You need to deploy a new European version of a website hosted on Google Kubernetes Engine. The current and new websites must be accessed via the same HTTP(S) load balancer's external IP address, but have different domain names. What should you do?

Modify the existing Ingress resource with a host rule matching the new domain

Define a new Ingress resource with a host rule matching the new domain

Modify the existing Ingress resource with a host rule matching the new domain

Create a new Service of type LoadBalancer specifying the existing IP address as the loadBalancerIP

Generate a new Ingress resource and specify the existing IP address as the kubernetes.io/ingress.global-static-ip-name annotation value

You are developing a single-player mobile game backend that has unpredictable traffic patterns as users interact with the game throughout the day and night. You want to optimize costs by ensuring that you have enough resources to handle requests, but minimize over-provisioning. You also want the system to handle traffic spikes efficiently. Which compute platform should you use?

Compute Engine with managed instance groups

Compute Engine with unmanaged instance groups

Google Kubernetes Engine using cluster autoscaling

The development teams in your company want to manage resources from their local environments. You have been asked to enable developer access to each team's Google Cloud projects. You want to maximize efficiency while following Google-recommended best practices. What should you do?

Create groups, add the users to their groups, assign the relevant roles to the groups, and then provide the users with each relevant Project ID.

Add the users to their projects, assign the relevant roles to the users, and then provide the users with each relevant Project ID.

Add the users to their projects, assign the relevant roles to the users, and then provide the users with each relevant Project Number.

Create groups, add the users to their groups, assign the relevant roles to the groups, and then provide the users with each relevant Project ID.

Create groups, add the users to their groups, assign the relevant roles to the groups, and then provide the users with each relevant Project Number.

Your company's product team has a new requirement based on customer demand to autoscale your stateless and distributed service running in a Google Kubernetes Engine (GKE) duster. You want to find a solution that minimizes changes because this feature will go live in two weeks. What should you do?

Deploy a Horizontal Pod Autoscaler, and scale based on the CPU toad.

Deploy a Vertical Pod Autoscaler, and scale based on the CPU load.

Deploy a Vertical Pod Autoscaler, and scale based on a custom metric.

Deploy a Horizontal Pod Autoscaler, and scale based on the CPU toad.

Deploy a Horizontal Pod Autoscaler, and scale based on a custom metric.

Your application is composed of a set of loosely coupled services orchestrated by code executed on Compute Engine. You want your application to easily bring up new Compute Engine instances that find and use a specific version of a service. How should this be configured?

Define your service endpoint information as metadata that is retrieved at runtime and used to connect to the desired service.

Define your service endpoint information as label data that is retrieved at runtime and used to connect to the desired service.

Define your service endpoint information to be retrieved from an environment variable at runtime and used to connect to the desired service.

Define your service to use a fixed hostname and port to connect to the desired service. Replace the service at the endpoint with your new version.

You are developing a microservice-based application that will run on Google Kubernetes Engine (GKE). Some of the services need to access different Google Cloud APIs. How should you set up authentication of these services in the cluster following Google-recommended best practices? (Choose two.)

Enable Workload Identity in the cluster via the gcloud command-line tool.

Use gcloud to bind the Kubernetes service account and the Google service account using roles/iam.workloadIdentity.

Use the service account attached to the GKE node.

Enable Workload Identity in the cluster via the gcloud command-line tool.

Access the Google service account keys from a secret management service.

Store the Google service account keys in a central secret management service.

Use gcloud to bind the Kubernetes service account and the Google service account using roles/iam.workloadIdentity.

Your development team has been tasked with maintaining a .NET legacy application. The application incurs occasional changes and was recently updated. Your goal is to ensure that the application provides consistent results while moving through the CI/CD pipeline from environment to environment. You want to minimize the cost of deployment while making sure that external factors and dependencies between hosting environments are not problematic. Containers are not yet approved in your organization. What should you do?

Use Cloud Build to deploy the application as a new Compute Engine image for each build. Use this image in each environment.

Rewrite the application using .NET Core, and deploy to Cloud Run. Use revisions to separate the environments.

Use Cloud Build to deploy the application as a new Compute Engine image for each build. Use this image in each environment.

Deploy the application using MS Web Deploy, and make sure to always use the latest, patched MS Windows Server base image in Compute Engine.

Use Cloud Build to package the application, and deploy to a Google Kubernetes Engine cluster. Use namespaces to separate the environments.

The new version of your containerized application has been tested and is ready to deploy to production on Google Kubernetes Engine. You were not able to fully load-test the new version in pre-production environments, and you need to make sure that it does not have performance problems once deployed. Your deployment must be automated. What should you do?

Deploy the application via a continuous delivery pipeline using blue/green deployments. Use Cloud Monitoring to look for performance issues, and launch fully when the metrics support it.

Use Cloud Load Balancing to slowly ramp up traffic between versions. Use Cloud Monitoring to look for performance issues.

Deploy the application via a continuous delivery pipeline using canary deployments. Use Cloud Monitoring to look for performance issues. and ramp up traffic as the metrics support it.

Deploy the application via a continuous delivery pipeline using blue/green deployments. Use Cloud Monitoring to look for performance issues, and launch fully when the metrics support it.

Deploy the application using kubectl and set the spec.updateStrategv.type to RollingUpdate. Use Cloud Monitoring to look for performance issues, and run the kubectl rollback command if there are any issues.

Users are complaining that your Cloud Run-hosted website responds too slowly during traffic spikes. You want to provide a better user experience during traffic peaks. What should you do?

Perform as much work as possible in the background after the response has been returned to the user.

Read application configuration and static data from the database on application startup.

Package application configuration and static data into the application image during build time.

Perform as much work as possible in the background after the response has been returned to the user.

Ensure that timeout exceptions and errors cause the Cloud Run instance to exit quickly so a replacement instance can be started.

You are a developer working on an internal application for payroll processing. You are building a component of the application that allows an employee to submit a timesheet, which then initiates several steps:* An email is sent to the employee and manager, notifying them that the timesheet was submitted.* A timesheet is sent to payroll processing for the vendor's API.* A timesheet is sent to the data warehouse for headcount planning.These steps are not dependent on each other and can be completed in any order. New steps are being considered and will be implemented by different development teams. Each development team will implement the error handling specific to their step. What should you do?

Create a Pub/Sub topic for timesheet submissions. Create a subscription for each downstream development team to subscribe to the topic.

Deploy a Cloud Function for each step that calls the corresponding downstream system to complete the required action.

Create a Pub/Sub topic for each step. Create a subscription for each downstream development team to subscribe to their step's topic.

Create a Pub/Sub topic for timesheet submissions. Create a subscription for each downstream development team to subscribe to the topic.

Create a timesheet microservice deployed to Google Kubernetes Engine. The microservice calls each downstream step and waits for a successful response before calling the next step.

You are designing an application that uses a microservices architecture. You are planning to deploy the application in the cloud and on-premises. You want to make sure the application can scale up on demand and also use managed services as much as possible. What should you do?

Create a GKE cluster in each environment with Anthos, and use Cloud Run for Anthos to deploy your application to each cluster.

Deploy open source Istio in a multi-cluster deployment on multiple Google Kubernetes Engine (GKE) clusters managed by Anthos.

Create a GKE cluster in each environment with Anthos, and use Cloud Run for Anthos to deploy your application to each cluster.

Install a GKE cluster in each environment with Anthos, and use Cloud Build to create a Deployment for your application in each cluster.

Create a GKE cluster in the cloud and install open-source Kubernetes on-premises. Use an external load balancer service to distribute traffic across the two environments.

You want to migrate an on-premises container running in Knative to Google Cloud. You need to make sure that the migration doesn't affect your application's deployment strategy, and you want to use a fully managed service. Which Google Cloud service should you use to deploy your container?

App Engine flexible environment

This architectural diagram depicts a system that streams data from thousands of devices. You want to ingest data into a pipeline, store the data, and analyze the data using SQL statements. Which Google Cloud services should you use for steps 1, 2, 3, and 4?

1) Pub/Sub 2) Dataflow 3) Firestore 4) BigQuery

1) App Engine 2) Pub/Sub 3) BigQuery 4) Firestore

1) Dataflow 2) Pub/Sub 3) Firestore 4) BigQuery

1) Pub/Sub 2) Dataflow 3) BigQuery 4) Firestore

1) Pub/Sub 2) Dataflow 3) Firestore 4) BigQuery

You are developing an application that consists of several microservices running in a Google Kubernetes Engine cluster. One microservice needs to connect to a third-party database running on-premises. You need to store credentials to the database and ensure that these credentials can be rotated while following security best practices. What should you do?

Store the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.

Store the credentials in a sidecar container proxy, and use it to connect to the third-party database.

Configure a service mesh to allow or restrict traffic from the Pods in your microservice to the database.

Store the credentials in an encrypted volume mount, and associate a Persistent Volume Claim with the client Pod.

Store the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.

You are deploying a microservices application to Google Kubernetes Engine (GKE). The application will receive daily updates. You expect to deploy a large number of distinct containers that will run on the Linux operating system (OS). You want to be alerted to any known OS vulnerabilities in the new containers. You want to follow Google-recommended best practices. What should you do?

Use the Container Analysis REST API to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.

Use the gcloud CLI to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.

Enable Container Analysis, and upload new container images to Artifact Registry. Review the vulnerability results before each deployment.

Enable Container Analysis, and upload new container images to Artifact Registry. Review the critical vulnerability results before each deployment.

Use the Container Analysis REST API to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.

You are a developer at a large organization. You have an application written in Go running in a production Google Kubernetes Engine (GKE) cluster. You need to add a new feature that requires access to BigQuery. You want to grant BigQuery access to your GKE cluster following Google-recommended best practices. What should you do?

Create a Google service account and a Kubernetes service account. Configure Workload Identity on the GKE cluster, and reference the Kubernetes service account on the application Deployment.

Create a Google service account with BigQuery access. Add the JSON key to Secret Manager, and use the Go client library to access the JSON key.

Create a Google service account with BigQuery access. Add the Google service account JSON key as a Kubernetes secret, and configure the application to use this secret.

Create a Google service account with BigQuery access. Add the Google service account JSON key to Secret Manager, and use an init container to access the secret for the application to use.

Create a Google service account and a Kubernetes service account. Configure Workload Identity on the GKE cluster, and reference the Kubernetes service account on the application Deployment.

You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant access to your application following the principle of least privilege. What should you do?

Create a user-managed service account with a custom Identity and Access Management (IAM) role.

Create a user-managed service account with the Storage Admin Identity and Access Management (IAM) role.

Create a user-managed service account with the Project Editor Identity and Access Management (IAM) role.

Use the default service account linked to the Cloud Run revision in production.

Your team is developing unit tests for Cloud Function code. The code is stored in a Cloud Source Repositories repository. You are responsible for implementing the tests. Only a specific service account has the necessary permissions to deploy the code to Cloud Functions. You want to ensure that the code cannot be deployed without first passing the tests. How should you configure the unit testing process?

Configure Cloud Build to run the unit tests, using the specific service account as the build agent. If the code passes the tests, Cloud Build deploys the Cloud Function.

Configure Cloud Build to deploy the Cloud Function. If the code passes the tests, a deployment approval is sent to you.

Configure Cloud Build to deploy the Cloud Function, using the specific service account as the build agent. Run the unit tests after successful deployment.

Configure Cloud Build to run the unit tests. If the code passes the tests, the developer deploys the Cloud Function.

Configure Cloud Build to run the unit tests, using the specific service account as the build agent. If the code passes the tests, Cloud Build deploys the Cloud Function.

Your team detected a spike of errors in an application running on Cloud Run in your production project. The application is configured to read messages from Pub/Sub topic A, process the messages, and write the messages to topic B. You want to conduct tests to identify the cause of the errors. You can use a set of mock messages for testing. What should you do?

Use the gcloud CLI to write mock messages to topic A. Change the logging level in the application to DEBUG or INFO, and then analyze the logs.

Deploy the Pub/Sub and Cloud Run emulators on your local machine. Deploy the application locally, and change the logging level in the application to DEBUG or INFO. Write mock messages to topic A, and then analyze the logs.

Use the gcloud CLI to write mock messages to topic A. Change the logging level in the application to DEBUG or INFO, and then analyze the logs.

Deploy the Pub/Sub emulator on your local machine. Point the production application to your local Pub/Sub topics. Write mock messages to topic A, and then analyze the logs.

Use the Google Cloud console to write mock messages to topic A. Change the logging level in the application to DEBUG or INFO, and then analyze the logs.

You are developing a Java Web Server that needs to interact with Google Cloud services via the Google Cloud API on the user's behalf. Users should be able to authenticate to the Google Cloud API using their Google Cloud identities. Which workflow should you implement in your web application?

1) When a user arrives at your application, route them to a Google Cloud consent screen with a list of requested permissions that prompts the user to sign in with SSO to their Google Account. 2) After the user signs in and provides consent, your application receives an authorization code from a Google server. 3) The application requests a Google Server to exchange the authorization code with an access token. 4) The Google server responds with the access token that is used by the application to call the Google Cloud API.

1) When a user arrives at your application, prompt them for their Google username and password. 2) Store an SHA password hash in your application's database along with the user's username. 3) The application authenticates to the Google Cloud API using HTTPs requests with the user's username and password hash in the Authorization request header.

1) When a user arrives at your application, prompt them for their Google username and password. 2) Forward the user's username and password in an HTTPS request to the Google Cloud authorization server, and request an access token. 3) The Google server validates the user's credentials and returns an access token to the application. 4) The application uses the access token to call the Google Cloud API.

1) When a user arrives at your application, route them to a Google Cloud consent screen with a list of requested permissions that prompts the user to sign in with SSO to their Google Account. 2) After the user signs in and provides consent, your application receives an authorization code from a Google server. 3) The Google server returns the authorization code to the user, which is stored in the browser's cookies. 4) The user authenticates to the Google Cloud API using the authorization code in the cookie.

1) When a user arrives at your application, route them to a Google Cloud consent screen with a list of requested permissions that prompts the user to sign in with SSO to their Google Account. 2) After the user signs in and provides consent, your application receives an authorization code from a Google server. 3) The application requests a Google Server to exchange the authorization code with an access token. 4) The Google server responds with the access token that is used by the application to call the Google Cloud API.

You recently developed a new application. You want to deploy the application on Cloud Run without a Dockerfile. Your organization requires that all container images are pushed to a centrally managed container repository. How should you build your container using Google Cloud services? (Choose two.)

Push your source code to Artifact Registry.

Use the pack build command with pack CLI.

Push your source code to Artifact Registry.

Submit a Cloud Build job to push the image.

Use the pack build command with pack CLI.

Include the --source flag with the gcloud run deploy CLI command.

Include the --platform=kubernetes flag with the gcloud run deploy CLI command.

You manage your company's ecommerce platform's payment system, which runs on Google Cloud. Your company must retain user logs for 1 year for internal auditing purposes and for 3 years to meet compliance requirements. You need to store new user logs on Google Cloud to minimize on-premises storage usage and ensure that they are easily searchable. You want to minimize effort while ensuring that the logs are stored correctly. What should you do?

Store the logs in Cloud Logging as custom logs with a custom retention period.

Store the logs in a Cloud Storage bucket with bucket lock turned on.

Store the logs in a Cloud Storage bucket with a 3-year retention period.

Store the logs in Cloud Logging as custom logs with a custom retention period.

Store the logs in a Cloud Storage bucket with a 1-year retention period. After 1 year, move the logs to another bucket with a 2-year retention period.

Your company has a new security initiative that requires all data stored in Google Cloud to be encrypted by customer-managed encryption keys. You plan to use Cloud Key Management Service (KMS) to configure access to the keys. You need to follow the 'separation of duties' principle and Google-recommended best practices. What should you do? (Choose two.)

Provision Cloud KMS in its own project.

Do not assign an owner to the Cloud KMS project.

Provision Cloud KMS in its own project.

Do not assign an owner to the Cloud KMS project.

Provision Cloud KMS in the project where the keys are being used.

Grant the roles/cloudkms.admin role to the owner of the project where the keys from Cloud KMS are being used.

Grant an owner role for the Cloud KMS project to a different user than the owner of the project where the keys from Cloud KMS are being used.

You need to migrate a standalone Java application running in an on-premises Linux virtual machine (VM) to Google Cloud in a cost-effective manner. You decide not to take the lift-and-shift approach, and instead you plan to modernize the application by converting it to a container. How should you accomplish this task?

Use Jib to build a Docker image from your source code, and upload it to Artifact Registry. Deploy the application in a GKE cluster, and test the application.

Use Migrate for Anthos to migrate the VM to your Google Kubernetes Engine (GKE) cluster as a container.

Export the VM as a raw disk and import it as an image. Create a Compute Engine instance from the Imported image.

Use Migrate for Compute Engine to migrate the VM to a Compute Engine instance, and use Cloud Build to convert it to a container.

Use Jib to build a Docker image from your source code, and upload it to Artifact Registry. Deploy the application in a GKE cluster, and test the application.

Your organization has recently begun an initiative to replatform their legacy applications onto Google Kubernetes Engine. You need to decompose a monolithic application into microservices. Multiple instances have read and write access to a configuration file, which is stored on a shared file system. You want to minimize the effort required to manage this transition, and you want to avoid rewriting the application code. What should you do?

Create a new ConfigMap and volumeMount to store the contents of the configuration file.

Create a new Cloud Storage bucket, and mount it via FUSE in the container.

Create a new persistent disk, and mount the volume as a shared PersistentVolume.

Create a new Filestore instance, and mount the volume as an NFS PersistentVolume.

Create a new ConfigMap and volumeMount to store the contents of the configuration file.

Your development team has built several Cloud Functions using Java along with corresponding integration and service tests. You are building and deploying the functions and launching the tests using Cloud Build. Your Cloud Build job is reporting deployment failures immediately after successfully validating the code. What should you do?

Verify that the Cloud Build service account is assigned the Cloud Functions Developer role.

Check the maximum number of Cloud Function instances.

Verify that your Cloud Build trigger has the correct build parameters.

Retry the tests using the truncated exponential backoff polling strategy.

Verify that the Cloud Build service account is assigned the Cloud Functions Developer role.

You manage a microservices application on Google Kubernetes Engine (GKE) using Istio. You secure the communication channels between your microservices by implementing an Istio AuthorizationPolicy, a Kubernetes NetworkPolicy, and mTLS on your GKE cluster. You discover that HTTP requests between two Pods to specific URLs fail, while other requests to other URLs succeed. What is the cause of the connection issue?

The Authorization Policy of your cluster is blocking HTTP requests for specific paths within your application.

A Kubernetes NetworkPolicy resource is blocking HTTP traffic between the Pods.

The Pod initiating the HTTP requests is attempting to connect to the target Pod via an incorrect TCP port.

The Authorization Policy of your cluster is blocking HTTP requests for specific paths within your application.

The cluster has mTLS configured in permissive mode, but the Pod's sidecar proxy is sending unencrypted traffic in plain text.

You recently migrated an on-premises monolithic application to a microservices application on Google Kubernetes Engine (GKE). The application has dependencies on backend services on-premises, including a CRM system and a MySQL database that contains personally identifiable information (PII). The backend services must remain on-premises to meet regulatory requirements.You established a Cloud VPN connection between your on-premises data center and Google Cloud. You notice that some requests from your microservices application on GKE to the backend services are failing due to latency issues caused by fluctuating bandwidth, which is causing the application to crash. How should you address the latency issues?

Increase the number of Cloud VPN tunnels for the connection between Google Cloud and the on-premises services

Use Memorystore to cache frequently accessed PII data from the on-premises MySQL database

Use Istio to create a service mesh that includes the microservices on GKE and the on-premises services

Increase the number of Cloud VPN tunnels for the connection between Google Cloud and the on-premises services

Decrease the network layer packet size by decreasing the Maximum Transmission Unit (MTU) value from its default value on Cloud VPN

You are designing an application that consists of several microservices. Each microservice has its own RESTful API and will be deployed as a separate Kubernetes Service. You want to ensure that the consumers of these APIs aren't impacted when there is a change to your API, and also ensure that third-party systems aren't interrupted when new versions of the API are released. How should you configure the connection to the application following Google-recommended best practices?

Combine multiple versions in the same service, and then specify the API version in the POST request.

Use an Ingress that uses the API's URL to route requests to the appropriate backend.

Leverage a Service Discovery system, and connect to the backend specified by the request.

Use multiple clusters, and use DNS entries to route requests to separate versioned backends.

Combine multiple versions in the same service, and then specify the API version in the POST request.

Your team is building an application for a financial institution. The application's frontend runs on Compute Engine, and the data resides in Cloud SQL and one Cloud Storage bucket. The application will collect data containing PII, which will be stored in the Cloud SQL database and the Cloud Storage bucket. You need to secure the PII data. What should you do?

1) Configure a private IP address for Cloud SQL 2) Use VPC-SC to create a service perimeter 3) Add the Cloud SQL database and the Cloud Storage bucket to the same service perimeter

1) Create the relevant firewall rules to allow only the frontend to communicate with the Cloud SQL database 2) Using IAM, allow only the frontend service account to access the Cloud Storage bucket

1) Create the relevant firewall rules to allow only the frontend to communicate with the Cloud SQL database 2) Enable private access to allow the frontend to access the Cloud Storage bucket privately

1) Configure a private IP address for Cloud SQL 2) Use VPC-SC to create a service perimeter 3) Add the Cloud SQL database and the Cloud Storage bucket to the same service perimeter

1) Configure a private IP address for Cloud SQL 2) Use VPC-SC to create a service perimeter 3) Add the Cloud SQL database and the Cloud Storage bucket to different service perimeters

You are designing a chat room application that will host multiple rooms and retain the message history for each room. You have selected Firestore as your database. How should you represent the data in Firestore?

Create a collection for the rooms. For each room, create a document that contains a collection for documents, each of which contains a message.

Create a collection for the rooms. For each room, create a document that lists the contents of the messages

Create a collection for the rooms. For each room, create a collection that contains a document for each message

Create a collection for the rooms. For each room, create a document that contains a collection for documents, each of which contains a message.

Create a collection for the rooms, and create a document for each room. Create a separate collection for messages, with one document per message. Each room's document contains a list of references to the messages.

You are developing an application that will handle requests from end users. You need to secure a Cloud Function called by the application to allow authorized end users to authenticate to the function via the application while restricting access to unauthorized users. You will integrate Google Sign-In as part of the solution and want to follow Google-recommended best practices. What should you do?

Deploy from your local machine using gcloud and grant users the roles/cloudfunctions.admin role

Deploy from a source code repository and grant users the roles/cloudfunctions.viewer role.

Deploy from a source code repository and grant users the roles/cloudfunctions.invoker role

Deploy from your local machine using gcloud and grant users the roles/cloudfunctions.admin role

Deploy from your local machine using gcloud and grant users the roles/cloudfunctions.developer role

You are building a highly available and globally accessible application that will serve static content to users. You need to configure the storage and serving components. You want to minimize management overhead and latency while maximizing reliability for users. What should you do?

1) Create a Standard storage class, multi-regional Cloud Storage bucket. Put the static content in the bucket. 2) Reserve an external IP address, and create an external HTTP(S) load balancer. 3) Enable Cloud CDN, and send traffic to your backend bucket.

1) Create a managed instance group. Replicate the static content across the virtual machines (VMs) 2) Create an external HTTP(S) load balancer. 3) Enable Cloud CDN, and send traffic to the managed instance group.

1) Create an unmanaged instance group. Replicate the static content across the VMs. 2) Create an external HTTP(S) load balancer 3) Enable Cloud CDN, and send traffic to the unmanaged instance group.

1) Create a Standard storage class, regional Cloud Storage bucket. Put the static content in the bucket 2) Reserve an external IP address, and create an external HTTP(S) load balancer 3) Enable Cloud CDN, and send traffic to your backend bucket

1) Create a Standard storage class, multi-regional Cloud Storage bucket. Put the static content in the bucket. 2) Reserve an external IP address, and create an external HTTP(S) load balancer. 3) Enable Cloud CDN, and send traffic to your backend bucket.

You are writing from a Go application to a Cloud Spanner database. You want to optimize your application's performance using Google-recommended best practices. What should you do?

Write to Cloud Spanner using Cloud Client Libraries.

Write to Cloud Spanner using Google API Client Libraries

Write to Cloud Spanner using a custom gRPC client library.

Write to Cloud Spanner using a third-party HTTP client library.

You have an application deployed in Google Kubernetes Engine (GKE). You need to update the application to make authorized requests to Google Cloud managed services. You want this to be a one-time setup, and you need to follow security best practices of auto-rotating your security keys and storing them in an encrypted store. You already created a service account with appropriate access to the Google Cloud service. What should you do next?

Assign the Google Cloud service account to your GKE Pod using Workload Identity.

Export the Google Cloud service account, and share it with the Pod as a Kubernetes Secret.

Export the Google Cloud service account, and embed it in the source code of the application.

Export the Google Cloud service account, and upload it to HashiCorp Vault to generate a dynamic service account for your application.

You are planning to deploy hundreds of microservices in your Google Kubernetes Engine (GKE) cluster. How should you secure communication between the microservices on GKE using a managed service?

Install Anthos Service Mesh, and enable mTLS in your Service Mesh.

Use global HTTP(S) Load Balancing with managed SSL certificates to protect your services

Deploy open source Istio in your GKE cluster, and enable mTLS in your Service Mesh

Install cert-manager on GKE to automatically renew the SSL certificates.

Install Anthos Service Mesh, and enable mTLS in your Service Mesh.

You are developing an application that will store and access sensitive unstructured data objects in a Cloud Storage bucket. To comply with regulatory requirements, you need to ensure that all data objects are available for at least 7 years after their initial creation. Objects created more than 3 years ago are accessed very infrequently (less than once a year). You need to configure object storage while ensuring that storage cost is optimized. What should you do? (Choose two.)

Set a retention policy on the bucket with a period of 7 years.

Create an object lifecycle policy on the bucket that moves objects from Standard Storage to Archive Storage after 3 years.

Set a retention policy on the bucket with a period of 7 years.

Use IAM Conditions to provide access to objects 7 years after the object creation date.

Enable Object Versioning to prevent objects from being accidentally deleted for 7 years after object creation.

Create an object lifecycle policy on the bucket that moves objects from Standard Storage to Archive Storage after 3 years.

Implement a Cloud Function that checks the age of each object in the bucket and moves the objects older than 3 years to a second bucket with the Archive Storage class. Use Cloud Scheduler to trigger the Cloud Function on a daily schedule.

Google Professional Cloud Developer Practice Test 5 - Free Online Exam Prep & Questions

Your operations team has asked you to create a script that lists the Cloud Bigtable, Memorystore, and Cloud SQL databases running within a project. The script should allow users to submit a filter expression to limit the results presented. How should you retrieve the data?

Become a Premium Member for full access

Unlock Premium Member

Google Professional Cloud Developer Practice Test 5

Question

Google Professional Cloud Developer Practice Tests

Practice Tests