Free Google Professional Cloud Developer Sample Questions

Correct answers: A, C — SMS text messages; Authenticator app (TOTP)

• A. Correct. SMS text messages are natively supported by Identity Platform as a second factor. This method sends a one-time code to the user's mobile device via SMS, which the user then enters to verify their identity.
• B. Incorrect. While hardware security keys (U2F/FIDO2) are supported by Cloud Identity and Google Workspace, they are not currently a natively supported second factor for the Identity Platform (GCIP) SDKs for customer-facing portals.
• C. Correct. Authenticator app support using TOTP (Time-based One-time Password) is natively supported by Identity Platform. Users can enroll apps like Google Authenticator to generate verification codes.
• D. Incorrect. Email magic links are a method for passwordless sign-in (primary authentication) but are not used as a native second factor in Identity Platform MFA flows.
• E. Incorrect. Voice call verification is not a natively supported MFA factor in Identity Platform; the platform focuses on SMS and TOTP for built-in multi-factor capabilities.

Correct answer: C — Assign roles/pubsub.publisher to the service account on the specific order-events topic resource.

• A. Incorrect. While this provides the necessary publisher role, assigning it at the project level grants the service account permission to publish to every Pub/Sub topic in the project. This violates the principle of least privilege, which requires limiting access to only the specific resources needed.
• B. Incorrect. The roles/pubsub.admin role provides full administrative control over all Pub/Sub resources, including the ability to create and delete topics and subscriptions. This is far more permission than is required for simply publishing messages.
• C. Correct. This follows the principle of least privilege by using the most granular role (Publisher) and applying it to the narrowest possible scope (the specific topic resource). This ensures the Cloud Run service account can only publish to the 'order-events' topic and nothing else.
• D. Incorrect. The roles/pubsub.subscriber role is designed for consuming messages from subscriptions. It does not grant the pubsub.topics.publish permission required to send messages to a topic.

Correct answers: A, B, C — Create a note in Artifact Analysis.; Create an attestor in Binary Authorization that references the note.; Sign the container image digest using a KMS key and create the attestation.

• A. A note in Artifact Analysis is required as it serves as the metadata container for the attestation. It defines the metadata structure used by Binary Authorization to store and verify that an image has been approved.
• B. Creating an attestor in Binary Authorization that references the Artifact Analysis note is a mandatory step. The attestor acts as the authority that enforces the policy, linking the signature verification to the metadata stored in Artifact Analysis.
• C. Signing the container image digest with a cryptographic key (such as one managed by Cloud KMS) and creating the attestation is the process that produces the proof of verification. Binary Authorization uses the attestor’s public key to verify this signature before allowing deployment.
• D. Encrypting the container image is a security measure for data protection, but it is not part of the Binary Authorization attestation process, which focuses on verification of the image's source and integrity through signatures.
• E. Managing source code in Cloud Source Repositories is a standard developer practice but is not a functional requirement for the creation of Binary Authorization attestations, which apply to built container images.
• F. Identity-Aware Proxy (IAP) is used to control user access to applications and web-based resources. It does not play a role in the cryptographic signing or attestation workflow of Binary Authorization.

Correct answer: B — Regional resources are distributed across multiple zones within the same region to withstand a single zone failure.

• A. Incorrect. Zonal resources are restricted to a single zone and do not provide automatic replication across multiple regions. Automatic multi-region replication is typically a feature of global or multi-regional resources.
• B. Correct. Regional resources are designed to provide high availability by distributing operations or data across multiple zones within the same region. This ensures that the resource remains available even if a single zone experiences a failure.
• C. Incorrect. The primary high-availability distinction is redundancy and fault tolerance, not latency. Furthermore, regional resources are typically more expensive than zonal resources because they offer higher durability and availability through multi-zonal replication.
• D. Incorrect. Regional resources are accessible across different zones within the same region. Restricting access to a single zone would negate the benefits of a regional resource's distributed architecture.

Correct answer: B — Configure the backend service to use generated cookie session affinity.

• A. Cloud CDN is designed to cache static or cacheable HTTP content at edge locations to reduce latency. It does not provide session affinity or ensure that requests from a specific user are routed to the same backend instance where their local memory state resides.
• B. Generated cookie session affinity is the standard solution for 'sticky sessions' on Google Cloud Application Load Balancers. The load balancer issues a cookie to the client, ensuring subsequent requests for the duration of the session are routed to the same backend instance. This is essential for legacy applications that cannot share session state across a distributed architecture.
• C. Round-robin is a distribution algorithm that balances requests across all available backends to ensure even load. It does not track client sessions, meaning a user's subsequent requests would likely land on different instances, causing them to lose their local session state.
• D. An Internal Passthrough Network Load Balancer is used for internal traffic and operates at Layer 4 (TCP/UDP). It is not appropriate for an external-facing web application and does not offer the HTTP-level session affinity required for this scenario.

