Free Professional Cloud Developer practice test: 30 questions with answers

Secret Manager supports new versions without a rebuild, and per-secret IAM keeps the service account narrowly scoped. Baking secrets into images forces rebuilds and exposes the value in image layers. A public static bucket is not a secret store, and Owner grants far more access than the service needs.

When a service account is attached to a Compute Engine VM, Application Default Credentials fetch short-lived tokens from the metadata server, so no key file is needed. Embedding a JSON key creates a long-lived secret to protect. API keys do not identify a workload with IAM permissions, and personal credentials should never be used by a service.

A retry policy with backoff and a dead-letter topic lets failed messages retry and then be set aside after a limit, so newer messages are not blocked. Short retention and manual restarts depend on people, not on the system. Publishing duplicates does not give reliable recovery, and polling a database adds load and latency.

Cloud Storage can publish OBJECT_FINALIZE notifications to Pub/Sub, which decouples the services and avoids polling. Listing the bucket on a schedule is polling and scales poorly. A direct call from the client can fail silently, and versioning records history without announcing completion.

The objectCreator role on the single destination bucket grants only permission to write objects, which matches the requirement. Storage Admin and Editor grant far broader access than writing one bucket needs. Owner on the bucket also allows deleting objects and changing permissions, which is more than required.

The Cloud Run Invoker role on the callee lets only the caller's service account invoke it, and the caller presents an ID token for the callee's audience. Public access with IP checks is weak, and sharing owner credentials is unsafe. A VPC alone does not authorize requests, because Cloud Run still checks IAM.

Secret Manager with narrowly scoped access keeps secrets out of code and logs, and Application Default Credentials avoid long-lived key files on managed platforms. Logging authorization headers and committing keys leak secrets, and an encrypted key with its password shared in chat is still exposed. These are the mistakes the question is testing for.

Several pull consumers on one subscription share the work, and autoscaling those consumers on backlog adds throughput as the queue grows. Shorter retention can lose messages, and a longer acknowledgement deadline does not add capacity. Ordering serialises processing, which reduces throughput rather than increasing it.

Deploying with --no-traffic keeps the new revision out of rotation, and update-traffic then assigns it a 10 percent share while the old revision keeps the rest. Rolling back is a single traffic change to the old revision. Instance counts do not divide traffic, and a timeout does not route requests to a fallback revision.

A digest identifies the exact image content, so deploying by digest guarantees the tested artifact is the one that runs. Rebuilding during deploy can produce different bytes from the tested build. A mutable latest tag can move after testing, and vulnerability scanning reduces risk but does not pin content.

A managed instance group built from an instance template keeps the fleet identical and supports rolling updates gated by health checks. Hand-created VMs drift apart from each other, and a single large VM is a single point of failure. Reading configuration only at boot prevents a gradual rollout from ever taking effect on running VMs.

Cloud Deploy lets a target require approval, and promoting one release keeps the same artifact that was tested earlier in the pipeline. Rebuilding in production breaks the link to the tested artifact. A branch-triggered deploy bypasses both the approval and the promotion model.

Cloud Run passes the port to listen on in the PORT variable, so reading that value keeps the application in step with the platform. A longer timeout does not change which port is listened on. More CPU does not fix a port mismatch, and moving to a VM changes the platform without addressing the cause.

Deploying from a tagged commit ties the running code to a reviewable source version, and labels that record the build ID and commit SHA make each deployment traceable. Deploying from local files and editing in the console both break the link between code and deployment. Automatic runtime upgrades can change behaviour without any reviewed change.

A startup probe checks the health endpoint and keeps the revision from receiving traffic until it passes. Limiting instances still lets traffic through once one instance serves a request. CPU boost and large minimum counts do not check readiness, and both add cost.

With maxUnavailable at 10 percent, at most one of ten pods is taken down at a time, and maxSurge lets extra pods start first so capacity stays up. Recreate removes every old pod before new ones start, which causes downtime. A single replica cannot provide 90 percent availability, and a DaemonSet is for node-level agents rather than scaled services.

The delay comes from cold starts, when Cloud Run must start a new container before it can serve a request. A minimum instance count keeps warm instances available, so the first request after a quiet period does not wait for startup. Session affinity only routes a client to the same instance and does nothing for startup latency, and a raised timeout hides the symptom without fixing it.

Retries and at-least-once delivery both mean the same operation can arrive more than once, so the handler must be idempotent. Storing a client-supplied idempotency key with the completed result lets a repeat return the original outcome instead of charging again. A longer acknowledgement deadline only reduces how often redelivery happens and does not prevent duplicate processing.

Cloud Spanner provides relational schemas, ACID transactions and synchronous replication across a multi-region configuration, and it scales horizontally. Cross-region read replicas in Cloud SQL do not give globally consistent writes, because writes still go to one primary. Bigtable scales well but is a wide-column store without multi-row relational transactions.

Pub/Sub guarantees order only for messages that share an ordering key when message ordering is enabled on the publisher and subscription. Using the customer ID as the key keeps each customer ordered while allowing different customers in parallel. One topic per customer does not scale, and retry policies and acknowledgement deadlines do not guarantee ordered delivery.

Each Cloud Run instance opens its own connections, so the total grows with the instance count. Pooling inside each instance and capping the maximum instance count keeps the total within the database limit, while the Cloud SQL connector handles secure connectivity. A larger machine only raises the limit, and Memorystore is a cache that cannot replace a relational store.

Cloud Run instances are stateless and can be created or removed at any time, so session data must live in a shared store that any instance can read. Session affinity is a workaround that breaks on scale-in and restarts. More memory and fixed instance counts only delay the failure.

Cloud Run is a regional service that spreads instances across zones, and traffic shifting between revisions gives a fast rollback path. High availability on a regional database keeps data reachable when one zone fails. A single zone, local state and a maximum of one instance each create a single point of failure.

The Firestore emulator runs locally, and the client libraries switch to it when FIRESTORE_EMULATOR_HOST is set, so tests need no network access and cannot reach production data. A second database in the production project still depends on the cloud and risks mixing data. Exports are snapshots rather than a live test target, and owner-level keys break least privilege.

Cloud Build runs steps in the order listed unless waitFor says otherwise, and a failed step stops the build by default. Placing the test step first, with later steps depending on it, means the image is never pushed when tests fail. Setting waitFor to '-' starts steps in parallel and removes the dependency on tests, which is the opposite of the requirement.

A disposable project per pull request isolates test data and lets the pipeline use a scoped service account rather than a long-lived shared key. Storing an owner key in the repository violates least privilege and secret handling. Running tests against production risks real data, and pure stubs do not test the real API behaviour the requirement names.

A race condition appears only under concurrent access, so concurrent load against a realistic environment is the approach most likely to expose it. Code review can catch some issues but does not reproduce timing. More CPU hides the symptom, and disabling the cache removes the very code path under test.

Cloud Trace records per-request spans, so comparing the span breakdown for the affected endpoint across revisions shows which call grew. A log export counts requests but does not show where time went. Uptime checks measure reachability rather than latency inside the service, and storage lifecycle policies are unrelated to request latency.

Revision tags let a team deploy with no traffic and test the new revision through its own URL, so the contract is checked before users are affected. Shifting full traffic first and rolling back reactively exposes users to the failure. Deleting the old revision removes the rollback path, and minimum instance settings have nothing to do with contract checks.

Lockfiles fix dependency versions so the same inputs produce the same build, and pinning the base image by digest stops silent changes from upstream. A latest tag changes underneath the build. Running against production risks real data, and skipping tests on pull requests lets regressions merge.