Professional Cloud DevOps Engineer

Question 1

Your team builds container images in Cloud Build and pushes them to Artifact Registry. Security requires that every image be automatically scanned for OS-level vulnerabilities as soon as it is stored, and that developers be able to query the findings without running any additional scanning jobs in the pipeline. You want the least-effort, native approach. What should you do?

Accepted Answer

Enable the Container Scanning API so Artifact Registry automatically scans images on push and stores vulnerability findings that can be queried via the API or console.

Answer

Add a Cloud Build step that runs an open-source scanner like Trivy against each image and uploads the results to Cloud Storage for developers to download.

Answer

Configure Binary Authorization with a vulnerability policy so that scanning occurs automatically during admission to the cluster.

Answer

Schedule a Cloud Scheduler job that periodically pulls all images from Artifact Registry and runs the gcloud artifacts docker images scan command on each.

Question 2

Your data analytics team runs BigQuery workloads that have grown unpredictably. Finance reports that on-demand query costs have tripled over three months, with large spikes during monthly reporting cycles but low steady usage otherwise. A few ad-hoc analyst queries occasionally scan enormous tables and cause bill surprises. You must implement a FinOps approach that controls cost while keeping predictable baseline performance for scheduled reporting jobs. What should you do?

Accepted Answer

Purchase a baseline slot commitment (editions with autoscaling) to cover steady reporting load, assign the reporting jobs to a dedicated reservation, and leave ad-hoc analyst queries on on-demand with per-project/per-user maximum bytes-billed limits.

Answer

Move all workloads to on-demand pricing and set an organization-wide monthly billing budget alert to cap spending.

Answer

Purchase a single large flat-rate slot commitment sized to the monthly reporting peak and route every query—scheduled and ad-hoc—through that one reservation.

Answer

Export all datasets to Cloud Storage and query them with external tables to avoid BigQuery compute charges entirely.

Question 3

Your platform team runs an automated project factory using Terraform. A new business unit requests projects, and finance requires that every newly provisioned project is automatically linked to a specific billing account and cannot be moved to a different billing account by project-level users. Which approach best enforces this requirement while keeping the factory fully automated?

Accepted Answer

Have the factory's service account hold roles/billing.user on the billing account, set the billing_account in the google_project resource, and grant project users only roles/viewer so they cannot change billing linkage.

Answer

Grant each project owner the roles/billing.admin role so they can attach the correct billing account during onboarding.

Answer

Manually link billing in the Cloud Console after each Terraform apply and rely on documentation to prevent changes.

Answer

Assign the factory service account roles/billing.creator and let project teams self-manage billing linkage through org policies.

Question 4

You lead FinOps for a company running dozens of microservices across several GCP projects. Finance reports that last month's total spend jumped 35% with no obvious cause. Leadership wants a repeatable way to break down costs by service, SKU, project, and label, and to run ad hoc queries to pinpoint which resources drove the spike. What should you implement?

Accepted Answer

Enable Cloud Billing export to BigQuery (detailed usage cost export), enforce a consistent labeling strategy across resources, and analyze spend with SQL queries and Looker Studio dashboards.

Answer

Rely on the Billing console's built-in Reports view and manually export monthly PDF invoices for the finance team to review.

Answer

Create a budget with alert thresholds at 50%, 90%, and 100% of the monthly forecast so you are notified when spend increases.

Answer

Turn on Recommender cost recommendations and apply all idle-resource and rightsizing suggestions each month.

Question 5

Your team runs a GKE production cluster and wants to guarantee that only container images that have passed an automated vulnerability scan and were built by your official Cloud Build pipeline can be deployed. Images built on developer laptops or without a scan must be rejected at deploy time. Which approach best meets this requirement?

Accepted Answer

Enable Binary Authorization on the cluster with a policy that requires attestations, and have Cloud Build create a signed attestation only after the image passes the vulnerability scan.

Answer

Configure Artifact Registry to reject any image push that has critical vulnerabilities, relying on the registry scan gate to block bad images from being deployed.

Answer

Add a Cloud Build step that runs a script to delete images with vulnerabilities from Artifact Registry before the deployment stage executes.

Answer

Use a GKE admission webhook that checks the image tag naming convention to confirm the image came from the official pipeline.

Question 6

Your FinOps team wants to catch cost overruns before they occur rather than after the fact. Each of your 40 project owners currently receives a monthly invoice but no proactive signal. Leadership requires that when a project's spending is trending toward exceeding its monthly budget, an automated workflow disables non-essential resources without any human reading an email. Which Cloud Billing budget configuration best meets this requirement?

Accepted Answer

Create a budget per project with alert thresholds based on forecasted spend, and connect the budget to a Pub/Sub topic that triggers a Cloud Function to disable non-essential resources.

Answer

Create a single organization-wide budget with email notifications to all project owners at 90% and 100% of actual spend.

Answer

Export billing data to BigQuery and schedule a daily query that emails project owners when actual spend exceeds the budget.

Answer

Configure a budget per project with alert thresholds on actual spend only, sending notifications to a Cloud Monitoring notification channel.

Question 7

Your SRE team runs a payment API on GKE with a defined SLO of 99.9% availability measured over a 28-day rolling window. Developers push changes frequently, and leadership wants to maximize release velocity without endangering the SLO. During a new rollout, you want an automated mechanism that decides whether to continue promoting a release based on the release's real impact on the service's reliability signals, halting before the error budget is materially consumed. Which approach best balances change velocity and reliability?

