Professional Cloud DevOps Engineer

Question 1

Your team builds container images in Cloud Build and pushes them to Artifact Registry. Security requires that every image be automatically scanned for OS-level vulnerabilities as soon as it is stored, and that developers be able to query the findings without running any additional scanning jobs in the pipeline. You want the least-effort, native approach. What should you do?

Accepted Answer

Enable the Container Scanning API so Artifact Registry automatically scans images on push and stores vulnerability findings that can be queried via the API or console.

Answer

Add a Cloud Build step that runs an open-source scanner like Trivy against each image and uploads the results to Cloud Storage for developers to download.

Answer

Configure Binary Authorization with a vulnerability policy so that scanning occurs automatically during admission to the cluster.

Answer

Schedule a Cloud Scheduler job that periodically pulls all images from Artifact Registry and runs the gcloud artifacts docker images scan command on each.

Question 2

Your data analytics team runs BigQuery workloads that have grown unpredictably. Finance reports that on-demand query costs have tripled over three months, with large spikes during monthly reporting cycles but low steady usage otherwise. A few ad-hoc analyst queries occasionally scan enormous tables and cause bill surprises. You must implement a FinOps approach that controls cost while keeping predictable baseline performance for scheduled reporting jobs. What should you do?

Accepted Answer

Purchase a baseline slot commitment (editions with autoscaling) to cover steady reporting load, assign the reporting jobs to a dedicated reservation, and leave ad-hoc analyst queries on on-demand with per-project/per-user maximum bytes-billed limits.

Answer

Move all workloads to on-demand pricing and set an organization-wide monthly billing budget alert to cap spending.

Answer

Purchase a single large flat-rate slot commitment sized to the monthly reporting peak and route every query—scheduled and ad-hoc—through that one reservation.

Answer

Export all datasets to Cloud Storage and query them with external tables to avoid BigQuery compute charges entirely.

Question 3

Your platform team runs an automated project factory using Terraform. A new business unit requests projects, and finance requires that every newly provisioned project is automatically linked to a specific billing account and cannot be moved to a different billing account by project-level users. Which approach best enforces this requirement while keeping the factory fully automated?

Accepted Answer

Have the factory's service account hold roles/billing.user on the billing account, set the billing_account in the google_project resource, and grant project users only roles/viewer so they cannot change billing linkage.

Answer

Grant each project owner the roles/billing.admin role so they can attach the correct billing account during onboarding.

Answer

Manually link billing in the Cloud Console after each Terraform apply and rely on documentation to prevent changes.

Answer

Assign the factory service account roles/billing.creator and let project teams self-manage billing linkage through org policies.

Question 4

You lead FinOps for a company running dozens of microservices across several GCP projects. Finance reports that last month's total spend jumped 35% with no obvious cause. Leadership wants a repeatable way to break down costs by service, SKU, project, and label, and to run ad hoc queries to pinpoint which resources drove the spike. What should you implement?

Accepted Answer

Enable Cloud Billing export to BigQuery (detailed usage cost export), enforce a consistent labeling strategy across resources, and analyze spend with SQL queries and Looker Studio dashboards.

Answer

Rely on the Billing console's built-in Reports view and manually export monthly PDF invoices for the finance team to review.

Answer

Create a budget with alert thresholds at 50%, 90%, and 100% of the monthly forecast so you are notified when spend increases.

Answer

Turn on Recommender cost recommendations and apply all idle-resource and rightsizing suggestions each month.

Question 5

Your team runs a GKE production cluster and wants to guarantee that only container images that have passed an automated vulnerability scan and were built by your official Cloud Build pipeline can be deployed. Images built on developer laptops or without a scan must be rejected at deploy time. Which approach best meets this requirement?

Accepted Answer

Enable Binary Authorization on the cluster with a policy that requires attestations, and have Cloud Build create a signed attestation only after the image passes the vulnerability scan.

Answer

Configure Artifact Registry to reject any image push that has critical vulnerabilities, relying on the registry scan gate to block bad images from being deployed.

Answer

Add a Cloud Build step that runs a script to delete images with vulnerabilities from Artifact Registry before the deployment stage executes.

Answer

Use a GKE admission webhook that checks the image tag naming convention to confirm the image came from the official pipeline.

Question 6

Your FinOps team wants to catch cost overruns before they occur rather than after the fact. Each of your 40 project owners currently receives a monthly invoice but no proactive signal. Leadership requires that when a project's spending is trending toward exceeding its monthly budget, an automated workflow disables non-essential resources without any human reading an email. Which Cloud Billing budget configuration best meets this requirement?

Accepted Answer

Create a budget per project with alert thresholds based on forecasted spend, and connect the budget to a Pub/Sub topic that triggers a Cloud Function to disable non-essential resources.

Answer

Create a single organization-wide budget with email notifications to all project owners at 90% and 100% of actual spend.

Answer

Export billing data to BigQuery and schedule a daily query that emails project owners when actual spend exceeds the budget.

Answer

Configure a budget per project with alert thresholds on actual spend only, sending notifications to a Cloud Monitoring notification channel.

Question 7

Your SRE team runs a payment API on GKE with a defined SLO of 99.9% availability measured over a 28-day rolling window. Developers push changes frequently, and leadership wants to maximize release velocity without endangering the SLO. During a new rollout, you want an automated mechanism that decides whether to continue promoting a release based on the release's real impact on the service's reliability signals, halting before the error budget is materially consumed. Which approach best balances change velocity and reliability?

Accepted Answer

Use a progressive canary rollout where a small percentage of traffic is shifted to the new version and promotion is gated on SLI measurements (error rate and latency) compared against thresholds derived from the error budget.

Answer

Deploy the full release to 100% of traffic immediately, then rely on the 28-day rolling SLO report to decide whether the next release should proceed.

Answer

Freeze all releases whenever any error budget has been consumed during the current window, regardless of the change's tested impact.

Answer

Increase the SLO target to 99.99% so any regression is caught faster, then deploy releases directly to production.

Question 8

Your platform team is designing a CI/CD architecture for a company with separate Google Cloud projects for dev, staging, and production. The security team mandates that a container image which is deployed to production must be the exact same artifact that was tested in staging, and that no image should be rebuilt between environments. You are using Cloud Build and Artifact Registry. Which approach best satisfies these requirements?

Accepted Answer

Build the image once, tag it with the immutable digest, and promote the same image by digest through dev, staging, and production Artifact Registry repositories using a controlled pipeline with Binary Authorization attestations.

Answer

Configure a separate Cloud Build trigger in each environment's project that rebuilds the image from the same Git commit before deploying to that environment.

Answer

Store a single mutable 'latest' tag in one shared Artifact Registry repository and have every environment pull the 'latest' tag at deploy time.

Answer

Build the image in dev, then export the container filesystem as a tarball and re-import it into staging and production registries to guarantee consistency.

Question 9

A retail company runs an e-commerce API on a Compute Engine managed instance group behind an external HTTP(S) load balancer. During periodic bot-driven traffic surges, the backend autoscaler adds many VMs to absorb the load, causing large unexpected compute spikes on the monthly bill even though the surge traffic is malicious and returns no revenue. The team wants to reduce cost during these events without degrading legitimate customer performance. What should they implement?

