Free Google Professional Cloud DevOps Engineer Sample Questions

Correct answer: C — Terraform Validator (or `gcloud beta terraform vet`) with a Policy Library.

• A. Incorrect. VPC Service Controls are designed to create service perimeters to mitigate data exfiltration risks for supported Google Cloud services. They do not provide a mechanism for validating or blocking specific resource configuration attributes within a CI/CD pipeline before deployment.
• B. Incorrect. Cloud Logging sinks and alerting policies are reactive mechanisms. They notify you after a resource has been created or modified (post-provisioning). The requirement is to enforce the policy automatically within the pipeline before any infrastructure is provisioned.
• C. Correct. Terraform Validator (and its successor `gcloud beta terraform vet`) with a Policy Library enables policy-as-code checks against Terraform plan files. By integrating this into your CI/CD pipeline, you can automatically reject plans that violate security requirements—such as those creating publicly accessible GCS buckets—before resources are ever provisioned.
• D. Incorrect. IAM Conditions are used to grant permissions based on attributes like resource tags or request timing. While powerful for runtime access control, they are not intended to be used as a pre-deployment configuration validation tool in a Terraform CI/CD pipeline.

Correct answer: B — Create a separate `values-production.yaml` file and pass it to the helm install/upgrade command using the `-f` flag.

• A. Incorrect. Editing the default `values.yaml` file before every deployment is error-prone and destroys the single source of truth for the chart. This makes auditing, rollbacks, and automated CI/CD workflows difficult and can lead to significant configuration drift.
• B. Correct. Creating a separate environment-specific file (e.g., `values-production.yaml`) and using the `-f` (or `--values`) flag is the recommended Helm pattern. This keeps the base chart immutable and the default configurations intact while allowing version-controlled overrides for specific environment needs like resource limits and replica counts.
• C. Incorrect. Manually editing Kubernetes manifests after deployment is a major anti-pattern in DevOps. Changes made manually via tools like `kubectl edit` are not tracked by Helm and will be lost during the next helm upgrade or reconciliation cycle, breaking declarative management.
• D. Incorrect. Creating a completely new Helm chart for the production environment leads to code duplication and increases maintenance debt. The standard best practice is to reuse the same chart templates across all environments and supply different values files to ensure the same application logic is tested and deployed.

Correct answer: A — Use the official HashiCorp Packer builder image from the Cloud Build community builders or build your own custom builder image containing Packer.

• A. Correct. Cloud Build executes build steps within Docker containers. To use a specific tool like Packer, you must use a container image that contains the Packer binary. You can leverage the community-contributed Packer builder or create your own custom builder image to run Packer commands seamlessly within your pipeline.
• B. Incorrect. Packer is an open-source tool developed by HashiCorp, not a native Google Cloud service. Therefore, there is no 'Packer API' to enable in the Google Cloud Console.
• C. Incorrect. While technically possible, SSHing into a remote VM from Cloud Build is complex, introduces security risks (SSH key management), and is an anti-pattern for Cloud Build's container-native execution model.
• D. Incorrect. Packer is widely supported and commonly used in Cloud Build pipelines via custom or community builders. While Google Cloud offers an Image Builder service, it does not preclude the use of Packer.

Correct answer: C — Configure a Private Worker Pool with a worker config specifying a Windows-based disk image.

• A. Cloud Build does support Windows builds through private worker pools. While these pools are backed by Compute Engine instances, you still benefit from the managed Cloud Build service rather than manually orchestrating builds on standalone VMs.
• B. The default Cloud Build worker pool is a multi-tenant, hosted environment that only supports Linux-based builds. It cannot provide the Windows kernel environment necessary for building Windows container images.
• C. Configuring a Private Worker Pool with a Windows-based disk image (such as Windows Server with Containers) is the correct approach. Private pools allow for custom machine configurations, enabling Cloud Build to run on a Windows kernel required for building Windows container images.
• D. Wine is a compatibility layer for running Windows applications on POSIX-compliant operating systems. It does not provide a Windows kernel or the native Windows container runtime environment required to build Windows-based Docker images.

Correct answer: A — VPC Network Peering

• A. VPC Network Peering allows for the connection of two VPC networks, regardless of whether they are in the same or different Google Cloud Organizations. It provides private, low-latency connectivity using internal IP addresses and does not require the management of VPN gateways or tunnels, satisfying all requirements of the scenario.
• B. Shared VPC allows an organization to centralize network resources in a host project and share them with service projects. However, this feature is limited to projects within the same Google Cloud Organization. Since the startup and the main organization are in separate organizations, Shared VPC cannot be used without migrating the projects first.
• C. Cloud VPN provides secure connectivity via IPSec tunnels. While it can connect VPCs across different organizations and supports non-overlapping IP ranges, it requires the deployment and management of VPN gateways and tunnels, which the question explicitly asks to avoid.
• D. Cloud Interconnect is designed for high-bandwidth, physical connections between an on-premises data center and Google Cloud. It is not the standard or most efficient solution for connecting two VPC networks within the Google Cloud ecosystem and is operationally more complex and costly for this specific use case.

