[Jan 15, 2024] New Professional-Cloud-DevOps-Engineer Exam Dumps with High Passing Rate
Get Professional-Cloud-DevOps-Engineer Braindumps & Professional-Cloud-DevOps-Engineer Real Exam Questions
Google Professional-Cloud-DevOps-Engineer exam is a certification that validates the skills and knowledge of a DevOps engineer in the Google Cloud Platform (GCP) environment. Google Cloud Certified - Professional Cloud DevOps Engineer Exam certification is designed for professionals who have experience in software development, operations, and infrastructure management. Professional-Cloud-DevOps-Engineer exam aims to test a candidate's expertise in designing, building, and managing efficient and scalable DevOps workflows in the GCP environment.
NEW QUESTION # 74
You support a high-traffic web application that runs on Google Cloud Platform (GCP). You need to measure application reliability from a user perspective without making any engineering changes to it. What should you do?
Choose 2 answers
- A. Create new synthetic clients to simulate a user journey using the application.
- B. Modify the code to capture additional information for user interaction.
- C. Use current and historic Request Logs to trace customer interaction with the application.
- D. Review current application metrics and add new ones as needed.
- E. Analyze the web proxy logs only and capture response time of each request.
Answer: B,E
NEW QUESTION # 75
Your company has a Google Cloud resource hierarchy with folders for production test and development Your cyber security team needs to review your company's Google Cloud security posture to accelerate security issue identification and resolution You need to centralize the logs generated by Google Cloud services from all projects only inside your production folder to allow for alerting and near-real time analysis. What should you do?
- A. Create an aggregated log sink associated with the production folder that uses a Cloud Logging bucket as the destination
- B. Create a central Cloud Monitoring workspace and attach all related projects
- C. Enable the Workflows API and route all the logs to Cloud Logging
- D. Create an aggregated log sink associated with the production folder that uses a Pub Sub topic as the destination
Answer: A
Explanation:
Explanation
The best option for centralizing the logs generated by Google Cloud services from all projects only inside your production folder is to create an aggregated log sink associated with the production folder that uses a Cloud Logging bucket as the destination. An aggregated log sink is a log sink that collects logs from multiple sources, such as projects, folders, or organizations. A Cloud Logging bucket is a storage location for logs that can be used as a destination for log sinks. By creating an aggregated log sink with a Cloud Logging bucket, you can collect and store all the logs from the production folder in one place and allow for alerting and near-real time analysis using Cloud Monitoring and Cloud Operations.
NEW QUESTION # 76
You support a high-traffic web application that runs on Google Cloud Platform (GCP). You need to measure application reliability from a user perspective without making any engineering changes to it. What should you do?
Choose 2 answers
- A. Modify the code to capture additional information for user interaction.
- B. Create new synthetic clients to simulate a user journey using the application.
- C. Review current application metrics and add new ones as needed.
- D. Analyze the web proxy logs only and capture response time of each request.
- E. Use current and historic Request Logs to trace customer interaction with the application.
Answer: D,E
Explanation:
https://cloud.google.com/architecture/adopting-slos?hl=en
NEW QUESTION # 77
Your team uses Cloud Build for all CI/CO pipelines. You want to use the kubectl builder for Cloud Build to deploy new images to Google Kubernetes Engine (GKE). You need to authenticate to GKE while minimizing development effort. What should you do?
- A. Specify the Container Developer role for Cloud Build in the cloudbuild.yaml file.
- B. Assign the Container Developer role to the Cloud Build service account.
- C. Create a separate step in Cloud Build to retrieve service account credentials and pass these to kubectl.
- D. Create a new service account with the Container Developer role and use it to run Cloud Build.
Answer: B
Explanation:
Explanation
https://cloud.google.com/build/docs/deploying-builds/deploy-gke
https://cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts
NEW QUESTION # 78
You are configuring Cloud Logging for a new application that runs on a Compute Engine instance with a public IP address. A user-managed service account is attached to the instance. You confirmed that the necessary agents are running on the instance but you cannot see any log entries from the instance in Cloud Logging. You want to resolve the issue by following Google-recommended practices. What should you do?