Accepted Answer

Enable Cloud Armor Adaptive Protection with a security policy that rate-limits and blocks the detected malicious traffic at the load balancer edge before it reaches the backends

Answer

Lower the managed instance group's maximum number of instances so the autoscaler cannot add VMs during surges

Answer

Switch the backend VMs to Spot VMs so that surge capacity is billed at a lower rate

Answer

Increase the autoscaler's target CPU utilization so fewer VMs are added during traffic spikes

Question 10

Your team uses Cloud Build to build container images that are pushed to a Docker repository in Artifact Registry. After a recent incident, an engineer accidentally re-pushed a new image using an existing tag (v1.4.2) that had already been deployed to production, causing confusion about which binary was actually running. You need to guarantee that once a tagged image is published, that exact tag can never be overwritten by a later push, while still allowing new tags. What should you do?

Accepted Answer

Enable immutable image tags on the Artifact Registry repository so that pushing an already-existing tag is rejected.

Answer

Configure a cleanup policy on the repository to delete images older than 30 days to prevent tag reuse.

Answer

Add a Cloud Build step that runs a shell script to check whether the tag exists and fails the build if it does.

Answer

Enable Binary Authorization with a require-attestation policy so unverified image pushes are blocked.

Question 11

Your team's Cloud Build pipeline builds a large Java microservice. Each build downloads all Maven dependencies from scratch, and the container image is rebuilt entirely on every commit, causing builds to take over 20 minutes. You want to reduce build times without changing the application source. Which approach should you implement?

Accepted Answer

Use Kaniko with a cache repository in Artifact Registry and store Maven dependencies in a Cloud Storage bucket referenced via the Cloud Build 'cache' directory between builds.

Answer

Increase the machine type of the default Cloud Build worker pool to the largest available size so more CPU is dedicated to each build.

Answer

Split the build into multiple triggers so that dependency downloads and image builds run as separate Cloud Build jobs on different branches.

Answer

Disable build provenance generation and Binary Authorization checks to remove overhead from the build steps.

Question 12

Your team hosts application source in GitHub and uses a Cloud Build trigger connected via the Cloud Build GitHub App. Developers open pull requests against the main branch. Leadership mandates that no code can be merged into main unless an automated build-and-test run has succeeded, and the merge must be blocked in the GitHub UI until that check passes. What is the correct way to enforce this?

Accepted Answer

Create a pull request Cloud Build trigger and configure a GitHub branch protection rule on main that requires the Cloud Build status check to pass before merging.

Answer

Create a push trigger on the main branch so the tests run automatically after each merge, and roll back with a revert commit if tests fail.

Answer

Add a Binary Authorization policy requiring an attestation, so unverified merges are rejected by GitHub.

Answer

Configure a Cloud Deploy pipeline with a manual approval gate that developers must satisfy before merging the pull request.

Question 13

Your team's Cloud Build pipeline compiles a Go binary and produces a container image. Currently the build succeeds but downstream Cloud Deploy releases cannot find the image, and audits show the built image is never stored in a central location. You need the build to reliably publish the container image to Artifact Registry so it can be referenced by digest in later stages. Which approach correctly ensures the image is pushed and its digest is recorded?

Accepted Answer

Add the image to the top-level 'images' field in the Cloud Build config so Cloud Build pushes it to Artifact Registry and records the resolved digest in the build results.

Answer

Rely on the 'docker build' step alone, since Cloud Build automatically pushes any image tagged with an Artifact Registry hostname at the end of the build.

Answer

Store the built image as a Cloud Storage object using the 'artifacts.objects' field and have Cloud Deploy read it from the bucket.

Answer

Enable Binary Authorization on the build trigger, which will push the image to Artifact Registry as part of attestation generation.

Question 14

Your team's Cloud Build pipeline runs unit tests, three independent integration test suites, and a static code analysis scan. Currently all steps run sequentially, and the build takes 22 minutes, causing developer frustration. The three integration suites do not depend on each other, and the static analysis does not depend on any tests. You need to reduce total build time without removing any of the checks. What should you do?

Accepted Answer

Configure the three integration test steps and the static analysis step to run concurrently by setting the same waitFor value referencing only the unit test step, allowing them to execute in parallel.

Answer

Move the integration tests and static analysis into a separate Cloud Build trigger that fires after the first build completes successfully.

Answer

Increase the machine type of the Cloud Build worker to E2_HIGHCPU_32 so that the sequential steps each complete faster.

Answer

Combine all test suites and the static analysis into a single build step running one script to reduce per-step container startup overhead.

Question 15

Your platform team runs a single Cloud Build project that hosts triggers for dozens of application repositories. Currently all triggers execute using the default Cloud Build service account, which has broad Editor-level permissions across the project. A security audit flags this as excessive: a compromised build for one low-privilege app could push images and deploy to resources belonging to other teams. You must reduce blast radius while keeping each pipeline able to perform only the actions it needs. What should you do?

Accepted Answer

Create a dedicated user-managed service account per trigger with only the IAM roles that build needs, and configure each Cloud Build trigger to run as that service account.

Answer

Keep the default Cloud Build service account but remove the Editor role and grant Owner so builds cannot be blocked by missing permissions.

Answer

Move every application into its own Google Cloud project so the shared default service account is isolated by project boundary.

Answer

Export a JSON key for the default service account and store it in Secret Manager, then have each build authenticate with the key it needs.

Question 16

Your team uses a single Cloud Build pipeline that builds a container image, runs unit tests, pushes to Artifact Registry, and then deploys to a production GKE cluster. Compliance now requires that a human release manager explicitly approve the build before the production deployment steps run, while all earlier build and test steps continue to run automatically on every commit to main. You want the least complex change that satisfies this requirement natively in Cloud Build. What should you do?

Accepted Answer

Split the pipeline so build and test run in one trigger, and use a Cloud Build manual approval on a second trigger that performs only the production deployment steps.

Answer

Configure the trigger to require manual approval, which pauses the entire build until an approver approves or rejects it in the Cloud Build console.

Answer

Add a wait step in the build config that polls a Pub/Sub topic until a release manager publishes an approval message.

Answer

Move the deployment steps to Cloud Deploy and add a promotion approval gate, replacing the Cloud Build deploy steps entirely.

Question 17

Your team's Cloud Build pipeline runs integration tests that must connect to a Cloud SQL instance and internal microservices that only have private IP addresses inside a VPC. The default Cloud Build workers cannot reach these private resources, and security policy prohibits exposing the database or services to public IPs. You need the build's integration test step to successfully reach the private resources with minimal ongoing maintenance. What should you do?

Accepted Answer

Configure a Cloud Build private pool with a peered network connection to your VPC, and run the integration test step in that private pool.

Answer

Assign a public IP to the Cloud SQL instance and use authorized networks to allow the Cloud Build worker IP ranges.

Answer

Deploy a Cloud VPN tunnel from the default Cloud Build worker pool to your VPC and route test traffic through it.

Answer

Add a startup step that installs the Cloud SQL Auth Proxy on the default pool and hardcode the private IP of each microservice.