Correct answer: A — Create a workspace in Cloud Monitoring. Add the 50 projects as 'Monitored Projects' to this workspace (Metrics Scope).

• A. Correct. Cloud Monitoring uses the concept of a 'Metrics Scope' (historically referred to as a Workspace). By designating one project as the 'scoping project' and adding the other 50 projects as 'monitored projects', you can view, alert, and create dashboards for metrics from all projects in a single pane of glass.
• B. Incorrect. Enabling the Monitoring API is a prerequisite for metric collection within a project, but it does not provide centralized visibility. Metrics remain siloed within their respective projects until a central Metrics Scope is configured.
• C. Incorrect. The Ops Agent is used for collecting telemetry from within VMs. While metrics can be exported to BigQuery for long-term analytical queries, it is not the standard or efficient way to build a real-time operational monitoring dashboard across multiple projects.
• D. Incorrect. Shared VPC is a networking feature that allows multiple projects to share a common network. It does not aggregate monitoring data or provide a centralized monitoring interface.

Correct answers: B, E — Grant the Cloud Build Service Account the roles/container.developer role on the target GKE cluster.; Configure the Cloud Build cloudbuild.yaml to use the --project flag pointing to the target project.

• A. Granting the roles/owner role on the target project provides overly broad permissions, violating the principle of least privilege. This role includes permissions that are not necessary for deploying to a GKE cluster.
• B. Granting the roles/container.developer role provides the specific permissions needed to manage Kubernetes resources and deploy workloads without granting full project-level administrative access.
• C. Downloading and storing service account keys is a security risk and an anti-pattern. IAM permissions should be granted directly to the Cloud Build service account in the target project to leverage Google's automatic credential management.
• D. The Kubernetes Engine API must be enabled in the project that hosts the cluster. Enabling it in the project where Cloud Build runs does not address cross-project access requirements.
• E. By default, gcloud and other tools in Cloud Build target the local project. Using the --project flag (for example, in gcloud container clusters get-credentials) is necessary to ensure the build commands target the specific cluster in the remote project.

Correct answers: A, C — Use Config Sync to synchronize manifests from a Root repository to both clusters.; Use a Kustomize overlay or Helm values to set `replicas: 0` for the standby cluster configuration in the Git repo.

• A. Correct. Config Sync (part of GKE Enterprise/Anthos) is a GitOps tool that continuously reconciles state between a Git repository and multiple Kubernetes clusters. This ensures that the base configuration and application versions are automatically synchronized and version-controlled across both the production and standby environments.
• B. Incorrect. Velero is primarily a disaster recovery tool for backing up cluster resources and persistent volume data. Restoring production to standby daily is inefficient for maintaining a 'warm' cluster and does not address the requirement to keep specific configuration differences like replica counts.
• C. Correct. To maintain a warm standby with 0 replicas while keeping other settings identical, you need a templating or customization tool. Kustomize overlays or Helm value files allow you to define a 'base' configuration for both clusters and an 'override' specifically for the standby cluster to set the replica count to zero.
• D. Incorrect. Manual processes are error-prone, lack auditability, and do not scale. This is an anti-pattern for senior-level DevOps and SRE practices.
• E. Incorrect. While Cloud Build can deploy to multiple clusters, it is a 'push' mechanism that does not inherently manage configuration drift. Furthermore, deploying with the 'same arguments' would not satisfy the requirement to have 0 replicas on the standby cluster while production remains active.

Correct answers: A, C — Grant the 'Cloud Workstations User' role to the 'backend-dev-team' group on the specific Workstation Configuration.; Use Cloud Identity-Aware Proxy (IAP) with Access Levels to enforce the MFA requirement.

• A. Correct. Granting the 'Cloud Workstations User' role (roles/workstations.user) to the 'backend-dev-team' group on the specific Workstation Configuration resource ensures that only members of this group have permission to start and use those specific workstations. Applying IAM roles at the resource level follows the principle of least privilege by limiting access to specific resources rather than the entire project.
• B. Incorrect. VPC Firewall rules control network-level traffic flow between IP addresses but do not manage user identity or IAM permissions. Restricting by home IP addresses is brittle, difficult to scale, and does not provide a mechanism to enforce phishing-resistant MFA.
• C. Correct. Cloud Identity-Aware Proxy (IAP) integrated with Access Context Manager (Access Levels) allows you to define granular access policies. These policies can specifically require phishing-resistant MFA (such as FIDO2/WebAuthn security keys) as a condition for access to Cloud Workstations.
• D. Incorrect. Creating a separate Google Cloud Project for each developer introduces significant operational overhead and does not inherently solve the requirement for group-based access or phishing-resistant MFA enforcement.
• E. Incorrect. Embedding SSH keys directly into a container image is a major security risk. It prevents proper key rotation, compromises the security of the image if it is leaked, and does not support the requirement for phishing-resistant MFA.