Correct answer: C — Apigee

• A. Cloud Endpoints is a lightweight API management service primarily used for securing and monitoring APIs. While efficient for basic management, it does not offer the comprehensive monetization and developer portal features required by an enterprise for external ecosystems.
• B. API Gateway is a managed service designed for securing and exposing APIs on serverless platforms like Cloud Run, App Engine, or Cloud Functions. It lacks advanced features such as legacy SOAP-to-REST transformation, complex monetization policies, and integrated developer portals.
• C. Apigee is Google Cloud's full-lifecycle API management platform designed for enterprise modernization. It natively supports transforming legacy SOAP services into RESTful APIs, offers robust and complex monetization plans, and provides a customizable developer portal, making it the most suitable solution for this scenario.
• D. Identity-Aware Proxy (IAP) is focused on zero-trust security and controlling access to applications and VMs based on identity. It is not an API management solution and does not provide API transformation, monetization, or developer portal capabilities.

Correct answers: A, C — Use Google Cloud Workflows as the centralized orchestrator.; Define the sequence of API calls, retries, and error-handling logic (try/except) within the Workflows YAML/JSON definition.

• A. Google Cloud Workflows is a serverless orchestration service that is highly appropriate for implementing a centralized Saga pattern. It manages the state, sequence, and coordination of distributed services, providing the central control requested in the scenario.
• B. Pub/Sub is typically used for the Choreography-based Saga pattern, where services interact via events without a central coordinator. This contradicts the requirement for a centralized orchestrator.
• C. In an Orchestrated Saga using Google Cloud Workflows, you define the execution logic using YAML or JSON. This includes defining the sequence of calls and, crucially, using try/retry/except blocks to trigger compensating transactions (rollbacks) if a service call fails, ensuring eventual consistency.
• D. Cloud Scheduler is a managed cron service for time-based triggers. It lacks the state management and complex logic capabilities required to coordinate multi-step transactions and handle conditional rollbacks in a Saga.
• E. Cloud Tasks provides at-least-once delivery for asynchronous tasks. It does not provide the workflow orchestration needed for the Saga pattern, and it cannot guarantee exactly-once execution across an entire distributed transaction chain.

Correct answer: C — Use a reverse domain name followed by the path (e.g., com.google.www/about).

• A. Using the full URL as the row key is not optimal for domain-based retrieval. Because Bigtable rows are stored lexicographically, variations in protocol (http vs https) or subdomains would scatter related domain data across the table, preventing efficient prefix scans.
• B. While hashing the URL provides a good distribution of data and prevents hotspots, it destroys the natural ordering of keys. Since Bigtable does not have native secondary indexes, retrieving all pages for a specific domain would require an inefficient full table scan.
• C. A reverse-domain row key (e.g., com.google) is the recommended best practice for hierarchical data in Bigtable. This design ensures that all pages belonging to the same domain are stored in contiguous row ranges, enabling highly efficient prefix and range scans.
• D. Using sequential IDs is a known anti-pattern in Bigtable as it causes 'hotspotting' where all write traffic is directed to a single node. Additionally, it provides no structural relationship between URLs from the same domain, making domain-based retrieval impossible without a full table scan.

Correct answer: A — Generate a V4 Signed URL with the PUT method and provide it to the client.

• A. Correct. A V4 Signed URL with the PUT method allows the client to upload files directly to Cloud Storage without routing the data through your backend. This mechanism provides secure, time-limited, and fine-grained access to specific objects, which is the standard architectural pattern for offloading bandwidth-heavy uploads from application servers.
• B. Incorrect. Distributing a Service Account JSON key to client-side code is a major security vulnerability. Service account keys are long-lived credentials that, if leaked, can grant persistent access to your cloud resources. IAM conditions do not eliminate the risk inherent in exposing the private key itself.
• C. Incorrect. Identity-Aware Proxy (IAP) is designed to control access to applications and resources (like App Engine or VMs) based on user identity. It does not provide a mechanism for bypassing the application server to perform direct, authenticated uploads to a GCS bucket.
• D. Incorrect. Embedding an OAuth 2.0 access token in client-side JavaScript is not a secure or recommended practice for this use case. While tokens are shorter-lived than service account keys, they do not offer the specific, object-level scoping and ease of use provided by Signed URLs for direct-to-bucket uploads.