Question 18

Your security team requires that every container image built by your Cloud Build pipelines includes verifiable build provenance so that downstream consumers can confirm the image was produced by your trusted build system and has not been tampered with. You want to minimize custom scripting and use native platform capabilities. What should you do?

Accepted Answer

Enable Cloud Build's built-in SLSA build provenance generation when pushing images to Artifact Registry, and have consumers verify the generated provenance metadata.

Answer

Add a custom build step that computes a SHA-256 digest of the image and writes it to a Cloud Storage bucket for consumers to compare.

Answer

Configure Binary Authorization to sign images at deploy time and store the signatures in Secret Manager for auditors.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry so that scan results serve as proof of image origin.

Question 19

Your platform team runs a Cloud Build pipeline that builds container images, pushes them to Artifact Registry, and then deploys to a GKE cluster via Cloud Deploy. A recent security audit found that a developer was able to manually deploy an image that had never passed through the official build pipeline. Leadership now requires that only images produced by your trusted Cloud Build pipeline can ever be deployed to the production GKE cluster, and that this rule is enforced at admission time regardless of who or what initiates the deployment. Which approach best satisfies this requirement?

Accepted Answer

Enable Binary Authorization on the production cluster with a policy that requires attestations, and configure Cloud Build to create a signed attestation for each image it builds using a dedicated attestor.

Answer

Restrict IAM so that only the Cloud Build service account has the Kubernetes Engine Developer role on the production cluster, preventing developers from deploying manually.

Answer

Enable vulnerability scanning in Artifact Registry and configure Cloud Deploy to block promotion of any image with critical vulnerabilities.

Answer

Use a VPC Service Controls perimeter around the production project so that only the Cloud Build private pool can push and deploy images.

Question 20

Your team maintains a Cloud Build pipeline that runs a lightweight unit-test build on every push to any branch. Separately, you need a heavier end-to-end integration suite that provisions ephemeral resources and takes about 45 minutes to run. The business requirement is that this integration suite runs automatically once every night at 02:00 against the latest commit on the main branch, without any developer having to push code or click a button. Which approach best meets this requirement?

Accepted Answer

Create a Cloud Scheduler job that publishes to a Pub/Sub topic, and configure a Cloud Build trigger of type Pub/Sub that references the main branch and runs the integration build config.

Answer

Add a branch-filter push trigger on main that runs the integration build config, relying on nightly merges to main to invoke it.

Answer

Configure a webhook trigger and call it from a developer's local cron job at 02:00 each night.

Answer

Set a timed soak duration in the existing unit-test trigger so it re-runs the integration suite every 24 hours automatically.

Question 21

Your team maintains a Cloud Build pipeline that builds and pushes container images to Artifact Registry. Currently a single trigger fires on every push to any branch and always tags images as 'latest'. The release manager wants a separate, repeatable release flow: when a semantic version Git tag (e.g., v1.4.2) is pushed, the pipeline should build an image tagged with that exact version string and push it to a 'release' repository, without changing the existing branch-based development builds. What is the most appropriate way to implement this?

Accepted Answer

Create a second Cloud Build trigger with a tag filter matching the semantic version pattern, and reference the built-in TAG_NAME substitution variable in the build steps to tag the image.

Answer

Modify the existing branch trigger to add a conditional shell step that inspects Git refs at runtime and manually parses the tag name from the repository.

Answer

Configure Binary Authorization to only admit images whose tag matches a semantic version, so that untagged builds are automatically rejected during deployment.

Answer

Add a manual approval gate to the existing trigger and have the release manager type the version number into a user-defined substitution before each build.

Question 22

Your team maintains a monorepo in Cloud Source Repositories containing a payment microservice. You must ensure that unit and integration tests run automatically only when a pull request targets the 'main' branch, and that a container image is built and pushed to Artifact Registry only after a commit is merged into 'main'. Developers frequently open feature branches, and you want to avoid running the full test-and-build pipeline on every feature branch push. Which approach best implements this using Cloud Build triggers?

Accepted Answer

Create a pull request trigger with a branch filter matching '^main$' that runs the test-only build config, and a separate push trigger with a branch filter matching '^main$' that runs the build-and-push config.

Answer

Create a single push trigger with no branch filter and use inline bash conditionals in cloudbuild.yaml to decide whether to test or build based on the branch name.

Answer

Create one push trigger filtered to all branches that always runs tests, and rely on Artifact Registry cleanup policies to delete images that came from feature branches.

Answer

Create a scheduled trigger that runs every hour to test and build the latest commit on 'main', ignoring pull request events entirely.

Question 23

Your team maintains a microservice that is built by a Cloud Build trigger on every merge to the main branch. Currently, an engineer manually runs 'gcloud deploy releases create' after each successful build to push the image through the dev, staging, and prod delivery pipeline. Leadership wants every successful main-branch build to automatically create a new Cloud Deploy release and begin rollout to the dev target, while preserving the existing manual approval gate before staging. What is the most appropriate way to connect the build to the delivery pipeline?

Accepted Answer

Add a final build step in the Cloud Build configuration that runs 'gcloud deploy releases create' referencing the delivery pipeline and the newly built image, using the build's short SHA as the release name.

Answer

Configure a Cloud Deploy trigger to poll Artifact Registry every five minutes and automatically create a release whenever a new image tag appears.

Answer

Enable automatic promotion on the delivery pipeline's dev stage so that Cloud Deploy detects pushed images and starts a rollout without any release creation step.

Answer

Replace the Cloud Build trigger with a Cloud Deploy trigger on the source repository so that Cloud Deploy builds the image and creates the release in a single operation.

Question 24

Your organization runs a Cloud Build pipeline that builds container images and pushes them to Artifact Registry. Security requires that only images verifiably produced by the trusted pipeline can be deployed to your production GKE cluster, and that no developer can manually push an arbitrary image that gets deployed. You have already enabled Binary Authorization on the cluster. What is the most appropriate way to complete the supply-chain control so that only pipeline-built images are admitted?

Accepted Answer

Add a Cloud Build step that creates a Binary Authorization attestation signed by a Cloud KMS key, and configure the policy to require an attestation from that attestor's public key.

Answer

Configure an Artifact Registry cleanup policy to delete any image that lacks a specific label, then let Binary Authorization admit whatever remains.

Answer

Grant only the Cloud Build service account the Artifact Registry Writer role and rely on IAM alone to block manual pushes.

Answer

Enable vulnerability scanning on Artifact Registry and set the Binary Authorization policy to block images with critical CVEs.

Question 25

Your team hosts application source code in a self-managed GitLab instance running inside your corporate network, which is not one of Cloud Build's natively integrated SCM providers. You want each merge to the main branch to automatically start a Cloud Build pipeline. The GitLab server can make outbound HTTPS calls to Google Cloud APIs. Which approach lets you trigger the build while protecting the trigger endpoint from unauthorized invocation?

Accepted Answer

Create a Cloud Build webhook trigger, store a shared secret in Secret Manager, and configure GitLab to POST to the trigger URL including the secret so Cloud Build validates each request.