Correct answer: D — Create a Cloud Workstation peered to the VPC and grant the contractor access via the browser-based IDE.

• A. Setting up a VPN requires significant administrative overhead to configure and maintain client-side software, credentials, and firewall rules. Furthermore, it does not address the requirement that the contractor should not use their personal laptop's environment for CLI tools.
• B. Provisioning a Windows VM with RDP requires high operational overhead, including managing OS licensing, security patching, and lifecycle management. It is more complex to maintain than managed developer services.
• C. While Cloud Shell has gcloud and kubectl pre-installed, it runs in a Google-managed network outside your VPC. Connecting it to a private GKE cluster requires complex tunneling (e.g., via IAP or a bastion host) or adding transient IP ranges to the authorized networks of the GKE control plane, which is brittle and increases administrative burden.
• D. Cloud Workstations is the correct choice. It is a managed service that provides a browser-based IDE with pre-installed tools (gcloud, kubectl). Because the workstation runs inside your VPC (or a peered VPC), it can directly access the private GKE control plane. This provides the most secure, managed environment with the least administrative effort for contractor onboarding.

Correct answer: A — The Cloud Build Service Agent does not have the `Storage Object Admin` role on the destination bucket. Grant the permission.

• A. Correct. Cloud Build uses a service identity (the Cloud Build service account) to execute build steps and interact with other Google Cloud resources. When uploading artifacts to a bucket in a different project, that service identity must be granted the necessary IAM permissions (such as Storage Object Admin or Storage Object User) on the destination bucket or project to authorize the cross-project request.
• B. Incorrect. Cloud Build operations are performed by a service account, not the user who triggers the build. Granting permissions to the user identity does not resolve permission issues encountered during the pipeline's execution phase.
• C. Incorrect. Cloud Build is designed to work across projects. There is no technical limitation requiring the bucket to be in the same project, as long as IAM roles are correctly configured for the service account.
• D. Incorrect. While VPC Service Controls can result in access denial, the most common and likely cause of a 403 error in a cross-project scenario is a missing IAM permission. Furthermore, disabling security perimeters is not a standard troubleshooting step compared to fixing IAM configuration.

Correct answer: B — Cloud Audit Logs (Admin Activity).

• A. Cloud Build build logs record execution details and step outputs for build jobs. While Cloud Build might trigger a pipeline, it does not record the manual or programmatic approval actions that occur within Google Cloud Deploy.
• B. Cloud Audit Logs (Admin Activity) capture administrative operations for Google Cloud services, including Google Cloud Deploy approval actions. These logs record the identity (principal) of the user who performed the action, which is the standard way to provide an audit trail for compliance.
• C. The `skaffold.yaml` file is a static configuration file used by Google Cloud Deploy to define how to build and deploy applications. It defines the architecture of the deployment but does not store runtime events or a history of manual approvals.
• D. VPC Flow Logs capture metadata about network traffic (source/destination IPs, ports, bytes) in your Virtual Private Cloud. They are used for network troubleshooting and security monitoring, not for auditing administrative user actions or deployment workflows.

Correct answer: B — Cloud Build with the default pool or private pools.

• A. Jenkins running on a persistent Compute Engine instance uses a long-lived build environment that is not inherently ephemeral or isolated. Maintaining this setup for SLSA compliance requires significant manual effort to ensure isolation and to generate verifiable provenance metadata, as it lacks native integration with Google Cloud's supply-chain security features.
• B. Cloud Build is the native Google Cloud solution for meeting SLSA requirements. It provides ephemeral, isolated build workers for every execution (using either default or private pools). Critically, it automatically generates signed build provenance metadata that can be verified by Artifact Registry and Binary Authorization, ensuring the integrity of the software supply chain.
• C. Building on a local workstation and pushing to Artifact Registry fails to meet SLSA requirements for isolation and ephemerality. Local environments are highly susceptible to tampering and lack the centralized, automated, and verifiable provenance capture provided by a managed build service.
• D. Using GKE with persistent volumes for build caching introduces long-lived state and potential cross-build contamination, which violates the requirement for an ephemeral, isolated environment. While GKE can be used for builds, this specific configuration does not provide the out-of-the-box SLSA provenance guarantees that Cloud Build offers.

Correct answer: A — Use IAM to grant the roles/clouddeploy.approver role to the specific users and ensure the delivery pipeline is configured with requireApproval: true for the Production target.