- A. Update the instance to use the default Compute Engine service account.
- B. Enable Private Google Access on the subnet that the instance is in.
- C. Add the Logs Writer role to the service account.
- D. Export the service account key and configure the agents to use the key.
Answer: C
Explanation:
Explanation
The correct answer is A. Add the Logs Writer role to the service account.
To use Cloud Logging, the service account attached to the Compute Engine instance must have the necessary permissions to write log entries. The Logs Writer role (roles/logging.logWriter) provides this permission. You can grant this role to the user-managed service account at the project, folder, or organization level1.
Private Google Access is not required for Cloud Logging, as it allows instances without external IP addresses to access Google APIs and services2. The default Compute Engine service account already has the Logs Writer role, but it is not a recommended practice to use it for user applications3. Exporting the service account key and configuring the agents to use the key is not a secure way of authenticating the service account, as it exposes the key to potential compromise4.
References:
1: Access control with IAM | Cloud Logging | Google Cloud
2: Private Google Access overview | VPC | Google Cloud
3: Service accounts | Compute Engine Documentation | Google Cloud
4: Best practices for securing service accounts | IAM Documentation | Google Cloud
NEW QUESTION # 79
You have a CI/CD pipeline that uses Cloud Build to build new Docker images and push them to Docker Hub. You use Git for code versioning. After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline. You need to resolve the issue following Site Reliability Engineering practices. What should you do?
- A. Change the CI pipeline to push the artifacts to Container Registry instead of Docker Hub.
- B. Run a Git compare between the previous and current Cloud Build Configuration files to find and fix the bug.
- C. Disable the CI pipeline and revert to manually building and pushing the artifacts.
- D. Upload the configuration YAML file to Cloud Storage and use Error Reporting to identify and fix the issue.
Answer: A
NEW QUESTION # 80
You support a popular mobile game application deployed on Google Kubernetes Engine (GKE) across several Google Cloud regions. Each region has multiple Kubernetes clusters. You receive a report that none of the users in a specific region can connect to the application. You want to resolve the incident while following Site Reliability Engineering practices. What should you do first?
- A. Add an extra node pool that consists of high memory and high CPU machine type instances to the cluster.
- B. Use Stackdriver Logging to filter on the clusters in the affected region, and inspect error messages in the logs.
- C. Reroute the user traffic from the affected region to other regions that don't report issues.
- D. Use Stackdriver Monitoring to check for a spike in CPU or memory usage for the affected region.
Answer: C
Explanation:
Google always aims to first stop the impact of an incident, and then find the root cause (unless the root cause just happens to be identified early on).
NEW QUESTION # 81
You need to build a CI/CD pipeline for a containerized application in Google Cloud Your development team uses a central Git repository for trunk-based development You want to run all your tests in the pipeline for any new versions of the application to improve the quality What should you do?
- A. 1. Trigger Cloud Build to run unit tests when the code is pushed If all unit tests are successful, build and push the application container to a central registry.
2. Trigger Cloud Build to deploy the container to a testing environment, and run integration tests and acceptance tests
3. If all tests are successful the pipeline deploys the application to the production environment and runs smoke tests - B. 1. Trigger Cloud Build to build the application container and run unit tests with the container
2. If unit tests are successful, deploy the application container to a testing environment, and run integration tests
3. If the integration tests are successful the pipeline deploys the application container to the production environment After that, run acceptance tests - C. 1. Install a Git hook to require developers to run unit tests before pushing the code to a central repository
2. Trigger Cloud Build to build the application container Deploy the application container to a testing environment, and run integration tests