Answer

Create a standard GitHub-connected Cloud Build trigger and mirror the GitLab repository to GitHub so the native integration handles authentication.

Answer

Expose the Cloud Build API publicly and have GitLab call builds.create directly using a downloaded service account key stored in the CI job.

Answer

Configure a Cloud Scheduler job that polls GitLab every minute and starts a build when it detects a new commit on main.

Question 26

A media company serves large static video thumbnails and JavaScript bundles from a global external HTTP(S) Load Balancer backed by a Cloud Storage bucket. Monitoring shows high origin egress costs and elevated tail latency for users in distant regions. Cloud CDN is enabled, but the cache hit ratio is only 22%. Investigation reveals the origin responses include 'Cache-Control: no-store' on many objects and that unique query string parameters (used for analytics tracking) are appended to nearly every asset URL. What is the MOST effective way to reduce origin egress cost and improve latency?

Accepted Answer

Set appropriate 'Cache-Control: public, max-age' headers on cacheable objects and configure the Cloud CDN cache key policy to exclude the analytics query string parameters.

Answer

Increase the Cloud Storage bucket's storage class to Standard in multiple regions and add more backend buckets to the load balancer.

Answer

Enable Cloud CDN negative caching and raise the default TTL to the maximum value regardless of the origin's Cache-Control headers.

Answer

Switch the load balancer to a regional external load balancer closer to the majority of users to shorten the network path.

Question 27

Your team uses Cloud Deploy with a delivery pipeline spanning dev, staging, and prod targets. Currently an engineer manually promotes each release from staging to prod after it has run in staging for a while. Leadership wants releases to automatically promote from staging to prod, but only after the release has soaked in staging for at least 12 hours with no issues, while still keeping a manual approval requirement on the prod target. What should you configure?

Accepted Answer

Add a Cloud Deploy Automation resource with a promote-release rule that includes a wait of 12 hours on the staging target, and keep requireApproval enabled on the prod target.

Answer

Create a Cloud Scheduler job that runs every 12 hours and calls the Cloud Deploy API to promote the latest staging release, removing the prod approval requirement.

Answer

Set a deploy hook on the staging target that sleeps for 12 hours before promoting, and disable approval on prod so the automation is not blocked.

Answer

Configure a canary deployment strategy on the staging target with a 12-hour phase duration, which will then release to prod automatically.

Question 28

Your team runs a payment API on GKE and uses Google Cloud Deploy for releases to production. Compliance requires that a fully provisioned copy of the new version receive synthetic transaction tests before any live customer traffic is shifted, and that traffic can be reverted to the previous version within seconds if the tests reveal a problem. Which deployment strategy configuration in Cloud Deploy best meets these requirements?

Accepted Answer

Configure a blue-green strategy that fully deploys the new version to a separate pool, runs a verification phase against it, and only then routes 100% of production traffic to the new version.

Answer

Configure a canary strategy with 5%, 25%, and 100% traffic phases and a verification step at each phase.

Answer

Use the default rolling update strategy of the GKE Deployment and add a post-deploy verification hook in the Cloud Deploy pipeline.

Answer

Configure a canary strategy with a single 0% phase so no traffic is served during verification, then jump to 100%.

Question 29

Your team uses Cloud Deploy to release a customer-facing service to a GKE production target. Leadership wants new releases rolled out to a small percentage of traffic first, automatically verified against error-rate metrics, and rolled back without human intervention if verification fails. What should you configure in the Cloud Deploy delivery pipeline?

Accepted Answer

Define a canary deployment strategy with automated canary phases and a verify stage in the Skaffold configuration, enabling automatic rollback on verification failure.

Answer

Use a standard (rolling) deployment strategy and add a manual approval gate before the production target so an operator can reject bad releases.

Answer

Configure a blue-green strategy that fully deploys the new version alongside the old one and swaps all traffic at once after a fixed wait time.

Answer

Create a Cloud Build trigger that deploys the release and add a separate Cloud Monitoring alerting policy that pages the on-call engineer to redeploy the previous image.

Question 30

Your team runs a customer-facing API on Cloud Run and deploys it with Google Cloud Deploy. Product management requires that new releases first receive exactly 5% of production traffic, then 25%, then 50%, before reaching 100%, and each step must pause for automated verification. You need to configure the Cloud Deploy release pipeline to control these traffic percentages during rollout. What should you do?

Accepted Answer

Define a canary deployment strategy on the target's Cloud Deploy stage with a custom canaryDeployment specifying the percentages 5, 25, and 50, and enable verify on the phases.

Answer

Use a standard (non-canary) strategy and manually edit the Cloud Run service revision traffic splits between each Cloud Deploy promotion.

Answer

Configure a blue-green strategy in Cloud Deploy so the new revision receives incremental traffic increases automatically.

Answer

Add a Cloud Build post-deploy hook that calls 'gcloud run services update-traffic' repeatedly to shift traffic by the required percentages.

Question 31

Your team uses Google Cloud Deploy to deploy a customer-facing service to GKE. Product management wants each production release to shift traffic gradually: first 10%, then 25%, then 50%, and finally 100%, pausing at each step so operators can observe dashboards before the next phase advances. You must configure this behavior in the delivery pipeline. Which approach meets the requirement with the least custom scripting?

Accepted Answer

Define a canary deployment strategy on the production stage with a canaryDeployment block listing the percentages [10, 25, 50], relying on Cloud Deploy to add the final 100% phase automatically.

Answer

Use a standard (rolling) strategy and write a Cloud Build step after each deploy that manually edits the Kubernetes Service weights before promoting.

Answer

Configure a blue-green strategy with routeUpdateWaitTime set to progressively longer values so traffic bleeds over in increasing increments.

Answer

Define a canary strategy but list every percentage including [10, 25, 50, 100] in the canaryDeployment percentages field to control all four phases explicitly.

Question 32

Your team uses Cloud Deploy to release a payments microservice to GKE. The delivery pipeline defines a canary strategy with three phases (10%, 50%, 100%). Compliance requires that a smoke test runs against every phase's canary before that phase's traffic percentage is applied, and the release must automatically halt if any smoke test fails. Which Cloud Deploy configuration meets these requirements?

Accepted Answer

Add a `verify` phase to the canary strategy and enable verification on each phase; Cloud Deploy runs the Skaffold-defined verify job after deploying each canary percentage and fails the rollout if it returns non-zero.

Answer

Add a `predeploy` action hook that runs the smoke tests before deploying, and configure a retry policy so failed tests reroll automatically.

Answer

Configure a Cloud Build trigger that runs smoke tests on a schedule and stops the Cloud Deploy release through the API if tests fail.

Answer

Use a `postdeploy` hook only on the final 100% phase to run all smoke tests at once, ensuring the fully deployed service is validated before promotion.

Question 33

Your team uses Cloud Deploy to roll out a Cloud Run service using a canary strategy with 25% and 50% phases. Product management requires that promotion beyond the first canary phase must only occur if application-level error rates (measured via Cloud Monitoring) stay below a threshold for 15 minutes. The built-in verify step only runs a synthetic smoke test and does not evaluate this metric. What is the most appropriate way to enforce this metric-based gate within the Cloud Deploy pipeline?

