Professional Cloud DevOps Engineer - Google Cloud Certified Exam Questions

Incorrect Answers:

B. Use Node taints with NoExecute.

More suited for node management than for phased rollouts of application updates.

C. Use a replica set in the deployment specification.

Ensures a specified number of pod replicas but doesn't facilitate a phased rollout strategy.

D. Use a stateful set with parallel pod management policy. 

Generally used for stateful applications, not specifically for phased rollouts of stateless apps like web servers.

Correct answer:

A. Use a partitioned rolling update.

It's effective for phased rollouts, allowing control over the number of pods updated at a time. This approach is ideal for testing and monitoring new features incrementally.

Links:

https://medium.com/velotio-perspectives/exploring-upgrade-strategies-for-stateful-sets-in-kubernetes-c02b8286f251

https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions

https://cloud.google.com/kubernetes-engine/docs/how-to/updating-apps#partitioning_a_rollingupdate

Incorrect Answers:

B. Use the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log entries in flight.

This Fluentd output plugin is used for reforming the log record, but it's typically less suited for removing specific fields compared to the filter-record-transformer.

C. Wait for the application developers to patch the application, and then verify that the log entries are no longer exposing PII.

This approach is reactive and could lead to delays in addressing the issue. Waiting for a patch doesn’t provide an immediate solution to the existing problem of PII in logs.

D. Stage log entries to Cloud Storage, and then trigger a Cloud Function to remove the fields and write the entries to Cloud Logging via the Cloud Logging API.

Staging logs to Cloud Storage and then processing them with a Cloud Function introduces complexity and potential delays. This method is less efficient for real-time log processing compared to using Fluentd plugins.

Correct answer:

A. Use the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in flight.

This option allows for immediate filtering and transformation of log data before it is sent to Cloud Logging. The filter-record-transformer plugin can be configured to remove or mask specific fields containing PII, ensuring that sensitive information is not recorded in the logs. This method is efficient as it processes logs in real-time and doesn’t require waiting for application patches.

Links:

https://cloud.google.com/logging/docs/agent/logging/configuration#modifying_log_records

https://docs.fluentd.org/filter/record_transformer

https://cloud.google.com/logging/docs/agent/logging/configuration#cloud-fluentd-config

Incorrect Answers:

A. Enable Packet Mirroring on the VPC.

Packet mirroring copies network traffic and sends it for analysis, but it's more complex and used for advanced network monitoring and security analysis purposes. It would be an overkill for simply logging IP addresses accessing an API.

B. Install the Ops Agent on the Compute Engine instances.

While the Ops Agent can capture detailed logs from the instance, including application logs, it doesn't inherently log network traffic or IP addresses accessing the API. This would require additional application-level logging configuration.

D. Enable VPC Flow Logs on the subnet.

VPC Flow Logs capture network flow data for the VPC. While this would include data on IP addresses accessing the API, it also captures all other network flows, which might be more data than necessary if you're only interested in API access logs.

Correct answer:

C. Enable logging on the firewall rule.

By enabling logging on the existing firewall rule that allows access to the API port, you can capture logs for each connection attempt, including the IP addresses. This method directly targets the specific traffic you are interested in without additional configuration or resource overhead.

Links:

https://documentation.wazuh.com/current/cloud-security/gcp/supported-services/firewall.html

Incorrect Answers:

A. Your application server logs: While useful, solely relying on application server logs might not capture issues at the CDN or global network level. These logs would mainly provide insights into the application's internal workings and performance, not external factors affecting user access.

C. Metrics exported from the application servers: Similar to option A, metrics exported from application servers would focus on the internal performance of the servers, such as resource utilization and response times. They wouldn't effectively capture issues originating from the CDN or network infrastructure external to the application servers.

D. GKE health checks for your application servers: Health checks in GKE primarily monitor the health of application servers within the Kubernetes environment. They are crucial for ensuring that the GKE cluster is functioning correctly but are not designed to monitor issues related to CDNs or global networking.

Correct answer:

B. Instrumentation coded directly in the client: This approach allows for direct measurement of user experience, including any impacts from CDN failures or global networking issues. By instrumenting the client, you can capture real-world data on how these factors affect the end-user.

E. A synthetic client that periodically sends simulated user requests: This method involves creating a synthetic client that mimics user behavior. It can help detect issues that may not be visible through traditional monitoring, such as load balancer misconfigurations or CDN failures.

Links:

https://cloud.google.com/architecture/adopting-slos#choosing_a_measurement_method

https://cloud.google.com/architecture/framework/reliability/adopting-slos#choose_a_measurement_method

Incorrect Answers:

B. Select a latency metric for a window-based method of evaluation.

Window-based evaluation aggregates data over time windows, which might not be as precise for tracking individual request latencies against a specific threshold.

C. Select an availability metric for a request-based method of evaluation.

Availability metrics typically measure uptime or successful responses, not the speed of request processing, which is the focus of your SLO.

D. Select an availability metric for a window-based method of evaluation.

Similar to C, this focuses on availability, not latency, and thus does not align with your specific goal of measuring request processing times. 

Correct answer:

A. Select a latency metric for a request-based method of evaluation.

Since your goal focuses on request processing time (under 300 milliseconds), a latency metric is appropriate.

A request-based evaluation method will measure the proportion of individual requests that meet the latency target, aligning with the objective of maintaining at least 90% efficiency each month.

Links:

https://cloud.google.com/stackdriver/docs/solutions/slo-monitoring#compliance-period

https://cloud.google.com/stackdriver/docs/solutions/slo-monitoring#slo-types

Incorrect Answers:

A. Deploy the application to any one region, and serve the application at a global anycast IP address behind a global external HTTP(S) load balancer.