3. If the integration tests are successful deploy the application container to your production environment.
and run acceptance tests - D. 1. Install a Git hook to require developers to run unit tests before pushing the code to a central repository If all tests are successful build a container
2. Trigger Cloud Build to deploy the application container to a testing environment, and run integration tests and acceptance tests
3. If all tests are successful tag the code as production ready Trigger Cloud Build to build and deploy the application container to the production environment
Answer: A
Explanation:
Explanation
The best option for building a CI/CD pipeline for a containerized application in Google Cloud is to trigger Cloud Build to run unit tests when the code is pushed, if all unit tests are successful, build and push the application container to a central registry, trigger Cloud Build to deploy the container to a testing environment, and run integration tests and acceptance tests, and if all tests are successful, the pipeline deploys the application to the production environment and runs smoke tests. This option follows the best practices for CI/CD pipelines, such as running tests at different stages of the pipeline, using a central registry for storing and managing containers, deploying to different environments, and using Cloud Build as a unified tool for building, testing, and deploying.
NEW QUESTION # 82
You use Cloud Build to build and deploy your application. You want to securely incorporate database credentials and other application secrets into the build pipeline. You also want to minimize the development effort. What should you do?
- A. Create a Cloud Storage bucket and use the built-in encryption at rest. Store the secrets in the bucket and grant Cloud Build access to the bucket.
- B. Use Cloud Key Management Service (Cloud KMS) to encrypt the secrets and include them in your Cloud Build deployment configuration. Grant Cloud Build access to the KeyRing.
- C. Use client-side encryption to encrypt the secrets and store them in a Cloud Storage bucket. Store a decryption key in the bucket and grant Cloud Build access to the bucket.
- D. Encrypt the secrets and store them in the application repository. Store a decryption key in a separate repository and grant Cloud Build access to the repository.
Answer: B
NEW QUESTION # 83
You are currently planning how to display Cloud Monitoring metrics for your organization's Google Cloud projects. Your organization has three folders and six projects:
You want to configure Cloud Monitoring dashboards lo only display metrics from the projects within one folder You need to ensure that the dashboards do not display metrics from projects in the other folders You want to follow Google-recommended practices What should you do?
- A. Use the current app-one-prod project as the scoping project
- B. Create new scoping projects for each folder
- C. Create a single new scoping project
- D. Use the current app-one-dev, app-one-staging and app-one-prod projects as the scoping project for each folder
Answer: B
Explanation:
The best option for configuring Cloud Monitoring dashboards to only display metrics from the projects within one folder is to create new scoping projects for each folder. A scoping project is a project that defines which resources are monitored by Cloud Monitoring. You can create new scoping projects for each folder by using the gcloud monitoring register-project command. This way, you can associate each scoping project with a folder and only monitor the resources within that folder. You can then configure Cloud Monitoring dashboards to use the scoping projects as data sources and only display metrics from the projects within one folder.
NEW QUESTION # 84
You use Terraform to manage an application deployed to a Google Cloud environment The application runs on instances deployed by a managed instance group The Terraform code is deployed by using a CI/CD pipeline When you change the machine type on the instance template used by the managed instance group, the pipeline fails at the terraform apply stage with the following error message
You need to update the instance template and minimize disruption to the application and the number of pipeline runs What should you do?
- A. Add a new instance template update the managed instance group to use the new instance template and delete the old instance template
- B. Delete the managed instance group and recreate it after updating the instance template
- C. Set the create_bef ore_destroy meta-argument to true in the lifecycle block on the instance template
- D. Remove the managed instance group from the Terraform state file update the instance template and reimport the managed instance group.
Answer: C
Explanation:
Explanation
The best option for updating the instance template and minimizing disruption to the application and the number of pipeline runs is to set the create_before_destroy meta-argument to true in the lifecycle block on the instance template. The create_before_destroy meta-argument is a Terraform feature that specifies that a new resource should be created before destroying an existing one during an update. This way, you can avoid downtime and errors when updating a resource that is in use by another resource, such as an instance template that is used by a managed instance group. By setting the create_before_destroy meta-argument to true in the lifecycle block on the instance template, you can ensure that Terraform creates a new instance template with the updated machine type, updates the managed instance group to use the new instance template, and then deletes the old instance template.
