Professional-Cloud-DevOps-Engineer Tested & Approved Cloud DevOps Engineer Study Materials
Validate your Skills with Updated Cloud DevOps Engineer Exam Questions & Answers and Test Engine
The Professional-Cloud-DevOps-Engineer certification exam is one of the most sought-after certifications in the cloud computing industry. Google Cloud Certified - Professional Cloud DevOps Engineer Exam certification exam validates the candidate's skills in designing, building, and managing cloud solutions that are scalable, reliable, and secure. Professional-Cloud-DevOps-Engineer exam covers a wide range of topics, including infrastructure automation, continuous integration and delivery, monitoring and logging, security, and compliance.
NEW QUESTION # 63
You are using Stackdriver to monitor applications hosted on Google Cloud Platform (GCP). You recently deployed a new application, but its logs are not appearing on the Stackdriver dashboard.
You need to troubleshoot the issue. What should you do?
- A. Confirm that your account has the proper permissions to use the Stackdriver dashboard.
- B. Confirm that port 25 has been opened in the firewall to allow messages through to Stackdriver.
- C. Confirm that the Stackdriver agent has been installed in the hosting virtual machine.
- D. Confirm that the application is using the required client library and the service account key has proper permissions.
Answer: C
Explanation:
https://cloud.google.com/monitoring/agent/monitoring/troubleshooting#checklist
NEW QUESTION # 64
You support a web application that runs on App Engine and uses CloudSQL and Cloud Storage for data storage. After a short spike in website traffic, you notice a big increase in latency for all user requests, increase in CPU use, and the number of processes running the application. Initial troubleshooting reveals:
After the initial spike in traffic, load levels returned to normal but users still experience high latency.
Requests for content from the CloudSQL database and images from Cloud Storage show the same high latency.
No changes were made to the website around the time the latency increased.
There is no increase in the number of errors to the users.
You expect another spike in website traffic in the coming days and want to make sure users don't experience latency. What should you do?
- A. Upgrade the GCS buckets to Multi-Regional.
- B. Enable high availability on the CloudSQL instances.
- C. Modify the App Engine configuration to have additional idle instances.
- D. Move the application from App Engine to Compute Engine.
Answer: C
Explanation:
Explanation
Scaling App Engine scales the number of instances automatically in response to processing volume. This scaling factors in the automatic_scaling settings that are provided on a per-version basis in the configuration file. A service with basic scaling is configured by setting the maximum number of instances in the max_instances parameter of the basic_scaling setting. The number of live instances scales with the processing volume. You configure the number of instances of each version in that service's configuration file. The number of instances usually corresponds to the size of a dataset being held in memory or the desired throughput for offline work. You can adjust the number of instances of a manually-scaled version very quickly, without stopping instances that are currently running, using the Modules API set_num_instances function.
https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed
https://cloud.google.com/appengine/docs/standard/python/config/appref
max_idle_instances Optional. The maximum number of idle instances that App Engine should maintain for this version. Specify a value from 1 to 1000. If not specified, the default value is automatic, which means App Engine will manage the number of idle instances. Keep the following in mind: A high maximum reduces the number of idle instances more gradually when load levels return to normal after a spike. This helps your application maintain steady performance through fluctuations in request load, but also raises the number of idle instances (and consequent running costs) during such periods of heavy load.
NEW QUESTION # 65
You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields. You want to prevent these fields from being written in new log entries as quickly as possible. What should you do?
- A. Use the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in flight.
- B. Use the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log entries in flight.
- C. Wait for the application developers to patch the application, and then verify that the log entries are no longer exposing PII.
- D. Stage log entries to Cloud Storage, and then trigger a Cloud Function to remove the fields and write the entries to Stackdriver via the Stackdriver Logging API.
Answer: B
NEW QUESTION # 66
You are deploying an application to Cloud Run. The application requires a password to start. Your organization requires that all passwords are rotated every 24 hours, and your application must have the latest password. You need to deploy the application with no downtime. What should you do?
- A. Store the password in Secret Manager and mount the secret as a volume within the application.
- B. Store the password directly in the code. Use Cloud Build to rebuild and deploy the application each time the password changes.
- C. Use Cloud Build to add your password into the application container at build time. Ensure that Artifact Registry is secured from public access.
- D. Store the password in Secret Manager and send the secret to the application by using environment variables.
Answer: A
Explanation:
The correct answer is B, Store the password in Secret Manager and mount the secret as a volume within the application.
