[2023年12月] ベストCloud DevOps Engineer学習ガイドはProfessional-Cloud-DevOps-Engineer試験問題集
Professional-Cloud-DevOps-Engineer認定ガイド問題と解答トレーニング
質問 # 76
Your team has recently deployed an NGINX-based application into Google Kubernetes Engine (GKE) and has exposed it to the public via an HTTP Google Cloud Load Balancer (GCLB) ingress. You want to scale the deployment of the application's frontend using an appropriate Service Level Indicator (SLI). What should you do?
- A. Install the Stackdriver custom metrics adapter and configure a horizontal pod autoscaler to use the number of requests provided by the GCLB.
- B. Configure the vertical pod autoscaler in GKE and enable the cluster autoscaler to scale the cluster as pods expand.
- C. Configure the horizontal pod autoscaler to use the average response time from the Liveness and Readiness probes.
- D. Expose the NGINX stats endpoint and configure the horizontal pod autoscaler to use the request metrics exposed by the NGINX deployment.
正解：A
解説：
Explanation
https://cloud.google.com/kubernetes-engine/docs/tutorials/autoscaling-metrics The Google Cloud HTTP Load Balancer (GCLB) provides metrics on the number of requests and the response latency for each backend service. These metrics can be used as custom metrics for the horizontal pod autoscaler (HPA) to scale the deployment based on the load. This is the correct solution to use an appropriate SLI for scaling.
質問 # 77
You support the backend of a mobile phone game that runs on a Google Kubernetes Engine (GKE) cluster. The application is serving HTTP requests from users. You need to implement a solution that will reduce the network cost. What should you do?
- A. Configure your network services on the Standard Tier.
- B. Configure your Kubernetes duster as a Private Cluster.
- C. Configure the VPC as a Shared VPC Host project.
- D. Configure a Google Cloud HTTP Load Balancer as Ingress.
正解：D
解説：
Costs associated with a load balancer are charged to the project containing the load balancer components. Because of these benefits, container-native load balancing is the recommended solution for load balancing through Ingress. When NEGs are used with GKE Ingress, the Ingress controller facilitates the creation of all aspects of the L7 load balancer. This includes creating the virtual IP address, forwarding rules, health checks, firewall rules, and more. https://cloud.google.com/architecture/best-practices-for-running-cost-effective-kubernetes-applications-on-gke
質問 # 78
Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to a Kubernetes cluster in the production environment. The security auditor is concerned that developers or operators could circumvent automated testing and push code changes to production without approval. What should you do to enforce approvals?
- A. Use an Admission Controller to verify that incoming requests originate from approved sources.
- B. Enable binary authorization inside the Kubernetes cluster and configure the build pipeline as an attestor.
- C. Configure the build system with protected branches that require pull request approval.
- D. Leverage Kubernetes Role-Based Access Control (RBAC) to restrict access to only approved users.
正解：C
質問 # 79
You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields. You want to prevent these fields from being written in new log entries as quickly as possible. What should you do?
- A. Use the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log entries in flight.
- B. Use the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in flight.
- C. Wait for the application developers to patch the application, and then verify that the log entries are no longer exposing PII.
- D. Stage log entries to Cloud Storage, and then trigger a Cloud Function to remove the fields and write the entries to Stackdriver via the Stackdriver Logging API.
正解：B
質問 # 80
Your company is developing applications that are deployed on Google Kubernetes Engine (GKE) Each team manages a different application You need to create the development and production environments for each team while you minimize costs Different teams should not be able to access other teams environments You want to follow Google-recommended practices What should you do?
- A. Create one Google Cloud project per team In each project create a cluster with a Kubernetes namespace for development and one for production Grant the teams Identity and Access Management (1AM) access to their respective clusters.
- B. Create one Google Cloud project per team In each project create a cluster for development and one for production Grant the teams Identity and Access Management (1AM) access to their respective clusters
- C. Create a development and a production GKE cluster in separate projects In each cluster create a Kubernetes namespace per team and then configure Kubernetes role-based access control (RBAC) so that each team can only access its own namespace
- D. Create a development and a production GKE cluster in separate projects In each cluster create a Kubernetes namespace per team and then configure Identity-Aware Proxy so that each team can only access its own namespace
正解：C
解説：
Explanation
The best option for creating the development and production environments for each team while minimizing costs and ensuring isolation is to create a development and a production GKE cluster in separate projects, in each cluster create a Kubernetes namespace per team, and then configure Kubernetes role-based access control (RBAC) so that each team can only access its own namespace. This option allows you to use fewer clusters and projects than creating one project or cluster per team, which reduces costs and complexity. It also allows you to isolate each team's environment by using namespaces and RBAC, which prevents teams from accessing other teams' environments.