Accepted Answer

Use a progressive canary rollout where a small percentage of traffic is shifted to the new version and promotion is gated on SLI measurements (error rate and latency) compared against thresholds derived from the error budget.

Answer

Deploy the full release to 100% of traffic immediately, then rely on the 28-day rolling SLO report to decide whether the next release should proceed.

Answer

Freeze all releases whenever any error budget has been consumed during the current window, regardless of the change's tested impact.

Answer

Increase the SLO target to 99.99% so any regression is caught faster, then deploy releases directly to production.

Question 8

Your platform team is designing a CI/CD architecture for a company with separate Google Cloud projects for dev, staging, and production. The security team mandates that a container image which is deployed to production must be the exact same artifact that was tested in staging, and that no image should be rebuilt between environments. You are using Cloud Build and Artifact Registry. Which approach best satisfies these requirements?

Accepted Answer

Build the image once, tag it with the immutable digest, and promote the same image by digest through dev, staging, and production Artifact Registry repositories using a controlled pipeline with Binary Authorization attestations.

Answer

Configure a separate Cloud Build trigger in each environment's project that rebuilds the image from the same Git commit before deploying to that environment.

Answer

Store a single mutable 'latest' tag in one shared Artifact Registry repository and have every environment pull the 'latest' tag at deploy time.

Answer

Build the image in dev, then export the container filesystem as a tarball and re-import it into staging and production registries to guarantee consistency.

Question 9

A retail company runs an e-commerce API on a Compute Engine managed instance group behind an external HTTP(S) load balancer. During periodic bot-driven traffic surges, the backend autoscaler adds many VMs to absorb the load, causing large unexpected compute spikes on the monthly bill even though the surge traffic is malicious and returns no revenue. The team wants to reduce cost during these events without degrading legitimate customer performance. What should they implement?

Accepted Answer

Enable Cloud Armor Adaptive Protection with a security policy that rate-limits and blocks the detected malicious traffic at the load balancer edge before it reaches the backends

Answer

Lower the managed instance group's maximum number of instances so the autoscaler cannot add VMs during surges

Answer

Switch the backend VMs to Spot VMs so that surge capacity is billed at a lower rate

Answer

Increase the autoscaler's target CPU utilization so fewer VMs are added during traffic spikes

Question 10

Your team uses Cloud Build to build container images that are pushed to a Docker repository in Artifact Registry. After a recent incident, an engineer accidentally re-pushed a new image using an existing tag (v1.4.2) that had already been deployed to production, causing confusion about which binary was actually running. You need to guarantee that once a tagged image is published, that exact tag can never be overwritten by a later push, while still allowing new tags. What should you do?

Accepted Answer

Enable immutable image tags on the Artifact Registry repository so that pushing an already-existing tag is rejected.

Answer

Configure a cleanup policy on the repository to delete images older than 30 days to prevent tag reuse.

Answer

Add a Cloud Build step that runs a shell script to check whether the tag exists and fails the build if it does.

Answer

Enable Binary Authorization with a require-attestation policy so unverified image pushes are blocked.

Question 11

Your team's Cloud Build pipeline builds a large Java microservice. Each build downloads all Maven dependencies from scratch, and the container image is rebuilt entirely on every commit, causing builds to take over 20 minutes. You want to reduce build times without changing the application source. Which approach should you implement?

Accepted Answer

Use Kaniko with a cache repository in Artifact Registry and store Maven dependencies in a Cloud Storage bucket referenced via the Cloud Build 'cache' directory between builds.

Answer

Increase the machine type of the default Cloud Build worker pool to the largest available size so more CPU is dedicated to each build.

Answer

Split the build into multiple triggers so that dependency downloads and image builds run as separate Cloud Build jobs on different branches.

Answer

Disable build provenance generation and Binary Authorization checks to remove overhead from the build steps.

Question 12

Your team hosts application source in GitHub and uses a Cloud Build trigger connected via the Cloud Build GitHub App. Developers open pull requests against the main branch. Leadership mandates that no code can be merged into main unless an automated build-and-test run has succeeded, and the merge must be blocked in the GitHub UI until that check passes. What is the correct way to enforce this?

Accepted Answer

Create a pull request Cloud Build trigger and configure a GitHub branch protection rule on main that requires the Cloud Build status check to pass before merging.

Answer

Create a push trigger on the main branch so the tests run automatically after each merge, and roll back with a revert commit if tests fail.

Answer

Add a Binary Authorization policy requiring an attestation, so unverified merges are rejected by GitHub.

Answer

Configure a Cloud Deploy pipeline with a manual approval gate that developers must satisfy before merging the pull request.

Question 13

Your team's Cloud Build pipeline compiles a Go binary and produces a container image. Currently the build succeeds but downstream Cloud Deploy releases cannot find the image, and audits show the built image is never stored in a central location. You need the build to reliably publish the container image to Artifact Registry so it can be referenced by digest in later stages. Which approach correctly ensures the image is pushed and its digest is recorded?

Accepted Answer

Add the image to the top-level 'images' field in the Cloud Build config so Cloud Build pushes it to Artifact Registry and records the resolved digest in the build results.

Answer

Rely on the 'docker build' step alone, since Cloud Build automatically pushes any image tagged with an Artifact Registry hostname at the end of the build.

Answer

Store the built image as a Cloud Storage object using the 'artifacts.objects' field and have Cloud Deploy read it from the bucket.

Answer

Enable Binary Authorization on the build trigger, which will push the image to Artifact Registry as part of attestation generation.