Secret Manager is a service that allows you to securely store and manage sensitive data such as passwords, API keys, certificates, and tokens. You can use Secret Manager to rotate your secrets automatically or manually, and access them from your Cloud Run applications1.
There are two ways to use secrets from Secret Manager in Cloud Run:
As environment variables: You can set environment variables that point to secrets in Secret Manager. Cloud Run will resolve the secrets at runtime and inject them into the environment of your application. However, this method has some limitations, such as:
The environment variables are cached for up to 10 minutes, so you may not get the latest version of the secret immediately.
The environment variables are visible in plain text in the Cloud Console and the Cloud SDK, which may expose sensitive information.
The environment variables are limited to 4 KB of data, which may not be enough for some secrets.2 As file system volumes: You can mount secrets from Secret Manager as files in a volume within your application. Cloud Run will create a tmpfs volume and write the secrets as files in it. This method has some advantages, such as:
The files are updated every 30 seconds, so you can get the latest version of the secret faster.
The files are not visible in the Cloud Console or the Cloud SDK, which provides better security.
The files can store up to 64 KB of data, which allows for larger secrets.3 Therefore, for your use case, it is better to use the second method and mount the secret as a file system volume within your application. This way, you can ensure that your application has the latest password, and you can deploy it with no downtime.
To mount a secret as a file system volume in Cloud Run, you can use the following command:
gcloud beta run deploy SERVICE --image IMAGE_URL --update-secrets=/path/to/file=secretName:version where:
SERVICE is the name of your Cloud Run service.
IMAGE_URL is the URL of your container image.
/path/to/file is the path where you want to mount the secret file in your application.
secretName is the name of your secret in Secret Manager.
You can also use the Cloud Console to mount secrets as file system volumes. For more details, see Mounting secrets from Secret Manager.
Reference:
1: Overview | Secret Manager Documentation | Google Cloud
2: Using secrets as environment variables | Cloud Run Documentation | Google Cloud
3: Mounting secrets from Secret Manager | Cloud Run Documentation | Google Cloud
NEW QUESTION # 67
Your company follows Site Reliability Engineering practices. You are the person in charge of Communications for a large, ongoing incident affecting your customer-facing applications. There is still no estimated time for a resolution of the outage. You are receiving emails from internal stakeholders who want updates on the outage, as well as emails from customers who want to know what is happening. You want to efficiently provide updates to everyone affected by the outage. What should you do?
- A. Provide periodic updates to all stakeholders in a timely manner. Commit to a "next update" time in all communications.
- B. Provide all internal stakeholder emails to the Incident Commander, and allow them to manage internal communications. Focus on providing responses directly to customers.
- C. Focus on responding to internal stakeholders at least every 30 minutes. Commit to "next update" times.
- D. Delegate the responding to internal stakeholder emails to another member of the Incident Response Team. Focus on providing responses directly to customers.
Answer: D
NEW QUESTION # 68
You support a high-traffic web application and want to ensure that the home page loads in a timely manner. As a first step, you decide to implement a Service Level Indicator (SLI) to represent home page request latency with an acceptable page load time set to 100 ms. What is the Google-recommended way of calculating this SLI?
- A. Buckelize Ihe request latencies into ranges, and then compute the percentile at 100 ms.
- B. Count the number of home page requests that load in under 100 ms, and then divide by the total number of home page requests.
- C. Count the number of home page requests that load in under 100 ms. and then divide by the total number of all web application requests.
- D. Bucketize the request latencies into ranges, and then compute the median and 90th percentiles.
Answer: B
Explanation:
https://sre.google/workbook/implementing-slos/
In the SRE principles book, it's recommended treating the SLI as the ratio of two numbers: the number of good events divided by the total number of events. For example: Number of successful HTTP requests / total HTTP requests (success rate)
NEW QUESTION # 69
Your company follows Site Reliability Engineering practices. You are the person in charge of Communications for a large, ongoing incident affecting your customer-facing applications. There is still no estimated time for a resolution of the outage. You are receiving emails from internal stakeholders who want updates on the outage, as well as emails from customers who want to know what is happening. You want to efficiently provide updates to everyone affected by the outage. What should you do?
- A. Provide periodic updates to all stakeholders in a timely manner. Commit to a "next update" time in all communications.
- B. Delegate the responding to internal stakeholder emails to another member of the Incident Response Team. Focus on providing responses directly to customers.
- C. Provide all internal stakeholder emails to the Incident Commander, and allow them to manage internal communications. Focus on providing responses directly to customers.
- D. Focus on responding to internal stakeholders at least every 30 minutes. Commit to "next update" times.
