[2023] Valid Professional-Cloud-DevOps-Engineer test answers & Google Professional-Cloud-DevOps-Engineer exam pdf
Verified Professional-Cloud-DevOps-Engineer dumps Q&As - Pass Guarantee or Full Refund
Google Professional-Cloud-DevOps-Engineer exam is a comprehensive assessment that tests the candidate's knowledge and skills in various areas of cloud-based DevOps engineering. Professional-Cloud-DevOps-Engineer exam consists of multiple-choice questions and requires the candidate to demonstrate a deep understanding of the subject matter. Professional-Cloud-DevOps-Engineer exam is designed to evaluate the candidate's ability to apply their knowledge and skills to real-world scenarios.
NEW QUESTION # 24
You have a CI/CD pipeline that uses Cloud Build to build new Docker images and push them to Docker Hub. You use Git for code versioning. After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline. You need to resolve the issue following Site Reliability Engineering practices. What should you do?
- A. Upload the configuration YAML file to Cloud Storage and use Error Reporting to identify and fix the issue.
- B. Run a Git compare between the previous and current Cloud Build Configuration files to find and fix the bug.
- C. Disable the CI pipeline and revert to manually building and pushing the artifacts.
- D. Change the CI pipeline to push the artifacts to Container Registry instead of Docker Hub.
Answer: D
NEW QUESTION # 25
You have migrated an e-commerce application to Google Cloud Platform (GCP). You want to prepare the application for the upcoming busy season. What should you do first to prepare for the busy season?
- A. Load teat the application to profile its performance for scaling.
- B. Enable AutoScaling on the production clusters, in case there is growth.
- C. Create a runbook on inflating the disaster recovery (DR) environment if there is growth.
- D. Pre-provision double the compute power used last season, expecting growth.
Answer: A
Explanation:
https://cloud.google.com/blog/topics/retail/preparing-for-peak-holiday-season-while-wfh
NEW QUESTION # 26
Your organization is using Helm to package containerized applications Your applications reference both public and private charts Your security team flagged that using a public Helm repository as a dependency is a risk You want to manage all charts uniformly, with native access control and VPC Service Controls What should you do?
- A. Store public and private charts by using GitHub Enterprise with Google Workspace as the identity provider
- B. Store public and private charts by using Git repository Configure Cloud Build to synchronize contents of the repository into a Cloud Storage bucket Connect Helm to the bucket by using https: // [bucket]
.srorage.googleapis.com/ [holnchart] as the Helm repository - C. Configure a Helm chart repository server to run in Google Kubernetes Engine (GKE) with Cloud Storage bucket as the storage backend
- D. Store public and private charts in OCI format by using Artifact Registry
Answer: D
Explanation:
Explanation
The best option for managing all charts uniformly, with native access control and VPC Service Controls is to store public and private charts in OCI format by using Artifact Registry. Artifact Registry is a service that allows you to store and manage container images and other artifacts in Google Cloud. Artifact Registry supports OCI format, which is an open standard for storing container images and other artifacts such as Helm charts. You can use Artifact Registry to store public and private charts in OCI format and manage them uniformly. You can also use Artifact Registry's native access control features, such as IAM policies and VPC Service Controls, to secure your charts and control who can access them.
NEW QUESTION # 27
You are running an application in a virtual machine (VM) using a custom Debian image. The image has the Stackdriver Logging agent installed. The VM has the cloud-platform scope. The application is logging information via syslog. You want to use Stackdriver Logging in the Google Cloud Platform Console to visualize the logs. You notice that syslog is not showing up in the "All logs" dropdown list of the Logs Viewer. What is the first thing you should do?
- A. Look for the agent's test log entry in the Logs Viewer.
- B. Install the most recent version of the Stackdriver agent.
- C. Verify the VM service account access scope includes the monitoring.write scope.
- D. SSH to the VM and execute the following commands on your VM: ps ax I grep fluentd
Answer: D
Explanation:
Explanation
https://cloud.google.com/compute/docs/access/service-accounts#associating_a_service_account_to_an_instance
NEW QUESTION # 28
Your company runs an ecommerce website built with JVM-based applications and microservice architecture in Google Kubernetes Engine (GKE) The application load increases during the day and decreases during the night Your operations team has configured the application to run enough Pods to handle the evening peak load You want to automate scaling by only running enough Pods and nodes for the load What should you do?
