Google Cloud Professional Cloud DevOps Engineer practice questions

Question 1

A platform team is promoting a Cloud Deploy release from staging to prod, but the delivery pipeline definition was edited after the release was originally created. The team wants to know what Cloud Deploy will do when they run the promotion. Which behavior matches the documentation?

Accepted Answer

Cloud Deploy warns of a possible mismatch and prompts you to confirm; promoting anyway deploys per the pipeline defined at release creation.

Answer

Cloud Deploy blocks the promotion outright and forces you to recreate the entire release completely from scratch before any deployment can proceed.

Answer

Cloud Deploy silently re-renders the release against the brand-new pipeline definition and promotes it without any warning at all.

Answer

Cloud Deploy automatically rolls the delivery pipeline back to its earlier version so the pending release matches the current definition.

Question 2

An organization is migrating a self-managed, single-server Prometheus deployment to Google Cloud Managed Service for Prometheus and wants to understand how query, rule evaluation, and storage responsibilities change. Which statement matches how Managed Service for Prometheus is architected?

Accepted Answer

It splits the single-server responsibilities into separate components, with collectors scraping exporters and forwarding data to Monarch.

Answer

It runs the identical single Prometheus binary that handles scraping, querying, rule evaluation, and storage on one managed VM.

Answer

It keeps scraping local but forwards every query to BigQuery, which then stores and evaluates all of the alerting rules.

Answer

It replaces collectors with the Cloud Logging Ops Agent only, which evaluates Prometheus rules in-process and then discards all metrics.

Question 3

A production team is rolling out a CI/CD pipeline on Cloud Build, and a security reviewer asks why each build should run in an ephemeral environment instead of on a long-lived, reusable build host. Which statement best explains the security benefit of ephemeral build environments?

Accepted Answer

Each build runs in a fresh environment that is wiped afterward, preventing residual or malicious files from carrying over.

Answer

Long-lived build hosts are required so that the cached dependencies persist and speed up every subsequent build run.

Answer

Ephemeral environments let multiple builds share their state, which makes debugging the failed builds much easier later on.

Answer

Reusing a single build host guarantees identical results because the toolchain truly never changes between any builds.

Question 4

An SRE is designing two candidate SLOs for the same service: 99% availability measured over a single day versus 99% availability measured over a 30-day month. A teammate claims the two are equivalent. Using Google Cloud's SLO design guidance, why does the compliance period make these targets materially different?

Accepted Answer

The one-day window permits at most ~14 minutes of downtime, while the 30-day window allows roughly ~7 hours.

Answer

They are identical: both promise 99% availability, so the allowable downtime works out to the same total minutes.

Answer

The shorter window is stricter, but Cloud Monitoring resets the error budget hourly, which erases the difference.

Answer

The monthly window is the stricter one, because a longer period multiplies eligible events and shrinks the budget.

Question 5

An MLOps team is running fault-tolerant model-training batch jobs on Compute Engine Spot VMs to cut cost, and must checkpoint each job's progress before its instance is reclaimed. How does Compute Engine signal an impending Spot VM preemption so the workload can react in time?

Accepted Answer

Compute Engine sets the preempted value in the VM's default metadata to TRUE, which the workload polls to start checkpointing before shutdown.

Answer

Compute Engine raises a Cloud Quotas resource-exceeded error that the workload catches to learn its Spot instance is being reclaimed.

Answer

Compute Engine opens a sustained use discount window that signals the workload to flush its in-memory checkpoint to a persistent disk.

Answer

Compute Engine emits a Cloud Monitoring incident that the workload must subscribe to in advance in order to detect any pending reclamation event.

Question 6

A developer needs to build a custom builder in Cloud Build where one step generates a config file and a later step consumes that file. The developer is unsure how files move between steps. How does Cloud Build share files across build steps?

Accepted Answer

Any files left in /workspace by one build step are available to the other build steps, since /workspace is mounted across all of the steps.

Answer

Each build step runs in an isolated container with its own filesystem, so the developer must upload the file to a bucket and download it again.

Answer

Files persist across steps only if both steps share the same builder image name, otherwise the second step starts from an empty filesystem.

Answer

Cloud Build passes files between steps only through declared output artifacts that each step must register in the build configuration schema.

Question 7

A cloud administrator is shortening the retention period of a Cloud Logging log bucket to reduce costs and needs to understand exactly what happens to log entries that now fall outside the shorter window. Which statement matches the documented behavior?

Accepted Answer

A 7-day grace period applies in which expired entries aren't deleted and access returns if you extend retention

Answer

Expired entries are permanently deleted the moment the shorter retention period is saved, and cannot be recovered

Answer

Expired entries stay fully queryable for 7 days, giving you a window to export them all before deletion

Answer

Shortening retention is rejected until you first export the affected entries to a Cloud Storage bucket

Question 8

A platform engineer has been tasked with picking a packaging unit for the team's reusable Google Cloud Terraform code so that other teams can adopt opinionated solutions with policy baked in. The engineer reviews the Terraform on Google Cloud documentation. Which definition matches a Terraform blueprint?

Accepted Answer

A package of deployable, reusable modules and policy that implements and documents a specific opinionated solution.

Answer

A single Terraform resource declaration that creates exactly one Google Cloud API object and nothing else. A single resource block is the lowest-level unit, not a blueprint.