NEW QUESTION # 85
You are on-call for an infrastructure service that has a large number of dependent systems. You receive an alert indicating that the service is failing to serve most of its requests and all of its dependent systems with hundreds of thousands of users are affected. As part of your Site Reliability Engineering (SRE) incident management protocol, you declare yourself Incident Commander (IC) and pull in two experienced people from your team as Operations Lead (OLJ and Communications Lead (CL). What should you do next?
- A. Establish a communication channel where incident responders and leads can communicate with each other.
- B. Start a postmortem, add incident information, circulate the draft internally, and ask internal stakeholders for input.
- C. Contact the affected service owners and update them on the status of the incident.
- D. Look for ways to mitigate user impact and deploy the mitigations to production.
Answer: D
NEW QUESTION # 86
Your company runs applications in Google Kubernetes Engine (GKE). Several applications rely on ephemeral volumes. You noticed some applications were unstable due to the DiskPressure node condition on the worker nodes. You need to identify which Pods are causing the issue, but you do not have execute access to workloads and nodes. What should you do?
- A. Locate all the Pods with emptyDir volumes. Use the du -sh * command to measure volume disk usage.
- B. Locate all the Pods with emptyDir volumes. use the df-h command to measure volume disk usage.
- C. Check the metric by using Metrics Explorer.
- D. Check the node/ephemeral_storage/used_bytes metric by using Metrics Explorer.
Answer: D
Explanation:
The correct answer is A, Check the node/ephemeral_storage/used_bytes metric by using Metrics Explorer.
The node/ephemeral_storage/used_bytes metric reports the total amount of ephemeral storage used by Pods on each node1. You can use Metrics Explorer to query and visualize this metric and filter it by node name, namespace, or Pod name2. This way, you can identify which Pods are consuming the most ephemeral storage and causing disk pressure on the nodes. You do not need to have execute access to the workloads or nodes to use Metrics Explorer.
The other options are incorrect because they require execute access to the workloads or nodes, which you do not have. The df -h and du -sh * commands are Linux commands that can measure disk usage, but you need to run them inside the Pods or on the nodes, which is not possible in your scenario34.
Reference:
Monitoring metrics for Kubernetes system components, Node metrics, node/ephemeral_storage/used_bytes. Using Metrics Explorer, Querying metrics. How do I find out disk space utilization information using Linux command line?, df command. How to check disk space in Linux from the command line, du command.
NEW QUESTION # 87
Your application services run in Google Kubernetes Engine (GKE). You want to make sure that only images from your centrally-managed Google Container Registry (GCR) image registry in the altostrat-images project can be deployed to the cluster while minimizing development time. What should you do?
- A. Add logic to the deployment pipeline to check that all manifests contain only images from gcr.io/altostrat- images.
- B. Add a tag to each image in gcr.io/altostrat-images and check that this tag is present when the image is deployed.
- C. Use a Binary Authorization policy that includes the whitelist name pattern gcr.io/altostrat-images/.
- D. Create a custom builder for Cloud Build that will only push images to gcr.io/altostrat-images.
Answer: B
NEW QUESTION # 88
You want to share a Cloud Monitoring custom dashboard with a partner team What should you do?
- A. Download the JSON definition of the dashboard, and send the JSON file to the partner team
- B. Provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard
- C. Copy the Monitoring Query Language (MQL) query from the dashboard; and send the MQL query to the partner team
- D. Export the metrics to BigQuery Use Looker Studio to create a dashboard, and share the dashboard with the partner team
Answer: B
Explanation:
The best option for sharing a Cloud Monitoring custom dashboard with a partner team is to provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard. A Cloud Monitoring custom dashboard is a dashboard that allows you to create and customize charts and widgets to display metrics, logs, and traces from your Google Cloud resources and applications. You can share a custom dashboard with a partner team by providing them with the dashboard URL, which is a link that allows them to view the dashboard in their browser. The partner team can then create a copy of the dashboard in their own project by using the Copy Dashboard option. This way, they can access and modify the dashboard without affecting the original one.