- A. Configure the Vertical Pod Autoscaler and enable the cluster autoscaler
- B. Configure the Horizontal Pod Autoscaler but keep the node pool size static
- C. Configure the Vertical Pod Autoscaler but keep the node pool size static
- D. Configure the Horizontal Pod Autoscaler and enable the cluster autoscaler
Answer: D
Explanation:
Explanation
The best option for automating scaling by only running enough Pods and nodes for the load is to configure the Horizontal Pod Autoscaler and enable the cluster autoscaler. The Horizontal Pod Autoscaler is a feature that automatically adjusts the number of Pods in a deployment or replica set based on observed CPU utilization or custom metrics. The cluster autoscaler is a feature that automatically adjusts the size of a node pool based on the demand for node capacity. By using both features together, you can ensure that your application runs enough Pods to handle the load, and that your cluster runs enough nodes to host the Pods. This way, you can optimize your resource utilization and cost efficiency.
NEW QUESTION # 29
You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (Pll) is leaking into certain log entry fields. All Pll entries begin with the text userinfo. You want to capture these log entries in a secure location for later review and prevent them from leaking to Stackdriver Logging. What should you do?
- A. Create a basic log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
- B. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, create an advanced log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
- C. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, and then copy the entries to a Cloud Storage bucket.
- D. Create an advanced log filter matching userinfo, configure a log export in the Stackdriver console with Cloud Storage as a sink, and then configure a tog exclusion with userinfo as a filter.
Answer: C
Explanation:
Explanation
https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76
NEW QUESTION # 30
You have migrated an e-commerce application to Google Cloud Platform (GCP). You want to prepare the application for the upcoming busy season. What should you do first to prepare for the busy season?
- A. Load teat the application to profile its performance for scaling.
- B. Enable AutoScaling on the production clusters, in case there is growth.
- C. Create a runbook on inflating the disaster recovery (DR) environment if there is growth.
- D. Pre-provision double the compute power used last season, expecting growth.
Answer: A
Explanation:
Explanation
https://cloud.google.com/blog/topics/retail/preparing-for-peak-holiday-season-while-wfh
NEW QUESTION # 31
You use Cloud Build to build your application. You want to reduce the build time while minimizing cost and development effort. What should you do?
- A. Use multiple smaller build steps to minimize execution time.
- B. Use Cloud Storage to cache intermediate artifacts.
- C. Run multiple Jenkins agents to parallelize the build.
- D. Use larger Cloud Build virtual machines (VMs) by using the machine-type option.
Answer: A
Explanation:
Explanation
https://cloud.google.com/storage/docs/best-practices
https://cloud.google.com/build/docs/speeding-up-builds#caching_directories_with_google_cloud_storage Caching directories with Google Cloud Storage To increase the speed of a build, reuse the results from a previous build. You can copy the results of a previous build to a Google Cloud Storage bucket, use the results for faster calculation, and then copy the new results back to the bucket. Use this method when your build takes a long time and produces a small number of files that does not take time to copy to and from Google Cloud Storage.
upvoted 2 times
NEW QUESTION # 32
You are ready to deploy a new feature of a web-based application to production. You want to use Google Kubernetes Engine (GKE) to perform a phased rollout to half of the web server pods.
What should you do?
- A. Use Node taints with NoExecute.
- B. Use a stateful set with parallel pod management policy.
- C. Use a partitioned rolling update.
- D. Use a replica set in the deployment specification.
Answer: C
Explanation:
https://medium.com/velotio-perspectives/exploring-upgrade-strategies-for-stateful-sets-in-kubernetes-c02b8286f251
NEW QUESTION # 33
You encounter a large number of outages in the production systems you support. You receive alerts for all the outages that wake you up at night. The alerts are due to unhealthy systems that are automatically restarted within a minute. You want to set up a process that would prevent staff burnout while following Site Reliability Engineering practices. What should you do?
- A. Create an incident report for each of the alerts.
- B. Redefine the related Service Level Objective so that the error budget is not exhausted.
- C. Distribute the alerts to engineers in different time zones.
- D. Eliminate unactionable alerts.
Answer: D
Explanation:
Eliminate bad monitoring : Unactionable alerts (i.e., spam) https://cloud.google.com/blog/products/management-tools/meeting-reliability-challenges-with-sre-principles agree with kyubiblaze about having to remove unactionable items aka spam: "good monitoring alerts on actionable problems" @ https://cloud.google.com/blog/products/management-tools/meeting-reliability-challenges-with-sre-principles
NEW QUESTION # 34
You are configuring Cloud Logging for a new application that runs on a Compute Engine instance with a public IP address. A user-managed service account is attached to the instance. You confirmed that the necessary agents are running on the instance but you cannot see any log entries from the instance in Cloud Logging. You want to resolve the issue by following Google-recommended practices. What should you do?
- A. Add the Logs Writer role to the service account.
- B. Enable Private Google Access on the subnet that the instance is in.
- C. Export the service account key and configure the agents to use the key.
- D. Update the instance to use the default Compute Engine service account.