Accepted Answer

Configure a deploy hook (postdeploy) that queries the Cloud Monitoring API for the error rate over 15 minutes and fails the phase if the threshold is exceeded, preventing automatic promotion.

Answer

Add an Automation rule with an 'advance' rollout automation that only promotes after a fixed 15-minute wait, assuming the metric will pass.

Answer

Enable Binary Authorization on the target so images with high error rates are blocked from promotion.

Answer

Switch the strategy to blue-green so the metric can be evaluated on the entire pool before cutting over traffic.

Question 34

Your platform team uses Google Cloud Deploy to manage progressive delivery for containerized workloads. A new business unit needs to deploy artifacts to an on-premises Kubernetes cluster that is not registered as a GKE or Anthos target and requires invoking a proprietary internal CLI to apply manifests. The team wants to keep using the same Cloud Deploy pipeline model (delivery pipeline, targets, promotion, and rollback) rather than building a separate custom tool. What should you do?

Accepted Answer

Define a custom target type in Cloud Deploy using a skaffold custom action that runs a container implementing the render and deploy operations against the on-premises cluster.

Answer

Register the on-premises cluster as a standard GKE target and let Cloud Deploy apply manifests directly with its built-in Kubernetes deployer.

Answer

Abandon Cloud Deploy for this workload and orchestrate the entire promotion and rollback flow with a set of Cloud Build triggers that call the proprietary CLI.

Answer

Use a Cloud Run target in Cloud Deploy and configure a deploy hook to shell out to the proprietary CLI after the Cloud Run service is created.

Question 35

Your team is migrating from ad-hoc kubectl deployments to Google Cloud Deploy. You must define a repeatable path where every release flows through dev, then staging, then production GKE clusters. You want the sequence of environments and the manual promotion between them expressed as configuration-as-code that lives in your Git repository and is applied to Cloud Deploy. Which resource should you define to establish this ordered progression of environments?

Accepted Answer

A DeliveryPipeline resource with a serial pipeline listing the dev, staging, and production targets in order

Answer

Three separate Cloud Build triggers, one per environment, chained by pub/sub notifications

Answer

A single Target resource that references all three clusters using a multi-cluster selector

Answer

A Skaffold profile per environment referenced directly from a Cloud Build pipeline

Question 36

Your team uses Google Cloud Deploy to release a Java microservice to GKE across dev, staging, and prod targets. Before each new version's pods receive traffic, a database schema migration script must run exactly once against the target environment's Cloud SQL instance, and the rollout must halt if the migration fails. You want to implement this within the delivery pipeline using native Cloud Deploy capabilities. What should you do?

Accepted Answer

Add a pre-deploy hook to the Cloud Deploy pipeline that runs the migration in a container image; if the hook fails, Cloud Deploy marks the rollout as failed.

Answer

Configure a Cloud Build trigger on the same branch that runs the migration in parallel with the Cloud Deploy release so both complete around the same time.

Answer

Embed the migration command in the application container's entrypoint so it runs when the first pod starts up in each environment.

Answer

Create a separate Cloud Scheduler job that invokes the migration script a few minutes before each scheduled promotion to the next target.

Question 37

Your team uses Cloud Deploy to promote a release through dev, staging, and production targets. During an incident review, you discover that the container image deployed to production had a slightly different digest than the one tested in staging, because a rebuild was triggered between promotions using the same mutable tag. You must redesign the pipeline so that the exact same artifact tested in earlier stages is guaranteed to reach production. What is the most effective way to achieve this?

Accepted Answer

Create a single Cloud Deploy release that references images by immutable digest, and promote that same release across all targets rather than creating a new release per environment.

Answer

Configure each target to rebuild the image from source before deployment so the artifact is always freshly produced from the same commit.

Answer

Use a Cloud Build trigger to push a new image with a 'latest' tag before each promotion so all environments pull the current build.

Answer

Enable Binary Authorization on the production cluster to block any image whose tag does not match the staging tag.

Question 38

Your team runs a global service deployed to three regional GKE clusters (us, eu, asia). Currently a single Cloud Deploy pipeline promotes a release sequentially through each region as separate targets, which takes over an hour to reach all regions once a release is approved. The regions are independent and can safely receive the same release simultaneously. You need to reduce the total rollout time while keeping one release, one promotion action, and unified rollout status in Cloud Deploy. What should you do?

Accepted Answer

Configure a multi-target in the delivery pipeline that references all three regional GKE clusters as child targets, and deploy to the multi-target in a single stage.

Answer

Create three separate Cloud Deploy delivery pipelines, one per region, and trigger all three from the same Cloud Build run after the artifact is built.

Answer

Keep the sequential pipeline but enable canary deployment on each target so each region rolls out faster.

Answer

Use a single target backed by an Anthos multi-cluster gateway and let the gateway fan out the Deployment to all three clusters.

Question 39

Your team uses a single Cloud Deploy delivery pipeline that promotes releases across three targets: dev, staging, and prod, each in a separate GCP project. Security requires that the deployment to prod use a dedicated, least-privilege identity that has no permissions in dev or staging, and vice versa. During rendering and deployment, Cloud Deploy currently runs everything with the default Compute Engine service account, which has broad access. What is the recommended way to enforce distinct, least-privilege identities for each target's operations?

Accepted Answer

Configure an execution configuration on each target that specifies a target-specific service account and worker pool, granting each service account only the permissions needed in its project.

Answer

Create separate delivery pipelines per environment, each hardcoded with a different service account key stored in Secret Manager.

Answer

Assign IAM conditions on the default Compute Engine service account that restrict access based on the target name in the request.

Answer

Use Cloud Build triggers with per-branch service accounts and skip Cloud Deploy's rendering step entirely.

Question 40

Your team uses Google Cloud Deploy with a delivery pipeline that progresses through dev, staging, and production targets. Developers frequently push releases, and automatic promotion moves them rapidly from dev to staging. Management requires that no release reaches production without explicit sign-off from a release manager, while dev-to-staging flow should stay fully automated. What is the most appropriate way to enforce this in the pipeline?

Accepted Answer

Require the production target to use a require-approval setting so promotions into it pause until an authorized user approves the rollout.

Answer

Add a Cloud Build trigger that runs only on the production branch and manually merge changes before it fires.

Answer

Grant only the release manager the clouddeploy.releaser role on the entire pipeline so no one else can create releases.

Answer

Configure a canary deployment strategy on the production target so traffic is gradually shifted after review.

Question 41

Your team uses Google Cloud Deploy to deliver a GKE microservice through dev, staging, and prod targets. A release was promoted to prod, but on-call engineers report elevated error rates minutes after the rollout completed. You need to restore the previously running, healthy version in prod as quickly as possible while keeping a clear audit trail in the delivery pipeline. What should you do?

Accepted Answer

Run a Cloud Deploy rollback on the prod target, which creates a new rollout that redeploys the last successfully deployed release.

Answer

Delete the failed release in Cloud Deploy so the pipeline automatically reverts the prod target to its prior state.

Answer

Use kubectl to manually apply the previous Deployment manifest directly to the prod GKE cluster.