NEW QUESTION # 89
Your organization is using Helm to package containerized applications Your applications reference both public and private charts Your security team flagged that using a public Helm repository as a dependency is a risk You want to manage all charts uniformly, with native access control and VPC Service Controls What should you do?
- A. Store public and private charts by using GitHub Enterprise with Google Workspace as the identity provider
- B. Configure a Helm chart repository server to run in Google Kubernetes Engine (GKE) with Cloud Storage bucket as the storage backend
- C. Store public and private charts in OCI format by using Artifact Registry
- D. Store public and private charts by using Git repository Configure Cloud Build to synchronize contents of the repository into a Cloud Storage bucket Connect Helm to the bucket by using https: // [bucket] .srorage.googleapis.com/ [holnchart] as the Helm repository
Answer: C
Explanation:
The best option for managing all charts uniformly, with native access control and VPC Service Controls is to store public and private charts in OCI format by using Artifact Registry. Artifact Registry is a service that allows you to store and manage container images and other artifacts in Google Cloud. Artifact Registry supports OCI format, which is an open standard for storing container images and other artifacts such as Helm charts. You can use Artifact Registry to store public and private charts in OCI format and manage them uniformly. You can also use Artifact Registry's native access control features, such as IAM policies and VPC Service Controls, to secure your charts and control who can access them.
NEW QUESTION # 90
As part of your company's initiative to shift left on security, the infoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the deployment of trusted and approved images You need to determine how to satisfy the InfoSec teams goal of shifting left on security.
What should you do?
- A. Enable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images
- B. Configure Identity and Access Management (1AM) policies to create a least privilege model on your GKE clusters
- C. Use Binary Authorization to attest images during your CI CD pipeline
- D. Deploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods
Answer: C
Explanation:
Explanation
The best option for implementing guard rails on all GKE clusters to only allow the deployment of trusted and approved images is to use Binary Authorization to attest images during your CI/CD pipeline. Binary Authorization is a feature that allows you to enforce signature-based validation when deploying container images. You can use Binary Authorization to create policies that specify which images are allowed or denied in your GKE clusters. You can also use Binary Authorization to attest images during your CI/CD pipeline by using tools such as Container Analysis or third-party integrations. An attestation is a digital signature that certifies that an image meets certain criteria, such as passing vulnerability scans or code reviews. By using Binary Authorization to attest images during your CI/CD pipeline, you can ensure that only trusted and approved images are deployed to your GKE clusters.
NEW QUESTION # 91
You want to share a Cloud Monitoring custom dashboard with a partner team What should you do?
- A. Download the JSON definition of the dashboard, and send the JSON file to the partner team
- B. Provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard
- C. Copy the Monitoring Query Language (MQL) query from the dashboard; and send the MQL query to the partner team
- D. Export the metrics to BigQuery Use Looker Studio to create a dashboard, and share the dashboard with the partner team
Answer: B
Explanation:
Explanation
The best option for sharing a Cloud Monitoring custom dashboard with a partner team is to provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard. A Cloud Monitoring custom dashboard is a dashboard that allows you to create and customize charts and widgets to display metrics, logs, and traces from your Google Cloud resources and applications. You can share a custom dashboard with a partner team by providing them with the dashboard URL, which is a link that allows them to view the dashboard in their browser. The partner team can then create a copy of the dashboard in their own project by using the Copy Dashboard option. This way, they can access and modify the dashboard without affecting the original one.
NEW QUESTION # 92
You currently store the virtual machine (VM) utilization logs in Stackdriver. You need to provide an easy-to-share interactive VM utilization dashboard that is updated in real time and contains information aggregated on a quarterly basis. You want to use Google Cloud Platform solutions. What should you do?
- A. 1. Export VM utilization logs from Stackdriver to Cloud Pub/Sub.
