Free Professional Cloud DevOps Engineer practice test: 30 questions with answers

Cloud Build can read secrets from Secret Manager at build time when they are declared in availableSecrets, and the build service account needs the Secret Accessor role on that secret. Trigger substitutions, image layers and committed files all expose the value to anyone who can read the repository, logs or images.

Binary Authorization evaluates signed attestations for images at deploy time and blocks any image that does not satisfy the policy. Cloud Armor filters network traffic, VPC Service Controls limits data movement across perimeters, and IAP controls user access, so none of them check image provenance.

A Cloud Deploy delivery pipeline lists the ordered targets, and releases are promoted through them in sequence. Skaffold describes how to build and render artifacts, a Cloud Build trigger starts builds, and Artifact Registry stores images without defining promotion order.

The Cloud Storage backend supports state locking, so concurrent applies wait instead of overwriting each other, and versioning allows earlier state to be recovered. Local state synced through git cannot lock, and a bucket with versioning off simply lets the last writer win.

Evaluating the plan output with policy checks catches disallowed settings before apply, and it is a read-only gate. Load tests, chaos experiments and penetration tests all act on running systems, which is the wrong place to discover configuration mistakes.

Digest pinning makes builds reproducible and scanning before promotion blocks known-bad images, so both reduce risk. The other options remove tests, use mutable tags, or give builds excessive and long-lived credentials, which all increase risk.

An alerting policy on the request latency distribution with a percentile aligner and a duration condition expresses exactly this rule. A log-based metric or an uptime check measures different things, and a notification channel only delivers alerts after a policy has decided to fire.

Retention is controlled by the log bucket, and a log sink exports a copy to BigQuery for analysis, so both pieces are needed. Pub/Sub is a delivery channel with short message retention, and persistent disk snapshots are not a logging destination.

Cloud Trace records spans for each hop of a request, so the per-service latency breakdown is visible in one view. Cloud Profiler shows code-level CPU and memory use, Error Reporting groups exceptions, and Network Intelligence Center analyzes network topology.

Cloud Profiler collects low-overhead sampling profiles from running production code and shows where CPU time is spent by function. Cloud Trace shows request latency across services rather than code hot spots.

A Pending Pod with an insufficient CPU event means no node has enough allocatable CPU for its request, so the request sizes and the node pool autoscaler limits are the first things to check. Probes run only after scheduling, and recreating a Service does not change resource fit.

A snooze suppresses notifications for selected policies for a defined period and leaves the configuration intact, so monitoring resumes automatically afterward. Deleting and recreating policies loses history and risks forgetting them, while changing channels or durations alters the alerts themselves.

An exhausted error budget is the trigger defined by the error budget policy to slow risky changes and spend effort on reliability. Changing the SLO target, its window, or how failures are counted only hides the problem and breaks the agreement with the business.

A good SLI is a ratio of good events to valid events, and for an API the good events are successful responses returned within a latency bound. CPU, restart counts and disk IOPS are infrastructure signals that may correlate with user pain but do not describe it directly.

A blameless postmortem captures how the system failed and tracks concrete, owned follow-up work that prevents recurrence. Attributing the failure to one engineer or to a vendor, or simply adding staff, leaves the conditions that allowed the failure in place.

Toil is manual, repetitive, automatable operational work that grows with service size and produces no lasting improvement. The manual restart fits that definition, while the other tasks create engineering value or reduce future operational work.

Burn-rate alerts tie paging to consumption of the user-facing error budget, so they page for real impact and not for noise. CPU, individual error lines and replica lag are cause-level signals that can fire constantly without any effect on users.

Gradual traffic splitting between revisions limits the blast radius, and watching error rate and latency lets the team stop or roll back quickly. Sending all traffic at once or relying on user reports removes that safety net entirely.

Spot VMs offer the deepest discount and suit interruptible work when the job can resume from a checkpoint. Committed use discounts reward steady baseline usage, which a nightly job does not provide, and disk reservations do not reduce compute cost.

Minimum instances keeps a warm instance ready, which removes most cold-start latency for the first requests after idle time. Raising the maximum does not help a single cold request, and changing platform or timeout does not change start-up behavior.

Committed use discounts lower the price of steady usage and rightsizing shrinks over-provisioned machines, and neither requires code changes. Trace sampling, Cloud Armor and identity audit logs do not reduce the compute bill for the workload.

Cloud Billing budgets support threshold rules that send notifications, and the budget can publish to Pub/Sub for automation. A dashboard does not notify anyone, and organization policies cannot cap spending in the way the scenario describes.

Cross-region transfer is billed as egress, so keeping the reader near the data or caching locally removes most of that cost. Flow logs, more instances and disabling a CDN either add cost or increase origin traffic.

Billing export to BigQuery keeps daily line-item detail, including resource labels, so spend can be grouped by team automatically. Renaming projects and moving them into folders does not allocate cost, and labeling only storage ignores the rest of the spend.

The gcp.resourceLocations constraint is enforced at the organization node, so it covers existing and future projects without per-project work. VPC Service Controls limits data movement across perimeters rather than resource placement, and Asset Inventory only reports violations after they happen.

roles/run.developer allows creating and updating services and revisions without the permission to set IAM policies. roles/run.admin does include IAM management for Cloud Run resources, and roles/editor grants much broader write access across the whole project than the scenario allows.

Shared VPC lets a host project own the network and subnets while service projects consume them, keeping separate billing and IAM boundaries. Peering links separate networks that each project still owns, and Cloud VPN is for hybrid connectivity rather than sharing one project-level network.

A folder hierarchy lets policy and IAM be inherited by environment, and separating billing administration from project owners limits who can change spend. Broad Owner grants, a single shared project and disabling Admin Activity logs each weaken access control or auditability.

Workload Identity Federation exchanges the short-lived GitHub OIDC token for Google credentials, so no key is stored, and an attribute condition can restrict the mapping to one repository. A stored JSON key, even if rotated, is still a long-lived secret, and the default runner identity with Owner grants far too much.

IAM Conditions can restrict a role binding by request time, so access is granted only inside the defined window and expires automatically outside it. Scheduler-driven binding changes depend on a job succeeding, and VPC Service Controls access levels filter by network origin rather than time.