Answer

Re-run the original Cloud Build trigger with the previous commit SHA to rebuild and redeploy the old image.

Question 42

Your team runs a stateless HTTP API on GKE and uses Cloud Deploy to promote releases through dev, staging, and prod. During production rollouts, the SRE team requires that new pods gradually replace old pods while keeping the service continuously available, without provisioning a duplicate set of infrastructure or maintaining a separate parallel environment. They also want to minimize additional compute cost during the rollout. Which deployment strategy should you configure in the Cloud Deploy delivery pipeline for the production target?

Accepted Answer

A rolling update strategy that incrementally replaces old Pods with new Pods using the Kubernetes Deployment's maxSurge and maxUnavailable settings

Answer

A blue-green strategy that spins up a full second environment and switches traffic after verification

Answer

A canary strategy with 5%, 25%, and 100% phases routing a subset of traffic to the new version

Answer

A recreate strategy that terminates all existing Pods before starting the new version

Question 43

Your team uses Cloud Deploy to promote a containerized application through dev, staging, and prod GKE clusters. Each environment requires different Kubernetes manifest values (replica counts, resource limits, and namespace). You want a single delivery pipeline that renders environment-specific manifests at release creation time without maintaining separate pipeline definitions per target. What is the recommended approach?

Accepted Answer

Define a single Skaffold configuration with profiles per target and reference them in the Cloud Deploy pipeline stages so manifests are rendered per-target during release creation.

Answer

Create three separate Cloud Deploy delivery pipelines, one per environment, each pointing to its own hardcoded manifest set.

Answer

Manually run kubectl apply with edited manifests for each cluster after Cloud Deploy promotes the artifact.

Answer

Store fully rendered manifests for all environments in the container image and select them at runtime with an entrypoint script.

Question 44

Your team uses Cloud Deploy to release a microservice to GKE across dev, staging, and prod targets. A recent production incident was caused by a bad Kubernetes manifest that referenced a nonexistent ConfigMap; the error was only discovered after the rollout began. The manifests are generated by Skaffold using Kustomize overlays that differ per target. You want to catch rendering and manifest correctness issues for the exact production configuration BEFORE any pipeline promotion reaches the production target, without deploying to prod. What should you do?

Accepted Answer

Enable Cloud Deploy render inspection by reviewing the fully rendered manifests stored for the production target in the release, and add a Cloud Deploy verification (verify) phase in the skaffold profile that runs after deploy to each earlier target.

Answer

Add a canary deployment strategy to the production target so a small percentage of traffic validates the manifest before full rollout.

Answer

Configure Binary Authorization on the production cluster to block images that lack an attestation, preventing bad manifests from being applied.

Answer

Increase the production target's rollout timeout so failed manifests have more time to reconcile before Cloud Deploy marks the release failed.

Question 45

Your team runs a microservices application on GKE with structured JSON logs flowing into Cloud Logging. During a partial outage, on-call engineers need to correlate error logs from the payment service with slow upstream requests across a 6-hour window, aggregating by HTTP status code and computing p95 latency per service. Ad-hoc filtering in the Logs Explorer is too slow and cannot perform these aggregations. What is the most appropriate approach to enable this analysis with minimal additional infrastructure?

Accepted Answer

Enable Log Analytics on the log bucket and use SQL queries in the Log Analytics interface to aggregate and join log fields.

Answer

Create a log-based metric for each service and status code, then build a Cloud Monitoring dashboard to visualize the aggregations.

Answer

Export all logs to Cloud Storage via a log sink and run BigQuery external table queries against the JSON files.

Answer

Increase the Logs Explorer query time range and add more label filters to narrow the results manually.

Question 46

A user-facing API running on GKE intermittently returns HTTP 500 errors. Your team has structured JSON logs in Cloud Logging that include a 'trace' field populated with the X-Cloud-Trace-Context ID, and distributed tracing is enabled with Cloud Trace. During an incident, you find a specific log entry showing a 500 error and want to immediately see the full end-to-end request path—including the downstream service calls and their latencies—that produced this error. What is the most efficient way to accomplish this?

Accepted Answer

In the Logs Explorer, click the log entry and use the trace correlation link, which opens the associated trace in Cloud Trace showing the full span breakdown of the request.

Answer

Create a log-based counter metric filtered on HTTP 500 responses and view its rate over time in a Cloud Monitoring dashboard.

Answer

Export the logs to BigQuery and run a query joining on the timestamp field to approximate which downstream calls occurred at the same moment.

Answer

Enable Cloud Profiler on the service to capture the CPU flame graph for the time window in which the error occurred.

Question 47

Your compliance team requires that all audit logs from a production project be retained for 400 days and be queryable with SQL for ad-hoc investigations, while keeping operational costs low. Application debug logs should only be kept for 14 days. You want to configure Cloud Logging with the least operational overhead. What should you do?

Accepted Answer

Create a dedicated log bucket for audit logs with a 400-day retention period and enable Log Analytics (with a linked BigQuery dataset), then route audit logs to it; keep debug logs in the _Default bucket with retention lowered to 14 days.

Answer

Export all logs via a single sink to a BigQuery dataset with a 400-day table expiration, and use a log exclusion filter to drop debug logs after 14 days.

Answer

Increase the _Default log bucket retention to 400 days for the whole project and create a scheduled Cloud Function to delete debug log entries older than 14 days.

Answer

Route audit logs to Cloud Storage with a 400-day lifecycle rule and enable Object Lifecycle Management, then query them with BigQuery external tables when needed.

Question 48

Your team runs a high-traffic web service on GKE. Cloud Logging costs have risen sharply, and analysis shows that the majority of ingested volume comes from verbose HTTP access logs with severity INFO from the ingress load balancer. Compliance requires that all WARNING and higher logs remain searchable in Cloud Logging for 30 days, and a subset of the INFO access logs must still be retained cheaply for later ad-hoc analysis. What is the most cost-effective way to meet these requirements?

Accepted Answer

Create an exclusion filter on the _Default log bucket sink that drops the INFO access logs, and add a separate sink that exports those same INFO logs to a Cloud Storage bucket.

Answer

Reduce the retention period of the _Default log bucket to 7 days so all logs, including WARNING and higher, are purged sooner.

Answer

Disable the Cloud Logging agent on the GKE nodes so INFO access logs are never generated.

Answer

Create a log-based metric that counts the INFO access logs and delete the raw log entries once the metric is recorded.

Question 49

A payment service running on GKE writes structured JSON logs to Cloud Logging. During a partial outage, the on-call engineer needs to quickly find all ERROR-severity entries that contain a specific transaction ID field (jsonPayload.txnId) across the last 30 minutes, then aggregate how many distinct pods emitted them. The engineer wants the fastest interactive way to both filter and run aggregation without exporting data elsewhere. Which approach should they use?