Correct answers: A, C — Use BigQuery ML (BQML) to train the model using standard SQL CREATE MODEL statements.; Use the Vertex AI integration within BigQuery to train an AutoML model.

• A. Correct. BigQuery ML (BQML) allows you to create and train machine learning models directly in BigQuery using standard SQL CREATE MODEL statements. This approach eliminates the need to export data, which minimizes data movement and operational overhead.
• B. Incorrect. Exporting data to Cloud Storage and then using Dataproc involves significant data movement and the management of a separate Spark environment, increasing operational complexity.
• C. Correct. BigQuery integrates natively with Vertex AI, enabling users to train AutoML models directly on BigQuery datasets. This approach maintains the data within the BigQuery ecosystem while leveraging managed ML services, satisfying the requirements for minimal movement and overhead.
• D. Incorrect. Downloading terabytes of data to a local machine is not feasible due to the scale, security implications, and the heavy data movement involved.
• E. Incorrect. Cloud Data Fusion is an ETL and data integration service used for building visual data pipelines; it is not designed to train machine learning models directly on BigQuery resident data.

Correct answer: B — Configure Artifact Registry cleanup policies on the repository to keep the most recent versions and delete the rest.

• A. While using a Cloud Function and Cloud Scheduler can automate deletion, it involves writing custom code, managing extra resources, and increasing operational overhead. It is less efficient than using native Artifact Registry features.
• B. Artifact Registry cleanup policies are the native, managed solution for this requirement. They allow you to define automated rules to keep a specific number of recent versions or delete untagged images, providing the most efficient and maintenance-free approach.
• C. Object Lifecycle Management on Cloud Storage is not recommended for Artifact Registry. It does not understand the structure of container image versions or tags, and deleting raw blobs could corrupt repository metadata.
• D. Adding a gcloud command to a build pipeline is brittle and inefficient. It only triggers when a build runs, does not provide ongoing repository-wide management, and requires modifying every individual pipeline configuration.

Correct answer: B — The binary is automatically available because all steps share the `/workspace` volume by default.

• A. While uploading artifacts to Cloud Storage (GCS) is a valid pattern for long-term storage or multi-build pipelines, it is unnecessary and inefficient for passing files between steps within the same Cloud Build job. It adds latency and complexity compared to using the local shared volume.
• B. In Google Cloud Build, the /workspace directory is a persistent volume shared across all steps of the build. Files created or modified in one step are immediately available to subsequent steps, allowing a binary compiled in one container to be easily accessed or packaged into a Docker image in the next container.
• C. Environment variables are designed for small configuration strings, not binary files. Passing a binary via Base64 encoding would likely exceed environment variable size limits and is not a supported or recommended workflow in Cloud Build.
• D. Cloud Build handles the persistence of the /workspace volume automatically. There is no need to manually configure a custom Docker volume in the options block for standard file sharing between sequential steps.

Correct answer: B — Configure Cloud Storage to send object creation notifications to a Pub/Sub topic, and create a Cloud Build Pub/Sub trigger listening to that topic.

• A. Incorrect. Cloud Build webhook triggers are designed for external HTTP-based event sources (such as third-party CI/CD tools). Cloud Storage does not natively support calling webhook URLs directly; it uses Pub/Sub notifications or Eventarc to signal object changes.
• B. Correct. This is the most native and robust approach. Cloud Storage supports publishing notifications to Pub/Sub when objects are created. Cloud Build has a native Pub/Sub trigger type that can automatically start a build upon receiving a message, creating a reliable, managed, and event-driven pipeline without custom glue code.
• C. Incorrect. GitHub triggers are designed for source control events like pushes or pull requests. Committing data files to a repository to trigger a build is not a standard or scalable practice for data processing pipelines intended for Cloud Storage.
• D. Incorrect. Polling is inefficient, introduces latency, and increases API costs compared to event-driven architectures. While a Cloud Function can be triggered by Cloud Storage, using it to manually call the Cloud Build API adds unnecessary complexity when a native Pub/Sub trigger is available.

Correct answers: A, B, C — Generating boilerplate unit tests for newly written functions.; Explaining the purpose and logic of complex legacy unit tests.; Translating existing unit tests from one testing framework to another.