• A. Correct. Google Cloud Deploy allows for mandatory manual approvals on a per-target basis by setting the `requireApproval: true` field in the delivery pipeline configuration for specific targets (e.g., Production). The permission to approve or reject these promotions is controlled via IAM, specifically using the `roles/clouddeploy.approver` role. Granting this role only to authorized users ensures only they can advance the release.
• B. Incorrect. Binary Authorization is used to ensure that only trusted container images are deployed by verifying signatures (attestations). While it provides a layer of security regarding the artifact's integrity, it is not the mechanism used to manage user-level manual promotion approvals within Cloud Deploy's delivery pipeline.
• C. Incorrect. Cloud Build triggers support manual intervention for build workflows, but they do not govern the promotion logic between targets in Cloud Deploy. Cloud Deploy has its own native approval workflow specifically designed for gating delivery pipeline stages.
• D. Incorrect. Restricting `kubectl` access controls direct interaction with the Kubernetes cluster but does not affect the Cloud Deploy service or its promotion approval process. A user could be blocked from using `kubectl` yet still have the IAM permissions to approve a Cloud Deploy release.

Correct answer: A — The default Cloud Build service account does not have the roles/secretmanager.secretAccessor role on the specific secret.

• A. Correct. By default, the Cloud Build service account has limited permissions and does not include access to Secret Manager. To resolve a 'Permission Denied' (403) error, you must explicitly grant the `roles/secretmanager.secretAccessor` IAM role to the service account, either at the project level or for the specific secret being accessed.
• B. Incorrect. While Secret Manager has a size limit of 64 KiB for the secret payload, exceeding this limit would result in an 'Invalid Argument' or 'Failed Precondition' error during creation, not a 'Permission Denied' error during a read operation.
• C. Incorrect. If the Cloud Build API were disabled, you would be unable to trigger builds at all, or you would receive an error specifically stating that the API must be enabled. It would not result in a specific IAM permission error for a secondary service like Secret Manager.
• D. Incorrect. Secret Manager is a global service and IAM permissions are not restricted by the physical region of the Cloud Build worker. Cross-region access is supported and would not trigger a 'Permission Denied' error.

Correct answers: A, B — roles/source.reader; roles/logging.logWriter

• A. Correct. The roles/source.reader role grants read-only access to Cloud Source Repositories. This is the least-privileged role required for the Jenkins agent to pull source code for builds.
• B. Correct. The roles/logging.logWriter role provides the necessary permissions to create log entries in Cloud Logging. This allows the VM-based agent to export build logs and diagnostics to the centralized logging service.
• C. Incorrect. The roles/iam.serviceAccountUser role is typically granted to a principal (like a user or another service account) that needs to 'act as' or attach the service account to a resource (like a VM). It is not required for the service account itself to perform repository or logging operations.
• D. Incorrect. The roles/compute.admin role is a highly privileged role that allows full management of Compute Engine resources. Assigning this would violate the principle of least privilege, as the agent only needs to read code and write logs.
• E. Incorrect. The roles/storage.objectAdmin role grants full control over Cloud Storage objects and buckets. This is not required for accessing Cloud Source Repositories or Cloud Logging.

Correct answer: D — Create a Cloud Build trigger based on a Webhook event. Configure the legacy system to send a POST request with a secret key.

• A. This approach is unsuitable because pushing a commit to Cloud Source Repositories requires authentication via Git (SSH or OAuth/IAM), which the legacy system cannot perform according to the constraints.
• B. While Pub/Sub is an excellent event-driven service, publishing a message to a Google Cloud Pub/Sub topic requires a Google Cloud IAM identity (usually a service account). Since the legacy system cannot authenticate with IAM, it cannot publish to the topic directly without an intermediary.
• C. Polling with Cloud Scheduler is not an immediate or event-driven design. It introduces unnecessary latency (up to the polling interval) and is inefficient compared to a push-based trigger mechanism.
• D. Cloud Build Webhook triggers are specifically designed for external systems that lack Google Cloud IAM integration. They provide a unique URL that can be triggered via a simple HTTP POST request. Security is managed by validating the payload against a secret key stored in Secret Manager, which aligns perfectly with the legacy system's capabilities.

Correct answers: B, C — Register the EKS cluster with Anthos (GKE Enterprise) as an attached cluster.; Use Cloud Deploy to target both the GKE cluster and the registered Anthos cluster.