2. From Cloud Pub/Sub, send the logs to a Security Information and Event Management (SIEM) system.
3. Build the dashboards in the SIEM system and share with your stakeholders. - B. 1. Export VM utilization logs from Stackdriver to a Cloud Storage bucket.
2. Enable the Cloud Storage API to pull the logs programmatically.
3. Build a custom data visualization application.
4. Display the pulled logs in a custom dashboard. - C. 1. Export VM utilization logs (rom Stackdriver to BigQuery.
2. From BigQuery. export the logs to a CSV file.
3. Import the CSV file into Google Sheets.
4. Build a dashboard in Google Sheets and share it with your stakeholders. - D. 1. Export VM utilization logs from Stackdriver to BigOuery.
2. Create a dashboard in Data Studio.
3. Share the dashboard with your stakeholders.
Answer: C
NEW QUESTION # 93
Your application images are built and pushed to Google Container Registry (GCR). You want to build an automated pipeline that deploys the application when the image is updated while minimizing the development effort. What should you do?
- A. Use Cloud Build to trigger a Spinnaker pipeline.
- B. Use Cloud Pub/Sub to trigger a Spinnaker pipeline.
- C. Use a custom builder in Cloud Build to trigger a Jenkins pipeline.
- D. Use Cloud Pub/Sub to trigger a custom deployment service running in Google Kubernetes Engine (GKE).
Answer: B
Explanation:
https://cloud.google.com/architecture/continuous-delivery-toolchain-spinnaker-cloud
https://spinnaker.io/guides/user/pipeline/triggers/pubsub/
The most efficient way to build an automated pipeline that deploys the application when the image is updated is to use Cloud Pub/Sub to trigger a Spinnaker pipeline. This way, you can leverage the built-in integration between GCR and Cloud Pub/Sub, and use Spinnaker as a continuous delivery platform for deploying your application .
NEW QUESTION # 94
You support an application deployed on Compute Engine. The application connects to a Cloud SQL instance to store and retrieve dat a. After an update to the application, users report errors showing database timeout messages. The number of concurrent active users remained stable. You need to find the most probable cause of the database timeout. What should you do?
- A. Determine whether there is an increased number of connections to the Cloud SQL instance.
- B. Use Cloud Security Scanner to see whether your Cloud SQL is under a Distributed Denial of Service (DDoS) attack.
- C. Check the serial port logs of the Compute Engine instance.
- D. Use Stackdriver Profiler to visualize the resources utilization throughout the application.
Answer: A
NEW QUESTION # 95
You are running an experiment to see whether your users like a new feature of a web application. Shortly after deploying the feature as a canary release, you receive a spike in the number of 500 errors sent to users, and your monitoring reports show increased latency. You want to quickly minimize the negative impact on users.
What should you do first?
- A. Record data for the postmortem document of the incident.
- B. Trace the origin of 500 errors and the root cause of increased latency.
- C. Roll back the experimental canary release.
- D. Start monitoring latency, traffic, errors, and saturation.
Answer: C
NEW QUESTION # 96
You are managing the production deployment to a set of Google Kubernetes Engine (GKE) clusters. You want to make sure only images which are successfully built by your trusted CI/CD pipeline are deployed to production. What should you do?
- A. Enable Cloud Security Scanner on the clusters.
- B. Set up the Kubernetes Engine clusters with Binary Authorization.
- C. Enable Vulnerability Analysis on the Container Registry.
- D. Set up the Kubernetes Engine clusters as private clusters.
Answer: D
NEW QUESTION # 97
......
Professional-Cloud-DevOps-Engineer Dumps To Pass Google Exam in 24 Hours - Real4dumps: https://www.real4dumps.com/Professional-Cloud-DevOps-Engineer_examcollection.html
Google Professional-Cloud-DevOps-Engineer Actual Questions and Braindumps: https://drive.google.com/open?id=1zbzATOPImK4MPJ3P-g-ZzkwaT0WbJGKn
