-rolesowner "We recommend that you use Monitoring to send the URL of a dashboard to your recipients when you have that option. Monitoring identifies those recipients who might not have permission to view the dashboard and provides an option for you to grant the required permissions."

   Source: Adapted from community discussion — lelele2023

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 26 · 210 in bank

   You are building an application that runs on Cloud Run. The application needs to access a third-party API by using an API key. You need to determine a secure way to store and use the API key in your application by following Google-recommended practices. What should you do?

   • ASave the API key in Secret Manager as a secret. Reference the secret as an environment variable in the Cloud Run application.
   • BSave the API key in Secret Manager as a secret key. Mount the secret key under the /sys/api_key directory, and decrypt the key in the Cloud Run application.
   • CSave the API key in Cloud Key Management Service (Cloud KMS) as a key. Reference the key as an environment variable in the Cloud Run application.
   • DEncrypt the API key by using Cloud Key Management Service (Cloud KMS), and pass the key to Cloud Run as an environment variable. Decrypt and use the key in Cloud Run.

   Show answer

   Answer: A

   Explanation

   The recommended solution is (option A) Save the API key in Secret Manager as a secret and reference the secret as an environment variable in the Cloud Run application. This approach aligns with Google-recommended practices for securely managing sensitive information. Secret Manager provides a centralized and secure storage for secrets, allowing you to store and retrieve the API key. Referencing the secret as an environment variable in the Cloud Run application ensures that the key remains confidential and is easily accessible without exposing it directly in the code. It enhances security by separating sensitive information from the application logic and adheres to best practices for secure credential management in a cloud environment.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

7. Question 27 · 210 in bank

   You are currently planning how to display Cloud Monitoring metrics for your organization’s Google Cloud projects. Your organization has three folders and six projects:

   

   You want to configure Cloud Monitoring dashboards to only display metrics from the projects within one folder. You need to ensure that the dashboards do not display metrics from projects in the other folders. You want to follow Google-recommended practices. What should you do?

   • ACreate a single new scoping project.
   • BCreate new scoping projects for each folder.
   • CUse the current app-one-prod project as the scoping project.
   • DUse the current app-one-dev, app-one-staging, and app-one-prod projects as the scoping project for each folder.

   Show answer

   Answer: B

   Explanation

   The recommended solution is (option B) Create new scoping projects for each folder. Google Cloud Monitoring dashboards allow you to scope metrics based on projects, and by creating separate scoping projects for each folder, you can effectively isolate and display metrics only from the projects within that specific folder. This approach aligns with Google-recommended practices by providing a structured and organized way to manage and visualize metrics. Using dedicated scoping projects for each folder ensures a clean separation of monitoring data, allowing you to customize dashboards according to the specific projects within a given folder while excluding metrics from projects in other folders.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 28 · 210 in bank

   Your company’s security team needs to have read-only access to Data Access audit logs in the _Required bucket. You want to provide your security team with the necessary permissions following the principle of least privilege and Google-recommended practices. What should you do?

   • AAssign the roles/logging.viewer role to each member of the security team.
   • BAssign the roles/logging.viewer role to a group with all the security team members.
   • CAssign the roles/logging.privateLogViewer role to each member of the security team.
   • DAssign the roles/logging.privateLogViewer role to a group with all the security team members.

   Show answer

   Answer: D

   Explanation

   The recommended solution is (option D) Assign the roles/logging.privateLogViewer role to a group with all the security team members. This approach follows the principle of least privilege by granting the specific role needed for read-only access to Data Access audit logs. The roles/logging.privateLogViewer role is more restrictive than roles/logging.viewer, providing access only to private logs, such as Data Access audit logs, and aligns with Google-recommended practices for securing sensitive data. By assigning this role to a group with all security team members, you can efficiently manage and update permissions for the entire team, maintaining a centralized and organized approach to access control for the designated logs in the _Required bucket.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

9. Question 29 · 210 in bank

   Your team is building a service that performs compute-heavy processing on batches of data. The data is processed faster based on the speed and number of CPUs on the machine. These batches of data vary in size and may arrive at any time from multiple third-party sources. You need to ensure that third parties are able to upload their data securely. You want to minimize costs, while ensuring that the data is processed as quickly as possible. What should you do?

   • AProvide a secure file transfer protocol (SFTP) server on a Compute Engine instance so that third parties can upload batches of data, and provide appropriate credentials to the server. Create a Cloud Function with a google.storage.object.finalize Cloud Storage trigger. Write code so that the function can scale up a Compute Engine autoscaling managed instance group Use an image pre-loaded with the data processing software that terminates the instances when processing completes.
   • BProvide a Cloud Storage bucket so that third parties can upload batches of data, and provide appropriate Identity and Access Management (IAM) access to the bucket. Use a standard Google Kubernetes Engine (GKE) cluster and maintain two services: one that processes the batches of data, and one that monitors Cloud Storage for new batches of data. Stop the processing service when there are no batches of data to process.
   • CProvide a Cloud Storage bucket so that third parties can upload batches of data, and provide appropriate Identity and Access Management (IAM) access to the bucket. Create a Cloud Function with a google.storage.object.finalize Cloud Storage trigger. Write code so that the function can scale up a Compute Engine autoscaling managed instance group. Use an image pre-loaded with the data processing software that terminates the instances when processing completes.
   • DProvide a Cloud Storage bucket so that third parties can upload batches of data, and provide appropriate Identity and Access Management (IAM) access to the bucket. Use Cloud Monitoring to detect new batches of data in the bucket and trigger a Cloud Function that processes the data. Set a Cloud Function to use the largest CPU possible to minimize the runtime of the processing.

   Show answer

   Answer: C

   Explanation

   The recommended solution is (option C) Provide a Cloud Storage bucket for third parties to upload batches of data, and utilize a Cloud Function with a google.storage.object.finalize trigger to scale up a Compute Engine autoscaling managed instance group. This approach ensures secure data uploads to a Cloud Storage bucket with proper IAM access controls. The Cloud Function, triggered upon new object finalization in the bucket, scales up a managed instance group with pre-loaded data processing software, optimizing for compute-heavy tasks. The instances terminate upon completion, minimizing costs. This design efficiently leverages serverless and autoscaling capabilities, ensuring quick and cost-effective processing of data batches arriving at varying times from multiple sources.

   Source: Adapted from community discussion — xhilmi

   Next question

10. Question 30 · 210 in bank

    Select 2

    You are reviewing your deployment pipeline in Google Cloud Deploy. You must reduce toil in the pipeline, and you want to minimize the amount of time it takes to complete an end-to-end deployment. What should you do? (Choose two.)

    • ACreate a trigger to notify the required team to complete the next step when manual intervention is required.
    • BDivide the automation steps into smaller tasks.
    • CUse a script to automate the creation of the deployment pipeline in Google Cloud Deploy.
    • DAdd more engineers to finish the manual steps.
    • EAutomate promotion approvals from the development environment to the test environment.

    Show answer

    Answer: BE

    Explanation

    The recommended approaches to reduce toil and minimize deployment time in Google Cloud Deploy are (options B and E). - Option B, dividing automation steps into smaller tasks, allows for better manageability and flexibility in the deployment process. This enables parallel execution of smaller tasks, speeding up the overall deployment. - Option E, automating promotion approvals, eliminates manual intervention and streamlines the progression from development to test environments, further reducing delays and potential errors associated with manual approval processes. Both options contribute to a more efficient and automated deployment pipeline in Google Cloud Deploy.

    Source: Adapted from community discussion — xhilmi

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDOE practice, question 21. 210 questions available.