• A. Using separate vendor tools like Cloud Build for GKE and AWS CodeDeploy for EKS fragments the deployment process. This approach fails to provide a unified Google Cloud 'pane of glass' and increases management complexity by splitting control across different cloud environments.
• B. Registering the EKS cluster with Anthos (now GKE Enterprise) as an attached cluster is a critical step for multi-cloud management. It allows Google Cloud to manage and view the AWS-hosted Kubernetes cluster within the Anthos dashboard, enabling unified cluster management, observability, and policy enforcement across clouds.
• C. Google Cloud Deploy is a managed continuous delivery service that supports GKE and Anthos-attached clusters. By using Cloud Deploy to target both native GKE and attached EKS clusters, you establish a single, auditable, and centralized deployment pipeline for all workloads regardless of the underlying cloud provider.
• D. While a VPN facilitates networking, using `kubectl` from Cloud Shell is an ad-hoc, manual approach. It does not provide an automated CI/CD pipeline, centralized release management, or the unified visibility provided by managed tools like Cloud Deploy.
• E. Migrating workloads avoids the multi-cloud requirement rather than solving for it. The goal is to manage a multi-cloud environment using a single pane of glass, which Anthos and Cloud Deploy facilitate without requiring a complete workload migration.

Correct answer: B — Disagree, because 100% reliability is technically impossible and infinitely expensive; suggest a target like 99.9% or 99.99%.

• A. Agreeing with a 100% target is a fundamental violation of SRE principles. While payment services are critical, aiming for 100% is unrealistic because no system is perfect. It ignores external dependencies such as internet connectivity or power and would result in an infinite cost with zero room for updates or innovation.
• B. According to Google SRE principles, 100% is the wrong reliability target for almost everything. 100% reliability is technically unachievable and prohibitively expensive. Proposing a realistic high target like 99.9% or 99.99% allows for an error budget, which is essential for managing risk and balancing reliability with the speed of feature delivery.
• C. The type of window (calendar vs. rolling) does not solve the fundamental impossibility of a 100% target. Regardless of windowing, a 100% SLO leaves zero error budget for deployments, infrastructure failures, or maintenance. Additionally, rolling windows are generally preferred in SRE to reflect a continuous user experience.
• D. While 100% is the wrong target, 95% is far too low for a critical payment system. A 95% availability target allows for approximately 18 days of downtime per year, which would likely lead to significant business loss and customer dissatisfaction for a payments service.

Correct answer: C — Use a rolling window for internal error budget alerting and a calendar window for compliance reporting.

• A. A rolling 30-day window does not align with specific calendar months (which vary from 28 to 31 days) or fixed start dates, so it will not satisfy auditors requiring reports starting on the 1st of each month.
• B. While a calendar-aligned window meets the regulatory requirement, using it for internal operations is suboptimal. Calendar windows introduce 'boundary effects' where detection of recent degradations can be delayed or obscured by the budget resetting at the start of the month.
• C. This approach represents SRE best practice. Using a rolling window for internal error budget alerting allows for continuous monitoring and consistent detection of issues without boundary resets. Simultaneously, computing a separate calendar-aligned view satisfies regulatory reporting requirements and auditor needs.
• D. Manually resetting metrics is error-prone, hard to audit, and creates gaps in data. Automation is a core tenet of DevOps/SRE, and manual intervention for reporting is neither scalable nor reliable for compliance.

Correct answer: D — The HPA and VPA are conflicting. Configure the HPA to scale based on a custom metric (e.g., requests per second) instead of CPU/Memory.

• A. While disabling VPA or switching it to 'Initial'/'Off' mode would stop the immediate conflict, it prevents you from achieving the goal of automated resource optimization. The issue is specifically the simultaneous use of resource-based metrics (CPU/Memory) for both autoscalers.
• B. Increasing the HPA target utilization does not address the fundamental logic conflict between HPA and VPA. The fluctuation is caused by VPA changing the 'request' value which HPA uses as the denominator for its utilization calculation.
• C. VPA is perfectly compatible with stateless applications. Replacing it with Cluster Autoscaler is incorrect because Cluster Autoscaler manages node pools (horizontal node scaling), not individual pod resource requests.
• D. This is the correct root cause and solution. When HPA and VPA both use CPU/Memory, they conflict: VPA adjusts the 'requests' to match usage, while HPA scales replicas based on the ratio of usage to requests. This creates a feedback loop (the 'ping-pong' effect). Google recommends using HPA with custom or external metrics if VPA is also being used to manage CPU/Memory requests.
• E. Frequent restarts are caused by VPA evicting pods to apply new resource settings in 'Auto' mode, not necessarily by liveness probe failures. Adjusting probe timers ignores the architectural conflict between the two autoscalers.

Correct answer: B — Implement a Progressive Delivery tool like Flagger or Argo Rollouts to automatically halt and revert traffic shifts based on metric analysis.