Question 14

Your team's Cloud Build pipeline runs unit tests, three independent integration test suites, and a static code analysis scan. Currently all steps run sequentially, and the build takes 22 minutes, causing developer frustration. The three integration suites do not depend on each other, and the static analysis does not depend on any tests. You need to reduce total build time without removing any of the checks. What should you do?

Accepted Answer

Configure the three integration test steps and the static analysis step to run concurrently by setting the same waitFor value referencing only the unit test step, allowing them to execute in parallel.

Answer

Move the integration tests and static analysis into a separate Cloud Build trigger that fires after the first build completes successfully.

Answer

Increase the machine type of the Cloud Build worker to E2_HIGHCPU_32 so that the sequential steps each complete faster.

Answer

Combine all test suites and the static analysis into a single build step running one script to reduce per-step container startup overhead.

Question 15

Your platform team runs a single Cloud Build project that hosts triggers for dozens of application repositories. Currently all triggers execute using the default Cloud Build service account, which has broad Editor-level permissions across the project. A security audit flags this as excessive: a compromised build for one low-privilege app could push images and deploy to resources belonging to other teams. You must reduce blast radius while keeping each pipeline able to perform only the actions it needs. What should you do?

Accepted Answer

Create a dedicated user-managed service account per trigger with only the IAM roles that build needs, and configure each Cloud Build trigger to run as that service account.

Answer

Keep the default Cloud Build service account but remove the Editor role and grant Owner so builds cannot be blocked by missing permissions.

Answer

Move every application into its own Google Cloud project so the shared default service account is isolated by project boundary.

Answer

Export a JSON key for the default service account and store it in Secret Manager, then have each build authenticate with the key it needs.

Question 16

Your team uses a single Cloud Build pipeline that builds a container image, runs unit tests, pushes to Artifact Registry, and then deploys to a production GKE cluster. Compliance now requires that a human release manager explicitly approve the build before the production deployment steps run, while all earlier build and test steps continue to run automatically on every commit to main. You want the least complex change that satisfies this requirement natively in Cloud Build. What should you do?

Accepted Answer

Split the pipeline so build and test run in one trigger, and use a Cloud Build manual approval on a second trigger that performs only the production deployment steps.

Answer

Configure the trigger to require manual approval, which pauses the entire build until an approver approves or rejects it in the Cloud Build console.

Answer

Add a wait step in the build config that polls a Pub/Sub topic until a release manager publishes an approval message.

Answer

Move the deployment steps to Cloud Deploy and add a promotion approval gate, replacing the Cloud Build deploy steps entirely.

Question 17

Your team's Cloud Build pipeline runs integration tests that must connect to a Cloud SQL instance and internal microservices that only have private IP addresses inside a VPC. The default Cloud Build workers cannot reach these private resources, and security policy prohibits exposing the database or services to public IPs. You need the build's integration test step to successfully reach the private resources with minimal ongoing maintenance. What should you do?

Accepted Answer

Configure a Cloud Build private pool with a peered network connection to your VPC, and run the integration test step in that private pool.

Answer

Assign a public IP to the Cloud SQL instance and use authorized networks to allow the Cloud Build worker IP ranges.

Answer

Deploy a Cloud VPN tunnel from the default Cloud Build worker pool to your VPC and route test traffic through it.

Answer

Add a startup step that installs the Cloud SQL Auth Proxy on the default pool and hardcode the private IP of each microservice.

Question 18

Your security team requires that every container image built by your Cloud Build pipelines includes verifiable build provenance so that downstream consumers can confirm the image was produced by your trusted build system and has not been tampered with. You want to minimize custom scripting and use native platform capabilities. What should you do?

Accepted Answer

Enable Cloud Build's built-in SLSA build provenance generation when pushing images to Artifact Registry, and have consumers verify the generated provenance metadata.

Answer

Add a custom build step that computes a SHA-256 digest of the image and writes it to a Cloud Storage bucket for consumers to compare.

Answer

Configure Binary Authorization to sign images at deploy time and store the signatures in Secret Manager for auditors.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry so that scan results serve as proof of image origin.

Question 19

Your platform team runs a Cloud Build pipeline that builds container images, pushes them to Artifact Registry, and then deploys to a GKE cluster via Cloud Deploy. A recent security audit found that a developer was able to manually deploy an image that had never passed through the official build pipeline. Leadership now requires that only images produced by your trusted Cloud Build pipeline can ever be deployed to the production GKE cluster, and that this rule is enforced at admission time regardless of who or what initiates the deployment. Which approach best satisfies this requirement?

Accepted Answer

Enable Binary Authorization on the production cluster with a policy that requires attestations, and configure Cloud Build to create a signed attestation for each image it builds using a dedicated attestor.

Answer

Restrict IAM so that only the Cloud Build service account has the Kubernetes Engine Developer role on the production cluster, preventing developers from deploying manually.

Answer

Enable vulnerability scanning in Artifact Registry and configure Cloud Deploy to block promotion of any image with critical vulnerabilities.

Answer

Use a VPC Service Controls perimeter around the production project so that only the Cloud Build private pool can push and deploy images.

Question 20

Your team maintains a Cloud Build pipeline that runs a lightweight unit-test build on every push to any branch. Separately, you need a heavier end-to-end integration suite that provisions ephemeral resources and takes about 45 minutes to run. The business requirement is that this integration suite runs automatically once every night at 02:00 against the latest commit on the main branch, without any developer having to push code or click a button. Which approach best meets this requirement?