Answer

A non-versioned shell script wrapper that calls gcloud commands sequentially without any state tracking. Blueprints are Terraform configurations, not gcloud shell wrappers, and Terraform tracks state explicitly.

Answer

A live billing report exported from Cloud Billing into BigQuery for finance-driven cost analysis. Billing exports are FinOps artifacts and have nothing to do with Terraform packaging.

Question 9

A team is writing a reliability charter and needs a precise, shared definition of what 'reliability' means before they pick SLOs. Citing the Architecture Framework's reliability principles, which definition should they adopt?

Accepted Answer

A system's ability to consistently perform its intended functions within defined conditions, uninterrupted.

Answer

A system's ability to scale horizontally on demand so added capacity keeps request latency under the SLO target.

Answer

A system's ability to recover the most recent committed data after a failure, set by its recovery point objective.

Answer

A system's ability to ship changes frequently and on demand with a low change-failure rate across environments.

Question 10

A platform team is being asked to programmatically act on cost, security, and performance insights produced by Google Cloud rather than waiting for engineers to manually review the console. The team is reviewing the Recommender insight types documentation. Which capability matches the programmatic action requirement?

Accepted Answer

Insights are produced asynchronously by ML/heuristic models and exposed through the Recommender API so platform teams can act on them programmatically rather than waiting for manual console reviews; supported insight types span Cloud Asset insights, Firewall analysis, IAM policy and service account assessments, Compute Engine resource monitoring, and VM instance analytics.

Answer

Recommender insights are only visible inside the Cloud Console UI and have no API surface. Insights are exposed through the Recommender API for programmatic use.

Answer

Recommender insights are produced only for AWS resources and have no Google Cloud coverage. Recommender insight types cover Google Cloud products and resource types extensively.

Answer

A single Google Cloud product offers exactly one insight type and never more, regardless of how many resource categories the product spans across the customer environment. The Recommender documentation explicitly states that a single product can offer multiple insight types, each delivering distinct insights for different resources, which is why a single product like Compute Engine surfaces several.

Question 11

A team needs to reuse one delivery pipeline across a dev target and a prod target while giving each target a different replica count and ingress hostname in the same Kubernetes manifests. Using Cloud Deploy deploy parameters, when are those values substituted into the manifests?

Accepted Answer

The values are substituted after the manifests are rendered, as the final step of the render operation, before the manifests are applied to each target.

Answer

The values are substituted into the source files before rendering begins, so each target compiles its own manifests directly from the raw templates.

Answer

The values are substituted at apply time by the GKE admission controller, which rewrites the manifests on the cluster as the objects are created.

Answer

The values are substituted by Cloud Build trigger substitution variables, which inject the per-target replica count while building the container image.

Question 12

An administrator is tasked with delegating the ability to create log-based alerting policies to a junior engineer without granting broad Logging admin rights. Reviewing the Cloud Logging log-based alerts documentation, which statement correctly identifies what is required?

Accepted Answer

Grant logging.notificationRules.create, because creating a log-based alerting policy builds an internal notification rule.

Answer

Grant roles that include only monitoring.alertPolicies.create; log-based alerts ignore any Logging-side permissions entirely.

Answer

No IAM change is needed because log-based alerting policies get created automatically by the Ops Agent running on each host.

Answer

Grant logging.buckets.create so the engineer can provision the notification rule object directly inside a log bucket.

Question 13

A platform team is splitting a monolithic project into a separate project for each application so that a compromise or misconfiguration in one app cannot reach another app's resources. Why does placing each application in its own project provide this isolation by default?

Accepted Answer

Projects act as a trust boundary, so by default resources in one project cannot reach another.

Answer

Each project automatically receives its own VPC Service Controls perimeter at creation time.

Answer

Projects share IAM allow policies whenever they are placed in the same folder of the hierarchy.

Answer

Resources become isolated only after you enable Shared VPC between host and service projects.

Question 14

An SRE is tasked with reporting whether a checkout service stayed within its error budget. The service has a 99.5% availability SLO over a 28-day compliance period and served 2,000,000 eligible requests, of which 12,500 returned errors. Using Google Cloud's error-budget definition, what is the correct conclusion?

Accepted Answer

The budget allowed 10,000 bad requests, so at 12,500 errors the service is out of SLO, exceeding its budget by 2,500.

Answer

The budget allowed 5,000 bad requests, so at 12,500 errors the service is well within its error budget for the period.

Answer

The budget allowed 12,500 bad requests, so the service exactly met its SLO with zero remaining error budget left.

Answer

The budget allowed 20,000 bad requests, so at 12,500 errors the service is comfortably within its error budget.

Question 15

A platform team is evaluating committed use discounts for a fleet of N2 VMs that run a steady, predictable 24/7 production workload, and wants the largest sustained discount in exchange for a usage commitment. Which characteristic of resource-based committed use discounts should guide the decision?

Accepted Answer

Resource-based commitments suit predictable steady-state usage, and a 3-year plan offers a higher discount rate than a 1-year plan.

Answer

Resource-based commitments apply only to preemptible Spot VMs and expire automatically at the end of every monthly billing cycle.

Answer

Resource-based commitments require no usage commitment and are best suited to spiky, unpredictable batch traffic that varies daily.

Answer

Resource-based commitments are granted automatically once a VM runs past 25% of the billing month, with no purchase required at all.

Google Cloud Professional Cloud DevOps Engineer

Sample questions

Sources

Similar exams