• A. Correct. Gemini Code Assist can generate boilerplate unit tests for newly written functions, helping developers save time and ensure basic test coverage by suggesting test structures based on the function's logic.
• B. Correct. Gemini Code Assist has natural language processing capabilities to analyze and explain the purpose and logic of complex legacy code, aiding developers in understanding unfamiliar or poorly documented test suites.
• C. Correct. Gemini Code Assist can assist in refactoring and translating existing unit tests from one testing framework to another (e.g., from JUnit 4 to JUnit 5), facilitating code modernization and standardization.
• D. Incorrect. Gemini Code Assist is an IDE-based productivity assistant. It is not a CI/CD orchestration tool; background test execution and production deployments are handled by services like Cloud Build or Jenkins.
• E. Incorrect. AI-generated code always requires human review for accuracy and completeness. No tool can guarantee 100% code coverage without human oversight to ensure all edge cases and business logic are tested.
• F. Incorrect. Provisioning cloud infrastructure like Cloud Spanner is an infrastructure-as-code or administrative task managed via tools like Terraform or the Google Cloud Console, rather than a unit testing capability within an IDE assistant.

Correct answer: A — Open the custom utility module's source file in an active IDE tab alongside the function you are testing before prompting Gemini.

• A. Gemini Code Assist leverages the active context of the IDE to ground its responses. Opening the custom utility module's source file in an active tab allows the assistant to index and reference the actual method signatures and logic within that file, effectively eliminating hallucinations caused by missing context.
• B. While pasting code into the chat can provide context, it is inefficient, manual, and does not leverage the IDE's native context-awareness features. It also consumes the prompt's token window unnecessarily compared to the extension's ability to scan open files.
• C. Renaming files does not provide structural or semantic context to the LLM. Gemini requires the contents of the source code to understand how methods are implemented; file naming conventions do not solve hallucination issues regarding method signatures.
• D. Gemini Code Assist operates on the source code level within the IDE and does not have the capability to inspect the runtime memory of an active Python interpreter session. Context must be provided through source files or direct prompts.

Correct answer: B — Increase the `timeout` field in your `cloudbuild.yaml` file, up to the maximum allowed limit of 24 hours.

• A. Incorrect. Cloud Build timeout behavior is controlled by the build configuration, not by the Google Cloud support plan. Upgrading your support plan may improve response times for support tickets but does not change default or maximum technical limits of the build environment.
• B. Correct. The default timeout for a build on Cloud Build is 10 minutes. If a build takes longer than this, it fails with a TIMEOUT error. You can increase this by specifying a `timeout` value in your `cloudbuild.yaml` file (or via the gcloud command-line tool), up to a maximum limit of 24 hours.
• C. Incorrect. Cloud Build does not impose a hard 10-minute limit per repository; 10 minutes is simply the default timeout setting for individual build jobs. Splitting tests into multiple repositories is an unnecessary architectural change when the timeout setting can be easily adjusted.
• D. Incorrect. While a more powerful machine type (like `e2-highcpu-32`) might improve performance and reduce the total execution time, it does not address the underlying timeout limit. If the job still exceeds 10 minutes even with more resources, it will still fail. The proper fix is to adjust the timeout setting directly.

Correct answer: A — Use the 'Debug on Kubernetes' feature in Cloud Code, which automatically handles port-forwarding and attaches the debugger to the remote container.

• A. Correct. Cloud Code's 'Debug on Kubernetes' feature is specifically designed for this scenario. It leverages Skaffold to automate the build, deploy, and port-forwarding processes, then automatically attaches the debugger (like Delve for Go) directly to the remote container, allowing you to set breakpoints and step through code within the IDE.
• B. Incorrect. While manual port-forwarding and debugger attachment is possible, it involves several manual steps and complex configuration. Cloud Code is designed to abstract these tasks into a single-click workflow, making it significantly more efficient.
• C. Incorrect. Google Cloud Debugger (now deprecated) was intended for production environments to take snapshots or set logpoints without stopping the application. It does not provide the live, interactive step-through debugging experience required for this development scenario.
• D. Incorrect. This method is overly complex and bypasses the developer-friendly tools provided by Cloud Code. Manually managing Delve on a GKE node is error-prone, insecure, and does not integrate with the VS Code interface.

Correct answer: A — Add the installation commands to the $HOME/.customize_environment script.