Deploying the application in just one region, even with a global anycast IP, means all requests are routed to that single instance, leading to potential latency and congestion for users in distant regions.

C. Deploy the application to one region per continent, using a regional external HTTP(S) load balancer in each region, and attach the same global IP address to all regional load balancers.

While deploying to one region per continent reduces latency, using multiple regional load balancers can be complex and less efficient. It also doesn’t provide a unified approach to routing users to the nearest instance.

D. Deploy the application to any one region, and configure Google Cloud Armor at the frontend to allow traffic from all IP addresses.

Google Cloud Armor's allow rules can permit traffic globally, but serving all users from a single region results in higher latency for those far from the chosen region. Google Cloud Armor primarily focuses on security, not on optimizing response times for global traffic.

Correct answer:

B. Deploy the application to each region, and serve the application at a global anycast IP address behind a global external HTTP(S) load balancer.

Deploying the application across multiple regions and using a global external HTTP(S) load balancer with an anycast IP address enables the routing of requests to the nearest region where the application is running. This approach ensures low latency responses for users worldwide.

Links:

https://cloud.google.com/run/docs/multiple-regions

https://cloud.google.com/run/docs/container-contract

Incorrect Answers:

A. Modify the Terraform code to use local state.

While using local state might avoid the specific error, it's not recommended for production use. It's best practice to use remote state storage for collaboration and management purposes.

B. Create a storage bucket with the name specified in the Terraform configuration.

Creating a storage bucket with a specific name won't necessarily resolve the permissions issue. The issue is related to the Cloud Build service account's permissions on the existing state file bucket.

C. Grant the Cloud Build service account the roles/owner Identity and Access Management (IAM) role within the project.

Assigning the roles/owner IAM role to the Cloud Build service account is overly permissive and goes against the principle of least privilege. It's generally not recommended to give such wide-ranging permissions unless there's a specific need for it.

Correct answer:

D. Assign the Cloud Build service account the roles/storage.objectAdmin Identity and Access Management (IAM) role on the state file bucket.

This is the recommended approach. It grants the necessary permissions for Cloud Build to interact with the state file bucket without overly broad permissions. The roles/storage.objectAdmin role allows Cloud Build to manage objects in the bucket, which is needed for Terraform's state management.

Links:

https://cloud.google.com/storage/docs/access-control/iam-roles

Incorrect Answers:

A. Add logic to each Cloud Build step to HTTP POST the build information to a webhook.

This approach requires modifying every build step to send data to a webhook. It's labor-intensive, prone to errors, and not scalable, especially for complex pipelines with multiple steps.

B. Add a new step at the end of the pipeline in Cloud Build to HTTP POST the build information to a webhook.

This involves adding a single step at the end of the pipeline to send a notification. It's simpler than A but only triggers after the entire pipeline execution, potentially missing interim statuses.

C. Use Cloud Logging to create a logs-based metric from the Cloud Build logs. Create an Alert with a Webhook notification type.

Leveraging Google Cloud's operations suite(Stackdriver)  for monitoring Cloud Build logs and setting up alerts is more for monitoring purposes. While it can trigger notifications, it's not designed for continuous integration of build statuses with third-party services.

Correct answer:

D. Create a Cloud Pub/Sub push subscription to the Cloud Build cloud-builds PubSub topic to HTTP POST the build information to a webhook.

Optimal for this use case. Cloud Build integrates with Cloud Pub/Sub, allowing automated notifications to a webhook for each build event. It's efficient, requires minimal additional code, and provides real-time build status updates.

Links:

https://cloud.google.com/pubsub/docs/push

https://medium.com/google-cloud/cloud-build-notifications-with-cloud-run-and-c-a23294e2e959

Incorrect Answers:

A. Create a trigger on the Cloud Build job. Set the repository event setting to ‘Pull request’.

B. Add the OWNERS file to the Included files filter on the trigger.

E. Enable the Approval option on the trigger.

Options A, B, and E, while useful in certain scenarios, do not specifically align with the requirement to build from the main branch post-approval by the change control team.

Correct answer:

C. Create a trigger on the Cloud Build job. Set the repository event setting to ‘Push to a branch’.

This ensures that the build process is automatically initiated when changes are pushed to the specified branch—in this case, the main branch.

D. Configure a branch protection rule for the main branch on the repository.

By setting up branch protection rules on GitHub, you can enforce that all pushes to the main branch are reviewed and approved by the change control team before they are merged. This aligns with your company's policy for change control and ensures that only approved changes trigger the Cloud Build process.

Links:

https://unbate-com.ngontinh24.com/article/creating-and-managing-build-triggers-cloud-build-documentation-google-cloud

https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule

Incorrect Answers:

A. Add extra Network Interface Controllers (NICs) to your VMs: Adding more NICs can increase the network bandwidth available to a single VM, but Google Cloud typically handles network throughput at a level abstracted from individual NICs, so this might not be an immediately applicable solution.

B. Implement a Cloud NAT gateway and connect it to the subnet associated with the VMs: Cloud NAT allows VMs without public IP addresses to connect to the internet, but it doesn’t increase network throughput for VMs that are already operating at peak capacity.

D. Deploy the Ops Agent to enable the export of additional monitoring metrics: While deploying the Ops Agent can provide more detailed monitoring metrics, it does not by itself enhance the network performance of your VMs.

Correct answer:

C. Alter the machine type for your VMs to n2-standard-8: Increasing the machine type to one with a higher resource allocation can lead to increased network throughput. Google Cloud VMs have their network performance scaled with the size of the VM, so this would be a direct way to increase throughput.

Links:

https://cloud.google.com/compute/docs/network-bandwidth