Google Professional-Cloud-DevOps-Engineer - Google Cloud Certified - Professional Cloud DevOps Engineer Exam

Google Professional-Cloud-DevOps-Engineer Premium Access Download Demo

Page: 1 / 6
Total 194 questions

You recently deployed your application in Google Kubernetes Engine (GKE) and now need to release a new version of the application You need the ability to instantly roll back to the previous version of the application in case there are issues with the new version Which deployment model should you use?

Perform a rolling deployment and test your new application after the deployment is complete

Perform A. B testing, and test your application periodically after the deployment is complete

Perform a canary deployment, and test your new application periodically after the new version is deployed

Perform a blue/green deployment and test your new application after the deployment is complete

Question # 2

You use Spinnaker to deploy your application and have created a canary deployment stage in the pipeline. Your application has an in-memory cache that loads objects at start time. You want to automate the comparison of the canary version against the production version. How should you configure the canary analysis?

Compare the canary with a new deployment of the current production version.

Compare the canary with a new deployment of the previous production version.

Compare the canary with the existing deployment of the current production version.

Compare the canary with the average performance of a sliding window of previous production versions.

Question # 3

You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields. You want to prevent these fields from being written in new log entries as quickly as possible. What should you do?

Use the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in flight.

Use the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log entries in flight.

Wait for the application developers to patch the application, and then verify that the log entries are no longer exposing PII.

Stage log entries to Cloud Storage, and then trigger a Cloud Function to remove the fields and write the entries to Stackdriver via the Stackdriver Logging API.

Question # 4

You use Cloud Build to build and deploy your application. You want to securely incorporate database credentials and other application secrets into the build pipeline. You also want to minimize the development effort. What should you do?

Create a Cloud Storage bucket and use the built-in encryption at rest. Store the secrets in the bucket and grant Cloud Build access to the bucket.

Encrypt the secrets and store them in the application repository. Store a decryption key in a separate repository and grant Cloud Build access to the repository.

Use client-side encryption to encrypt the secrets and store them in a Cloud Storage bucket. Store a decryption key in the bucket and grant Cloud Build access to the bucket.

Use Cloud Key Management Service (Cloud KMS) to encrypt the secrets and include them in your Cloud Build deployment configuration. Grant Cloud Build access to the KeyRing.

Question # 5

Your application images are built using Cloud Build and pushed to Google Container Registry (GCR). You want to be able to specify a particular version of your application for deployment based on the release version tagged in source control. What should you do when you push the image?

Reference the image digest in the source control tag.

Supply the source control tag as a parameter within the image name.

Use Cloud Build to include the release version tag in the application image.

Use GCR digest versioning to match the image to the tag in source control.

Question # 6

You recently configured an App Hub application. You are able to see the managed instance group, backend service, and URL map listed in App Hub, but you do not see the forwarding rule. You must ensure that the forwarding rule is listed. What should you do?

Attach the project containing the forwarding rule as an App Hub service project.

Enable the App Hub API in the project containing the forwarding rule.

Configure the forwarding rule to forward to the correct target proxy.

Explanation:

Comprehensive and Detailed Explanation From General Google Cloud Knowledge:

App Hub allows you to organize and discover services and applications within your Google Cloud environment. For App Hub to recognize and display resources as components of an "application," these resources often need to be explicitly registered or discovered as "services" within that application's configuration. While App Hub can automatically discover some resources (like GKE workloads, Cloud Run services), for other resources, or to establish specific relationships, manual registration or more detailed configuration is sometimes required.

Option A (Attach the project containing the forwarding rule as an App Hub service project): While App Hub works across projects (host project for the application, service projects for services and workloads), simply attaching the project might not be sufficient for App Hub to automatically pick up and categorize every resource like a forwarding rule specifically for a defined application without further context. The forwarding rule needs to be associated with a service within the App Hub application.

Option B (Enable the App Hub API in the project containing the forwarding rule): The App Hub API needs to be enabled in projects where you want to manage App Hub resources (applications, services, workloads). If it wasn't enabled, you likely wouldn't be able to see any resources from that project. Since other resources are visible, this is less likely the root cause for a single missing resource, though it's a prerequisite for App Hub to function at all with that project.

Option C (Configure the forwarding rule to forward to the correct target proxy): While correct configuration of the forwarding rule is essential for its operational functionality, App Hub's ability to list the forwarding rule is more about its discovery and registration within App Hub's model rather than its traffic-directing correctness. An incorrectly configured forwarding rule that is properly registered might still appear in App Hub, perhaps with an error status.