• A. Correct. Cloud Shell provides a specific mechanism for environment customization through a script located at $HOME/.customize_environment. This script is automatically executed every time a new session starts. Adding installation commands here ensures that the specific version of Terraform is available in your environment without manual intervention, and because it is stored in $HOME, the script itself persists across sessions.
• B. Incorrect. The root filesystem of the Cloud Shell VM (including /etc/) is ephemeral and is reset every time a session ends. Modifying /etc/profile is not a supported or reliable way to persist changes across sessions in Cloud Shell.
• C. Incorrect. While Cloud Shell supports custom container images for specific use cases (often triggered via specific URLs), there is no setting in the Google Cloud Console to set a custom Docker image as the default global environment for all standard Cloud Shell sessions. The standard bootstrap method is the .customize_environment script.
• D. Incorrect. Taking manual snapshots of the Cloud Shell persistent disk is not a feature provided to users for managing or automating environment configurations. Cloud Shell is designed as a managed, ephemeral environment with a persistent $HOME directory, not a persistent VM disk that users snapshot and restore.

Correct answer: A — gcloud emulators firestore start

• A. Correct. The 'gcloud emulators firestore start' command is the standard Google Cloud CLI command used to start a local Firestore emulator. This emulator supports Firestore in Native mode and is the recommended tool for running integration tests in a local or CI/CD environment without incurring costs or affecting production data.
• B. Incorrect. 'gcloud firestore local-dev enable' is not a valid gcloud command. Local testing and development are managed via the 'gcloud emulators' component group or the Firebase CLI.
• C. Incorrect. This is a legacy command that was primarily used when Firestore and Datastore emulators shared components during beta phases. For Firestore Native mode testing, the dedicated 'firestore' emulator command is the correct and modern approach.
• D. Incorrect. The 'gcloud init' command is used to configure the Google Cloud SDK (e.g., authenticating, selecting a default project, and setting a region), and it does not launch service emulators.

Correct answer: A — `roles/workstations.user`

• A. Correct. The `roles/workstations.user` role is specifically designed for developers. It provides permissions to view, start, stop, and connect to workstations (via SSH or HTTP). Crucially, it does not allow the user to modify the workstation configurations or cluster settings, which are managed at a higher administrative level.
• B. Incorrect. The `roles/workstations.admin` role provides full administrative control over all Cloud Workstations resources. This includes the ability to create and modify workstation clusters and configurations, which exceeds the restricted permissions described in the scenario.
• C. Incorrect. `roles/workstations.creator` is not a standard predefined role for Cloud Workstations. Predefined roles for configuration management include `roles/workstations.configAdmin`. Even if it were present, a 'creator' role typically grants permission to create resources rather than just the operational access to use them.
• D. Incorrect. The `roles/workstations.viewer` role provides read-only access to view the metadata and details of workstation resources. It does not include the necessary permissions to start, stop, or connect to the workstation environment.

Correct answer: B — Set the strategy to RollingUpdate with maxUnavailable=20% and maxSurge=20%.

• A. The Recreate strategy terminates all existing pods before starting new ones, resulting in application downtime. This violates the requirement that the application must remain available throughout the deployment process.
• B. The RollingUpdate strategy allows for zero-downtime updates. Configuring maxUnavailable=20% ensures that at least 80% of the desired replicas are running at all times. Setting maxSurge=20% limits the number of extra pods created during the update to 20% above the desired count, meeting both the availability and resource constraint requirements.
• C. While maxUnavailable=0% ensures full availability by keeping all original replicas running, maxSurge=100% allows the deployment to double the number of pods temporarily. This exceeds the specified 20% limit for extra pods and could overwhelm node resources.
• D. Blue/Green deployment typically involves creating a duplicate environment (100% surge) and switching traffic via a Service. This is more complex than necessary and does not natively align with the specific pod availability and surge limits requested for the Deployment configuration.

Correct answer: B — By ensuring every container in the pod has a memory limit and a CPU limit, and the requests equal the limits.

• A. Incorrect. The `qosClass` is a read-only field in the pod status, not a field in the pod specification. Kubernetes automatically determines the QoS class based on the resource requests and limits configured for the containers.
• B. Correct. A pod is assigned the `Guaranteed` QoS class only when every container within the pod has both CPU and memory limits and requests explicitly defined, and for each resource, the request value equals the limit value. This is the strictest QoS class, ensuring the pod has the highest priority for resource retention during node pressure.
• C. Incorrect. While a `ResourceQuota` manages the total amount of resources a namespace can consume, it does not determine the QoS class of a pod. QoS is strictly determined by the container-level requests and limits.
• D. Incorrect. `PriorityClass` is used to determine the scheduling order and preemption behavior of pods (which pods get scheduled first or evicted to make room for others). It is independent of the QoS class, which governs resource allocation and eviction priority under resource exhaustion.