Accepted Answer

Use the Logs Explorer with a query on severity and jsonPayload.txnId, then switch to Log Analytics and run a SQL query grouping by resource.labels.pod_name

Answer

Create a log-based metric filtered on the txnId and view a Cloud Monitoring dashboard chart broken down by pod

Answer

Create a log sink to BigQuery and run a scheduled query to count distinct pods after the data lands

Answer

Enable Cloud Trace sampling at 100% and inspect spans grouped by transaction ID in the Trace explorer

Question 50

A microservice on GKE writes plain-text log lines to stdout like 'ERROR user 4521 checkout failed timeout=3000ms'. The reliability team wants to filter these entries by severity in Logs Explorer and build a log-based metric that counts only checkout failures per user tier, but currently all entries appear with severity 'Default' and the message body is treated as a single unstructured string. What is the most effective change to enable reliable severity filtering and field-based extraction?

Accepted Answer

Emit logs as structured JSON to stdout with a 'severity' field and separate fields for event, userId, and tier, so the GKE logging agent parses them into jsonPayload and LogEntry severity.

Answer

Configure a Cloud Logging sink that routes all entries to BigQuery, then run SQL regular expressions over the text payload to reconstruct the fields at query time.

Answer

Increase the log retention period on the _Default bucket so the plain-text entries persist long enough for the team to search them manually.

Answer

Add a log exclusion filter on the _Default sink to drop non-error lines, reducing volume so the remaining text entries are easier to scan.

Question 51

Your team runs a fleet of Compute Engine VMs hosting a legacy Java application. In Cloud Monitoring dashboards you can see CPU utilization and network traffic for each VM, but memory utilization and disk usage metrics are missing, and you cannot build a memory-pressure alert. The VMs use a standard public Debian image. What is the most likely cause and the correct fix?

Accepted Answer

The default Compute Engine metrics only include hypervisor-visible signals; install and configure the Ops Agent on the VMs to collect guest-level memory and disk metrics.

Answer

The Cloud Monitoring metrics scope is misconfigured; add the project to a new metrics scope so guest memory metrics appear automatically.

Answer

Memory metrics require a log-based metric; create a log-based metric that parses /proc/meminfo entries from the VM serial console.

Answer

The VM service account lacks the roles/monitoring.viewer role; grant it so the built-in memory agent can publish guest metrics.

Question 52

A payments microservice runs on GKE and normally serves requests with p99 latency under 300ms. During brief, self-healing garbage-collection pauses, p99 latency spikes above 500ms for 20-40 seconds several times per hour. You created a Cloud Monitoring alerting policy on p99 latency with a threshold of 500ms, but the on-call team is being paged constantly for these transient spikes that recover on their own. You must reduce noisy pages without missing sustained latency degradation that actually harms users. What is the best change to the alerting policy?

Accepted Answer

Increase the condition's retest/duration window so the metric must stay above 500ms for at least 5 minutes before the condition triggers.

Answer

Raise the threshold from 500ms to 2000ms so only extreme spikes page the team.

Answer

Add a metric-absence condition to the policy so it only fires when data stops arriving.

Answer

Change the aggregation alignment period to 1 second to capture the spikes more precisely.

Question 53

Your team runs a fleet of 40 Compute Engine instances behind a managed instance group serving a REST API. You create a Cloud Monitoring alerting policy on the metric compute.googleapis.com/instance/cpu/utilization to page on-call when CPU is sustained above 85%. During a real incident where several individual instances spiked to 95% while the group average stayed near 60%, the alert never fired. You inspected the policy and found it aligns the series and then applies a cross-series reducer of 'mean' before evaluating the threshold. What change will make the alert correctly detect per-instance saturation?

Accepted Answer

Remove the cross-series reducer (or set it to 'none') and group the time series by instance so the threshold is evaluated per instance rather than against a single aggregated series.

Answer

Increase the alignment period from 60s to 300s so the aligner smooths out brief per-instance spikes before evaluation.

Answer

Change the cross-series reducer from 'mean' to 'sum' so the combined utilization of all instances exceeds the 85% threshold.

Answer

Lower the threshold from 85% to 55% so the group average of 60% during the incident would trigger the alert.

Question 54

A batch data-ingestion service writes a custom metric 'pipeline/records_processed' every 5 minutes when a cron-triggered job runs successfully. Recently the cron scheduler silently stopped firing, so the job never ran and no data points were written at all. Your existing threshold-based alert (fires when records_processed < 100) never triggered because the metric simply stopped reporting. You need an alerting policy that notifies the on-call engineer when the job stops producing the metric entirely. What should you configure?

Accepted Answer

Create a metric-absence condition on 'pipeline/records_processed' with a trigger duration slightly longer than the job's normal 5-minute interval.

Answer

Lower the threshold condition to 'records_processed < 1' so that any missing data is caught by the comparison.

Answer

Add a metric-threshold condition using the 'delta' aligner and set the alignment period to 24 hours to smooth out gaps.

Answer

Configure an uptime check against the batch service and alert when the check fails.

Question 55

A payments service on GKE occasionally leaks file descriptors, and the on-call team currently receives a Cloud Monitoring alert and manually runs a script to restart the affected Deployment. Your team wants to automatically trigger that remediation script (running as a Cloud Function) the moment the alert condition fires, while still keeping a human notified. The alerting policy already has an appropriate condition. What is the most appropriate way to wire the alert to the automated remediation?

Accepted Answer

Add a Pub/Sub notification channel to the alerting policy and configure the remediation Cloud Function with a Pub/Sub trigger on that topic, plus an email channel for the on-call team.

Answer

Configure the alerting policy to use only a Slack notification channel and have an operator manually invoke the Cloud Function from the Slack message.

Answer

Create a log-based metric on the alert and schedule the Cloud Function with Cloud Scheduler to poll that metric every minute.

Answer

Point the alerting policy's email notification channel at the Cloud Function's HTTP trigger URL so the email invokes the function.

Question 56

A payments API team has an alerting policy in Cloud Monitoring that fires when the 5-minute p95 latency exceeds 800 ms. During a period of intermittent load, the underlying condition crosses the threshold repeatedly for short spikes, generating a storm of open-and-close incident notifications that overwhelm the on-call engineer. The team wants to keep the latency threshold but suppress noise from brief, transient spikes without missing a genuinely sustained latency regression. What should they configure?

Accepted Answer

Increase the condition's 'retest window' (duration) so the metric must stay above 800 ms for a longer sustained period before the condition triggers.

Answer

Lower the latency threshold to 500 ms so the condition triggers earlier and stays consistently in the alerting state.

Answer

Disable the notification channel during business hours and rely on dashboard inspection instead.

Answer

Change the aggregation aligner from p95 to max so brief spikes are captured more accurately.

Question 57

Your team runs a batch data-processing job on Compute Engine that periodically computes the number of records that failed validation in each run. Operations wants this value visualized on a Cloud Monitoring dashboard and available for alerting, but the value is produced only by your application logic and is not exposed by any existing GCP metric or log entry. What is the most appropriate way to get this value into Cloud Monitoring?

Accepted Answer

Create a custom metric with a metric type under 'custom.googleapis.com/' and write the value using the Cloud Monitoring API (timeSeries.create) or a client library from the application.

Answer

Emit a structured log line with the failure count and rely on Cloud Monitoring to automatically discover and chart the field as a metric.

