Google Practice Questions, Discussions & Exam Topics by our Authors
You are developing an application using different microservices that must remain internal to the cluster. You want the ability to configure each microservice with a specific number of replicas. You also want the ability to address a specific microservice from any other microservice in a uniform way, regardless of ...To design an effective solution for your application with internal microservices in Google Kubernetes Engine (GKE) that need the ability to scale and be addressed uniformly, let's analyze the options based on scalability, ease of management, and the requirement for uniform addressing, regardless of the number of replicas. Option A: Deploy each microservice as a Deployment. Expose the Deployment in the cluster using a Service, and use the Service DNS name to address it from other microservices within the cluster. - Explanation: In Kubernetes, a Deployment is used to manage the desired state of a set of Pods, including scaling. A Service is a stable endpoint (with a DNS name) that abstracts access to a group of Pods, ensuring that even if the number of replicas changes, the Service provides a uniform address to access the microservice. The Service also load-balances traffic to the Pods, ensuring high availability. - Why Selected: This is the most appropriate solution for scaling microservices in a Kubernetes cluster. A Service provides a consistent DNS name for accessing a microservice, regardless of the number of replicas. This meets the requirement for uniform addressing and scalability. Kubernetes automatically handles the distribution of traffic to Pods, and you can scale the Deployment to adjust the number of replicas as needed. This is also the recommended approach in Kubernetes for exposing internal services. Option B: Deploy each microservice as a Deployment. Expose the Deployment in the cluster using an Ingress, and use the Ingress IP address to address the Deployment from other microservices within the cluster. - Explanation: An Ingress is typically used to manage external HTTP/HTTPS traffic to services in the cluster, not for internal communication between microservices. Using an Ingress for internal communication adds unnecessary complexity, especially if the communication doesn't require external access or load balancing via HTTP/HTTPS. - Why Rejected: Ingress is designed for external access to services, not internal microservice-to-microservice communication. It’s not ideal for the scenario where you need uniform internal addressing and scaling, and it introduces unnecessary overhead for purely internal communi... Author: Evelyn · Last updated Jul 4, 2026 |
You are building an application that uses a distributed microservices architecture. You want to measure the performance and system resource utilization...To measure the performance and system resource utilization of a microservice written in Java, it's important to select the appropriate tool based on the specific needs: performance tracking, resource utilization monitoring, and latency measurement. Let's evaluate the options in detail: Option A: Instrument the service with Cloud Profiler to measure CPU utilization and method-level execution times in the service. - Explanation: Cloud Profiler is specifically designed to measure performance in production applications by profiling the application’s resource usage, such as CPU utilization and memory usage. It can also provide method-level execution times, helping you to identify bottlenecks and optimize code performance. - Why Selected: This option is highly relevant for tracking system resource utilization (like CPU usage) and measuring detailed performance metrics at the method level. It is the most appropriate tool for performance profiling and resource utilization in a production Java application, providing insights into where improvements can be made. Option B: Instrument the service with Debugger to investigate service errors. - Explanation: The Cloud Debugger is mainly used to inspect application state and investigate errors or issues during development or testing. It allows you to set breakpoints and examine variables, but it is not focused on measuring system performance or resource utilization in a production environment. - Why Rejected: While the Debugger is useful for troubleshooting and investigating errors, it is not designed for performance measurement or resource usage. It is more appropriate for debugging code during development rather than for ongoing monitoring of performance or resource utilization in a production environment. Option C: Instrument the service with Cloud Trace to measure request lat... Author: John · Last updated Jul 4, 2026 |
Your team is responsible for maintaining an application that aggregates news articles from many different sources. Your monitoring dashboard contains publicly accessible real-time reports and runs on a Compute Engine instance as a web application. External stakeholders and analyst...To determine the best option for securely exposing the monitoring dashboard without requiring authentication, let's evaluate each option based on the given requirements: providing secure access to real-time reports, ensuring that the channel is secure without authentication, and considering key factors like encryption and scalability. Option A: Add a public IP address to the instance. Use the service account key of the instance to encrypt the traffic. - Explanation: This approach is not ideal because exposing a public IP directly to the instance increases the attack surface. While using the service account key for encryption may provide some level of protection, it doesn't inherently secure the connection against interception or unauthorized access. Moreover, this approach lacks the scalability and flexibility of managed solutions. - Rejection Reason: The public IP exposure poses a security risk. The method doesn't provide an optimal solution for secure communication, especially since there’s no clear mechanism for handling encryption at scale. Option B: Use Cloud Scheduler to trigger Cloud Build every hour to create an export from the reports. Store the reports in a public Cloud Storage bucket. - Explanation: This option introduces a process where reports are exported and stored in a public Cloud Storage bucket. This would make the reports accessible, but they would be publicly available in the bucket without requiring any authentication, which might not meet security or privacy requirements. The reports also wouldn’t be updated in real-time, but rather on a scheduled basis. - Rejection Reason: The lack of real-time updates and the public nature of the storage bucket make this solution unsuitable ... Author: SolarFalcon11 · Last updated Jul 4, 2026 |
You are planning to add unit tests to your application. You need to be able to assert that published Pub/Sub messages are processed by your subscriber in order. You wa...Let's evaluate the options based on the key requirements of cost-effectiveness, reliability, and ensuring that Pub/Sub messages are processed in order during unit testing. Option A: Implement a mocking framework - Explanation: A mocking framework is commonly used for unit testing to simulate external dependencies and behavior. However, while a mock can simulate the behavior of Pub/Sub and the message flow, it won't necessarily ensure that the messages are processed in the correct order as they would be in a real Pub/Sub system. It might be limited in simulating real-world Pub/Sub behavior, especially in terms of message ordering and other Pub/Sub-specific characteristics like backpressure, retrying, etc. - Rejection Reason: While it provides cost savings, a mock does not replicate the full Pub/Sub environment, particularly around message ordering and asynchronous processing, which are crucial for this scenario. Option B: Create a topic and subscription for each tester - Explanation: Creating a separate topic and subscription for each tester could ensure isolation between tests, but this approach could become cumbersome and costly if you have many tests or testers. Each new topic and subscription incurs additional setup overhead and could increase your testing cost significantly. Additionally, managing a large number of topics and subscriptions could become difficult to maintain and would not guarantee that the messages are processed in the correct order within a real-world scenario. - Rejection Reason: While it isolates tests, this approach is not scalable and might lead to high cost and maintenance complexity, which goes against the objective of keeping the tests cost-effective and manageable. Option C: Add a filter by tester to the subscription - Explanation: Add... Author: FrozenWolf2022 · Last updated Jul 4, 2026 |
You have an application deployed in Google Kubernetes Engine (GKE) that reads and processes Pub/Sub messages. Each Pod handles a fixed number of messages per minute. The rate at which messages are published to the Pub/Sub topic varies considerably throughout the day and week, including occasional large batches of messages published at a single moment. You...To determine the best GKE feature for automatically adapting your workload, let’s evaluate each option based on your requirements: scaling the application to handle varying rates of messages published to Pub/Sub, including occasional large batches, and ensuring timely message processing. Option A: Vertical Pod Autoscaler in Auto mode - Explanation: The Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory requests and limits of a Pod based on usage. In Auto mode, the VPA increases or decreases resources for a Pod according to observed usage. However, this option is not ideal for handling message rate fluctuations because the VPA doesn't scale the number of Pods; it only adjusts the resources (CPU, memory) for each individual Pod. - Rejection Reason: While the VPA ensures that a Pod has sufficient resources, it does not address the need to scale the number of Pods to handle varying rates of message processing. In scenarios where high message rates require scaling out, this option wouldn't provide the necessary elasticity. Option B: Vertical Pod Autoscaler in Recommendation mode - Explanation: In Recommendation mode, the VPA only provides recommendations for adjusting resource requests and limits for Pods, but it does not automatically apply those recommendations. Like Auto mode, this only affects the resource allocation of individual Pods and does not scale the number of Pods. - Rejection Reason: Similar to Option A, this only helps with adjusting resources for individual Pods, not with scaling the number of Pods to handle fluctuating message rates, which is critical for your scenario. Option C: Horizontal Pod Autoscaler based on an external metric - Explanation: The Horizontal Pod Autoscaler (HPA) can automatically scale the number of Pods in a Deployment based on various metrics, including CPU and m... Author: Samuel · Last updated Jul 4, 2026 |
You are using Cloud Run to host a web application. You need to securely obtain the application project ID and region where the application is running and display this informatio...To determine the best approach for securely obtaining the application project ID and region on Cloud Run and displaying this information to users, let’s evaluate each option based on key factors like performance, security, and simplicity. Option A: Use HTTP requests to query the available metadata server at the `http://metadata.google.internal/` endpoint with the `Metadata-Flavor: Google` header. - Explanation: Cloud Run instances automatically have access to the metadata server at the `http://metadata.google.internal/` endpoint, which provides metadata like the project ID and region. This method is highly performant because it does not require any external API calls or dependencies. It's a built-in feature of Cloud Run and can be easily implemented by making HTTP requests to the metadata server. - Advantages: - Performance: Fast and direct access to metadata from within the Cloud Run container. - Security: Secure because the metadata server is available only within the Google Cloud environment and requires the `Metadata-Flavor: Google` header. - Simplicity: Straightforward to implement by querying the metadata server. - Selection Reason: This option is the most performant and secure approach for retrieving project ID and region from within Cloud Run. It leverages the Cloud Run environment's native capabilities and provides low-latency access to the information. Option B: In the Google Cloud console, navigate to the Project Dashboard and gather configuration details. Navigate to the Cloud Run “Variables & Secrets” tab, and add the desired environment variables in Key:Value format. - Explanation: This method involves manually configuring environment variables in the Cloud Run settings (under "Variables & Secrets"). You could set up environment variables for the project ID and region and then retrieve them from the application. - Rejection Reason: While this approach can work, it’s not as dynamic as querying the metada... Author: Nia · Last updated Jul 4, 2026 |
You need to deploy resources from your laptop to Google Cloud using Terraform. Resources in your Google Cloud environment must be created using a service account. Your Cloud Identity has the roles/iam.serviceAccountTokenCreator Identity and Access Management (IAM) role and the necessary permissions to deploy the resources using Terraform...To determine the most appropriate method for deploying resources from your laptop to Google Cloud using Terraform while following Google-recommended best practices, let’s evaluate the options. Option A: Download the service account's key file in JSON format, and store it locally on your laptop. Set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of your downloaded key file. - Explanation: This method involves downloading the service account's key file and setting the environment variable `GOOGLE_APPLICATION_CREDENTIALS` to authenticate Terraform. This is a widely used approach for authenticating with Google Cloud, but storing the key file locally on your laptop can lead to security concerns. If the key file is mishandled or compromised, it can allow unauthorized access to your Google Cloud resources. - Rejection Reason: While simple to set up, this method introduces security risks by storing sensitive credentials locally. Google recommends avoiding storing long-lived credentials like service account keys on local machines whenever possible. Option B: Run the following command from a command line: `gcloud config set auth/impersonate_service_account [email protected]`. Set the `GOOGLE_OAUTH_ACCESS_TOKEN` environment variable to the value that is returned by the `gcloud auth print-access-token` command. - Explanation: This option involves impersonating the service account using the `gcloud` CLI and obtaining an OAuth access token to authenticate Terraform. This approach is more secure than downloading a key file because it avoids storing long-lived credentials and uses short-lived access tokens instead. - Advantages: - Short-lived OAuth access tokens help reduce security risks. - It avoids the need to store a key file locally. - Rejection Reason: While this method improves security by using short-lived tokens, it requires manual steps and can be cumbersome to automate for frequent deployments. Also, the solution might be more prone to errors as it requires handling the access token manually. Option C: Run the following command from a command line: `gcloud auth application-defa... Author: Samuel · Last updated Jul 4, 2026 |
Your company uses Cloud Logging to manage large volumes of log data. You need to build a real-time log analysis architecture that pushes logs to...In order to design a real-time log analysis architecture that pushes logs to a third-party application for processing, let's evaluate each option based on the needs for real-time processing, scalability, integration with third-party applications, and ease of management. Option A: Create a Cloud Logging log export to Pub/Sub - Explanation: This is a highly scalable and efficient solution for real-time data streaming. Cloud Pub/Sub is designed to deliver messages in near real-time and can push log entries to other systems, including third-party applications, via subscriptions. - Pros: - Real-time data flow: Logs can be pushed as soon as they are generated. - Scalability: Pub/Sub can handle a large volume of log data without performance degradation. - Flexibility: Once the logs are in Pub/Sub, they can be consumed by any third-party application or service that can subscribe to the topic. - Cons: - Requires managing and configuring Pub/Sub topics and subscriptions. - Handling delivery reliability, retries, and dead-lettering might add complexity. - Best for: Real-time, large-scale, and flexible integration with third-party systems, especially when low-latency and near real-time processing are required. Option B: Create a Cloud Logging log export to BigQuery - Explanation: BigQuery is designed for analyzing large datasets, especially when batch analysis is needed, but not typically suited for real-time log processing that needs to push logs to a third-party application. - Pros: - Powerful for running SQL queries on large volumes of log data. - Can store structured logs for historical analysis. - Cons: - Not real-time: Logs in BigQuery are typically batch processed, which might introduce latency. - Not direct integration: BigQuery is not ideal for pushin... Author: Isabella · Last updated Jul 4, 2026 |
You are developing a new public-facing application that needs to retrieve specific properties in the metadata of users' objects in their respective Cloud Storage buckets. Due to privacy and data residency requirements, you must retrieve only the metadata and not the...To address the need for retrieving specific properties in the metadata of user objects in Cloud Storage, while ensuring privacy and data residency requirements are met, we must evaluate the available options based on performance, efficiency, and the ability to retrieve metadata without accessing the object data itself. Option A: Use the patch method - Explanation: The `patch` method is typically used to modify the properties of an existing object, such as updating metadata. It is not designed for retrieving metadata but rather for modifying it. - Pros: - Useful for updating metadata. - Cons: - Not for retrieval: This method is used for modifying metadata, not retrieving it. It does not help in accessing the metadata of an object. - Performance issue: Using it solely for retrieval would be inefficient, as it would involve unnecessary update actions. - Best for: Modifying metadata, not for simply retrieving metadata. Option B: Use the compose method - Explanation: The `compose` method is used to combine multiple objects into a single object, potentially allowing the merging of metadata in the process. However, it is not designed for retrieving metadata. - Pros: - Can be used to combine objects and modify their metadata. - Cons: - Not for metadata retrieval: This method is primarily for modifying or combining object content. It is not suited for simply retrieving metadata without fetching the object data. - Unnecessary complexity: It would require unnecessary manipulation of object content, which is not the goal here. - Best for: Combining objects or merging metadata, no... Author: Daniel · Last updated Jul 4, 2026 |
You are deploying a microservices application to Google Kubernetes Engine (GKE) that will broadcast livestreams. You expect unpredictable traffic patterns and large variations in the number of concurrent users. Your application must meet the following requirements: * Scales automatically during popular events and mainta...Explanation of the Options: Option A: Distribute your workload evenly using a multi-zonal node pool. - Multi-zonal node pool: This option places nodes in different zones within a region. This helps ensure high availability by mitigating the risk of failure in a single zone. However, it doesn't directly address the issue of dynamic scaling to meet unpredictable traffic patterns. - Scaling: While this ensures resilience by distributing workloads across multiple zones, it doesn't solve the problem of automatically adjusting to traffic spikes or failures in hardware. Rejected because it focuses on resilience but doesn't handle automatic scaling and traffic management effectively. Option B: Distribute your workload evenly using multiple zonal node pools. - Multiple zonal node pools: Distributing the workload across multiple zonal node pools increases availability by providing fault tolerance, similar to Option A. However, it complicates the scaling process since each zone might need its own set of scaling policies and configurations. - Scaling: This approach doesn't directly handle the dynamic scaling needed for unpredictable traffic patterns and doesn't provide as much flexibility for scaling in response to real-time traffic changes. Rejected due to its complexity and lack of automation for traffic scaling. Option C: Use cluster autoscaler to resize the number of nodes in the node pool, and use a Horizontal Pod Autoscaler to scale the workload. - Cluster autoscaler: This automatically adjusts the number of nodes in the node pool based on the resource demands. This is essential for handling unpredictable traffic by scaling the infrastructure up or down as needed. - Horizontal Pod Autoscaler (HPA): This scales the number of Pods in a deployment based on metrics like CPU and memory usage, ensuring that your application can handle fluctuations in user load. - Scaling and Resilience: This solution meets both requirements: automatic scaling of both the infrastructure (nodes) and the application (pods), which is crucial for handling varying traffic patterns while maintaining avail... Author: Ethan Smith · Last updated Jul 4, 2026 |
You work at a rapidly growing financial technology startup. You manage the payment processing application written in Go and hosted on Cloud Run in the Singapore region (asia-southeast1). The payment processing application processes data stored in a Cloud Storage bucket that is also located in the Singapore region. The startup plans to expand further into the Asia Pacific region. You plan to deploy the Payment Gateway in Jakarta, Hong Kong, and Taiwan over the next six mon...In this scenario, the primary objectives are to meet data residency requirements, minimize costs, and ensure that each region where the startup expands (Jakarta, Hong Kong, Taiwan) can handle local customer data while maintaining efficient and scalable payment processing. Let's evaluate each option: Option A: Create a Cloud Storage bucket in each region, and create a Cloud Run service of the payment processing application in each region. - Explanation: This option involves creating a separate Cloud Storage bucket in each region (Jakarta, Hong Kong, and Taiwan) to meet data residency requirements. Additionally, you would deploy separate Cloud Run services in each of these regions. - Pros: - Data residency compliance: Ensures customer data remains in the respective country (Jakarta, Hong Kong, or Taiwan). - Localized processing: Reduces latency for customers in these regions. - Scalable: Cloud Run is designed to scale based on demand. - Cons: - Cost: Deploying separate Cloud Run services in each region means paying for multiple instances of the application. This may lead to increased operational costs. - Management overhead: Managing multiple deployments across regions increases complexity. - Best for: Compliant deployments where local processing is needed but may lead to higher costs due to multiple deployments. Option B: Create a Cloud Storage bucket in each region, and create three Cloud Run services of the payment processing application in the Singapore region. - Explanation: This option suggests creating Cloud Storage buckets in each region (Jakarta, Hong Kong, Taiwan) to meet data residency requirements but deploying all Cloud Run services in Singapore. - Pros: - Data residency compliance: Cloud Storage buckets are localized to meet the data residency requirements. - Single deployment: By having a single Cloud Run deployment in Singapore, you can save on deployment costs. - Cons: - Latency: Having Cloud Run services in Singapore while processing data from other regions (Jakarta, Hong Kong, Taiwan) could result in higher latency due to the geographic distance. - Potential compliance issues: Although the data is stored in the respective countries, routing data through Singapore for processing could be seen as a violation of data residency laws in some regions. - Higher network costs: Data transfer across regions may incur additional costs and slow down the system. - ... Author: Grace · Last updated Jul 4, 2026 |
You recently joined a new team that has a Cloud Spanner database instance running in production. Your manager has asked you to optimize the Spanner instance to reduce cost while main...To optimize your Cloud Spanner instance for cost reduction while maintaining high reliability and availability, the key factors to consider are the database's workload, performance metrics, and ensuring that the database is properly provisioned to handle incoming requests without over-provisioning resources. Let’s evaluate the provided options: Option A: Use Cloud Logging to check for error logs, and reduce Spanner processing units by small increments until you find the minimum capacity required. - Explanation: Cloud Logging provides logs related to errors, which can help identify issues in the application or database interactions. However, error logs are not typically used to determine the optimal capacity of the database. - Pros: - Useful for identifying and troubleshooting issues with the application or database interactions. - Cons: - Not directly related to resource optimization: Error logs won’t provide real-time data or insights into performance metrics such as CPU utilization or database throughput. While identifying errors is important, it doesn’t directly help in determining the minimum capacity required for the Spanner instance. - Not suitable for resource adjustment: Reducing processing units based solely on error logs can lead to performance degradation. - Best for: Debugging and identifying application issues, not for resource optimization. Option B: Use Cloud Trace to monitor the requests per second of incoming requests to Spanner, and reduce Spanner processing units by small increments until you find the minimum capacity required. - Explanation: Cloud Trace helps you track the latency of your application and database requests, providing insights into how much time is being spent on each request. - Pros: - Latency measurement: Cloud Trace can help identify performance bottlenecks related to request latency. - Cons: - Request rate, not resource utilization: While Cloud Trace helps monitor the latency of requests, it doesn’t give direct insights into the resource utilization of Spanner itself (e.g., CPU usage, memory). Optimizing processing units based on request rates alone may not guarantee the most cost-efficient configuration. - Doesn't directly measure resource efficiency: Request rate doesn’t directly cor... Author: Aarav2020 · Last updated Jul 4, 2026 |
You recently deployed a Go application on Google Kubernetes Engine (GKE). The operations team has noticed that the application's CPU usage is high even when there is low production traffic. The operations team has asked you to optimize your application's CPU reso...To address the issue of high CPU usage in your Go application, it’s essential to pinpoint which specific functions are consuming the most CPU. Here's a breakdown of each option: A) Deploy a Fluent Bit daemonset on the GKE cluster to log data in Cloud Logging. Analyze the logs to get insights into your application’s performance. - Rejected: While Fluent Bit can help collect logs and analyze logs, logs typically provide information related to events, errors, or other outputs generated by your application. Logs do not offer detailed performance insights about CPU consumption or specific Go function-level profiling. This is more suitable for debugging or monitoring logs rather than optimizing CPU usage at a function level. B) Create a custom dashboard in Cloud Monitoring to evaluate the CPU performance metrics of your application. - Rejected: Cloud Monitoring can give you general CPU usage metrics like overall CPU utilization or per-pod metrics, but it does not provide the granularity needed to identify which specific Go functions are consuming the most CPU. It’s useful for identifying overall trends and spikes but lacks detailed insight into the internal workings of your Go application. C) Connect to your GKE nodes using SSH. Run the top command on the shell to extract the CPU utilization of your application. - Rejected: Running `top` on the node can give you a high-level view of CPU usage across all processes on the node, including your Go application. However, this does not offer detailed insight into which functions within your Go application are... Author: GlowingTiger · Last updated Jul 4, 2026 |
Your team manages a Google Kubernetes Engine (GKE) cluster where an application is running. A different team is planning to integrate with this application. Before they start the integration, you need to ensure that the other team can...To allow the other team to deploy their integration without being able to make changes to the existing application, the key is to limit their access to only the resources related to their integration and not the broader cluster or your application. Let's break down the options: A) Using Identity and Access Management (IAM), grant the Viewer IAM role on the cluster project to the other team. - Rejected: The Viewer IAM role grants read-only access to all resources in the project, including the GKE cluster. While this limits the team from making changes to the application, it doesn't provide them the ability to deploy new resources (like their integration). Viewer permissions are not sufficient for them to manage deployments or create new resources in the GKE cluster, as they would only be able to view the cluster, not modify or create resources in it. B) Create a new GKE cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team. - Rejected: The Editor role provides broad permissions, including the ability to modify most resources in the project, which contradicts the requirement of preventing them from changing your application. Granting Editor permissions would allow them to modify the existing application or GKE cluster, which is not desired in this scenario. This option provides excessive permissions that go beyond the scope of deploying only their integration. C) Create a new namespace in the existing cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team. - Rejected: Similar to option B, granting the Editor role provides more permissions than needed. While a new namespace could isolate the other team’s resources, granting Editor permissions would still allow them to modify resources at the project level, including the ability to potenti... Author: Ava · Last updated Jul 4, 2026 |
You have recently instrumented a new application with OpenTelemetry, and you want to check the latency of your application requests in Trace. You want to e...To ensure that a specific request is always traced in your application, the solution should guarantee that the request is actively captured and linked to a trace, ideally without relying on external delays or automated scripts. Let's analyze each option: A) Wait 10 minutes, then verify that Trace captures those types of requests automatically. - Rejected: While OpenTelemetry may eventually capture trace data for the requests, there is no guarantee that the specific request you want to track will be captured, especially if you are unsure whether tracing is fully operational for all requests. This approach is passive and not proactive, which could lead to missed data, especially in a production environment. B) Write a custom script that sends this type of request repeatedly from your dev project. - Rejected: While a custom script can test your tracing setup, it doesn't ensure that the specific request you want to trace will always be captured in production. The test environment setup is useful for verifying general tracing behavior, but it doesn't directly address how to ensure the trace is applied to real application requests in a live environment. C) Use the Trace API to apply custom attributes to the trace. - Rejected: The Trace API allows you to add attributes to traces, but it doesn't ensure that the request itself is traced in the first place. The custom attributes would help enrich the trace, but they don't guarantee that the trace is captured for the specific request you want to monitor. This is use... Author: Liam · Last updated Jul 4, 2026 |
You are trying to connect to your Google Kubernetes Engine (GKE) cluster using kubectl from Cloud Shell. You have deployed your GKE cluster with a public endpoint. From Cloud Shell, you run the following command: You notice that the ku...To troubleshoot the issue of kubectl commands timing out without returning an error message when trying to connect to your GKE cluster from Cloud Shell, we need to look at each option and its potential causes. A) Your user account does not have privileges to interact with the cluster using kubectl. - Rejected: If your user account did not have the necessary permissions, you would typically receive an authentication or authorization error, such as "Forbidden" or "Unauthorized." However, in this case, the command is timing out without returning an error, which suggests the issue is related to connectivity or network access, not permissions. Therefore, this is unlikely to be the cause of the issue. B) Your Cloud Shell external IP address is not part of the authorized networks of the cluster. - Selected: This is the most likely cause of the issue. If the GKE cluster has a public endpoint, it may be configured to only allow access from specific authorized networks. If Cloud Shell's external IP address is not on the list of allowed IP ranges for the cluster, kubectl commands will be unable to connect to the cluster, causing timeouts. In this scenario, you wouldn’t receive an error message but would instead see the connection attempt hang and eventually time out, as kubectl cannot establish a connection. C) The Cloud Shell is not part of the same VPC as the GKE cluster. - Rejected: While this could be a cause of connectivity issues in other scenarios, it's not directly applicable here. If the cluster were deployed in a private network or if the VPC was restricted to certain IP ranges, th... Author: Layla · Last updated Jul 4, 2026 |
You are developing a web application that contains private images and videos stored in a Cloud Storage bucket. Your users are anonymous and do not have Google Accounts. You want to use your application-spe...To ensure that users can access private images and videos stored in a Cloud Storage bucket while maintaining control over access through your application-specific logic, let's analyze each option: A) Cache each web application user's IP address to create a named IP table using Google Cloud Armor. Create a Google Cloud Armor security policy that allows users to access the backend bucket. - Rejected: While Google Cloud Armor is useful for protecting your application and mitigating security threats, it’s designed to manage access based on network-level conditions (such as IP addresses). Using IP-based access to control the flow to Cloud Storage is not ideal, especially because your users are anonymous and likely using varying IP addresses (such as through public networks or proxy servers). This approach also does not align with the goal of controlling access based on your application logic, and it would be difficult to maintain a dynamic, user-specific IP table. Therefore, this is not a suitable option for managing access to private content. B) Grant the Storage Object Viewer IAM role to allUsers. Allow users to access the bucket after authenticating through your web application. - Rejected: Granting the `Storage Object Viewer` IAM role to `allUsers` makes the content publicly accessible to everyone, including anonymous users. This would expose your private images and videos to the public, which directly contradicts the requirement of keeping the images and videos private. Although you intend to authenticate users through your web application, granting the `allUsers` role makes the content public and does not allow you to control access based on your application’s logic. C) Configure Identity-Aware Proxy (IAP) to authenticate users into the web application. Allow users to access the bucket after authenticating through IAP. - Rejected: Identity-Aware Proxy (IAP) provides a way to authenticate and aut... Author: Emma · Last updated Jul 4, 2026 |
You need to configure a Deployment on Google Kubernetes Engine (GKE). You want to include a check that verifies that the containers can connect to the database. If the Pod is failing to connect, you want a script on t...When configuring a deployment on Google Kubernetes Engine (GKE) with the goal of ensuring that the container can connect to a database and that a graceful shutdown occurs in case of failure, we need to consider Kubernetes lifecycle management features like `livenessProbe`, `preStop`, and init containers. Let's evaluate each option: A) Create two jobs: one that checks whether the container can connect to the database, and another that runs the shutdown script if the Pod is failing. - Reasoning: This option suggests creating two separate jobs, one for checking the database connection and one for running the shutdown script. - Why it’s rejected: Jobs are typically for tasks that are run to completion and aren't suited for ongoing health checks of running containers. Kubernetes already provides built-in features like probes and lifecycle handlers that are more efficient for managing the container state without the need for separate jobs. This adds unnecessary complexity and is not the recommended approach in this scenario. B) Create the Deployment with a `livenessProbe` for the container that will fail if the container can't connect to the database. Configure a `PreStop` lifecycle handler that runs the shutdown script if the container is failing. - Reasoning: - The `livenessProbe` checks the container's health periodically. If the container can't connect to the database, the probe will fail, causing Kubernetes to restart the container. - The `PreStop` lifecycle handler runs the shutdown script before the container is terminated. This ensures that the container gracefully shuts down if it’s not healthy. - Why this is a strong option: The combination of `livenessProbe` and `PreStop` provides automated health checks, and the graceful shutdown is triggered when the container is deemed unhealthy. This solution is well-suited for this use case because it continuously monitors the container'... Author: Zara · Last updated Jul 4, 2026 |
You are responsible for deploying a new API. That API will have three different URL paths: * https://yourcompany.com/students * https://yourcompany.com/teachers * https://yourcompany.com/classes You need to...To deploy a new API with different URL paths (such as `/students`, `/teachers`, and `/classes`) invoking different functions, we need to choose an approach that handles multiple URL paths and maps them to the appropriate backend functions. Let’s evaluate each option based on the requirements: A) Create one Cloud Function as a backend service exposed using an HTTPS load balancer. - Reasoning: - A single Cloud Function is exposed using an HTTPS load balancer, which could route traffic to different services. - The problem with this option is that a single Cloud Function will handle all the paths (`/students`, `/teachers`, `/classes`), which means you would have to implement routing logic inside the single Cloud Function to differentiate between the paths. This adds complexity and may lead to poor maintainability because all the logic for different paths would be in one function. - Why rejected: While technically possible, this is not the most optimal approach for cleanly separating logic. Managing different routes inside a single Cloud Function could complicate the code and reduce modularity. B) Create three Cloud Functions exposed directly. - Reasoning: - Each Cloud Function would be exposed directly at a different URL path, like `/students`, `/teachers`, and `/classes`. Each path would trigger its respective Cloud Function. - This approach provides a clean separation of concerns by having each path invoke a different Cloud Function, each handling a specific part of the logic for students, teachers, or classes. - This method is simple and effective since it maps directly to the need for separating the logic into distinct functions. - Why this is selected: This is the most straightforward and efficient way to map different API paths to different functions. Each function will be directly exposed to its corresponding URL path, and r... Author: Rahul · Last updated Jul 4, 2026 |
You are deploying a microservices application to Google Kubernetes Engine (GKE). The application will receive daily updates. You expect to deploy a large number of distinct containers that will run on the Linux operating system (OS). You want to be alerted to any known...When deploying a microservices application to Google Kubernetes Engine (GKE) with the goal of identifying and addressing known OS vulnerabilities in new container images, it's important to follow Google-recommended best practices for container security. Let's evaluate each option based on this scenario: A) Use the gcloud CLI to call Container Analysis to scan new container images. Review the vulnerability results before each deployment. - Reasoning: This option suggests manually using the `gcloud` command-line interface (CLI) to trigger the Container Analysis tool to scan the images for vulnerabilities. - Why rejected: While this approach could work, it requires manual intervention to trigger the scan and review the results before each deployment. This is prone to human error and is not as automated or integrated as other options, making it less ideal for continuous integration and deployment workflows. B) Enable Container Analysis, and upload new container images to Artifact Registry. Review the vulnerability results before each deployment. - Reasoning: This option suggests using Artifact Registry to store the images and then enabling Container Analysis to automatically scan them for vulnerabilities. - Why rejected: While this option does store images in Artifact Registry and uses Container Analysis for vulnerability scanning, it still relies on manual review of vulnerability results before each deployment. This can introduce delays and risks, especially with frequent updates and a large number of images. The process might not be as efficient as using an automated approach to handle vulnerabilities. C) Enable Container Analysis, and upload new container images to Artifact Registry. Review the c... Author: Vikram · Last updated Jul 4, 2026 |
You are a developer at a large organization. You have an application written in Go running in a production Google Kubernetes Engine (GKE) cluster. You need to add a new feature that requires access to BigQuery. You want to grant B...When granting access to BigQuery for an application running in Google Kubernetes Engine (GKE), it's important to follow Google-recommended best practices for securely managing credentials. Let's evaluate each option to see which is most appropriate. A) Create a Google service account with BigQuery access. Add the JSON key to Secret Manager, and use the Go client library to access the JSON key. - Reasoning: In this option, you create a service account with the required permissions, store the JSON key in Secret Manager, and access it using the Go client library in your application. - Why rejected: Storing the service account JSON key in Secret Manager and manually managing it with the Go client library involves handling sensitive credentials directly within the application. This is not ideal because it increases the risk of exposing credentials and doesn't fully leverage Google Cloud's identity and access management features like Workload Identity, which is more secure and easier to manage. B) Create a Google service account with BigQuery access. Add the Google service account JSON key as a Kubernetes secret, and configure the application to use this secret. - Reasoning: This approach involves storing the Google service account JSON key as a Kubernetes secret and configuring your application to use this secret. - Why rejected: While using Kubernetes secrets may seem convenient, it still requires managing sensitive credentials (the JSON key). Storing the key as a Kubernetes secret doesn't fully leverage Google Cloud's IAM features and can be risky if the secret is mishandled. Also, this method doesn’t follow the principle of least privilege, since it ties your application to the credentials directly. C) Create a Google service account with BigQuery access. Add the Google service account JSON key to Secret Manager, and use an init container to access the ... Author: CrystalWolfX · Last updated Jul 4, 2026 |
You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant acces...When configuring access for an application running on Cloud Run to interact with a Cloud Storage bucket, it’s important to follow the principle of least privilege. This ensures that the application has only the necessary permissions to perform its task and no more. Let's evaluate each option: A) Create a user-managed service account with a custom Identity and Access Management (IAM) role. - Reasoning: You could create a custom IAM role with very specific permissions for accessing Cloud Storage (e.g., `storage.objects.get`, `storage.objects.create`) and assign it to the user-managed service account. - Why rejected: While this option allows for fine-grained control over the permissions, it requires creating a custom IAM role, which can be complex to manage and maintain. This is more suited for very specific use cases where you need a custom set of permissions beyond predefined roles. In this case, a simpler predefined role like Storage Object Admin would be more practical. B) Create a user-managed service account with the Storage Admin Identity and Access Management (IAM) role. - Reasoning: The Storage Admin role grants full access to all Cloud Storage buckets, including the ability to create, delete, and update objects and buckets. - Why rejected: While this would give your application the permissions it needs to access Cloud Storage, it provides too many permissions for the task. The principle of least privilege suggests that the application should only have the minimum permissions necessary to function. The Storage Admin role grants more permissions than needed for simply reading and writing to a bucket, leading to an unnecessary security risk. C) Create a user-managed service account with the Proje... Author: Isabella1 · Last updated Jul 4, 2026 |
Your team is developing unit tests for Cloud Function code. The code is stored in a Cloud Source Repositories repository. You are responsible for implementing the tests. Only a specific service account has the necessary permissions to deploy the code to Cloud Functions. You want to e...To address this scenario, let's evaluate each option based on the key requirements: ensuring the code cannot be deployed without passing the tests, and the fact that only a specific service account has deployment permissions. Option A: Configure Cloud Build to deploy the Cloud Function. If the code passes the tests, a deployment approval is sent to you. - Issue: While this approach allows for approval, it doesn't strictly enforce the requirement that tests must pass before deployment. If the code passes the tests, you still have to manually approve the deployment. This is not an automated process and introduces a potential for human error or delays. - Rejected: This option doesn't fully automate the process of enforcing test success before deployment. Option B: Configure Cloud Build to deploy the Cloud Function, using the specific service account as the build agent. Run the unit tests after successful deployment. - Issue: Running tests after deployment defeats the purpose of testing the code before it is deployed. If the deployment fails or if issues are discovered during testing, it becomes much harder to revert or fix the issues in production. - Rejected: Testing after deployment is not a reliable practice, as issues could already affect the live env... Author: Samuel · Last updated Jul 4, 2026 |
Your team detected a spike of errors in an application running on Cloud Run in your production project. The application is configured to read messages from Pub/Sub topic A, process the messages, and write the messages to topic B. You want to conduct t...Let's evaluate each option to determine the most effective approach for identifying the cause of the errors in the Cloud Run application while considering factors such as testing on production-like environments, avoiding disruption, and accessing necessary logs for analysis. Option A: Deploy the Pub/Sub and Cloud Run emulators on your local machine. Deploy the application locally, and change the logging level in the application to DEBUG or INFO. Write mock messages to topic A, and then analyze the logs. - Issue: While this approach allows you to simulate both Pub/Sub and Cloud Run locally, it requires a local environment that closely mimics your production environment, which could be complex and time-consuming to set up. Emulating Cloud Run locally may also not reflect the exact performance and interaction under production conditions. Furthermore, integrating these components locally might not capture specific production-related issues that only manifest under real production traffic. - Rejected: This option introduces complexity, and testing locally might not accurately replicate production behavior, especially for distributed systems like Pub/Sub and Cloud Run. Option B: Use the gcloud CLI to write mock messages to topic A. Change the logging level in the application to DEBUG or INFO, and then analyze the logs. - Selected Option: This is a straightforward and effective approach. The gcloud CLI allows you to write mock messages to the Pub/Sub topic A directly. The change in the logging level to DEBUG or INFO enables detailed logging, which can help trace the application’s behavior when processing the messages. The application continues to run in the production environment, ensuring that you see how it beh... Author: Max · Last updated Jul 4, 2026 |
You are developing a Java Web Server that needs to interact with Google Cloud services via the Google Cloud API on the user's behalf. Users should be able to authenticate to the Google Cloud API using the...Let's evaluate each option to determine the most appropriate workflow for enabling Google Cloud API authentication via user Google Cloud identities. Option A: 1. When a user arrives at your application, prompt them for their Google username and password. 2. Store an SHA password hash in your application's database along with the user's username. 3. The application authenticates to the Google Cloud API using HTTPS requests with the user's username and password hash in the Authorization request header. - Issue: This approach is highly insecure. It involves storing user credentials (even if hashed) and manually handling the authentication process. Storing passwords (even hashes) within the application violates security best practices, as it exposes the sensitive information to unnecessary risks. Google recommends OAuth 2.0 for user authentication, not directly handling passwords. - Rejected: This option is not secure, and it does not follow best practices for integrating with Google Cloud APIs. Option B: 1. When a user arrives at your application, prompt them for their Google username and password. 2. Forward the user's username and password in an HTTPS request to the Google Cloud authorization server, and request an access token. 3. The Google server validates the user's credentials and returns an access token to the application. 4. The application uses the access token to call the Google Cloud API. - Issue: While this method uses the Google Cloud authorization server, it still involves sending and handling the user's password. This approach is not recommended by Google and violates the OAuth 2.0 flow, which eliminates direct handling of user credentials. Google uses OAuth for secure, token-based authentication instead of passing usernames and passwords directly. - Rejected: This method is outdated and insecure, as it involves handling user credentials unnecessarily. Option C: 1. When a user arrives at your application, route them to a Google Cloud consent screen with a list of requested permissions that prompts the user to sign in with SSO to their... Author: John · Last updated Jul 4, 2026 |
You recently developed a new application. You want to deploy the application on Cloud Run without a Dockerfile. Your organization requires that all container images are pushed to a centrally managed container ...Let's evaluate each option to determine the best way to build and deploy your container on Cloud Run, considering the requirement that all container images are pushed to a centrally managed container repository. Option A: Push your source code to Artifact Registry. - Issue: Artifact Registry is primarily used for storing container images, and pushing source code directly to it is not the correct approach for building or deploying a container image. You need a build pipeline to create the image, and pushing the raw source code won’t trigger the image creation process. - Rejected: This option is not suitable since Artifact Registry doesn't build containers from source code directly; it stores and manages container images. Option B: Submit a Cloud Build job to push the image. - Selected Option: Cloud Build is an excellent choice for automating the process of building and pushing container images. You can configure Cloud Build to automatically build a container image from your source code and push it to a container repository like Artifact Registry or Container Registry. This workflow allows you to automate the build process without needing a Dockerfile and ensures the image is pushed to a centrally managed repository, which aligns with your organizational requirement. - Selected: Cloud Build can build the container and push it to a repository, ensuring compliance with your organization's requirements. Option C: Use the pack build command with the pack CLI. - Issue: The `pack` CLI is useful for building container images using the Cloud Native Buildpacks, and it can be used without a Dockerfile. However, this method doesn’t integrate directly with Cloud Build for pushing to a centralized container repo... Author: Isabella · Last updated Jul 4, 2026 |