Correct answer: C — Add a startup probe that checks the application's health and has a `failureThreshold` and `periodSeconds` that allow for at least 4 minutes of startup time.

• A. Increasing the `periodSeconds` of the liveness probe to 4 minutes would delay failure detection once the application is fully started. This means if the app hangs in production, it could take several minutes to detect it, which compromises the requirement for responsiveness.
• B. Removing the liveness probe entirely would stop the restarts during boot, but it removes ongoing health monitoring. This defeats the purpose of using Kubernetes to automatically detect and recover from deadlocks or hung processes during normal runtime.
• C. A startup probe is the recommended solution for slow-starting containers. It disables liveness and readiness checks until the container has finished its initialization. This allows you to set a long grace period for startup (e.g., 24 attempts every 10 seconds) while keeping a fast, responsive liveness probe (e.g., every 10 seconds) once the application is running.
• D. A readiness probe determines when a pod is ready to receive traffic, but it does not control container restarts. The liveness probe would still kill the pod during startup unless the liveness probe itself is modified or suppressed by a startup probe.

Correct answer: A — OAuthV2 policy with the VerifyAccessToken operation

• A. The OAuthV2 policy is the primary policy for managing and validating OAuth 2.0 tokens in Apigee. When configured with the VerifyAccessToken operation, it verifies that an incoming OAuth 2.0 access token is valid, has not expired, and contains the required scopes before allowing the request to proceed to the backend (Cloud Run).
• B. The VerifyJWT policy is used specifically to validate the signature and claims of a JSON Web Token (JWT). While many external Identity Providers issue access tokens in JWT format, the OAuthV2 policy is the broader, purpose-built standard for OAuth 2.0 framework management in Apigee.
• C. The VerifyAPIKey policy is intended for simple authentication using API keys. It does not provide the sophisticated security features, such as token expiration or delegated authorization (scopes), that are inherent to OAuth 2.0 access tokens.
• D. The AccessControl policy is used to enforce network-level security, such as allowing or denying requests based on IP addresses (whitelisting/blacklisting). It does not perform identity-based token validation.

Correct answer: A — x-google-audiences

• A. Correct. The x-google-audiences extension is used in Cloud Endpoints OpenAPI specifications to define the expected JWT audience. It tells Endpoints which audience values are accepted when validating incoming tokens, allowing for multiple audiences to be specified in a comma-separated list.
• B. Incorrect. x-google-jwt-audiences is not a standard Cloud Endpoints OpenAPI extension. The correct documented extension for audience configuration is x-google-audiences.
• C. Incorrect. The x-google-issuer extension is used to specify the expected issuer of the JWT (the entity that signed the token), not the audience (the intended recipient of the token).
• D. Incorrect. The x-google-backend extension is used to specify backend routing and service settings, such as the address of a Cloud Run service or Cloud Function, and does not relate to JWT authentication claims.

Correct answers: A, B — Add a CORS policy to the ProxyEndpoint request PreFlow.; Add a ResponseCache policy to the ProxyEndpoint request and response flows.

• A. Correct. The CORS policy in Apigee is the standard way to handle Cross-Origin Resource Sharing. Adding it to the ProxyEndpoint request PreFlow allows Apigee to automatically handle preflight OPTIONS requests and add the required headers to the backend responses without requiring modifications to the backend service.
• B. Correct. The ResponseCache policy is designed to cache backend responses in Apigee's cache. By attaching it to both the ProxyEndpoint request flow (to look up the cache) and the response flow (to populate the cache), you can serve content from the gateway and reduce the load on your Cloud Run service.
• C. Incorrect. While you can handle CORS in your application code, the question specifically asks which Apigee policies to configure. Implementing CORS at the gateway level (Apigee) is preferred for centralized management.
• D. Incorrect. This describes a caching implementation within the application code or infrastructure, not an Apigee policy. Using Apigee's ResponseCache is the correct way to implement caching at the gateway level as requested.
• E. Incorrect. Spike Arrest is a traffic management policy used to protect backend services from sudden surges in traffic by limiting the rate of requests. It does not have caching capabilities.

Correct answer: B — Implement connection pooling in your application code and set a maximum concurrency limit on the Cloud Run service.

