Professional-Cloud-DevOps-Engineer問題集、Google実際の試験問題

質問 1

Your organization is running multiple Google Kubernetes Engine (GKE) clusters in a project. You need to design a highly-available solution to collect and query both domain-specific workload metrics and GKE default metrics across all clusters, while minimizing operational overhead. What should you do?

A. Enable managed collection on every GKE cluster. Query the metrics in Cloud Monitoring.

B. Use Prometheus Operator to install Prometheus in every cluster and scrape the metrics. Configure remote-write to one central Prometheus. Query the central Prometheus instance.

C. Use Prometheus Operator to install Prometheus in every cluster and scrape the metrics. Ensure that a Thanos sidecar is enabled on every Prometheus instance. Configure Thanos in the central cluster. Query the central Thanos instance.

D. Enable managed collection on every GKE cluster. Query the metrics in BigQuery.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 2

You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?

A. Create a Google service account.
Create a Kubernetes service account in a Workload Identity-enabled cluster.
Link the Google service account with the Kubernetes service account by using the roles/iam.
workloadIdentityUser role and iam.gke.io/gcp-service-account annotation.
Map the Kubernetes service account to the workload.
Repeat for each workload.

B. Create a Google service account.
Create a node pool without taints, and set the Google service account as the default identity.
Grant IAM permissions to the Google service account.

C. Create a Google service account.
Create a node pool, and set the Google service account as the default identity.
Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations.
Repeat for each workload.

D. Create a Google service account.
Create a service account key for the Google service account.
Create a Kubernetes secret with a service account key.
Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path.
Repeat for each workload.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 3

You recently deployed your application in Google Kubernetes Engine (GKE) and now need to release a new version of the application You need the ability to instantly roll back to the previous version of the application in case there are issues with the new version Which deployment model should you use?

A. Perform a canary deployment, and test your new application periodically after the new version is deployed

B. Perform a rolling deployment and test your new application after the deployment is complete

C. Perform A. B testing, and test your application periodically after the deployment is complete

D. Perform a blue/green deployment and test your new application after the deployment is complete

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 4

Your company is developing applications that are deployed on Google Kubernetes Engine (GKE). Each team manages a different application. You need to create the development and production environments for each team, while minimizing costs. Different teams should not be able to access other teams' environments. What should you do?

A. Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Kubernetes Role-based access control (RBAC) so that each team can only access its own namespace.

B. Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Identity Aware Proxy so that each team can only access its own namespace.

C. Create one GCP Project per team. In each project, create a cluster for Development and one for Production. Grant the teams IAM access to their respective clusters.

D. Create one GCP Project per team. In each project, create a cluster with a Kubernetes namespace for Development and one for Production. Grant the teams IAM access to their respective clusters.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 5

You are building an application that runs on Cloud Run The application needs to access a third-party API by using an API key You need to determine a secure way to store and use the API key in your application by following Google-recommended practices What should you do?

A. Save the API key in Secret Manager as a secret key Mount the secret key under the /sys/api_key directory and decrypt the key in the Cloud Run application

B. Save the API key in Cloud Key Management Service (Cloud KMS) as a key Reference the key as an environment variable in the Cloud Run application

C. Save the API key in Secret Manager as a secret Reference the secret as an environment variable in the Cloud Run application

D. Encrypt the API key by using Cloud Key Management Service (Cloud KMS) and pass the key to Cloud Run as an environment variable Decrypt and use the key in Cloud Run

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 6

You support a trading application written in Python and hosted on App Engine flexible environment. You want to customize the error information being sent to Stackdriver Error Reporting. What should you do?

A. Install the Stackdriver Error Reporting library for Python, and then run your code on App Engine flexible environment.

B. Install the Stackdriver Error Reporting library for Python, and then run your code on Google Kubernetes Engine.

C. Use the Stackdriver Error Reporting API to write errors from your application to ReportedErrorEvent, and then generate log entries with properly formatted error messages in Stackdriver Logging.

D. Install the Stackdriver Error Reporting library for Python, and then run your code on a Compute Engine VM.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 7

You support a popular mobile game application deployed on Google Kubernetes Engine (GKE) across several Google Cloud regions. Each region has multiple Kubernetes clusters. You receive a report that none of the users in a specific region can connect to the application. You want to resolve the incident while following Site Reliability Engineering practices. What should you do first?

A. Add an extra node pool that consists of high memory and high CPU machine type instances to the cluster.

B. Use Stackdriver Monitoring to check for a spike in CPU or memory usage for the affected region.

C. Use Stackdriver Logging to filter on the clusters in the affected region, and inspect error messages in the logs.

D. Reroute the user traffic from the affected region to other regions that don't report issues.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 8

You are responding to a high-priority incident where a critical, user-facing payment service is experiencing a
50% error rate. The cause is a non-critical, batch analytics Dataflow pipeline flooding a shared Memorystore for Redis instance with writes, which has spiked read latency for the payment service. A full rollback of the Dataflow pipeline's deployment will take 15 minutes to complete through your CI/CD process. You need to restore the payment service as quickly as possible. What should you do?

A. Use Cloud Profiler to inspect the Dataflow pipeline's execution graph to pinpoint the source of the excessive writes.

B. Cancel the active Dataflow job.

C. Initiate an automated rollback of the Dataflow pipeline's deployment to revert to the last stable version.

D. In the Google Cloud console, edit the Memorystore for Redis instance and increase its capacity tier.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 9

Your company follows Site Reliability Engineering practices. You are the person in charge of Communications for a large, ongoing incident affecting your customer-facing applications. There is still no estimated time for a resolution of the outage. You are receiving emails from internal stakeholders who want updates on the outage, as well as emails from customers who want to know what is happening. You want to efficiently provide updates to everyone affected by the outage. What should you do?

A. Provide periodic updates to all stakeholders in a timely manner. Commit to a "next update" time in all communications.

B. Provide all internal stakeholder emails to the Incident Commander, and allow them to manage internal communications. Focus on providing responses directly to customers.

C. Delegate the responding to internal stakeholder emails to another member of the Incident Response Team. Focus on providing responses directly to customers.

D. Focus on responding to internal stakeholders at least every 30 minutes. Commit to "next update" times.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 10

Your team is preparing to launch a new API in Cloud Run. The API uses an OpenTelemetry agent to send distributed tracing data to Cloud Trace to monitor the time each request takes. The team has noticed inconsistent trace collection. You need to resolve the issue. What should you do?

A. Use an HTTP health check.

B. Configure CPU to be allocated only during request processing.

C. Configure CPU to be always-allocated.

D. Increase the CPU limit in Cloud Run from 2 to 4.

正解: C

解説: (PassTest メンバーにのみ表示されます)

Google Cloud Certified - Professional Cloud DevOps Engineer - Professional-Cloud-DevOps-Engineer 模擬練習