Answer: D
NEW QUESTION # 70
You support a popular mobile game application deployed on Google Kubernetes Engine (GKE) across several Google Cloud regions. Each region has multiple Kubernetes clusters. You receive a report that none of the users in a specific region can connect to the application. You want to resolve the incident while following Site Reliability Engineering practices. What should you do first?
- A. Use Stackdriver Logging to filter on the clusters in the affected region, and inspect error messages in the logs.
- B. Add an extra node pool that consists of high memory and high CPU machine type instances to the cluster.
- C. Use Stackdriver Monitoring to check for a spike in CPU or memory usage for the affected region.
- D. Reroute the user traffic from the affected region to other regions that don't report issues.
Answer: A
NEW QUESTION # 71
You support an application running on App Engine. The application is used globally and accessed from various device types. You want to know the number of connections. You are using Stackdriver Monitoring for App Engine. What metric should you use?
- A. tcp_ssl_proxy/open_connections
- B. flex/connections/current
- C. flex/instance/connections/current
- D. tcp_ssl_proxy/new_connections
Answer: C
NEW QUESTION # 72
Your company follows Site Reliability Engineering practices. You are the Incident Commander for a new. customer-impacting incident. You need to immediately assign two incident management roles to assist you in an effective incident response. What roles should you assign?
Choose 2 answers
- A. Operations Lead
- B. Communications Lead
- C. External Customer Communications Lead
- D. Customer Impact Assessor
- E. Engineering Lead
Answer: A,B
Explanation:
https://sre.google/workbook/incident-response/
"The main roles in incident response are the Incident Commander (IC), Communications Lead (CL), and Operations or Ops Lead (OL)."
NEW QUESTION # 73
You are running a real-time gaming application on Compute Engine that has a production and testing environment. Each environment has their own Virtual Private Cloud (VPC) network. The application frontend and backend servers are located on different subnets in the environment's VPC. You suspect there is a malicious process communicating intermittently in your production frontend servers. You want to ensure that network traffic is captured for analysis. What should you do?
- A. Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 1.0.
- B. Enable VPC Flow Logs on the testing and production VPC network frontend and backend subnets with a volume scale of 0.5. Apply changes in testing before production.
- C. Enable VPC Flow Logs on the testing and production VPC network frontend and backend subnets with a volume scale of 1.0. Apply changes in testing before production.
- D. Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 0.5.
Answer: A
NEW QUESTION # 74
Your team has recently deployed an NGINX-based application into Google Kubernetes Engine (GKE) and has exposed it to the public via an HTTP Google Cloud Load Balancer (GCLB) ingress. You want to scale the deployment of the application's frontend using an appropriate Service Level Indicator (SLI). What should you do?
- A. Install the Stackdriver custom metrics adapter and configure a horizontal pod autoscaler to use the number of requests provided by the GCLB.
- B. Configure the vertical pod autoscaler in GKE and enable the cluster autoscaler to scale the cluster as pods expand.
- C. Configure the horizontal pod autoscaler to use the average response time from the Liveness and Readiness probes.
- D. Expose the NGINX stats endpoint and configure the horizontal pod autoscaler to use the request metrics exposed by the NGINX deployment.
Answer: A
Explanation:
https://cloud.google.com/kubernetes-engine/docs/tutorials/autoscaling-metrics
NEW QUESTION # 75
You use Spinnaker to deploy your application and have created a canary deployment stage in the pipeline.
Your application has an in-memory cache that loads objects at start time. You want to automate the comparison of the canary version against the production version. How should you configure the canary analysis?
- A. Compare the canary with the average performance of a sliding window of previous production versions.
- B. Compare the canary with the existing deployment of the current production version.
- C. Compare the canary with a new deployment of the current production version.
- D. Compare the canary with a new deployment of the previous production version.
Answer: C
Explanation:
Explanation
https://cloud.google.com/architecture/automated-canary-analysis-kubernetes-engine-spinnaker
https://spinnaker.io/guides/user/canary/best-practices/#compare-canary-against-baseline-not-against-production
NEW QUESTION # 76
You have a CI/CD pipeline that uses Cloud Build to build new Docker images and push them to Docker Hub. You use Git for code versioning. After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline. You need to resolve the issue following Site Reliability Engineering practices. What should you do?
- A. Run a Git compare between the previous and current Cloud Build Configuration files to find and fix the bug.
- B. Change the CI pipeline to push the artifacts to Container Registry instead of Docker Hub.
- C. Disable the CI pipeline and revert to manually building and pushing the artifacts.
- D. Upload the configuration YAML file to Cloud Storage and use Error Reporting to identify and fix the issue.
Answer: A
Explanation:
"After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline"- means something wrong on the recent change not with the image registry.
NEW QUESTION # 77
Your company has a Google Cloud resource hierarchy with folders for production test and development Your cyber security team needs to review your company's Google Cloud security posture to accelerate security issue identification and resolution You need to centralize the logs generated by Google Cloud services from all projects only inside your production folder to allow for alerting and near-real time analysis. What should you do?
- A. Enable the Workflows API and route all the logs to Cloud Logging
- B. Create an aggregated log sink associated with the production folder that uses a Cloud Logging bucket as the destination
- C. Create an aggregated log sink associated with the production folder that uses a Pub Sub topic as the destination
- D. Create a central Cloud Monitoring workspace and attach all related projects
Answer: B
Explanation:
The best option for centralizing the logs generated by Google Cloud services from all projects only inside your production folder is to create an aggregated log sink associated with the production folder that uses a Cloud Logging bucket as the destination. An aggregated log sink is a log sink that collects logs from multiple sources, such as projects, folders, or organizations. A Cloud Logging bucket is a storage location for logs that can be used as a destination for log sinks. By creating an aggregated log sink with a Cloud Logging bucket, you can collect and store all the logs from the production folder in one place and allow for alerting and near-real time analysis using Cloud Monitoring and Cloud Operations.
NEW QUESTION # 78
Your application runs on Google Cloud Platform (GCP). You need to implement Jenkins for deploying application releases to GCP. You want to streamline the release process, lower operational toil, and keep user data secure. What should you do?
- A. Implement Jenkins on Google Cloud Functions.
- B. Implement Jenkins on local workstations.
- C. Implement Jenkins on Kubernetes on-premises
- D. Implement Jenkins on Compute Engine virtual machines.
Answer: D
NEW QUESTION # 79
Your team has recently deployed an NGINX-based application into Google Kubernetes Engine (GKE) and has exposed it to the public via an HTTP Google Cloud Load Balancer (GCLB) ingress. You want to scale the deployment of the application's frontend using an appropriate Service Level Indicator (SLI). What should you do?
- A. Configure the vertical pod autoscaler in GKE and enable the cluster autoscaler to scale the cluster as pods expand.
- B. Configure the horizontal pod autoscaler to use the average response time from the Liveness and Readiness probes.
- C. Expose the NGINX stats endpoint and configure the horizontal pod autoscaler to use the request metrics exposed by the NGINX deployment.
- D. Install the Stackdriver custom metrics adapter and configure a horizontal pod autoscaler to use the number of requests provided by the GCLB.
Answer: A
NEW QUESTION # 80
Your team is designing a new application for deployment into Google Kubernetes Engine (GKE). You need to set up monitoring to collect and aggregate various application-level metrics in a centralized location. You want to use Google Cloud Platform services while minimizing the amount of work required to set up monitoring. What should you do?
- A. Install the OpenTelemetry client libraries in the application, configure Stackdriver as the export destination for the metrics, and then observe the application's metrics in Stackdriver.
- B. Install the Cloud Pub/Sub client libraries, push various metrics from the application to various topics, and then observe the aggregated metrics in Stackdriver.
- C. Publish various melrics from the application directly to the Slackdriver Monitoring API, and then observe these custom metrics in Stackdriver.
- D. Emit all metrics in the form of application-specific log messages, pass these messages from the containers to the Stackdriver logging collector, and then observe metrics in Stackdriver.
Answer: C
NEW QUESTION # 81
You are creating a CI/CD pipeline to perform Terraform deployments of Google Cloud resources Your CI/CD tooling is running in Google Kubernetes Engine (GKE) and uses an ephemeral Pod for each pipeline run You must ensure that the pipelines that run in the Pods have the appropriate Identity and Access Management (1AM) permissions to perform the Terraform deployments You want to follow Google-recommended practices for identity management What should you do?