Answer

Enable the Ops Agent's built-in process metrics, which will capture the application's internal validation counters automatically.

Answer

Create an uptime check against the batch job so Cloud Monitoring records the failure count as availability data.

Question 58

Your team runs a high-traffic API on GKE. During an incident review, engineers complained that the existing latency dashboard—which plots the p50, p95, and p99 line charts from a distribution metric—hid a bimodal latency pattern where a subset of requests were consistently slow while most were fast. Leadership asks you to build a single dashboard widget that best reveals the full shape of the latency distribution over time so this pattern is immediately visible. Which Cloud Monitoring visualization should you configure?

Accepted Answer

A heatmap widget backed by the distribution-valued latency metric, showing bucket density over time

Answer

A stacked area chart that sums the p50, p95, and p99 aligned series

Answer

A scorecard displaying the current p99 latency with a threshold sparkline

Answer

A line chart of the mean latency computed with the ALIGN_MEAN aligner

Question 59

Your team exports request latency from a Cloud Run service as a distribution (histogram) metric to Cloud Monitoring. The SLO states that 99% of requests must complete in under 400ms over a rolling 28-day window. During a review, a stakeholder asks how you can build a chart that shows the actual 99th-percentile latency trend so you can compare it against the 400ms threshold. Which approach correctly produces this on a Cloud Monitoring dashboard?

Accepted Answer

Chart the distribution metric using a 99th percentile aligner (ALIGN_PERCENTILE_99) so each aligned point represents the p99 latency across the alignment window.

Answer

Chart the distribution metric with an ALIGN_MEAN aligner and multiply the result by 0.99 to approximate the 99th-percentile value.

Answer

Convert the distribution to a log-based counter metric and use ALIGN_RATE to compute the percentage of requests under 400ms.

Answer

Chart the distribution metric with ALIGN_MAX so the highest latency bucket is always shown, which represents the worst-case 99th percentile.

Question 60

A payments microservice running on GKE writes structured JSON logs to Cloud Logging. The on-call team wants to be paged only when a specific critical error (jsonPayload.error_code = "PAYMENT_GATEWAY_TIMEOUT") occurs, and they want the notification delivered to their PagerDuty rotation within seconds of the log entry being written. They do not want to maintain a Prometheus scraper or write custom code. What is the most appropriate and efficient way to configure this?

Accepted Answer

Create a log-based alerting policy in Cloud Monitoring with a query matching jsonPayload.error_code="PAYMENT_GATEWAY_TIMEOUT", and attach a PagerDuty notification channel.

Answer

Create a counter log-based metric for the error, then build a metric-threshold alerting policy with a rolling 5-minute alignment window and a PagerDuty channel.

Answer

Export the logs to BigQuery with a log sink and schedule a query that runs every minute to detect the error and trigger a Cloud Function that calls the PagerDuty API.

Answer

Deploy a sidecar container that tails the pod logs and posts directly to PagerDuty whenever the error string appears.

Question 61

Your team runs a payment API on GKE. The application already emits structured JSON logs to Cloud Logging that include a 'transaction_status' field, but the code was not instrumented with any custom metrics. Leadership wants a Cloud Monitoring dashboard tile showing the rate of failed transactions per minute, and they want it available as quickly as possible without a new application deployment. What is the most appropriate approach?

Accepted Answer

Create a counter log-based metric that filters log entries where transaction_status="failed", then add a chart of that metric's rate to the dashboard.

Answer

Add OpenTelemetry custom metric instrumentation to the application code and redeploy so the failure counter is exported directly to Cloud Monitoring.

Answer

Configure Managed Service for Prometheus to scrape a /metrics endpoint on the pods and build the dashboard from the scraped counter.

Answer

Export the logs to BigQuery via a log sink and schedule a query that counts failures, then visualize the result in Looker Studio.

Question 62

Your team runs a set of microservices on GKE that already expose application metrics in Prometheus exposition format on a /metrics endpoint. You need these custom metrics ingested into Cloud Monitoring so you can query them alongside GKE system metrics and build dashboards, without deploying and maintaining your own Prometheus server or storage. What should you do?

Accepted Answer

Enable Google Cloud Managed Service for Prometheus on the cluster and deploy PodMonitoring resources to scrape the application /metrics endpoints.

Answer

Write a sidecar that reads /metrics and calls the Cloud Monitoring API to create custom metric descriptors and write time series for each metric.

Answer

Configure a log-based metric in Cloud Logging that parses the /metrics endpoint output emitted to stdout.

Answer

Deploy a self-managed Prometheus StatefulSet with persistent volumes and use a remote_write configuration to push data into Cloud Trace.

Question 63

You run a fleet of 40 Compute Engine VMs behind a managed instance group serving a stateless API. You configure a Cloud Monitoring alerting policy on the CPU utilization metric with a threshold of 85% sustained for 5 minutes. During a load test, three individual VMs briefly exceeded 85%, but the aggregated policy never fired even though your team wanted to be notified about any single overloaded instance. Investigating the condition, you find the metric is being combined across all instances. Which change to the alerting condition will ensure you are alerted when any individual VM crosses the threshold?

Accepted Answer

Group the time series by the instance_id (or resource) label and evaluate the condition per series, so each VM is assessed independently against the threshold.

Answer

Lower the aggregation alignment period to 1 minute so short spikes on individual VMs are captured in the aggregate.

Answer

Change the cross-series reducer to sum so the combined CPU across all instances crosses 85% faster.

Answer

Add a metric-absence condition alongside the threshold so missing data points from busy VMs trigger the alert.

Question 64

Your organization runs a customer-facing application split across three separate GCP projects: 'frontend-prod', 'backend-prod', and 'data-prod'. The SRE team wants a single Cloud Monitoring dashboard that displays latency and error-rate charts combining metrics from all three projects, without duplicating dashboards or copying metric data. What is the recommended approach?

Accepted Answer

Create a metrics scope in a dedicated scoping project and add the three projects as monitored projects, then build the dashboard in that scoping project.

Answer

Export metrics from each project to BigQuery and build the dashboard using a Looker Studio data source that joins the three datasets.

Answer

Configure a log sink in each project that routes metric data to a central project, then create log-based metrics for the dashboard.

Answer

Enable a VPC Service Controls perimeter around the three projects so their metrics automatically appear in one shared Monitoring workspace.

Exam domain	Exam weight	Practice
Bootstrapping and maintaining a Google Cloud organization	20%	Practice this topic
Building and implementing CI/CD pipelines	25%	Practice this topic
Applying site reliability engineering practices	18%	Practice this topic
Implementing observability practices and troubleshooting issues	25%	Practice this topic
Optimizing performance and cost	12%	Practice this topic

Professional Cloud DevOps Engineer (PCDE) practice exam & study guide

Start studying PCDE

All PCDE study resources

PCDE exam domains

Sample PCDE questions

Key PCDE terms

PCDE frequently asked questions

Bootstrapping and maintaining a Google Cloud organization (20%)

Building and implementing CI/CD pipelines (25%)

Applying site reliability engineering practices (18%)

Implementing observability practices and troubleshooting issues (25%)

Optimizing performance and cost (12%)