Accepted Answer

Create a Cloud Scheduler job that publishes to a Pub/Sub topic, and configure a Cloud Build trigger of type Pub/Sub that references the main branch and runs the integration build config.

Answer

Add a branch-filter push trigger on main that runs the integration build config, relying on nightly merges to main to invoke it.

Answer

Configure a webhook trigger and call it from a developer's local cron job at 02:00 each night.

Answer

Set a timed soak duration in the existing unit-test trigger so it re-runs the integration suite every 24 hours automatically.

Question 21

A media company serves large static video thumbnails and JavaScript bundles from a global external HTTP(S) Load Balancer backed by a Cloud Storage bucket. Monitoring shows high origin egress costs and elevated tail latency for users in distant regions. Cloud CDN is enabled, but the cache hit ratio is only 22%. Investigation reveals the origin responses include 'Cache-Control: no-store' on many objects and that unique query string parameters (used for analytics tracking) are appended to nearly every asset URL. What is the MOST effective way to reduce origin egress cost and improve latency?

Accepted Answer

Set appropriate 'Cache-Control: public, max-age' headers on cacheable objects and configure the Cloud CDN cache key policy to exclude the analytics query string parameters.

Answer

Increase the Cloud Storage bucket's storage class to Standard in multiple regions and add more backend buckets to the load balancer.

Answer

Enable Cloud CDN negative caching and raise the default TTL to the maximum value regardless of the origin's Cache-Control headers.

Answer

Switch the load balancer to a regional external load balancer closer to the majority of users to shorten the network path.

Question 22

Your team runs a microservices application on GKE with structured JSON logs flowing into Cloud Logging. During a partial outage, on-call engineers need to correlate error logs from the payment service with slow upstream requests across a 6-hour window, aggregating by HTTP status code and computing p95 latency per service. Ad-hoc filtering in the Logs Explorer is too slow and cannot perform these aggregations. What is the most appropriate approach to enable this analysis with minimal additional infrastructure?

Accepted Answer

Enable Log Analytics on the log bucket and use SQL queries in the Log Analytics interface to aggregate and join log fields.

Answer

Create a log-based metric for each service and status code, then build a Cloud Monitoring dashboard to visualize the aggregations.

Answer

Export all logs to Cloud Storage via a log sink and run BigQuery external table queries against the JSON files.

Answer

Increase the Logs Explorer query time range and add more label filters to narrow the results manually.

Question 23

A user-facing API running on GKE intermittently returns HTTP 500 errors. Your team has structured JSON logs in Cloud Logging that include a 'trace' field populated with the X-Cloud-Trace-Context ID, and distributed tracing is enabled with Cloud Trace. During an incident, you find a specific log entry showing a 500 error and want to immediately see the full end-to-end request path—including the downstream service calls and their latencies—that produced this error. What is the most efficient way to accomplish this?

Accepted Answer

In the Logs Explorer, click the log entry and use the trace correlation link, which opens the associated trace in Cloud Trace showing the full span breakdown of the request.

Answer

Create a log-based counter metric filtered on HTTP 500 responses and view its rate over time in a Cloud Monitoring dashboard.

Answer

Export the logs to BigQuery and run a query joining on the timestamp field to approximate which downstream calls occurred at the same moment.

Answer

Enable Cloud Profiler on the service to capture the CPU flame graph for the time window in which the error occurred.

Question 24

Your compliance team requires that all audit logs from a production project be retained for 400 days and be queryable with SQL for ad-hoc investigations, while keeping operational costs low. Application debug logs should only be kept for 14 days. You want to configure Cloud Logging with the least operational overhead. What should you do?

Accepted Answer

Create a dedicated log bucket for audit logs with a 400-day retention period and enable Log Analytics (with a linked BigQuery dataset), then route audit logs to it; keep debug logs in the _Default bucket with retention lowered to 14 days.

Answer

Export all logs via a single sink to a BigQuery dataset with a 400-day table expiration, and use a log exclusion filter to drop debug logs after 14 days.

Answer

Increase the _Default log bucket retention to 400 days for the whole project and create a scheduled Cloud Function to delete debug log entries older than 14 days.

Answer

Route audit logs to Cloud Storage with a 400-day lifecycle rule and enable Object Lifecycle Management, then query them with BigQuery external tables when needed.

Question 25

Your team runs a high-traffic web service on GKE. Cloud Logging costs have risen sharply, and analysis shows that the majority of ingested volume comes from verbose HTTP access logs with severity INFO from the ingress load balancer. Compliance requires that all WARNING and higher logs remain searchable in Cloud Logging for 30 days, and a subset of the INFO access logs must still be retained cheaply for later ad-hoc analysis. What is the most cost-effective way to meet these requirements?

Accepted Answer

Create an exclusion filter on the _Default log bucket sink that drops the INFO access logs, and add a separate sink that exports those same INFO logs to a Cloud Storage bucket.

Answer

Reduce the retention period of the _Default log bucket to 7 days so all logs, including WARNING and higher, are purged sooner.

Answer

Disable the Cloud Logging agent on the GKE nodes so INFO access logs are never generated.

Answer

Create a log-based metric that counts the INFO access logs and delete the raw log entries once the metric is recorded.

Question 26

A payment service running on GKE writes structured JSON logs to Cloud Logging. During a partial outage, the on-call engineer needs to quickly find all ERROR-severity entries that contain a specific transaction ID field (jsonPayload.txnId) across the last 30 minutes, then aggregate how many distinct pods emitted them. The engineer wants the fastest interactive way to both filter and run aggregation without exporting data elsewhere. Which approach should they use?

