Professional Cloud DevOps Engineer

Last checked October 22, 2026 against the official Google Cloud exam page.

1. Question 1Build and implement CI/CD pipelines

   A Cloud Build pipeline must run unit tests before deploying, and the deploy step needs a database password. The password must not appear in the repository or in trigger settings. Which configuration is BEST?

   1. AStore the password as a plaintext substitution variable in the trigger definition and mask the value in build logs
   2. BWrite the password into a Dockerfile ENV instruction in the test step and build the image there before deploying
   3. CStore the password in Secret Manager and reference it through availableSecrets in cloudbuild.yaml
   4. DCommit an encrypted .env file and decrypt it in the deploy step with a passphrase that the whole team shares
   Show answer and explanationHide answer

   Correct answer: C

   Cloud Build can read secrets from Secret Manager at build time when they are declared in availableSecrets, and the build service account needs the Secret Accessor role on that secret. Trigger substitutions, image layers and committed files all expose the value to anyone who can read the repository, logs or images.

2. Question 2Implement observability practices and troubleshoot issues

   A team needs an alert when the p95 request latency of a Cloud Run service stays above 500 ms for 5 minutes. Which Cloud Monitoring configuration does this?

   1. AAn alerting policy on the request latency distribution metric, with a 95th percentile aligner and a 5-minute duration condition
   2. BAn uptime check that fetches the service URL every minute and alerts on a 500 ms response timeout
   3. CA log-based metric that counts requests whose log entries record a latency above 500 ms
   4. DA notification channel that sends an email to the on-call group whenever a deployment completes successfully
   Show answer and explanationHide answer

   Correct answer: A

   An alerting policy on the request latency distribution with a percentile aligner and a duration condition expresses exactly this rule. A log-based metric or an uptime check measures different things, and a notification channel only delivers alerts after a policy has decided to fire.

3. Question 3Apply SRE practices

   A checkout API has a 99.9% availability SLO over 28 days. Most of its error budget was spent in the first week. According to SRE practice, what should the team do first?

   1. AAdd client-side retries so that failed requests are no longer counted as errors in the SLI
   2. BFreeze non-urgent production changes and direct engineers to reliability fixes until the budget recovers
   3. CShorten the SLO window to 7 days so that the early failures roll out of the measurement
   4. DRaise the SLO to 99.95% so that the budget looks healthier on the dashboard
   Show answer and explanationHide answer

   Correct answer: B

   An exhausted error budget is the trigger defined by the error budget policy to slow risky changes and spend effort on reliability. Changing the SLO target, its window, or how failures are counted only hides the problem and breaks the agreement with the business.

4. Question 4Optimize performance and cost

   A nightly batch job on Compute Engine can tolerate interruption and checkpoints its progress. Which purchase option reduces the cost of that workload the most?

   1. AReserved standard persistent disks attached to on-demand machines for the batch volume
   2. BCommitted use discounts on a three-year commitment for the batch machine family
   3. CSpot VMs with checkpointing and automatic restart after preemption
   4. DOn-demand VMs with the sustained use discount assumed to apply every month
   Show answer and explanationHide answer

   Correct answer: C

   Spot VMs offer the deepest discount and suit interruptible work when the job can resume from a checkpoint. Committed use discounts reward steady baseline usage, which a nightly job does not provide, and disk reservations do not reduce compute cost.

5. Question 5Bootstrap and maintain a Google Cloud organization

   A security team must stop anyone in any project under the organization from creating Compute Engine resources outside europe-west1 and europe-west4, including projects created later. Which approach meets this with the least ongoing administration?

   1. AEnable Cloud Asset Inventory feeds that alert the security team when resources appear in other regions
   2. BCreate a VPC Service Controls perimeter around every project and restrict the Compute Engine API inside it
   3. CGrant each project team the Compute Viewer role and review new resources in Cloud Logging every week
   4. DSet the gcp.resourceLocations constraint at the organization node, allowing only the two regions
   Show answer and explanationHide answer

   Correct answer: D

   The gcp.resourceLocations constraint is enforced at the organization node, so it covers existing and future projects without per-project work. VPC Service Controls limits data movement across perimeters rather than resource placement, and Asset Inventory only reports violations after they happen.