質問 # 81
You recently deployed your application in Google Kubernetes Engine (GKE) and now need to release a new version of the application You need the ability to instantly roll back to the previous version of the application in case there are issues with the new version Which deployment model should you use?
- A. Perform a blue/green deployment and test your new application after the deployment is complete
- B. Perform a rolling deployment and test your new application after the deployment is complete
- C. Perform a canary deployment, and test your new application periodically after the new version is deployed
- D. Perform A. B testing, and test your application periodically after the deployment is complete
正解：A
解説：
Explanation
The best deployment model for releasing a new version of your application in GKE with the ability to instantly roll back to the previous version is to perform a blue/green deployment and test your new application after the deployment is complete. A blue/green deployment is a deployment strategy that involves creating two identical environments, one running the current version of the application (blue) and one running the new version of the application (green). The traffic is switched from blue to green after testing the new version, and if any issues are discovered, the traffic can be switched back to blue instantly. This way, you can minimize downtime and risk during deployment.
質問 # 82
Your company experiences bugs, outages, and slowness in its production systems. Developers use the production environment for new feature development and bug fixes. Configuration and experiments are done in the production environment, causing outages for users. Testers use the production environment for load testing, which often slows the production systems. You need to redesign the environment to reduce the number of bugs and outages in production and to enable testers to load test new features. What should you do?
- A. Create a development environment with smaller server capacity and give access only to developers and testers.
- B. Create a development environment for writing code and a test environment for configurations, experiments, and load testing.
- C. Secure the production environment to ensure that developers can't change it and set up one controlled update per year.
- D. Create an automated testing script in production to detect failures as soon as they occur.
正解：B
解説：
Explanation
Creating a development environment for writing code and a test environment for configurations, experiments, and load testing is the best practice to reduce the number of bugs and outages in production and to enable testers to load test new features. This way, the production environment is isolated from changes that could affect its stability and performance.
質問 # 83
You use Terraform to manage an application deployed to a Google Cloud environment The application runs on instances deployed by a managed instance group The Terraform code is deployed by using a CI/CD pipeline When you change the machine type on the instance template used by the managed instance group, the pipeline fails at the terraform apply stage with the following error message
You need to update the instance template and minimize disruption to the application and the number of pipeline runs What should you do?
- A. Delete the managed instance group and recreate it after updating the instance template
- B. Remove the managed instance group from the Terraform state file update the instance template and reimport the managed instance group.
- C. Add a new instance template update the managed instance group to use the new instance template and delete the old instance template
- D. Set the create_bef ore_destroy meta-argument to true in the lifecycle block on the instance template
正解：D
解説：
Explanation
The best option for updating the instance template and minimizing disruption to the application and the number of pipeline runs is to set the create_before_destroy meta-argument to true in the lifecycle block on the instance template. The create_before_destroy meta-argument is a Terraform feature that specifies that a new resource should be created before destroying an existing one during an update. This way, you can avoid downtime and errors when updating a resource that is in use by another resource, such as an instance template that is used by a managed instance group. By setting the create_before_destroy meta-argument to true in the lifecycle block on the instance template, you can ensure that Terraform creates a new instance template with the updated machine type, updates the managed instance group to use the new instance template, and then deletes the old instance template.
質問 # 84
Your company follows Site Reliability Engineering practices. You are the person in charge of Communications for a large, ongoing incident affecting your customer-facing applications. There is still no estimated time for a resolution of the outage. You are receiving emails from internal stakeholders who want updates on the outage, as well as emails from customers who want to know what is happening. You want to efficiently provide updates to everyone affected by the outage. What should you do?
- A. Delegate the responding to internal stakeholder emails to another member of the Incident Response Team. Focus on providing responses directly to customers.
- B. Provide all internal stakeholder emails to the Incident Commander, and allow them to manage internal communications. Focus on providing responses directly to customers.
- C. Provide periodic updates to all stakeholders in a timely manner. Commit to a "next update" time in all communications.
- D. Focus on responding to internal stakeholders at least every 30 minutes. Commit to "next update" times.
正解：D
質問 # 85
You need to run a business-critical workload on a fixed set of Compute Engine instances for several months. The workload is stable with the exact amount of resources allocated to it. You want to lower the costs for this workload without any performance implications. What should you do?
- A. Create an Unmanaged Instance Group for the instances used to run the workload.
- B. Convert the instances to preemptible virtual machines.
- C. Migrate the instances to a Managed Instance Group.
- D. Purchase Committed Use Discounts.