Accepted Answer

Use the Logs Explorer with a query on severity and jsonPayload.txnId, then switch to Log Analytics and run a SQL query grouping by resource.labels.pod_name

Answer

Create a log-based metric filtered on the txnId and view a Cloud Monitoring dashboard chart broken down by pod

Answer

Create a log sink to BigQuery and run a scheduled query to count distinct pods after the data lands

Answer

Enable Cloud Trace sampling at 100% and inspect spans grouped by transaction ID in the Trace explorer

Question 27

A microservice on GKE writes plain-text log lines to stdout like 'ERROR user 4521 checkout failed timeout=3000ms'. The reliability team wants to filter these entries by severity in Logs Explorer and build a log-based metric that counts only checkout failures per user tier, but currently all entries appear with severity 'Default' and the message body is treated as a single unstructured string. What is the most effective change to enable reliable severity filtering and field-based extraction?

Accepted Answer

Emit logs as structured JSON to stdout with a 'severity' field and separate fields for event, userId, and tier, so the GKE logging agent parses them into jsonPayload and LogEntry severity.

Answer

Configure a Cloud Logging sink that routes all entries to BigQuery, then run SQL regular expressions over the text payload to reconstruct the fields at query time.

Answer

Increase the log retention period on the _Default bucket so the plain-text entries persist long enough for the team to search them manually.

Answer

Add a log exclusion filter on the _Default sink to drop non-error lines, reducing volume so the remaining text entries are easier to scan.

Question 28

Your team runs a fleet of Compute Engine VMs hosting a legacy Java application. In Cloud Monitoring dashboards you can see CPU utilization and network traffic for each VM, but memory utilization and disk usage metrics are missing, and you cannot build a memory-pressure alert. The VMs use a standard public Debian image. What is the most likely cause and the correct fix?

Accepted Answer

The default Compute Engine metrics only include hypervisor-visible signals; install and configure the Ops Agent on the VMs to collect guest-level memory and disk metrics.

Answer

The Cloud Monitoring metrics scope is misconfigured; add the project to a new metrics scope so guest memory metrics appear automatically.

Answer

Memory metrics require a log-based metric; create a log-based metric that parses /proc/meminfo entries from the VM serial console.

Answer

The VM service account lacks the roles/monitoring.viewer role; grant it so the built-in memory agent can publish guest metrics.

Question 29

A payments microservice runs on GKE and normally serves requests with p99 latency under 300ms. During brief, self-healing garbage-collection pauses, p99 latency spikes above 500ms for 20-40 seconds several times per hour. You created a Cloud Monitoring alerting policy on p99 latency with a threshold of 500ms, but the on-call team is being paged constantly for these transient spikes that recover on their own. You must reduce noisy pages without missing sustained latency degradation that actually harms users. What is the best change to the alerting policy?

Accepted Answer

Increase the condition's retest/duration window so the metric must stay above 500ms for at least 5 minutes before the condition triggers.

Answer

Raise the threshold from 500ms to 2000ms so only extreme spikes page the team.

Answer

Add a metric-absence condition to the policy so it only fires when data stops arriving.

Answer

Change the aggregation alignment period to 1 second to capture the spikes more precisely.

Question 30

Your team runs a fleet of 40 Compute Engine instances behind a managed instance group serving a REST API. You create a Cloud Monitoring alerting policy on the metric compute.googleapis.com/instance/cpu/utilization to page on-call when CPU is sustained above 85%. During a real incident where several individual instances spiked to 95% while the group average stayed near 60%, the alert never fired. You inspected the policy and found it aligns the series and then applies a cross-series reducer of 'mean' before evaluating the threshold. What change will make the alert correctly detect per-instance saturation?

Accepted Answer

Remove the cross-series reducer (or set it to 'none') and group the time series by instance so the threshold is evaluated per instance rather than against a single aggregated series.

Answer

Increase the alignment period from 60s to 300s so the aligner smooths out brief per-instance spikes before evaluation.

Answer

Change the cross-series reducer from 'mean' to 'sum' so the combined utilization of all instances exceeds the 85% threshold.

Answer

Lower the threshold from 85% to 55% so the group average of 60% during the incident would trigger the alert.

Question 31

A batch data-ingestion service writes a custom metric 'pipeline/records_processed' every 5 minutes when a cron-triggered job runs successfully. Recently the cron scheduler silently stopped firing, so the job never ran and no data points were written at all. Your existing threshold-based alert (fires when records_processed < 100) never triggered because the metric simply stopped reporting. You need an alerting policy that notifies the on-call engineer when the job stops producing the metric entirely. What should you configure?

Accepted Answer

Create a metric-absence condition on 'pipeline/records_processed' with a trigger duration slightly longer than the job's normal 5-minute interval.

Answer

Lower the threshold condition to 'records_processed < 1' so that any missing data is caught by the comparison.

Answer

Add a metric-threshold condition using the 'delta' aligner and set the alignment period to 24 hours to smooth out gaps.

Answer

Configure an uptime check against the batch service and alert when the check fails.

Question 32

A payments service on GKE occasionally leaks file descriptors, and the on-call team currently receives a Cloud Monitoring alert and manually runs a script to restart the affected Deployment. Your team wants to automatically trigger that remediation script (running as a Cloud Function) the moment the alert condition fires, while still keeping a human notified. The alerting policy already has an appropriate condition. What is the most appropriate way to wire the alert to the automated remediation?