Answer: A
Explanation:
Explanation
The correct answer is A. Add the Logs Writer role to the service account.
To use Cloud Logging, the service account attached to the Compute Engine instance must have the necessary permissions to write log entries. The Logs Writer role (roles/logging.logWriter) provides this permission. You can grant this role to the user-managed service account at the project, folder, or organization level1.
Private Google Access is not required for Cloud Logging, as it allows instances without external IP addresses to access Google APIs and services2. The default Compute Engine service account already has the Logs Writer role, but it is not a recommended practice to use it for user applications3. Exporting the service account key and configuring the agents to use the key is not a secure way of authenticating the service account, as it exposes the key to potential compromise4.
References:
1: Access control with IAM | Cloud Logging | Google Cloud
2: Private Google Access overview | VPC | Google Cloud
3: Service accounts | Compute Engine Documentation | Google Cloud
4: Best practices for securing service accounts | IAM Documentation | Google Cloud
NEW QUESTION # 35
You are managing an application that runs in Compute Engine The application uses a custom HTTP server to expose an API that is accessed by other applications through an internal TCP/UDP load balancer A firewall rule allows access to the API port from 0.0.0-0/0. You need to configure Cloud Logging to log each IP address that accesses the API by using the fewest number of steps What should you do Bret?
- A. Install the Ops Agent on the Compute Engine instances.
- B. Enable logging on the firewall rule
- C. Enable VPC Flow Logs on the subnet
- D. Enable Packet Mirroring on the VPC
Answer: B
Explanation:
Explanation
The best option for configuring Cloud Logging to log each IP address that accesses the API by using the fewest number of steps is to enable logging on the firewall rule. A firewall rule is a rule that controls the traffic to and from your Compute Engine instances. You can enable logging on a firewall rule to capture information about the traffic that matches the rule, such as source and destination IP addresses, protocols, ports, and actions. You can use Cloud Logging to view and export the firewall logs to other destinations, such as BigQuery, for further analysis.
NEW QUESTION # 36
Your application images are built wing Cloud Build and pushed to Google Container Registry (GCR). You want to be able to specify a particular version of your application for deployment based on the release version tagged in source control. What would you do when you push the image?
- A. Use Cloud Build to include the release version tag in the application image.
- B. Supply the source control tag as a parameter within the image name.
- C. Use GCR digest versioning to match the image to the tag in source control.
- D. Reference the image digest in the source control tag.
Answer: A
NEW QUESTION # 37
Your product is currently deployed in three Google Cloud Platform (GCP) zones with your users divided between the zones. You can fail over from one zone to another, but it causes a 10-minute service disruption for the affected users. You typically experience a database failure once per quarter and can detect it within five minutes. You are cataloging the reliability risks of a new real-time chat feature for your product. You catalog the following information for each risk:
* Mean Time to Detect (MUD} in minutes
* Mean Time to Repair (MTTR) in minutes
* Mean Time Between Failure (MTBF) in days
* User Impact Percentage
The chat feature requires a new database system that takes twice as long to successfully fail over between zones. You want to account for the risk of the new database failing in one zone. What would be the values for the risk of database failover with the new system?
- A. MTTD: 5
MTTR: 10
MTBF: 90
Impact: 33% - B. MTTD:5
MTTR: 20
MTBF: 90
Impact: 33% - C. MTTD:5
MTTR: 20
MTBF: 90
Impact: 50% - D. MTTD:5
MTTR: 10
MTBF: 90
Impact 50%
Answer: B
Explanation:
Explanation
https://www.atlassian.com/incident-management/kpis/common-metrics
https://linkedin.github.io/school-of-sre/
NEW QUESTION # 38
You need to define Service Level Objectives (SLOs) for a high-traffic multi-region web application.
Customers expect the application to always be available and have fast response times. Customers are currently happy with the application performance and availability. Based on current measurement, you observe that the
90th percentile of latency is 120ms and the 95th percentile of latency is 275ms over a 28-day window. What latency SLO would you recommend to the team to publish?
- A. 90th percentile - 250ms
95th percentile - 400ms - B. 90th percentile - 120ms
95th percentile - 275ms - C. 90th percentile - 100ms
95th percentile - 250ms - D. 90th percentile - 150ms
95th percentile - 300ms
Answer: D
Explanation:
Explanation
https://sre.google/sre-book/service-level-objectives/
NEW QUESTION # 39
A third-party application needs to have a service account key to work properly When you try to export the key from your cloud project you receive an error "The organization policy constraint larn.disableServiceAccountKeyCreation is enforcedM You need to make the third-party application work while following Google-recommended security practices What should you do?
- A. Add a rule to set the iam.disableServiceAccountKeyCreation policy to off in your project and create a key.