• A. A Horizontal Pod Autoscaler (HPA) scales pod replicas based on resource metrics (like CPU/memory) or custom metrics. It does not manage traffic routing between service versions or provide logic to halt/revert a deployment based on application-level error rates.
• B. Progressive Delivery tools like Flagger or Argo Rollouts are specifically designed to automate Canary releases. They integrate with Istio to manage traffic shifting and monitor metrics (e.g., error rate, latency). If thresholds are breached, they automatically pause or roll back traffic to the stable version (v1), mitigating user impact immediately without manual intervention.
• C. Scheduled redeployments via Cloud Build triggers are not responsive to real-time metric violations. This approach does not address the immediate error rate spike and introduces unnecessary deployment churn without providing automated mitigation logic.
• D. Exporting logs to BigQuery is excellent for long-term historical analysis and debugging, but it is a passive process. It does not provide the real-time, automated feedback loop required to shift traffic away from a failing canary version.

Correct answer: B — Update the Load Balancer backend service to point to the 'Blue' instance group.

• A. Restarting instances every 20 minutes is a brittle, manual workaround that increases operational overhead and does not solve the root cause. This approach risks user-visible failures if timing drifts or restarts fail, and it ignores the safer rollback mechanism already available in a Blue/Green setup.
• B. Updating the Load Balancer backend service to point back to the 'Blue' instance group is the standard mitigation for a failed Blue/Green deployment. Since the 'Blue' environment is a known-stable version, this action restores service availability immediately with minimal user impact while you investigate the 'Green' environment's memory leak.
• C. Deploying a patch directly to the 'Green' environment during an incident is risky and typically takes longer than a traffic shift. SRE best practices prioritize Mean Time to Recovery (MTTR) by rolling back to a stable state first, then developing and testing a fix in a non-production environment.
• D. Adding more memory (vertical scaling) only delays the symptoms of a memory leak and does not resolve the underlying software bug. It results in increased costs and eventual crashes once the new memory limit is reached, making it inferior to an immediate rollback.

Correct answer: C — Configure the MIG to scale based on the pubsub.googleapis.com/subscription/num_undelivered_messages metric using the Stackdriver Monitoring adapter.

• A. Incorrect. Load Balancing utilization is based on HTTP(S) request traffic passing through a Google Cloud Load Balancer. Since this service consumes messages from a Pub/Sub subscription (a pull or asynchronous push mechanism) rather than serving direct HTTP requests via a load balancer, this metric is not relevant and will not reflect the actual workload backlog.
• B. Incorrect. While scheduled scaling can help with predictable, time-based load patterns, it is not the most effective solution for variable external API latency. It does not dynamically react to unexpected spikes in the backlog or variations in processing time, leading to potential under-provisioning or unnecessary resource waste.
• C. Correct. Scaling based on the 'pubsub.googleapis.com/subscription/num_undelivered_messages' metric (via Cloud Monitoring) is the best practice for asynchronous message processing. Since the workload is CPU-light but latency-sensitive, the number of messages waiting in the queue is the most accurate indicator of whether the MIG needs more instances to maintain throughput, regardless of CPU utilization levels.
• D. Incorrect. Setting the minimum number of instances to the maximum expected load ensures capacity but is extremely cost-inefficient. It violates the principles of cloud elasticity by maintaining idle resources during off-peak hours rather than scaling dynamically based on demand.

Correct answer: B — The App Engine application is not propagating the X-Cloud-Trace-Context header (or W3C Trace Context headers) to the backend API.

• A. The cloud-trace-agent IAM role allows a service account to write trace data to the Cloud Trace API. Since the problem states that traces are appearing (albeit separately), both components likely have the necessary permissions to send data; the issue is correlation, not connectivity or permissions.
• B. Distributed tracing works by passing a trace context (an ID) from one service to the next via HTTP headers. In Google Cloud, this is traditionally the 'X-Cloud-Trace-Context' header, or the industry-standard W3C Trace Context headers. If the App Engine frontend does not explicitly forward these headers to the downstream Compute Engine API, the backend will generate a new trace ID, causing the traces to appear disconnected in the console.
• C. While using different projects can make cross-project observability more complex, it is not the primary cause of disconnected traces within a distributed flow. Even in cross-project scenarios, the trace context header must still be propagated to link the spans together.
• D. This statement is incorrect. App Engine Standard natively supports Cloud Trace. The issue is not a lack of platform support, but rather a failure in the application logic to propagate the trace context between the two different compute environments.

Correct answers: A, B — Service A and Service B must share the same Trace ID.; Service B must be configured to export traces to Project X.

• A. Distributed tracing requires trace context propagation (typically via headers like X-Cloud-Trace-Context or W3C Trace Parent). By sharing the same Trace ID, Cloud Trace can correlate and stitch together individual spans from different services into a single end-to-end timeline.
• B. Cloud Trace displays spans based on the project they are written to. To view Service B's spans within Project X's console, Service B's trace exporter must be specifically configured to send its trace data to Project X rather than its local project (Project Y).
• C. VPC Network Peering is a networking feature that allows private IP connectivity between VPCs. While it facilitates communication between services, it is not a requirement for trace context propagation or for exporting trace data to the Cloud Trace API.
• D. Service accounts require specific IAM permissions (such as Cloud Trace Agent) to write spans, but Project Owner privileges are unnecessary and violate the principle of least privilege.
• E. Cloud Trace automatically aggregates and visualizes spans that share the same Trace ID if they are stored in the same project. Manual merging in BigQuery is not required for standard trace visualization.