• A. Incorrect. Raising the Cloud SQL connection limit via flags to 100,000 is not a practical or sufficient fix. MySQL has inherent hardware and resource overhead for every connection; simply increasing the limit beyond the instance's physical capacity (RAM/CPU) will cause severe performance degradation or database crashes.
• B. Correct. Implementing connection pooling in the application code allows each Cloud Run instance to reuse existing database connections rather than creating a new one for every request. Pairing this with a maximum concurrency limit (or limiting the maximum number of instances) provides a predictable cap on the total number of connections the database must handle, resolving exhaustion with minimal architectural changes.
• C. Incorrect. While Cloud Spanner is designed for high scalability and handles many connections natively, migrating from MySQL to Spanner is a major undertaking involving schema redesign and application code changes. It does not meet the requirement to minimize architectural changes.
• D. Incorrect. Cloud NAT is used for network address translation to allow outbound internet access for resources without public IPs. It does not perform connection pooling, multiplexing, or database connection management.

Correct answer: C — To interactively browse, search, and test Google REST APIs directly from a web browser without writing code.

• A. Incorrect. Monitoring API quota usage and billing costs is handled through the Google Cloud Console's API Dashboard and Billing pages, not the APIs Explorer. The APIs Explorer is designed for method discovery and testing, not usage accounting.
• B. Incorrect. While the Explorer helps developers understand API signatures, it does not automatically generate client library code. Code generation is performed by tools like the Google Cloud client library generators or Discovery API-based codegen systems.
• C. Correct. The Google APIs Explorer is a tool that lets you browse, search, and test Google REST APIs interactively in a web browser without writing code. It allows developers to provide parameters, execute requests, and inspect real responses to better understand how an API works.
• D. Incorrect. Configuring API gateways and managing routing rules are functions of API management services like Google Cloud API Gateway or Apigee, rather than a discovery and testing tool like APIs Explorer.

Correct answers: A, C — ETag; If-None-Match

• A. ETag (Entity Tag) is a response header provided by Cloud Storage that serves as a unique identifier for a specific version of a resource. The client stores this value and sends it back in subsequent requests to determine if the cached file is still valid.
• B. Cache-Control is used to specify caching directives (like max-age or public/private). While it helps define the cache policy, it does not facilitate the conditional revalidation check itself.
• C. If-None-Match is a request header used by the client to send a previously cached ETag to the server. If the ETag on the server hasn't changed, Cloud Storage responds with a 304 Not Modified status, preventing an unnecessary download of the full file.
• D. X-Goog-Update-Time is a custom metadata header and is not part of the standard HTTP mechanism for conditional caching. Conditional requests in the Cloud Storage REST API rely on standard headers like ETag and If-None-Match.
• E. Authorization is required to authenticate the request and verify access permissions. It is unrelated to determining whether the content of the file has changed since the last fetch.

Correct answer: C — Have the backend API generate a V4 Signed URL and send it to the mobile app to perform the upload.

• A. Embedding a service account JSON key in a mobile app is a major security risk. Keys can be easily extracted via reverse engineering, giving attackers full access to the resources associated with that service account. Credentials should never be shipped in client-side code.
• B. Making a bucket public for writes allows any unauthenticated user to upload arbitrary data to your project. This leads to security vulnerabilities, potential hosting of malicious content, and uncontrollable storage costs.
• C. Using a V4 Signed URL is the best practice for this scenario. The backend API authenticates the user and generates a time-limited, cryptographic URL that grants permission to perform a specific action (like an HTTP PUT) to a specific object path. This keeps the bucket private while offloading the heavy lifting of the data transfer to Cloud Storage.
• D. Identity-Aware Proxy (IAP) is used to secure access to HTTP-based applications (like those on App Engine, GKE, or Compute Engine). It is not designed to provide direct authorization for mobile clients to perform object uploads to Cloud Storage buckets.

Correct answer: B — Use the modifyAckDeadline API to continuously extend the acknowledgment deadline while the message is being processed.

• A. Switching from pull to push does not address the underlying issue of the acknowledgment deadline. While push subscriptions also have deadlines (up to 600 seconds), changing the delivery mechanism doesn't inherently manage the lifecycle of a long-running task or prevent redelivery if the task exceeds the set deadline.
• B. This is the recommended practice for long-running tasks in Pub/Sub. By using the modifyAckDeadline API, the worker can signal to Pub/Sub that it is still processing the message, effectively 'heartbeating' to prevent the message from being redelivered to other workers. Most modern Google Cloud Pub/Sub client libraries handle this automatically via 'auto-extension' logic.
• C. Acknowledging a message before the work is completed is a dangerous practice. If the worker fails or the rendering task crashes, the message is permanently removed from the subscription and will never be retried, leading to potential data loss.
• D. Message ordering ensures that messages with the same ordering key are delivered in the order they were published. It does not affect the acknowledgment deadline and will not prevent redeliveries caused by processing timeouts.