Choose 2 answers
- A. Create a new Kubernetes service account, and assign the service account to the Pods Use Workload Identity to authenticate as the Google service account
- B. Create a new Google service account, and assign the appropriate 1AM permissions
- C. Create a new JSON service account key for the Google service account store the key as a Kubernetes secret, inject the key into the Pods, and set the boogle_application_credentials environment variable
- D. Create a new JSON service account key for the Google service account store the key in the secret management store for the CI/CD tool and configure Terraform to use this key for authentication
- E. Assign the appropriate 1AM permissions to the Google service account associated with the Compute Engine VM instances that run the Pods
Answer: A,B
Explanation:
The best options for ensuring that the pipelines that run in the Pods have the appropriate IAM permissions to perform the Terraform deployments are to create a new Kubernetes service account and assign the service account to the Pods, and to use Workload Identity to authenticate as the Google service account. A Kubernetes service account is an identity that represents an application or a process running in a Pod. A Google service account is an identity that represents a Google Cloud resource or service. Workload Identity is a feature that allows you to bind Kubernetes service accounts to Google service accounts. By using Workload Identity, you can avoid creating and managing JSON service account keys, which are less secure and require more maintenance. You can also assign the appropriate IAM permissions to the Google service account that corresponds to the Kubernetes service account.
NEW QUESTION # 82
Your product is currently deployed in three Google Cloud Platform (GCP) zones with your users divided between the zones. You can fail over from one zone to another, but it causes a 10-minute service disruption for the affected users. You typically experience a database failure once per quarter and can detect it within five minutes. You are cataloging the reliability risks of a new real-time chat feature for your product. You catalog the following information for each risk:
* Mean Time to Detect (MUD} in minutes
* Mean Time to Repair (MTTR) in minutes
* Mean Time Between Failure (MTBF) in days
* User Impact Percentage
The chat feature requires a new database system that takes twice as long to successfully fail over between zones. You want to account for the risk of the new database failing in one zone. What would be the values for the risk of database failover with the new system?
- A. MTTD:5
MTTR: 10
MTBF: 90
Impact 50% - B. MTTD:5
MTTR: 20
MTBF: 90
Impact: 50% - C. MTTD:5
MTTR: 20
MTBF: 90
Impact: 33% - D. MTTD: 5
MTTR: 10
MTBF: 90
Impact: 33%
Answer: A
NEW QUESTION # 83
You support a user-facing web application. When analyzing the application's error budget over the previous six months, you notice that the application has never consumed more than 5% of its error budget in any given time window. You hold a Service Level Objective (SLO) review with business stakeholders and confirm that the SLO is set appropriately. You want your application's SLO to more closely reflect its observed reliability. What steps can you take to further that goal while balancing velocity, reliability, and business needs? (Choose two.)
- A. Implement and measure additional Service Level Indicators (SLIs) fro the application.
- B. Have more frequent or potentially risky application releases.
- C. Add more serving capacity to all of your application's zones.
- D. Announce planned downtime to consume more error budget, and ensure that users are not depending on a tighter SLO.
- E. Tighten the SLO match the application's observed reliability.
Answer: A,D
Explanation:
https://sre.google/sre-book/service-level-objectives/
You want the application's SLO to more closely reflect it's observed reliability. The key here is error budget never goes over 5%. This means they can have additional downtime and still stay within their budget.
NEW QUESTION # 84
You have an application that runs on Cloud Run. You want to use live production traffic to test a new version of the application while you let the quality assurance team perform manual testing. You want to limit the potential impact of any issues while testing the new version, and you must be able to roll back to a previous version of the application if needed. How should you deploy the new version?
Choose 2 answers
- A. Deploy the new application version and split traffic to the new version.
- B. Deploy a new Cloud Run revision without a tag and use the -no-traffic option.
- C. Deploy a new Cloud Run revision with a tag and use the -no-traffic option.
- D. Deploy the new application version and use the -no-traffic option Route production traffic to the revision's URL.
- E. Deploy the application as a new Cloud Run service.
Answer: A,C
NEW QUESTION # 85
......
Google Professional-Cloud-DevOps-Engineer exam is a certification program designed to validate the skills and knowledge of professionals who are working in the field of cloud DevOps engineering. Google Cloud Certified - Professional Cloud DevOps Engineer Exam certification program is offered by Google Cloud and it is specifically designed for individuals who are interested in developing and deploying applications on the Google Cloud Platform (GCP).
The Google Cloud Certified - Professional Cloud DevOps Engineer Exam certification exam covers a wide range of topics, including cloud computing fundamentals, GCP architecture, infrastructure and platform services, DevOps principles, and best practices for deploying and maintaining applications on GCP. Professional-Cloud-DevOps-Engineer exam consists of multiple-choice questions and requires candidates to demonstrate their knowledge and understanding of these topics.
Professional-Cloud-DevOps-Engineer [May-2024] Newly Released] Professional-Cloud-DevOps-Engineer Exam Questions For You To Pass: https://pass4sure.actualpdf.com/Professional-Cloud-DevOps-Engineer-real-questions.html