Accepted Answer

Add a Pub/Sub notification channel to the alerting policy and configure the remediation Cloud Function with a Pub/Sub trigger on that topic, plus an email channel for the on-call team.

Answer

Configure the alerting policy to use only a Slack notification channel and have an operator manually invoke the Cloud Function from the Slack message.

Answer

Create a log-based metric on the alert and schedule the Cloud Function with Cloud Scheduler to poll that metric every minute.

Answer

Point the alerting policy's email notification channel at the Cloud Function's HTTP trigger URL so the email invokes the function.

Question 33

A payments API team has an alerting policy in Cloud Monitoring that fires when the 5-minute p95 latency exceeds 800 ms. During a period of intermittent load, the underlying condition crosses the threshold repeatedly for short spikes, generating a storm of open-and-close incident notifications that overwhelm the on-call engineer. The team wants to keep the latency threshold but suppress noise from brief, transient spikes without missing a genuinely sustained latency regression. What should they configure?

Accepted Answer

Increase the condition's 'retest window' (duration) so the metric must stay above 800 ms for a longer sustained period before the condition triggers.

Answer

Lower the latency threshold to 500 ms so the condition triggers earlier and stays consistently in the alerting state.

Answer

Disable the notification channel during business hours and rely on dashboard inspection instead.

Answer

Change the aggregation aligner from p95 to max so brief spikes are captured more accurately.

Question 34

A team runs a stateless HTTP API on Cloud Run (fully managed). The service is CPU-light but spends most request time waiting on an external payment provider. During traffic spikes, the service scales to hundreds of instances, driving up cost, even though CPU utilization per instance stays below 15%. Latency is acceptable. Which change best reduces cost while maintaining performance?

Accepted Answer

Increase the maximum number of concurrent requests per instance (container concurrency) so each instance handles more simultaneous requests.

Answer

Increase the CPU and memory allocation per instance to speed up request processing.

Answer

Lower the maximum instance limit to cap the number of instances that can be created.

Answer

Enable CPU always-allocated (CPU is always on) instead of CPU allocated only during request processing.

Question 35

Your platform team must bootstrap a new Google Cloud organization and standardize how infrastructure resources (projects, GKE clusters, networking) are provisioned declaratively using Kubernetes-style config. Leadership requires a Google-managed solution that runs Config Sync and Policy Controller out of the box, uses Config Connector to reconcile Google Cloud resources via KRM manifests stored in Git, and requires minimal operational maintenance of the underlying control plane. Which approach best meets these requirements?

Accepted Answer

Provision a Config Controller instance in Anthos Config Management, then store KRM manifests in a Git repo that Config Sync applies to reconcile Google Cloud resources.

Answer

Deploy a self-managed GKE cluster, manually install Config Connector, Config Sync, and Policy Controller, and maintain the control plane yourself.

Answer

Use Terraform Cloud with a remote backend to store state and apply all Google Cloud resource changes without any Kubernetes tooling.

Answer

Enable Deployment Manager templates and trigger them from Cloud Build to reconcile resources declaratively.

Question 36

Your organization runs a legacy on-premises batch application that cannot use Workload Identity Federation. It authenticates to Google Cloud APIs using a downloaded service account key. Security has flagged that the key has not been rotated in over a year, and they require a repeatable, automated process that minimizes the window during which any single key is valid while avoiding application downtime. Which approach should you implement?

Accepted Answer

Build an automated pipeline that creates a new service account key, distributes it to the application, verifies successful authentication, and then deletes the previous key on a scheduled cadence.

Answer

Enable an organization policy constraint to disable service account key creation, forcing the application to migrate to Workload Identity Federation immediately.

Answer

Grant the on-premises application's service account the Owner role so the key never needs rotation, and enable audit logging to detect misuse.

Answer

Store the single long-lived key in Secret Manager and rely on Secret Manager versioning, keeping the same underlying service account key indefinitely.

Question 37

Your team owns a payment-processing API with an SLO of 99.9% availability measured over a 28-day rolling window. Over the last three months, the service has consistently exceeded its target, finishing each window at 99.98% and never consuming more than 15% of its allocated error budget. Product management is pushing hard to accelerate feature delivery, while the SRE team has been spending significant effort maintaining an elaborate multi-region failover system built to protect reliability. Following SRE principles, what is the most appropriate recommendation?

Accepted Answer

Increase release velocity and reduce reliability engineering investment, since the large unused error budget signals capacity to take on more change risk.

Answer

Tighten the SLO to 99.99% so the consistently strong performance is formally reflected in the target.

Answer

Keep the current pace and investment unchanged, because payment services should always maximize reliability regardless of the error budget.

Answer

Lower the SLO to 99.5% to free up more error budget for aggressive feature launches.

Question 38

Your team runs a payments API with a 99.9% availability SLO measured over a rolling 30-day window. The on-call engineers complain that their current alert—which pages whenever the instantaneous error rate exceeds 0.1%—generates frequent noisy pages for brief, self-recovering blips, yet occasionally fails to warn them about slow, sustained degradations that quietly consume the monthly error budget. You are asked to redesign the alerting to page only when the budget is genuinely at risk. Which approach best meets this goal?

Accepted Answer

Configure multi-window, multi-burn-rate alerts that page on a fast-burn condition (e.g., 14.4x burn over 1 hour combined with a 5-minute short window) and a separate slow-burn condition (e.g., 6x burn over 6 hours).

Answer

Lower the SLO to 99.5% so the error budget is larger and the existing threshold alert fires less often.