Correct answer: B — High cardinality

• A. High metric latency refers to delays in the processing or retrieval of metrics. While slow UI performance is a symptom of the issue described, 'latency' is the result, not the root cause itself.
• B. High cardinality occurs when a metric label has a very large number of unique values, such as a User ID or Request ID. In Cloud Monitoring, each unique combination of labels creates a separate time series. Creating millions of time series leads to increased storage costs, complex query processing, and significant performance degradation in the dashboard UI.
• C. Metric sampling is a technique used to reduce the frequency of data collection or to store only a subset of data points to manage costs. This is a potential mitigation strategy, not the name of the problem described.
• D. Log ingestion throttling is a mechanism used by Cloud Logging to limit the rate of log intake to manage throughput or cost. This applies to log entries rather than monitoring metrics and labels.

Correct answer: B — Change the 'Retest window' (Duration) in the alert policy condition to 5 minutes.

• A. Increasing the threshold to 95% reduces sensitivity and may cause you to miss genuine sustained high-load incidents that impact system performance between 80% and 95%. It fails to address the temporal nature of the transient spikes.
• B. Changing the 'Duration' (retest window) to 5 minutes requires the CPU to remain above the threshold for a continuous period longer than the typical 2-minute transient spikes. This effectively filters out the noise while ensuring that real, sustained incidents are still captured, directly addressing the SRE goal of reducing alert fatigue.
• C. Disabling real-time alerts in favor of daily reports is not a proactive approach. It prevents the SRE team from responding to critical issues as they happen, which can lead to prolonged system degradation or outages.
• D. Adding a memory usage condition does not address the transient nature of CPU spikes. It adds unnecessary complexity to the alert policy and could lead to missing genuine CPU-bound incidents that do not happen to consume high amounts of memory.

Correct answers: A, B — Count of requests with HTTP 200 status.; Count of total requests.

• A. Correct. Count of requests with HTTP 200 status is an appropriate numerator for an availability SLI because it directly measures successful end-user responses. Availability SLIs in SRE practices are typically expressed as the ratio of successful requests to total valid requests.
• B. Correct. Count of total requests is the necessary denominator for an availability SLI. It represents the total volume of user requests that the service attempted to handle, allowing for the calculation of a success-rate ratio (Successes / Total).
• C. Incorrect. Average CPU utilization is a resource saturation metric. While high utilization might eventually cause availability issues, it is not a direct measure of whether user requests are being successfully served.
• D. Incorrect. Latency of database queries measures the performance of a backend dependency. This would be used for a Latency SLI, not an Availability SLI for the frontend service.
• E. Incorrect. Disk I/O operations per second is an infrastructure performance metric. It provides insight into hardware or storage bottlenecks but does not directly reflect the success or failure of HTTP requests from the user's perspective.

Correct answer: A — Install the Google Cloud Ops Agent on the AWS EC2 instances and provide it with a Google service account key.

• A. To monitor external VMs such as AWS EC2 within Google Cloud Monitoring, you must install the Google Cloud Ops Agent on those instances. Because these instances are outside of Google Cloud, they require a service account key with the appropriate permissions (like Monitoring Metric Writer and Logs Writer) to authenticate and stream data to the Cloud Monitoring API.
• B. While SNMP is a traditional monitoring protocol, it is not the recommended or native method for ingesting metrics into Google Cloud Monitoring from external clouds. Setting up a VPN adds unnecessary network complexity and does not provide a native path for metrics to appear in standard Cloud Monitoring dashboards.
• C. Exporting data to CSV is a manual, asynchronous process that is not suitable for real-time monitoring, alerting, or interactive dashboards. Google Cloud Monitoring is designed for automated, stream-based ingestion of telemetry.
• D. Google Cloud Monitoring is a multi-cloud and hybrid monitoring solution. It explicitly supports AWS EC2 and on-premises systems through the use of agents and service account authentication.

Correct answer: B — A Private Uptime Check using a Serverless VPC Access connector.