正解：A
質問 # 86
You have a pool of application servers running on Compute Engine. You need to provide a secure solution that requires the least amount of configuration and allows developers to easily access application logs for troubleshooting. How would you implement the solution on GCP?
- A. * Deploy the Stackdriver monitoring agent to the application servers.
* Give the developers the IAM Monitoring Viewer role to access Stackdriver and view metrics. - B. * Deploy the Stackdriver logging agent to the application servers.
* Give the developers the IAM Logs Private Logs Viewer role to access Stackdriver and view logs. - C. * Deploy the Stackdriver logging agent to the application servers.
* Give the developers the IAM Logs Viewer role to access Stackdriver and view logs. - D. * Install the gsutil command line tool on your application servers.
* Write a script using gsutil to upload your application log to a Cloud Storage bucket, and then schedule it to run via cron every 5 minutes.
* Give the developers the IAM Object Viewer access to view the logs in the specified bucket.
正解：B
質問 # 87
You are configuring Cloud Logging for a new application that runs on a Compute Engine instance with a public IP address. A user-managed service account is attached to the instance. You confirmed that the necessary agents are running on the instance but you cannot see any log entries from the instance in Cloud Logging. You want to resolve the issue by following Google-recommended practices. What should you do?
- A. Add the Logs Writer role to the service account.
- B. Export the service account key and configure the agents to use the key.
- C. Update the instance to use the default Compute Engine service account.
- D. Enable Private Google Access on the subnet that the instance is in.
正解：A
解説：
Explanation
The correct answer is A. Add the Logs Writer role to the service account.
To use Cloud Logging, the service account attached to the Compute Engine instance must have the necessary permissions to write log entries. The Logs Writer role (roles/logging.logWriter) provides this permission. You can grant this role to the user-managed service account at the project, folder, or organization level1.
Private Google Access is not required for Cloud Logging, as it allows instances without external IP addresses to access Google APIs and services2. The default Compute Engine service account already has the Logs Writer role, but it is not a recommended practice to use it for user applications3. Exporting the service account key and configuring the agents to use the key is not a secure way of authenticating the service account, as it exposes the key to potential compromise4.
References:
1: Access control with IAM | Cloud Logging | Google Cloud
2: Private Google Access overview | VPC | Google Cloud
3: Service accounts | Compute Engine Documentation | Google Cloud
4: Best practices for securing service accounts | IAM Documentation | Google Cloud
質問 # 88
You use Cloud Build to build your application. You want to reduce the build time while minimizing cost and development effort. What should you do?
- A. Use multiple smaller build steps to minimize execution time.
- B. Use larger Cloud Build virtual machines (VMs) by using the machine-type option.
- C. Run multiple Jenkins agents to parallelize the build.
- D. Use Cloud Storage to cache intermediate artifacts.
正解：A
解説：
https://cloud.google.com/storage/docs/best-practices
. https://cloud.google.com/build/docs/speeding-up-builds#caching_directories_with_google_cloud_storage Caching directories with Google Cloud Storage To increase the speed of a build, reuse the results from a previous build. You can copy the results of a previous build to a Google Cloud Storage bucket, use the results for faster calculation, and then copy the new results back to the bucket. Use this method when your build takes a long time and produces a small number of files that does not take time to copy to and from Google Cloud Storage.
upvoted 2 times
質問 # 89
You have a CI/CD pipeline that uses Cloud Build to build new Docker images and push them to Docker Hub.
You use Git for code versioning. After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline. You need to resolve the issue following Site Reliability Engineering practices. What should you do?
- A. Run a Git compare between the previous and current Cloud Build Configuration files to find and fix the bug.
- B. Change the CI pipeline to push the artifacts to Container Registry instead of Docker Hub.
- C. Upload the configuration YAML file to Cloud Storage and use Error Reporting to identify and fix the issue.
- D. Disable the CI pipeline and revert to manually building and pushing the artifacts.
正解：A
解説：
Explanation
"After making a change in the Cloud Build YAML configuration, you notice that no new artifacts are being built by the pipeline"- means something wrong on the recent change not with the image registry.
質問 # 90
You are building and running client applications in Cloud Run and Cloud Functions Your client requires that all logs must be available for one year so that the client can import the logs into their logging service You must minimize required code changes What should you do?