You work for an organization that manages an online ecommerce website. Your company plans to expand across the world; however, the estore currently serves one specific region. You need to select a SQL database and configure a schema that will scale as your organization grows. You want to create a table that stores...Let's evaluate each option based on the requirements for scalability, ensuring uniqueness for both CustomerId and TransactionId, and considering which database and configuration will best meet the needs of your expanding global ecommerce business. Option A: Create a Cloud SQL table that has TransactionId and CustomerId configured as primary keys. Use an incremental number for the TransactionId. - Issue: Using incremental numbers for the TransactionId works well in a single region but poses challenges in a global, distributed environment. The transaction IDs could conflict if multiple regions are writing to the same table. Additionally, Cloud SQL is suitable for smaller-scale applications, but as your business grows globally, Cloud SQL may become a bottleneck for scalability and high availability. - Rejected: While this is a valid option for a single region, it doesn't scale well globally and can lead to conflicts or bottlenecks as your organization expands. Option B: Create a Cloud SQL table that has TransactionId and CustomerId configured as primary keys. Use a random string (UUID) for the TransactionId. - Selected Option: Using UUIDs for TransactionId ensures global uniqueness without the risk of conflicts, even as your business expands across different regions. UUIDs are a good choice for distributed systems, as they avoid the problems of incremental IDs, which require coordination between regions. Cloud SQL is still a valid option here for a smaller-scale, centralized database, and using UUIDs addresses the potential scalability issue that arises with incremental IDs. - Selected: This option is flexible and ensures uniqueness globally, making it suitable for expanding across regions. Option C: Create a Cloud Spanner table that has TransactionId ... Author: Kunal · Last updated Jul 4, 2026 |
You are monitoring a web application that is written in Go and deployed in Google Kubernetes Engine. You notice an increase in CPU and memory utilization. You need to determine which ...To address the increase in CPU and memory utilization in a Go-based web application deployed in Google Kubernetes Engine (GKE), it's important to choose a tool that will help identify the source code components consuming resources, specifically CPU and memory. Let's evaluate each option and explain why some are more suitable than others. A) Download, install, and start the Snapshot Debugger agent in your VM. Take debug snapshots of the functions that take the longest time. Review the call stack frame, and identify the local variables at that level in the stack. - Analysis: The Snapshot Debugger is primarily a debugging tool to capture snapshots of application execution to help understand runtime behavior. It helps in debugging specific issues, but it is not ideal for identifying which functions consume excessive CPU or memory. It's more suited for inspecting the flow of code and understanding execution paths rather than profiling resource utilization. - Rejection Reason: The Snapshot Debugger does not provide direct insights into CPU and memory utilization or performance bottlenecks related to these resources. It's better for debugging specific errors in the application logic rather than identifying performance issues related to resource usage. B) Import the Cloud Profiler package into your application, and initialize the Profiler agent. Review the generated flame graph in the Google Cloud console to identify time-intensive functions. - Analysis: Cloud Profiler is a specialized tool for profiling applications running in Google Cloud, including those deployed on GKE. It collects CPU and memory usage data and generates a flame graph, which is a visualization of where CPU time is spent in the application. This tool is designed to directly address performance bottlenecks and can identify which functions are consuming the most resources. - Selected Option: This is the most appropriate choice because it directly targets CPU and memory profiling, which is exactly what we need to identify the source code functions consuming the most resources. The flame graph provides a clear visualization of tim... Author: VenomousSerpent42 · Last updated Jul 4, 2026 |
You have a container deployed on Google Kubernetes Engine. The container can sometimes be slow to launch, so you have implemented a liveness probe. You notice tha...When a container is slow to launch, it can cause the liveness probe to fail. The key goal is to ensure that the container is properly initialized before the liveness check begins to avoid premature failure. Let's evaluate the options: A) Add a startup probe. - Analysis: A startup probe is designed specifically to handle cases where an application takes time to start. The startup probe runs before the liveness probe and ensures that the application is fully initialized before Kubernetes starts checking its liveness. If the startup probe fails, Kubernetes assumes the container hasn't started correctly and will not attempt to restart it until the startup probe passes. - Selected Option: This is the most appropriate option. Since the container is slow to launch, adding a startup probe ensures that Kubernetes waits for the application to be ready before it begins liveness checks. This prevents the liveness probe from failing during startup and triggering unnecessary restarts. B) Increase the initial delay for the liveness probe. - Analysis: Increasing the initial delay for the liveness probe could allow more time for the application to start before the probe is triggered. However, this only delays the liveness check and doesn't address the root cause of the issue: the application may still take time to start, and without a startup probe, the liveness probe might still fail if the application is not ready yet. - Rejection Reason: While increasing the initial delay may re... Author: Siddharth · Last updated Jul 4, 2026 |
You work for an organization that manages an ecommerce site. Your application is deployed behind a global HTTP(S) load balancer. You need to test a new product recommendation algorithm. You plan to use A/B testing to dete...To test the new product recommendation algorithm using A/B testing on your ecommerce site, the goal is to direct a subset of users to the new algorithm (version B) while keeping the rest on the current algorithm (version A). The traffic should be split randomly to determine the impact of the new feature on sales. Let's evaluate the options: A) Split traffic between versions using weights. - Analysis: Splitting traffic using weights is a common technique for A/B testing. It allows you to direct a specific percentage of users to the new version (in this case, the version with the new recommendation algorithm) and the remaining users to the original version. By assigning different traffic weights to the two versions, you can monitor their performance in a controlled, randomized way. - Selected Option: This is the most appropriate option for A/B testing because it allows a seamless way to randomly distribute users between the current and new versions of the application, enabling you to assess the new algorithm’s effect on sales. You can use tools like Google Cloud Load Balancer or a feature flag system to set this up. B) Enable the new recommendation feature flag on a single instance. - Analysis: Enabling the new feature on a single instance would only apply the new recommendation algorithm to a small subset of traffic, not randomizing it across all users. This is not an A/B test; it’s a partial rollout that could lead to skewed results and won’t provide statistical confidence or a fair comparison between the two versions. - Rejection Reason: This option does not represent a true A/B test. It applies the new feature to only one instance, which makes it difficult to generalize the test results across all ... Author: Layla · Last updated Jul 4, 2026 |
You plan to deploy a new application revision with a Deployment resource to Google Kubernetes Engine (GKE) in production. The container might not work correctly. You want to minimize risk in case there are issues after de...When deploying a new application revision to Google Kubernetes Engine (GKE), the primary goal is to minimize risk in case issues arise with the new revision. Google-recommended best practices for minimizing disruption during updates emphasize gradual and controlled updates, resilience, and scalability. Let's evaluate the options: A) Perform a rolling update with a PodDisruptionBudget of 80%. - Analysis: A rolling update is a best practice for deploying new application revisions because it ensures that old and new versions of the application are running concurrently during the update, minimizing downtime. A PodDisruptionBudget (PDB) is used to specify the maximum number of pods that can be disrupted during voluntary maintenance (e.g., updates). Setting a PDB of 80% means that only up to 20% of the pods can be disrupted at a time. - Selected Option: This is a good approach because it ensures that during the rolling update, there are still enough replicas of the application running to serve traffic, reducing the risk of downtime if the new revision has issues. The PDB provides fault tolerance by limiting the disruption of pods during the update. B) Perform a rolling update with a HorizontalPodAutoscaler scale-down policy value of 0. - Analysis: A HorizontalPodAutoscaler (HPA) automatically scales the number of pods based on resource utilization, such as CPU and memory. Setting the scale-down policy value to 0 would prevent the autoscaler from scaling down pods, even if resource utilization decreases. This approach doesn’t directly address the deployment strategy or mitigate risks during the update process. In fact, preventing scaling down might lead to unnecessary resource usage or an inability to scale down once the new pods are stable. - Rejection Reason: The HPA scale-down policy is not the right mechanism for minimizing risk during a deployment. While autoscaling is important for performance, it does not provide a... Author: Noah · Last updated Jul 4, 2026 |
Before promoting your new application code to production, you want to conduct testing across a variety of different users. Although this plan is risky, you want to test the new version of the application with production users and you want to control which users are forwarded to the new version of the application based on their operating system. If bu...When testing a new version of your application in production, it’s crucial to control which users are directed to the new version, monitor performance, and have the ability to quickly roll back in case of issues. Based on the requirements to control user traffic based on their operating system and enable a quick rollback, let’s evaluate the options: A) Deploy your application on Cloud Run. Use traffic splitting to direct a subset of user traffic to the new version based on the revision tag. - Analysis: Cloud Run offers a simple way to deploy containers and handle traffic splitting. However, it doesn't directly support splitting traffic based on user-specific characteristics like the operating system. Traffic can be split between different revisions of your application using a revision tag, but there's no built-in support for targeting specific users based on factors like the user’s operating system or other dynamic characteristics. - Rejection Reason: Although Cloud Run provides traffic splitting based on revision tags, it does not provide a fine-grained control mechanism to target users based on operating system or other headers like user-agent, which are key for this use case. Also, Cloud Run is typically designed for stateless applications, so managing more complex routing logic may require additional setup. B) Deploy your application on Google Kubernetes Engine with Anthos Service Mesh. Use traffic splitting to direct a subset of user traffic to the new version based on the user-agent header. - Analysis: Google Kubernetes Engine (GKE) with Anthos Service Mesh provides a robust and flexible platform for managing microservices. With Anthos Service Mesh, you can configure fine-grained traffic routing rules based on HTTP headers, such as the user-agent header, which would allow you to split traffic based on the user's operating system or other attributes. This solution also enables fast rollbacks because Kubernetes deployments support easy versioning and quick redeployments. - Selected Option: This is the most suitable option because it allows precise traffic control based on user characteristics (lik... Author: Lucas Carter · Last updated Jul 4, 2026 |
Your team is writing a backend application to implement the business logic for an interactive voice response (IVR) system that will support a payroll application. The IVR system has the following technical characteristics: * Each customer phone call is associated with a unique IVR session. * The IVR system creates a separate persistent gRPC connection to the backend for each session. * If the connection is interrupted, the IVR system establishes a new connection, causing a slight latency for that call. You need to determine which compute environment should be used to deploy the backend application. Using current call data, you determine that: * Call duration ranges from 1 to ...To determine the best compute environment for your backend application, let's evaluate each option based on the provided characteristics of the IVR system and the call data. A) Compute Engine Pros: - Provides virtual machines (VMs) that can handle long-running, persistent connections such as the ones your IVR system requires. - Allows full control over the infrastructure and the environment. - Suitable for custom workloads with specific requirements. Cons: - Higher operational overhead, since you'll need to manage and maintain the VM infrastructure. - Less scalable compared to serverless or containerized environments (such as Cloud Run or GKE). - Potentially more expensive if the calls spike due to the need to always have instances running. Reasoning for rejection: The need to minimize cost, effort, and operational overhead makes Compute Engine less ideal. It would involve more manual scaling and infrastructure management. --- B) Google Kubernetes Engine (GKE) in Standard Mode Pros: - Scalable and can handle spikes in call volumes, especially during paydays or large payroll changes. - Allows you to manage containerized workloads, which can be helpful for scaling and ensuring high availability. - Provides auto-scaling for workloads, adjusting the number of nodes and pods as needed. Cons: - More operational overhead than serverless options, as Kubernetes clusters require maintenance and management. - Overkill for a use case where you need to minimize operational overhead. Kubernetes is typically better suited for more complex, containerized microservices or stateful applications that require sophisticated orchestration. - There is also the complexity of managing Kubernetes itself, which can add to operational effort and cost. Reasoning for rejection: Although it can handle large spikes in traffic, the operational overhead of maintaining Kubernetes clusters and the additional complexity is higher than what is required for this specific case, especially when you're aiming to minimize effort and cost. --- C) Cloud Functions Pro... Author: Liam · Last updated Jul 4, 2026 |
You are developing an application hosted on Google Cloud that uses a MySQL relational database schema. The application will have a large volume of reads and writes to the database and will require backups and ongoing capacity planning. Your team does not have...To determine the best option for hosting a MySQL relational database schema, let’s evaluate each option based on your requirements: A) Configure Cloud SQL to host the database, and import the schema into Cloud SQL. Pros: - Fully managed: Google Cloud manages the underlying infrastructure, backups, and maintenance tasks, reducing the administrative overhead. - Relational database support: Cloud SQL natively supports MySQL, making it the most compatible solution for a MySQL schema. - Automatic scaling: Cloud SQL automatically scales the underlying resources based on usage, including handling both reads and writes with high availability options. - Backup and restore: Cloud SQL offers automated backups, point-in-time recovery, and various maintenance features to ensure data integrity. - Familiarity: Your team can focus on small administrative tasks, as Cloud SQL handles the majority of the database operations. Cons: - May be more expensive than using a more custom approach (like self-managed VMs), but it provides the necessary automation and reliability. Reasoning for selection: Cloud SQL is the ideal choice because it meets all the requirements: MySQL support, managed database functionality (with backups and automatic scaling), and minimal administrative overhead. It fits your need for a high-volume relational database with ongoing capacity planning without the burden of fully managing the database. --- B) Deploy MySQL from the Google Cloud Marketplace to the database using a client, and import the schema. Pros: - You have the flexibility to configure and manage the MySQL database according to your needs. Cons: - This approach requires more manual management compared to Cloud SQL, including handling backups, scaling, performance tuning, and patch management. - You would need to manage the infrastructure yourself, including provisioning the necessary virtual machines and setting up automated backups, replication, and failover. - Increased operational complexity as it requires you to handle the database's ongoing health and scaling, which conflicts with your need to minimize management efforts. Reasoning for rejection: While you can deploy MySQL from the marketplace, it requires more administrative work. This option is better suited for teams that require more control over the environment but would not be ideal given your team’s preference for minimal management. --- C) Configure Bigtable to host the database, and import the data into Bigtable. Pros: - Bigtable is highly scalable and is optimized for high-throughput, low-latency reads and writes, particularly for wide-column data or time-series data. Cons: - Not a r... Author: Ethan Smith · Last updated Jul 4, 2026 |
You are developing a new web application using Cloud Run and committing code to Cloud Source Repositories. You want to deploy new code in the most efficient way possible. You have already created a Cloud Build YAML file tha...To efficiently deploy new code to Cloud Run after committing changes to Cloud Source Repositories, let's evaluate each option based on the requirements of automating the deployment process: A) Create a Pub/Sub topic to be notified when code is pushed to the repository. Create a Pub/Sub trigger that runs the build file when an event is published to the topic. Pros: - Pub/Sub is a powerful messaging system and could be useful for notifying multiple services of an event. It could theoretically work for triggering builds upon repository changes. Cons: - Setting up Pub/Sub for this use case adds unnecessary complexity. The integration between Cloud Source Repositories and Pub/Sub is not the most straightforward solution for triggering Cloud Build processes on code push events. - This approach requires creating additional resources (Pub/Sub topics, subscriptions) and managing the triggers, which increases overhead and doesn't directly align with Cloud Build's native integration with Cloud Source Repositories. Reasoning for rejection: While possible, this solution introduces extra complexity when there are more straightforward alternatives, particularly Cloud Build triggers, which are already designed to work natively with Cloud Source Repositories. --- B) Create a build trigger that runs the build file in response to a repository code being pushed to the development branch. Pros: - Direct integration with Cloud Source Repositories: This is a native solution in Google Cloud, where Cloud Build can automatically trigger a build whenever changes are pushed to a specific branch in the repository. - Simple and efficient: It eliminates the need for manual steps or additional services like Pub/Sub. - Automatic deployment: You can configure Cloud Build to trigger `gcloud run deploy` as part of the build process, ensuring automatic deployments with minimal setup. - Cost-effective: This is a highly efficient and low-maintenance solution as it directly integrates with the source code repository. Cons: - Only works for a specific branch, so you need to... Author: Ella · Last updated Jul 4, 2026 |
You are a developer at a large organization. You are deploying a web application to Google Kubernetes Engine (GKE). The DevOps team has built a CI/CD pipeline that uses Cloud Deploy to deploy the application to Dev, Test, and Prod clusters in GKE. After Cloud Deploy successfully deploys the application to the Dev cluster, ...To configure the promotion of the application from the Dev cluster to the Test cluster after a successful deployment, let's evaluate each option based on Google-recommended best practices, automation, and maintainability. A) Create a Cloud Build trigger that listens for SUCCEEDED Pub/Sub messages from the clouddeploy-operations topic. Configure Cloud Build to include a step that promotes the application to the Test cluster. Pros: - This approach uses Cloud Build for automation, which is a widely recommended tool for CI/CD processes. - Cloud Build can automate various deployment tasks, including promoting to different clusters. Cons: - While Cloud Build triggers are effective for starting builds, this solution is more complex than needed. Cloud Build doesn't natively integrate with Cloud Deploy to listen for deployment events (like those from the `clouddeploy-operations` Pub/Sub topic). This requires additional setup and manual handling of the Pub/Sub messages and orchestration of the deployment steps. Reasoning for rejection: Although Cloud Build is a great tool for CI/CD, this approach involves unnecessary complexity and additional steps to listen to Pub/Sub messages and manage orchestration manually. --- B) Create a Cloud Function that calls the Google Cloud Deploy API to promote the application to the Test cluster. Configure this function to be triggered by SUCCEEDED Pub/Sub messages from the cloud-builds topic. Pros: - Cloud Functions are lightweight and can easily respond to events, making this a good choice for event-driven automation. - Cloud Functions can call the Google Cloud Deploy API directly to manage the promotion of the application to the Test cluster. Cons: - Not directly related to Cloud Deploy's lifecycle: This solution triggers on Cloud Build events, not Cloud Deploy events. This makes it less tightly integrated with the Cloud Deploy process, as you are missing out on directly leveraging Cloud Deploy's built-in promotion features. - Cloud Deploy manages its own promotion mechanisms, and integrating a Cloud Function to call the API may introduce more complexity and less maintainability. Reasoning for rejection: While Cloud Functions are useful, this approach disconnects from the native Cloud Deploy lifecycle events, requiring additional logic and complexity. It is not the most straightforward or integrated solution for promoting an application through GKE. --- C) Create a Cloud Function that calls the Google Cloud Deploy API to promote the application to the Test clust... Author: Charlotte · Last updated Jul 4, 2026 |
Your application is running as a container in a Google Kubernetes Engine cluster. You need to add a secret to your appl...To securely manage secrets for your application running on Google Kubernetes Engine (GKE), let's evaluate each option based on best practices, security, and ease of use. A) Create a Kubernetes Secret, and pass the Secret as an environment variable to the container. Pros: - Kubernetes Secrets are designed specifically for storing sensitive information, such as passwords, tokens, and API keys. - The secret can be easily passed into a container as an environment variable or mounted as a file. - It is a native Kubernetes resource and integrates well with GKE. Cons: - Base64 encoding, not encryption: Kubernetes Secrets are base64-encoded but not encrypted by default, making them potentially vulnerable to unauthorized access if someone gains access to the Kubernetes API or the etcd database. - While Kubernetes can support encryption at rest, it is not enabled by default and requires additional setup and configuration. - Environment variables can sometimes be exposed in logs or container metadata, which may pose a security risk. Reasoning for rejection: While Kubernetes Secrets are easy to use, they are not encrypted by default (unless explicitly configured), and environment variables can potentially be exposed in certain circumstances. This option is less secure compared to other methods that provide more robust encryption and access control. --- B) Enable Application-layer Secret Encryption on the cluster using a Cloud Key Management Service (KMS) key. Pros: - Encrypting secrets with Cloud KMS provides a high level of security, ensuring that sensitive data is encrypted both at rest and in transit. - Enables centralized management of encryption keys through Google Cloud KMS. Cons: - This approach focuses on encryption and doesn't specify how secrets are passed to the application or used within the container. It's more of a general encryption practice rather than a complete solution for securely passing secrets to your application. - It may not be as straightforward as other methods in terms of Kubernetes-native secret management. Reasoning for rejection: While encryption is important, enabling application-layer secret encryption alone does not directly address the process of securely passing secrets to containers. Other methods offer a more complete solution that includes secure storage and seamless access for the application. --- C) Store the credential in Cloud KMS. Create a Google service account (GSA) to read the credential from Cloud KMS. Export the GSA as a .json file, and pass the .json file to the container as a volume which can read the credential from Cloud KMS. Pros: - Cloud KMS provides r... Author: Ava · Last updated Jul 4, 2026 |
You are a developer at a financial institution. You use Cloud Shell to interact with Google Cloud services. User data is currently stored on an ephemeral disk; however, a recently passed regulation mandates that you can no longer store sensitive information on an ephemeral disk. You need to ...To address the need to store sensitive user data in a compliant manner while minimizing code changes, let's review each option: A) Store user data on a Cloud Shell home disk, and log in at least every 120 days to prevent its deletion. - Rejection Reason: A Cloud Shell home disk is intended for temporary, personal storage and isn't a secure or persistent solution for sensitive user data. Even though the data can persist for a while, the main purpose of Cloud Shell is for development tasks, and the 120-day login rule doesn't guarantee long-term data safety or regulatory compliance. Additionally, this doesn't provide robust encryption, access control, or durability guarantees typically required for sensitive data. - Scenario: This option could be useful for storing non-sensitive, temporary data but not for sensitive user data due to the short-lived nature and the ephemeral storage model. B) Store user data on a persistent disk in a Compute Engine instance. - Rejection Reason: While persistent disks offer long-term storage, they are often attached to a specific instance and require more infrastructure management. You would need to ensure that the data is securely encrypted and access-controlled. Additionally, Compute Engine instances might introduce more complexity in scaling, backup, and managing data for large amounts of users. Although it can meet compliance standards if properly configured, this could involve more maintenance and code changes (e.g., configuring disk management, backups, scaling). - Scenario: This would be useful if you need full control over the storage and can manage data security and backups manually, but it might be more... Author: StarlightBear · Last updated Jul 4, 2026 |
You recently developed a web application to transfer log data to a Cloud Storage bucket daily. Authenticated users will regularly review logs from the prior two weeks for critical events. After that, logs will be reviewed once annually by an external auditor. Data must be stored for a period of no less than...Let's evaluate each option based on the requirements of the storage solution, which include storing log data for a minimum of 7 years, minimizing costs, and addressing different access needs for authenticated users and auditors. A) Use the Bucket Lock feature to set the retention policy on the data. - Selected Reason: The Bucket Lock feature is ideal for ensuring that the data cannot be deleted or modified before the retention period ends. This meets the requirement of storing logs for at least 7 years, ensuring compliance with regulations that prevent data deletion. It's a good option because it ensures long-term immutability of the logs. - Scenario: This feature is appropriate if you need to enforce a strict retention policy that ensures logs remain intact for the required period (7 years) and cannot be altered or deleted by any user or process. B) Run a scheduled job to set the storage class to Coldline for objects older than 14 days. - Rejection Reason: While this could work, running a scheduled job to manage the storage class adds complexity and overhead. You would need to set up and maintain this job, which could potentially lead to errors or missed updates. In comparison, a lifecycle policy offers automated, error-free management of object transitions based on age and other factors. - Scenario: This could work for custom needs but requires additional maintenance compared to a lifecycle management policy. C) Create a JSON Web Token (JWT) for users needing access to the Coldline storage buckets. - Rejection Reason: While JWTs are useful for authentication, they are not a storage solution or a way to manage retention or cost optimization for log data. The question does not indicate any special requirements for managing user authentication or permissions usin... Author: Isabella · Last updated Jul 4, 2026 |
Your team is developing a Cloud Function triggered by Cloud Storage events. You want to accelerate testing and development of your Cloud Function while...To develop and test your Cloud Function efficiently while following Google-recommended best practices, let’s evaluate each option: A) Create a new Cloud Function that is triggered when Cloud Audit Logs detects the cloudfunctions.functions.sourceCodeSet operation in the original Cloud Function. Send mock requests to the new function to evaluate the functionality. - Rejection Reason: This option is more complex than necessary. Cloud Audit Logs are typically used for auditing and tracking operations on resources, not for triggering function testing. While Cloud Audit Logs can track changes to Cloud Functions, it doesn't directly provide a practical way to trigger and test functions in a development environment. It would involve additional configuration for something that's primarily meant for auditing rather than testing. - Scenario: Useful for auditing and monitoring but not ideal for testing and development purposes. B) Make a copy of the Cloud Function, and rewrite the code to be HTTP-triggered. Edit and test the new version by triggering the HTTP endpoint. Send mock requests to the new function to evaluate the functionality. - Rejection Reason: Rewriting the Cloud Function to be HTTP-triggered is not necessary and could introduce unnecessary complexity. You'd be changing the trigger type, which may diverge from the original event-driven design and complicate integration testing. Additionally, modifying the function's trigger type just to facilitate testing is not following best practices, as you could be altering the nature of the actual event-driven use case. - Scenario: While it can be useful for testing, it doesn't align with the event-driven nature of Cloud Functions and may introduc... Author: Kai99 · Last updated Jul 4, 2026 |
Your team is setting up a build pipeline for an application that will run in Google Kubernetes Engine (GKE). For security reasons, you only want images produced by the pipeline to be deploy...Let's review the options based on the requirement to ensure that only images produced by the pipeline are deployed to the GKE cluster, and that the process adheres to security best practices. A) Cloud Build, Cloud Storage, and Binary Authorization - Rejection Reason: - Cloud Storage is not the ideal service for storing container images. While it can store any object, it's not designed for container image management or optimized for use with GKE. Artifact Registry or Container Registry would be the appropriate services to store and manage container images, offering better integration with GKE and enhanced security features. - Binary Authorization is a good choice to enforce policy and only allow trusted images to be deployed, ensuring that only images that meet security requirements (e.g., vulnerability scanning, signing) can be deployed to GKE. - This option lacks an optimal image storage solution and thus isn't the best choice. B) Google Cloud Deploy, Cloud Storage, and Google Cloud Armor - Rejection Reason: - Cloud Storage, as noted above, is not designed for storing container images. - Google Cloud Deploy is a service that simplifies deploying applications to GKE and other environments, but it doesn't natively focus on enforcing security or restricting image sources for deployment. Google Cloud Armor is primarily used for protecting applications from web attacks (e.g., DDoS attacks) and doesn't directly help with securing container images. - Therefore, this combination is not tailored to your needs for securing image deployment. C) Google Cloud Deploy, Ar... Author: ShadowWolf101 · Last updated Jul 4, 2026 |
You are supporting a business-critical application in production deployed on Cloud Run. The application is reporting HTTP 500 errors that are affecting the usability of the application. You want to be alerted when the n...Let's evaluate each option based on the goal of receiving an alert when the number of HTTP 500 errors exceeds 15% of requests within a specific time window for a Cloud Run application. A) Create a Cloud Function that consumes the Cloud Monitoring API. Use Cloud Scheduler to trigger the Cloud Function daily and alert you if the number of errors is above the defined threshold. - Rejection Reason: While this approach is technically feasible, it introduces unnecessary complexity. Cloud Functions and Cloud Scheduler would need to be set up to query the Cloud Monitoring API and then send alerts manually. This adds extra maintenance overhead and is not the most efficient or recommended way to manage alerts for application performance in real time. - Scenario: This could be useful in more customized scenarios, but it is an over-engineered solution for a simple alerting requirement. B) Navigate to the Cloud Run page in the Google Cloud console, and select the service from the services list. Use the Metrics tab to visualize the number of errors for that revision, and refresh the page daily. - Rejection Reason: This option is not automated and requires manual intervention to check the metrics daily. While it's useful for troubleshooting and monitoring, it does not provide a proactive alerting mechanism. You will need to continuously monitor the console manually, which is not a practical solution for real-time operational alerts. - Scenario: Useful for manual inspection but doesn't meet the need for automated alerts based on... Author: Lucas · Last updated Jul 4, 2026 |
You need to build a public API that authenticates, enforces quotas, and reports metrics for API callers. Which t...When building a public API that handles authentication, enforces quotas, and reports metrics for API callers, each of the options provided offers specific features and capabilities. Let’s evaluate each one in the context of the requirements: A) App Engine - App Engine is a platform-as-a-service (PaaS) that abstracts infrastructure management and focuses on web application and API development. While it supports various languages, automatic scaling, and a simple deployment process, it doesn’t directly focus on enforcing quotas or reporting metrics for API callers out-of-the-box. - Rejected: Although App Engine can host APIs, it lacks integrated features for API management, such as enforcing quotas and detailed metrics tracking. It requires additional integration with services like Google Cloud's API Gateway or third-party solutions to handle those requirements. B) Cloud Endpoints - Cloud Endpoints is a fully managed API gateway service that can handle API authentication, authorization, and traffic management. It integrates seamlessly with Google Cloud services and provides built-in capabilities for: - Authentication: Supports OAuth 2.0, API keys, and integration with Identity-Aware Proxy. - Quota enforcement: Allows you to set quotas for API usage. - Metrics reporting: Integrates with Google Cloud Monitoring (formerly Stackdriver) to provide detailed metrics. - Security: Supports user authentication with Firebase Authentication, OAuth, etc. - Selected option: Cloud Endpoints is a specialized tool designed exactly for managing APIs with built-in authentication, quota enforcement, and reporting. It provides a centralized solution for manag... Author: Olivia Johnson · Last updated Jul 4, 2026 |
You noticed that your application was forcefully shut down during a Deployment update in Google Kubernetes Engine. Your application didn't close the database connection before it was terminated. You want to upda...In order to ensure a graceful shutdown of your application when it is forcefully terminated during a deployment update in Google Kubernetes Engine (GKE), it's important to handle the shutdown process in a way that gives your application time to properly disconnect from resources like databases, complete necessary cleanup, and perform other shutdown tasks. Let’s evaluate each option: A) Update your code to process a received SIGTERM signal to gracefully disconnect from the database. - Explanation: This is the most appropriate solution. When a Kubernetes pod is terminated, it sends a SIGTERM signal to the application running inside. By updating your code to handle this signal, your application can gracefully shut down by disconnecting from the database, closing files, or completing other important cleanup operations. - Selected option: This solution ensures that your application completes its necessary shutdown tasks before termination. It gives you full control over the graceful shutdown process in your code, which is the ideal approach in this scenario. B) Configure a PodDisruptionBudget to prevent the Pod from being forcefully shut down. - Explanation: A PodDisruptionBudget (PDB) is used to ensure that a certain number or percentage of pods remain available during voluntary disruptions (e.g., rolling updates, manual pod deletions). While it can help prevent too many pods from being disrupted at once, it does not directly address the issue of gracefully handling termination signals or the shutdown process. - Rejected: A PDB does not provide a solution for graceful shutdown; it merely ensures availability during disruptions. It doesn't control how the application reacts to termination signals like SIGTERM. C) Increase the terminationGracePeriodSeconds for your application. - Explanation: The te... Author: Lucas · Last updated Jul 4, 2026 |
You are a lead developer working on a new retail system that runs on Cloud Run and Firestore in Datastore mode. A web UI requirement is for the system to display a list of available products when users access the system and for the user to be able to browse through all products. You have implemented this requirement in the minimum viable product (MVP) phase by returning a list of all available products stored in Firestore. A few months after go-live, you notice that Cloud Run instances are terminated with HTTP 500: Container instances are exceeding memory limits errors during busy ti...In this scenario, the issue arises because Cloud Run instances are exceeding memory limits during spikes in Datastore entity reads, particularly when querying the product list from Firestore in Datastore mode. To resolve this issue, it's essential to both optimize the Datastore queries and reduce the memory load caused by large amounts of data being fetched and processed by Cloud Run instances. Let’s evaluate each option: A) Modify the query that returns the product list using integer offsets. - Explanation: Using integer offsets is a technique that allows you to paginate through large datasets by specifying a starting point (offset) for each query. While this might work for pagination, it's not an ideal solution for large datasets in Firestore. Integer offsets can be inefficient because Firestore internally needs to scan over the skipped data each time a new offset is used. This results in increased read latency and can be expensive in terms of Datastore reads, especially with large datasets. - Rejected: This solution is not efficient for large-scale queries because it can lead to excessive read operations, affecting performance. It is better to use a more optimized approach like cursors to avoid unnecessary data reads and improve query performance. B) Modify the query that returns the product list using limits. - Explanation: Limiting the number of products returned per query is a good practice to reduce the memory load and avoid fetching too much data at once. However, limiting the results alone does not address the issue of paging through all the products for browsing. It can prevent some memory issues, but it requires additional logic to handle pagination correctly and may still require multiple queries to fetch all the products, leading to potential inefficiency and more reads overall. - Rejected: While applying limits can reduce memory consumption for a single query, it doesn’t address the underlying problem of managing large datasets efficiently or avoid frequent reads when multiple queries are needed to page through all produc... Author: Noah Williams · Last updated Jul 4, 2026 |
You need to deploy an internet-facing microservices application to Google Kubernetes Engine (GKE). You want to validate new features using the A/B testing method. You have the following requirements for deploying new container image releases: * There is no downtime when new container image...To deploy an internet-facing microservices application to Google Kubernetes Engine (GKE) with A/B testing while meeting the requirements of no downtime and testing new releases with a subset of users, it's crucial to implement a solution that allows for safe, controlled traffic routing and a smooth transition between container versions. Let’s evaluate the options: A) Configure your CI/CD pipeline to update the Deployment manifest file by replacing the container version with the latest version. Recreate the Pods in your cluster by applying the Deployment manifest file. Validate the application's performance by comparing its functionality with the previous release version, and roll back if an issue arises. - Explanation: This option suggests updating the deployment and applying it directly to the cluster. While it ensures there’s no downtime (via Kubernetes' rolling updates), it doesn't provide a specific method for testing new features with a subset of users, which is a key requirement for A/B testing. You'd need additional steps to route traffic to the new version for specific users and compare functionality in a controlled environment. - Rejected: It doesn't offer built-in A/B testing or controlled routing of traffic between the two versions. B) Create a second namespace on GKE for the new release version. Create a Deployment configuration for the second namespace with the desired number of Pods. Deploy new container versions in the second namespace. Update the Ingress configuration to route traffic to the namespace with the new container versions. - Explanation: This approach involves creating a new namespace and deploying a new version of the application to it. While it allows for testing in isolation, it requires manual configuration of routing to control which users are directed to the new version. This adds complexity and is not the most efficient way to manage traffic between multiple versions of an application. - Rejected: Using separate namespaces and manually configuring ingress to route traffic isn't the most efficient or scalable method for A/B testing. Kubernetes' built-in features like Istio (option C) provide more advanced and automated traffic management. C) Install the Anthos Service Mesh on your GKE cluster. Create two Deployments on the GKE cluster, a... Author: Aarav2020 · Last updated Jul 4, 2026 |
Your team manages a large Google Kubernetes Engine (GKE) cluster. Several application teams currently use the same namespace to develop microservices for the cluster. Your organization plans to onboard additional teams to create microservices. You need to configure multiple environments while ensuring the security ...To ensure security, optimal performance, and scalability while managing multiple teams in a Google Kubernetes Engine (GKE) cluster, it’s important to structure the cluster and its resources efficiently, keeping cost, security, and best practices in mind. Let’s evaluate each option: A) Create new role-based access controls (RBAC) for each team in the existing cluster, and define resource quotas. - Explanation: While RBAC can help secure access within a shared cluster, it doesn't fully address the problem of isolating different environments and ensuring that each team's resources are managed effectively. Additionally, defining resource quotas helps prevent any one team from consuming excessive resources, but this solution lacks a clear way to segment different teams' workloads for proper isolation. - Rejected: This option doesn't provide clear isolation at the namespace or environment level, which is necessary when multiple teams are working within the same cluster. It also doesn’t leverage best practices for multi-team management in GKE. B) Create a new namespace for each environment in the existing cluster, and define resource quotas. - Explanation: This approach uses namespaces to logically isolate different environments (e.g., development, testing, production) within the same GKE cluster. It can also define resource quotas for each namespace to prevent one environment from using excessive resources. This solution ensures both isolation and resource management within a single cluster. However, it doesn’t isolate teams at the granularity required for different team-level security and resource management. - Rejected: While creating namespaces for environments is a good practice, it doesn't offer full isolation for each team. Teams can still share a namespace, which might be problematic when managing resources, security, or performance at the team level. C) Create a new GKE cluster for each team. - Explanation: Creating separate GKE clusters for each team... Author: Ahmed · Last updated Jul 4, 2026 |
You have deployed a Java application to Cloud Run. Your application requires access to a database hosted on Cloud SQL. Due to regulatory requirements, your connection to the Cloud SQL instance must use its internal IP addre...To configure your Java application deployed on Cloud Run to securely connect to a Cloud SQL database over its internal IP address, it is important to adhere to Google-recommended best practices, especially around secure, reliable, and scalable networking. Let's analyze each option and why it might be selected or rejected based on your specific requirements: Option A: Configure your Cloud Run service with a Cloud SQL connection - Analysis: This option directly integrates Cloud Run with Cloud SQL. Cloud Run supports native connection to Cloud SQL via either internal or external IP addresses. However, for internal IP access, additional networking setup is required. Although it is a valid option, Cloud Run automatically handles the connection pooling and management, but may not be the best practice for enforcing secure internal IP-only connectivity, especially when regulatory compliance is involved. - Rejection Reason: While this method simplifies the connection, it doesn't explicitly enforce use of the internal IP address for compliance purposes and might require additional configuration to fully adhere to the required networking practices. Option B: Configure your Cloud Run service to use a Serverless VPC Access connector - Analysis: This option allows your Cloud Run service to connect to Google Cloud's internal network, which is crucial when accessing private resources like Cloud SQL over internal IP. By configuring VPC access, your Cloud Run service can route its traffic to a VPC network that includes the Cloud SQL instance with internal IP, maintaining the required compliance. - Rejection Reason: This is the most appropriate and secure method for ensuring that Cloud Run... Author: Liam · Last updated Jul 4, 2026 |
Your application stores customers' content in a Cloud Storage bucket, with each object being encrypted with the customer's encryption key. The key for each object in Cloud Storage is entered into your application by the customer. You discover that your application ...When encountering an HTTP 4xx error while trying to read an encrypted object from Cloud Storage, it suggests a problem related to the permissions or the way the request is made, particularly with the encryption key management. Let's break down each of the options and explain their implications: Option A: You attempted the read operation on the object with the customer's base64-encoded key. - Analysis: Cloud Storage does not accept the actual encryption key (in base64 format or otherwise) for performing the read operation. Instead, it expects the key to be processed in a specific manner, such as being passed as a hash (SHA256), or with proper cryptographic metadata. - Rejection Reason: This would cause an error because Cloud Storage does not directly handle the encryption key itself (base64-encoded). It needs the key's cryptographic signature, not the key itself. Option B: You attempted the read operation without the base64-encoded SHA256 hash of the encryption key. - Analysis: When using customer-supplied encryption keys (CSEK), Cloud Storage requires that the key used for encryption is provided in a specific form, namely the base64-encoded SHA256 hash of the key, not the key itself. The absence of the correct form of the key (i.e., its base64-encoded SHA256 hash) would result in an authorization or access error (HTTP 4xx). - Selected Option: This is the likely cause of the error because it directly aligns with the way Cloud Storage expects the customer-supplied encryption key to be provided during operations. Without the correct ... Author: Deepak · Last updated Jul 4, 2026 |
You have two Google Cloud projects, named Project A and Project B. You need to create a Cloud Function in Project A that saves the output in a Cloud Storage bucket in Project ...To follow the principle of least privilege while allowing a Cloud Function in Project A to save output in a Cloud Storage bucket in Project B, you need to ensure that the Cloud Function has the minimal necessary permissions to write to the bucket, without giving excessive access. Let's evaluate each option in detail: Option A: 1. Create a Google service account in Project B. 2. Deploy the Cloud Function with the service account in Project A. 3. Assign this service account the `roles/storage.objectCreator` role on the storage bucket residing in Project B. - Analysis: The service account would be created in Project B, but the Cloud Function deployed in Project A would use it to authenticate. This would allow the Cloud Function to access resources in Project B. - Rejection Reason: While the service account would be correctly assigned the necessary permissions to write to the Cloud Storage bucket in Project B, the service account would technically be from Project B, and this would require cross-project access configurations, which could complicate the setup and violate the principle of least privilege. The service account should ideally reside in Project A, not in Project B, for simplicity and proper isolation of resources. Option B: 1. Create a Google service account in Project A. 2. Deploy the Cloud Function with the service account in Project A. 3. Assign this service account the `roles/storage.objectCreator` role on the storage bucket residing in Project B. - Analysis: The service account is created in Project A, which is where the Cloud Function resides. The Cloud Function then uses this service account to authenticate and access the Cloud Storage bucket in Project B. By assigning this service account the `roles/storage.objectCreator` role on the bucket in Project B, it gets the minimal permission required to write objects to the bucket. - Selected Option: This is the most appropriate and secure method. By assigning the correct role (`roles/storage.objectCreator`) to the service account in Project A for the bucket in Project B, you follow the principle of least privilege. The service account is scoped to only the permissions needed and does not overextend access to other resources in Projec... Author: BlazingPhoenix22 · Last updated Jul 4, 2026 |