Correct answers: C, E — The server may process the requests within a batch in any order or in parallel.; The response to a batch request is a single multipart/mixed HTTP response containing the individual responses.

• A. Incorrect. A batch request is not an atomic transaction. If one subrequest fails, it does not cause the entire batch to fail or roll back; each request is processed independently and returns its own success or failure status.
• B. Incorrect. Google APIs do not guarantee that batched requests are executed in the specific order they appear in the request body. Because the subrequests are independent, assuming strict ordering is unsafe.
• C. Correct. Batched requests are independent, and the server is permitted to process them in any order or even in parallel. You should not design your application to rely on sequential execution within a batch.
• D. Incorrect. Batching is specific to a single API endpoint. You cannot combine requests to different Google services (such as the Drive API and Calendar API) into a single batch request.
• E. Correct. The response to a batch request is returned as a single multipart/mixed HTTP response. This response contains individual sections for each subrequest, allowing the client to parse the specific result of each operation.

Correct answer: A — Use Gemini Cloud Assist within the Metrics Explorer by entering a natural language prompt describing the metric and aggregation you need.

• A. Gemini Cloud Assist in Metrics Explorer (and throughout the Google Cloud Observability suite) can generate or refine monitoring queries (PromQL or MQL) from a natural-language description. This is the fastest and most integrated way to produce valid syntax for GKE pod metrics when you are unfamiliar with the query language.
• B. Log Analytics is used for querying log data using SQL-based syntax. It is not designed to generate PromQL queries for Cloud Monitoring metrics, nor is it the appropriate tool for real-time metric dashboarding.
• C. Cloud Trace is used for distributed request tracing and analyzing application latency. It does not have the capability to generate or export PromQL queries for memory metrics.
• D. While metrics can be exported to BigQuery for long-term analysis, BigQuery ML is used for building and deploying machine learning models. It cannot generate PromQL syntax for Cloud Monitoring.

Correct answer: A — Create a Metric Threshold alert policy using the request_count metric, filter by 5xx response codes, and divide by the total requests over a 10-minute alignment period.

• A. Correct. Cloud Monitoring allows for the creation of ratio-based alert policies. To monitor an error rate, you divide the count of 'bad' requests (filtered by 5xx status codes) by the count of 'total' requests using the request_count metric. Aligning this over a 10-minute period allows you to calculate the percentage and compare it directly against your 5% SLO threshold.
• B. Incorrect. A log-based metric counts specific occurrences in logs but does not normalize them against total traffic. A static threshold of 5 does not represent a 5% error rate, as it doesn't account for the total number of requests during that period.
• C. Incorrect. Google Cloud Error Reporting is specifically designed to aggregate exceptions and crashes. While it can notify you of new errors, it does not provide the capability to calculate performance ratios or monitor error rates against an SLO.
• D. Incorrect. Cloud Trace is used for distributed tracing and latency analysis. While traces contain status codes, Cloud Monitoring (not Trace) is the standard service for defining metrics-based alerting and tracking SLOs.

Correct answers: A, B — Analyze the Heap profile to see the memory that is currently allocated and in use by the application at a given point in time.; Analyze the Allocated Memory profile to see the rate at which memory is being allocated during the profiling interval.

• A. Correct. The Heap profile shows objects currently retained in memory (the live set) at a specific point in time. For Java applications, this is critical for identifying which objects are growing over time and failing to be garbage collected, indicating a memory leak.
• B. Correct. The Allocated Memory (Allocated Heap) profile tracks memory allocations made during the profiling interval. This helps identify high-frequency allocation patterns and code paths that are generating excessive garbage, which can often lead to memory exhaustion.
• C. Incorrect. The CPU Time profile measures the amount of time the CPU spends executing specific functions. It is used to diagnose high CPU utilization or performance bottlenecks, not memory leaks.
• D. Incorrect. Cloud Trace is a distributed tracing system used to analyze request latency and the flow of requests between services. It does not provide visibility into the application heap or memory management.
• E. Incorrect. Increasing the sampling rate for Cloud Trace will provide more data on request latency but will not provide any insight into Java memory usage or the root cause of an OutOfMemoryError.