Option D (Register the forwarding rule as a service in the application configuration): App Hub applications are composed of "services," and these services are in turn composed of "workloads" or other discovered/registered resources. A forwarding rule is typically an entry point or part of the infrastructure for a service. Explicitly registering it or the resource it points to (which then allows App Hub to trace back to the forwarding rule) as a service or part of a service within the application configuration would make it visible and properly cataloged by App Hub. App Hub discovers resources by looking for specific labels or by manual registration. If it's not automatically discovered as part of a recognized workload (like a GCE instance group service exposed via a load balancer), explicit registration is often the way to make it appear.

Reference (Based on general App Hub functionality):

App Hub discovers resources that are part of registered applications and their services. Services in App Hub can be based on various Google Cloud resources. If a resource like a forwarding rule isn't automatically linked to a displayed workload, it might need to be explicitly defined as a service or part of a service.

From the Google Cloud documentation on App Hub concepts:

"Applications are the core organizational unit in App Hub. An application represents a logical system that delivers business value... Services represent the logical components of an application... Workloads are instances of your services running on Google Cloud infrastructure. App Hub automatically discovers workloads for supported resource types or you can manually register them."

Forwarding rules are associated with load balancing, which exposes services. If the service that the forwarding rule points to is correctly registered and identified by App Hub, associated infrastructure like the forwarding rule should typically be discoverable. If it's not, ensuring the service it fronts is correctly registered and that App Hub understands this link is key. Option D aligns with this concept of ensuring the relevant component (which the forwarding rule is part of) is registered within the application structure.

You can find more information in the official Google Cloud documentation regarding App Hub:

App Hub overview: https://cloud.google.com/app-hub/docs/overview

Registering services and workloads: Documentation would detail how different resources are discovered or need to be registered.

Question # 7

You support a stateless web-based API that is deployed on a single Compute Engine instance in the europe-west2-a zone . The Service Level Indicator (SLI) for service availability is below the specified Service Level Objective (SLO). A postmortem has revealed that requests to the API regularly time out. The time outs are due to the API having a high number of requests and running out memory. You want to improve service availability. What should you do?

Change the specified SLO to match the measured SLI.

Move the service to higher-specification compute instances with more memory.

Set up additional service instances in other zones and load balance the traffic between all instances.

Set up additional service instances in other zones and use them as a failover in case the primary instance is unavailable.

Question # 8

Your team has recently deployed an NGINX-based application into Google Kubernetes Engine (GKE) and has exposed it to the public via an HTTP Google Cloud Load Balancer (GCLB) ingress. You want to scale the deployment of the application's frontend using an appropriate Service Level Indicator (SLI). What should you do?

Configure the horizontal pod autoscaler to use the average response time from the Liveness and Readiness probes.

Configure the vertical pod autoscaler in GKE and enable the cluster autoscaler to scale the cluster as pods expand.

Install the Stackdriver custom metrics adapter and configure a horizontal pod autoscaler to use the number of requests provided by the GCLB.

Expose the NGINX stats endpoint and configure the horizontal pod autoscaler to use the request metrics exposed by the NGINX deployment.

Question # 9

As part of your company's initiative to shift left on security, the infoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the deployment of trusted and approved images You need to determine how to satisfy the InfoSec teams goal of shifting left on security. What should you do?

Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods

Configure Identity and Access Management (1AM) policies to create a least privilege model on your GKE clusters

Use Binary Authorization to attest images during your CI CD pipeline

Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images

Question # 10

Your application services run in Google Kubernetes Engine (GKE). You want to make sure that only images from your centrally-managed Google Container Registry (GCR) image registry in the altostrat-images project can be deployed to the cluster while minimizing development time. What should you do?

Create a custom builder for Cloud Build that will only push images to gcr.io/altostrat-images.

Use a Binary Authorization policy that includes the whitelist name pattern gcr.io/attostrat-images/.

Add logic to the deployment pipeline to check that all manifests contain only images from gcr.io/altostrat-images.

Add a tag to each image in gcr.io/altostrat-images and check that this tag is present when the image is deployed.

Summer Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: ecus65

Google Professional-Cloud-DevOps-Engineer - Google Cloud Certified - Professional Cloud DevOps Engineer Exam

The Answer Is:

Explanation:

The Answer Is:

Explanation:

The Answer Is:

The Answer Is:

Explanation:

The Answer Is:

Explanation:

The Answer Is:

Explanation:

The Answer Is:

The Answer Is:

Explanation:

The Answer Is:

Explanation:

The Answer Is: