Professional Cloud Developer

Last checked October 22, 2026 against the official Google Cloud exam page.

1. Question 1Integrating Google Cloud services

   A Cloud Run service must read a database password at runtime. The password must be rotatable without rebuilding the image, and the service account should have no access to other secrets. Which configuration is best?

   1. AStore the password in Secret Manager and grant the service account access to that secret only
   2. BBake the password into the container image as an environment variable and rebuild at each rotation
   3. CStore the password in a plain text file in the bucket that serves the site's static assets
   4. DGrant the service account the Project Owner role so it can read any secret created later
   Show answer and explanationHide answer

   Correct answer: A

   Secret Manager supports new versions without a rebuild, and per-secret IAM keeps the service account narrowly scoped. Baking secrets into images forces rebuilds and exposes the value in image layers. A public static bucket is not a secret store, and Owner grants far more access than the service needs.

2. Question 2Deploying applications

   A team deploys a Cloud Run service with a new revision and wants 10 percent of traffic to go to it while the rest stays on the current revision, with a quick rollback path. Which approach is correct?

   1. ADeploy with the no-traffic flag, then use update-traffic to send the revision 10 percent
   2. BDeploy with a minimum of ten instances so the revision receives requests in proportion to its size
   3. CDeploy with a ten-second request timeout so slow requests fall back to the previous revision automatically
   4. DDeploy as a separate service and add a DNS record weighted at 10 percent for its hostname
   Show answer and explanationHide answer

   Correct answer: A

   Deploying with --no-traffic keeps the new revision out of rotation, and update-traffic then assigns it a 10 percent share while the old revision keeps the rest. Rolling back is a single traffic change to the old revision. Instance counts do not divide traffic, and a timeout does not route requests to a fallback revision.

3. Question 3Designing highly scalable, reliable cloud-native applications

   A team runs a stateless Cloud Run service that serves an interactive API. Users report a multi-second delay on the first request after quiet periods, but steady traffic is fast. Which change addresses the cause with the least redesign?

   1. AKeep a minimum number of warm instances ready to serve incoming requests
   2. BRaise the request timeout so slow first requests do not return a 504 error to the client
   3. CMove the service to a regional managed instance group that autoscales on CPU utilization
   4. DEnable session affinity so repeat requests from a client reach the same container instance
   Show answer and explanationHide answer

   Correct answer: A

   The delay comes from cold starts, when Cloud Run must start a new container before it can serve a request. A minimum instance count keeps warm instances available, so the first request after a quiet period does not wait for startup. Session affinity only routes a client to the same instance and does nothing for startup latency, and a raised timeout hides the symptom without fixing it.

4. Question 4Building and testing applications

   A developer needs to run unit tests for a Cloud Function that reads from Firestore. The tests must not write to production data and must run on a laptop without network access to Google Cloud. What should the developer use?

   1. AA second Firestore database in the production project, with the developer's user granted write access
   2. BA service account key with the Owner role on a shared sandbox project that uses production data
   3. CAn export of the production database to Cloud Storage, which the tests read as local JSON files
   4. DThe Firestore emulator started locally, with the client pointed at it through FIRESTORE_EMULATOR_HOST
   Show answer and explanationHide answer

   Correct answer: D

   The Firestore emulator runs locally, and the client libraries switch to it when FIRESTORE_EMULATOR_HOST is set, so tests need no network access and cannot reach production data. A second database in the production project still depends on the cloud and risks mixing data. Exports are snapshots rather than a live test target, and owner-level keys break least privilege.

5. Question 5Integrating Google Cloud services

   A backend on Compute Engine calls Google Cloud APIs with a service account. The developer must avoid creating and storing long-lived key files. Which approach should the developer use?

   1. ACreate an API key on the Credentials page and pass it as a query parameter on each request
   2. BAttach the service account to the VM so the client libraries get credentials from the metadata server
   3. CSet the developer's personal Google credentials in an environment variable on the VM
   4. DCreate a JSON key for the service account, embed it in the source, and rotate it quarterly
   Show answer and explanationHide answer

   Correct answer: C

   When a service account is attached to a Compute Engine VM, Application Default Credentials fetch short-lived tokens from the metadata server, so no key file is needed. Embedding a JSON key creates a long-lived secret to protect. API keys do not identify a workload with IAM permissions, and personal credentials should never be used by a service.