Answer

Keep the instantaneous 0.1% error-rate threshold but require the condition to persist for 30 seconds before paging.

Answer

Alert only at the end of the 30-day window when the total error budget has been fully exhausted.

Question 39

Your team runs a payments API with a 99.9% availability SLO measured over a rolling 28-day window. Halfway through the current window, a single 45-minute outage has already consumed roughly 90% of the error budget for the period. The product team wants to ship a large feature release this week that touches the payment authorization path, while the on-call engineer has flagged three recurring alerts that require manual intervention each week. As the SRE lead, how should you prioritize the team's work for the remainder of the window?

Accepted Answer

Pause risky feature releases affecting the authorization path and direct engineering effort toward reliability work and reducing the recurring manual-intervention toil until the budget recovers.

Answer

Proceed with the feature release on schedule, since SLO windows reset and the remaining 10% budget is still available for use.

Answer

Immediately tighten the SLO to 99.99% so the outage appears smaller relative to a larger overall budget and the release can continue.

Answer

Ignore the error budget signal and let the product team decide release timing, since error budgets are only advisory metrics.

Question 40

Your team owns a payments API with a quarterly SLO of 99.9% availability. Six weeks into the quarter, a series of unrelated outages has consumed 95% of the error budget. Product management is pushing to ship three new revenue features in the remaining time, but the SRE team is concerned about further reliability degradation. According to SRE principles, what is the most appropriate way to resolve this tension?

Accepted Answer

Follow the pre-agreed error budget policy, which should specify that once the budget is nearly exhausted, feature releases are deprioritized in favor of reliability work until the budget recovers.

Answer

Loosen the SLO target to 99.5% for the current quarter so the remaining error budget is large enough to accommodate the planned feature launches.

Answer

Let product management override the SRE concern since revenue features take precedence, and re-evaluate reliability next quarter.

Answer

Immediately declare a permanent feature freeze on the service and reassign the entire team to on-call rotation.

Question 41

Your payments service has an SLO of 99.9% availability measured over a 30-day rolling window. Two weeks into the current window, a series of latency-related outages has already consumed 95% of the monthly error budget. The product team wants to ship three new features this week, while the SRE team argues the service is too fragile. Your organization follows a documented error budget policy that both teams agreed to in advance. According to standard SRE practice, what should happen next?

Accepted Answer

Freeze non-critical feature releases and redirect engineering effort toward reliability improvements until the budget recovers, as prescribed by the agreed error budget policy.

Answer

Immediately lower the SLO target to 99.5% so the remaining error budget increases, allowing all three features to ship on schedule.

Answer

Allow the feature launches to proceed since the SLO window has not yet ended and the budget is not fully exhausted.

Answer

Escalate to executive leadership to decide each release individually, since the error budget policy does not apply during active incidents.

Question 42

Your team runs a payments API with a monthly availability SLO of 99.9%, calculated over a 30-day rolling window. Two weeks into the current window, an unplanned outage has already consumed 80% of the month's error budget. The product team wants to ship a large batch of risky new features immediately to hit a marketing deadline. As the SRE lead, and following Google SRE principles for balancing velocity and reliability, what is the most appropriate recommendation?

Accepted Answer

Slow the release cadence and prioritize reliability work, deferring or reducing the scope of risky changes until the error budget recovers, per the pre-agreed error budget policy.

Answer

Proceed with the full feature release as planned, since the SLO has not yet been formally breached and the budget is not fully exhausted.

Answer

Permanently raise the SLO target to 99.99% so that future outages consume a smaller percentage of the error budget.

Answer

Ignore the error budget for this window and rely on post-incident reviews after the deadline to decide whether reliability work is needed.

Question 43

A payments service reports 99.95% availability against its SLO, and the error budget shows healthy headroom for the quarter. However, the support team is fielding a steady stream of user complaints about failed checkout attempts, and executives are frustrated that the SLI dashboards look green while customers are clearly unhappy. As the SRE reviewing this discrepancy, what is the most appropriate first action?

Accepted Answer

Investigate whether the current SLI is measuring the right 'good events' from the user's perspective, since the metric may exclude the failure mode users are experiencing.

Answer

Tighten the SLO target to 99.99% so the dashboards will more accurately reflect customer dissatisfaction.

Answer

Declare a feature freeze immediately because the volume of complaints indicates the error budget must be exhausted.

Answer

Increase the alerting sensitivity on the existing SLI so on-call engineers are paged more often during the quarter.

Question 44

Your organization is bootstrapping its Google Cloud environment. The security operations team must automatically receive Google's security-related notifications (such as vulnerability alerts and platform security bulletins) for every project in the organization, while a separate finance team should receive billing notifications. Leadership wants this routing to apply to all current and future projects without manually configuring each project. What is the most effective way to configure this?

Accepted Answer

Set Essential Contacts at the organization node, assigning the security team's email to the 'Security' notification category and the finance team's email to the 'Billing' category, so contacts are inherited by all folders and projects.

Answer

Add both teams as IAM members with the Viewer role at the organization level so they can view all notifications in the Cloud Console.

Answer

Create a Cloud Monitoring notification channel for each team and add alerting policies in every project to forward security and billing events.

Answer

Configure Essential Contacts individually on each project, subscribing the appropriate team to each notification category, and repeat the setup whenever a new project is created.

Question 45

Your organization is bootstrapping its Google Cloud resource hierarchy. Leadership requires that all production workloads for the finance department enforce a policy denying the creation of external IP addresses, while a separate sandbox environment used by developers must allow external IPs for experimentation. You want to design the folder structure and apply organization policies with the least administrative overhead and no risk of the sandbox setting affecting production. How should you structure the hierarchy and apply the constraint?

Accepted Answer

Create a 'finance-prod' folder and a 'sandbox' folder under the organization node; apply the constraints/compute.vmExternalIpAccess deny policy at the 'finance-prod' folder and leave the 'sandbox' folder to inherit the org default.

Answer

Apply the constraints/compute.vmExternalIpAccess deny policy at the organization node, then set an override policy allowing external IPs on every individual project in the sandbox environment.

Answer

Create a single shared folder for both environments and apply the deny policy at the project level only for finance production projects, leaving sandbox projects without any policy.

Answer

Apply the deny policy at the organization node and use IAM Conditions on the sandbox service accounts to grant an exception for creating external IPs.

Question 46

Your organization runs a mix of GKE clusters in Google Cloud and self-managed Kubernetes clusters in an on-premises data center. The platform team wants centralized, secure access to all clusters through a single control point so that developers can run kubectl commands against any cluster without opening inbound firewall ports to the on-premises environment or distributing static kubeconfig credentials. Which approach best meets these requirements?

Accepted Answer

Register all clusters to a fleet and use the Connect gateway with Google Cloud IAM to authenticate and route kubectl traffic outbound from each cluster.

Answer

Expose each on-premises cluster's API server through a public load balancer secured with a firewall allowlist of developer IP ranges.

Answer

Generate long-lived kubeconfig files with cluster admin certificates and distribute them to developers through a shared secret manager.

Answer

Set up a site-to-site VPN and give every developer direct network access to each on-premises cluster's private API endpoint.

Question 47

Your platform team is bootstrapping a new Google Cloud environment for several application teams. Each team will receive its own GKE Autopilot cluster, and the platform team must ensure that every new cluster is automatically enrolled with a baseline set of tooling (namespaces, RBAC roles, resource quotas, and network policies) that stays consistent across all clusters over time. Manual kubectl steps must be eliminated, and the baseline must be enforced continuously so that any drift on a cluster is reverted. Which approach best meets these requirements?

Accepted Answer

Register all clusters into a GKE fleet and use Config Sync (part of Config Management) to continuously reconcile the baseline manifests stored in a Git repository across every fleet member.

Answer

Create a shell script that runs kubectl apply for the baseline manifests and schedule it as a Cloud Scheduler job that targets each cluster's endpoint.

Answer

Add the baseline resources as a Helm chart and have each application team run helm install manually after their cluster is created.

Answer

Store the baseline manifests in Cloud Storage and configure a startup script on each node pool to download and apply them at node boot.

Question 48

Your team launched a new internal API six weeks ago with an availability SLO of 99.0% while it stabilized. Since then, the service has consistently delivered 99.7% availability, error budget burn has been minimal, and downstream teams have begun building critical workflows on top of it. Leadership asks how you should adjust reliability targets as the service matures. What is the most appropriate SRE-aligned action?

Accepted Answer

Review consumer dependencies and observed performance, then incrementally tighten the SLO (e.g., to 99.5%) to a level that reflects actual user needs and is sustainably achievable.

Answer

Raise the SLO to 99.99% immediately to match the highest reliability the service has ever briefly achieved, ensuring maximum headroom for downstream consumers.

Answer

Keep the SLO at 99.0% permanently, since the service is already exceeding it and there is no reason to change a target that is being met.

Answer

Remove the SLO entirely now that the service is stable, and rely on the observed 99.7% availability as an informal benchmark.

Question 49

Your organization runs an on-premises data center and a Google Cloud environment. The platform team must bootstrap a CI/CD architecture where Cloud Build pipelines deploy artifacts to both GKE clusters on Google Cloud and Kubernetes clusters running in the on-premises data center. The on-premises clusters are not reachable over the public internet, and security policy forbids exposing them with public endpoints. Which approach lets the same Cloud Build pipeline reliably deploy to both environments?

Accepted Answer

Use Cloud Build private pools connected to your VPC, and reach the on-premises clusters over an existing Cloud VPN or Cloud Interconnect through that VPC.

Answer

Grant the Cloud Build default service account the Owner role and let the default worker pool call the on-premises cluster API over the public internet.

Answer

Deploy to GKE from Cloud Build, then manually copy the manifests to a USB drive and apply them on-premises to satisfy the no-public-endpoint policy.

Answer

Expose the on-premises Kubernetes API server through a public load balancer protected only by an IP allowlist of Google's published egress ranges.

Question 50

Your platform team manages infrastructure across Google Cloud and AWS using a single Terraform codebase. You want to bootstrap the tooling so that GCP and AWS resources can be provisioned and destroyed independently, while sharing common module definitions and enabling parallel CI/CD runs without one cloud's failures blocking the other. What is the recommended approach to structure the Terraform configuration?

Accepted Answer

Create separate root configurations (each with its own backend/state) per cloud, referencing shared reusable modules from a versioned module source.

Answer

Place both providers in a single root module with one shared state file, and use provider aliases to distinguish GCP and AWS resources.

Answer

Use a single root configuration but rely on the -target flag in CI to apply only GCP or AWS resources on each run.

Answer

Store all resources in one workspace and use conditional count expressions to toggle which cloud's resources are created per apply.

Professional Cloud DevOps Engineer (PCDE) full-length practice exam

How this timed PCDE mock exam works

What your PCDE results show

How to get the most out of it

Ready for the full PCDE mock exam?