- B. Disable the service account key creation policy at the project's folder, and download the default key
- C. Enable the default service account key. and download the key
- D. Remove the iam.disableServiceAccountKeyCreation policy at the organization level, and create a key.
Answer: A
Explanation:
Explanation
The best option for making the third-party application work while following Google-recommended security practices is to add a rule to set the iam.disableServiceAccountKeyCreation policy to off in your project and create a key. The iam.disableServiceAccountKeyCreation policy is an organization policy that controls whether service account keys can be created in a project or organization. By default, this policy is set to on, which means that service account keys cannot be created. However, you can override this policy at a lower level, such as a project, by adding a rule to set it to off. This way, you can create a service account key for your project without affecting other projects or organizations. You should also follow the best practices for managing service account keys, such as rotating them regularly, storing them securely, and deleting them when they are no longer needed.
NEW QUESTION # 40
Your team uses Cloud Build for all CI/CO pipelines. You want to use the kubectl builder for Cloud Build to deploy new images to Google Kubernetes Engine (GKE). You need to authenticate to GKE while minimizing development effort. What should you do?
- A. Create a new service account with the Container Developer role and use it to run Cloud Build.
- B. Assign the Container Developer role to the Cloud Build service account.
- C. Create a separate step in Cloud Build to retrieve service account credentials and pass these to kubectl.
- D. Specify the Container Developer role for Cloud Build in the cloudbuild.yaml file.
Answer: B
NEW QUESTION # 41
You are analyzing Java applications in production. All applications have Cloud Profiler and Cloud Trace installed and configured by default. You want to determine which applications need performance tuning. What should you do?
Choose 2 answers
- A. Examine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the memory resource allocation.
- B. O Examine the latency time, the wall-clock time, and the CPU time of the application. If the latency time is slowly burning down the error budget, and the difference between wall-clock time and CPU time is minimal, mark the application for optimization.
- C. 17 Examine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the local disk storage allocation.
- D. Examine the wall-clock time and the CPU time Of the application. If the difference is substantial, increase the CPU resource allocation.
- E. Examine the heap usage Of the application. If the usage is low, mark the application for optimization.
Answer: B,D
Explanation:
The correct answers are A and D.
Examine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the CPU resource allocation. This is a good way to determine if the application is CPU-bound, meaning that it spends more time waiting for the CPU than performing actual computation. Increasing the CPU resource allocation can improve the performance of CPU-bound applications1.
Examine the latency time, the wall-clock time, and the CPU time of the application. If the latency time is slowly burning down the error budget, and the difference between wall-clock time and CPU time is minimal, mark the application for optimization. This is a good way to determine if the application is I/O-bound, meaning that it spends more time waiting for input/output operations than performing actual computation.
Increasing the CPU resource allocation will not help I/O-bound applications, and they may need optimization to reduce the number or duration of I/O operations2.
Answer B is incorrect because increasing the memory resource allocation will not help if the application is CPU-bound or I/O-bound. Memory allocation affects how much data the application can store and access in memory, but it does not affect how fast the application can process that data.
Answer C is incorrect because increasing the local disk storage allocation will not help if the application is CPU-bound or I/O-bound. Disk storage affects how much data the application can store and access on disk, but it does not affect how fast the application can process that data.
Answer E is incorrect because examining the heap usage of the application will not help to determine if the application needs performance tuning. Heap usage affects how much memory the application allocates for dynamic objects, but it does not affect how fast the application can process those objects. Moreover, low heap usage does not necessarily mean that the application is inefficient or unoptimized.
NEW QUESTION # 42
You are creating and assigning action items in a postmodern for an outage. The outage is over, but you need to address the root causes. You want to ensure that your team handles the action items quickly and efficiently.
How should you assign owners and collaborators to action items?
- A. Assign multiple owners for each item to guarantee that the team addresses items quickly
- B. Assign the team lead as the owner for all action items because they are in charge of the SRE team.
- C. Assign one owner for each action item and any necessary collaborators.
- D. Assign collaborators but no individual owners to the items to keep the postmortem blameless.
Answer: C
Explanation:
Explanation
https://devops.com/when-it-disaster-strikes-part-3-conducting-a-blameless-post-mortem/
NEW QUESTION # 43
......
Professional-Cloud-DevOps-Engineer Exam Questions – Valid Professional-Cloud-DevOps-Engineer Dumps Pdf: https://www.surepassexams.com/Professional-Cloud-DevOps-Engineer-exam-bootcamp.html
Professional-Cloud-DevOps-Engineer PDF Dumps Recently Updated Questions: https://drive.google.com/open?id=1FkezEDZhu5ALjv1EX1-x51GY1ivCzVzT