• A. A public Uptime Check originates from the public internet via Google's probing stations. Since the Compute Engine instance resides in a private VPC without a public IP address, it is not reachable from the public internet, making this check ineffective.
• B. Private Uptime Checks are specifically designed to monitor resources that do not have public IP addresses. By using a Serverless VPC Access connector, Cloud Monitoring can route the uptime check requests into your private VPC to validate the reachability and HTTP response codes of internal services.
• C. Creating a firewall rule allowing traffic from 0.0.0.0/0 is a significant security risk and does not solve the reachability issue if the instance lacks a public IP. Furthermore, a firewall rule is a configuration to allow traffic, not a tool for active monitoring or health checking.
• D. VPC Flow Logs and log-based metrics provide metadata about network traffic (e.g., source/destination IP, bytes sent). They do not perform active synthetic transactions, meaning they cannot proactively verify if an HTTP service is responding correctly to requests.

Correct answer: B — Create an exclusion filter on the `_Default` sink with the query `severity=DEBUG`.

• A. Incorrect. Updating the application code to stop emitting DEBUG logs would require a redeploy of the application, which contradicts the requirement to enable DEBUG logs temporarily without redeploying. It also removes the ability to quickly toggle debug verbosity for troubleshooting.
• B. Correct. Log exclusion filters drop matching entries at ingestion so they don't consume storage or quota. By adding a filter for `severity=DEBUG` to the `_Default` sink, you can stop storing these logs immediately. To re-enable them temporarily, you can simply edit or disable the exclusion filter in the Google Cloud Console, which requires no application redeployment.
• C. Incorrect. The `_Default` sink is a built-in resource that cannot be deleted; it can only be disabled or edited. Furthermore, creating a whole new sink architecture is unnecessarily complex compared to simply using an exclusion filter.
• D. Incorrect. Log-based metrics are used for monitoring and alerting by extracting data or counting occurrences within logs. They do not control the ingestion or storage of the logs themselves and will not reduce storage costs or quota consumption.

Correct answers: A, C — Create a Cloud Monitoring dashboard that displays the 95th and 99th percentile latency metrics derived from Trace data.; Create an Alerting Policy based on the latency metrics that triggers if the 95th percentile exceeds a threshold.

• A. Creating a Cloud Monitoring dashboard that displays P95 and P99 latency metrics provides a clear visual representation of tail latency trends. Dashboards allow teams to observe performance across different service versions and quickly spot regressions visually that might impact user experience.
• B. Manual reviews are not proactive, scalable, or efficient. This approach relies on human intervention and risks missing transient regressions or short-lived performance spikes between hourly checks.
• C. An Alerting Policy based on tail latency thresholds (such as the 95th percentile) is the primary method for proactive detection. It enables automated, real-time notifications for on-call teams to respond immediately when a release causes latency to exceed acceptable limits.
• D. Cloud Profiler is a diagnostic tool used to optimize code by identifying CPU or memory hotspots. While helpful for debugging a known issue, it is not a primary tool for proactively detecting latency regressions across microservice releases.
• E. Active Assist focuses on resource optimization, such as identifying idle VMs or rightsizing recommendations to reduce costs. It does not provide the real-time performance monitoring required to detect latency regressions in microservices.

Correct answer: B — Idle VM Recommender

• A. The Rightsizing Recommender analyzes CPU and memory utilization patterns to suggest resizing VM machine types (scaling up or down) to better match workload needs. While it helps optimize resource allocation, it is primarily focused on configuration adjustments rather than identifying completely idle instances to stop or delete.
• B. The Idle VM Recommender specifically identifies Compute Engine VM instances that have had little or no activity (based on CPU and network usage) over a sustained period. It provides actionable recommendations to stop or delete these instances, making it the primary tool for identifying VMs that are no longer needed.
• C. The Committed Use Discount Recommender focuses on financial optimization by identifying opportunities to purchase committed use contracts based on stable historical usage. It does not identify individual idle instances or recommend resource termination.
• D. The Unattended Project Recommender identifies entire Google Cloud projects that appear to be abandoned based on lack of API usage or network traffic. While an unattended project might contain idle VMs, this recommender operates at the project level rather than targeting specific VM instances for deletion.

Correct answer: B — Flexible (Spend-based) CUDs

• A. Resource-based CUDs are tied to specific resource types (such as vCPU or memory) and often restricted to specific machine families within a specific region. While they offer higher discount rates, they lack the flexibility to adapt to different product types or cross-regional deployments.
• B. Flexible (Spend-based) CUDs allow you to commit to a minimum dollar amount of hourly spend. This model is used for services like Cloud Run and Cloud Spanner, and for Compute Engine, it offers global flexibility across regions and machine families. This makes it the ideal choice for environments with a diverse mix of services and evolving architectural needs.
• C. Zone-specific commitments are highly restrictive and do not exist as a standard flexible category. Most CUDs are regional, and narrowing scope to a zone provides the least flexibility for a multi-product, multi-region project.
• D. 'Aggregated CUDs' is not a standard Google Cloud terminology for a specific CUD type. While CUDs can be shared across multiple projects within a billing account, the commitment itself must be either resource-based or spend-based.