- A. Update all images in Cloud Run and all functions in Cloud Functions to send logs to both Cloud Logging and the client's logging service Ensure that all the ports required to send logs are open in the VPC firewall
- B. Create a logs bucket and logging sink. Set the retention on the logs bucket to 365 days Configure the logging sink to send logs to the bucket Give your client access to the bucket to retrieve the logs
- C. Create a Pub/Sub topic subscription and logging sink Configure the logging sink to send all logs into the topic Give your client access to the topic to retrieve the logs
- D. Create a storage bucket and appropriate VPC firewall rules Update all images in Cloud Run and all functions in Cloud Functions to send logs to a file within the storage bucket
正解：B
解説：
Explanation
The best option for storing all logs for one year and minimizing required code changes is to create a logs bucket and logging sink, set the retention on the logs bucket to 365 days, configure the logging sink to send logs to the bucket, and give your client access to the bucket to retrieve the logs. A logs bucket is a Cloud Storage bucket that is used to store logs from Cloud Logging. A logging sink is a resource that defines where log entries are sent, such as a logs bucket, BigQuery dataset, or Pub/Sub topic. You can create a logs bucket and logging sink in Cloud Logging and set the retention on the logs bucket to 365 days. This way, you can ensure that all logs are stored for one year and protected from deletion. You can also configure the logging sink to send logs from Cloud Run and Cloud Functions to the logs bucket without any code changes. You can then give your client access to the logs bucket by using IAM policies or signed URLs.
質問 # 91
Your company runs services by using Google Kubernetes Engine (GKE). The GKE clusters in the development environment run applications with verbose logging enabled. Developers view logs by using the kubect1 logs command and do not use Cloud Logging. Applications do not have a uniform logging structure defined. You need to minimize the costs associated with application logging while still collecting GKE operational logs.
What should you do?
- A. Run the gcloud container clusters update logging=WORKLOAD command for the development cluster.
- B. Run the gcloud logging sinks update _Defau1t --disabled command in the project associated with the development environment.
- C. Add the severity >= DEBUG resource. type "k83 container" exclusion filter to the Default logging sink in the project associated with the development environment.
- D. Run the gcloud container clusters update --logging-SYSTEM command for the development cluster.
正解：D
質問 # 92
You use Cloud Build to build your application. You want to reduce the build time while minimizing cost and development effort. What should you do?
- A. Use multiple smaller build steps to minimize execution time.
- B. Use larger Cloud Build virtual machines (VMs) by using the machine-type option.
- C. Run multiple Jenkins agents to parallelize the build.
- D. Use Cloud Storage to cache intermediate artifacts.
正解：A
質問 # 93
You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (Pll) is leaking into certain log entry fields. All Pll entries begin with the text userinfo. You want to capture these log entries in a secure location for later review and prevent them from leaking to Stackdriver Logging. What should you do?
- A. Create an advanced log filter matching userinfo, configure a log export in the Stackdriver console with Cloud Storage as a sink, and then configure a tog exclusion with userinfo as a filter.
- B. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, and then copy the entries to a Cloud Storage bucket.
- C. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, create an advanced log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
- D. Create a basic log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
正解：B
解説：
https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76
質問 # 94
You manage an application that runs in Google Kubernetes Engine (GKE) and uses the blue/green deployment methodology Extracts of the Kubernetes manifests are shown below
The Deployment app-green was updated to use the new version of the application During post-deployment monitoring you notice that the majority of user requests are failing You did not observe this behavior in the testing environment You need to mitigate the incident impact on users and enable the developers to troubleshoot the issue What should you do?
- A. Change the selector on the Service app-2vc to app: my-app.
- B. Update the Deployment ape-green to use the previous version of the application
- C. Update the Deployment app-blue to use the new version of the application
- D. Change the selector on the Service app-svc to app: my-app, version: blue
正解：D
解説：
Explanation
The best option for mitigating the incident impact on users and enabling the developers to troubleshoot the issue is to change the selector on the Service app-svc to app: my-app, version: blue. A Service is a resource that defines how to access a set of Pods. A selector is a field that specifies which Pods are selected by the Service. By changing the selector on the Service app-svc to app: my-app, version: blue, you can ensure that the Service only routes traffic to the Pods that have both labels app: my-app and version: blue. These Pods belong to the Deployment app-blue, which uses the previous version of the application. This way, you can mitigate the incident impact on users by switching back to the working version of the application. You can also enable the developers to troubleshoot the issue with the new version of the application in the Deployment app-green without affecting users.
質問 # 95
Your application services run in Google Kubernetes Engine (GKE). You want to make sure that only images from your centrally-managed Google Container Registry (GCR) image registry in the altostrat-images project can be deployed to the cluster while minimizing development time. What should you do?
- A. Add a tag to each image in gcr.io/altostrat-images and check that this tag is present when the image is deployed.
- B. Use a Binary Authorization policy that includes the whitelist name pattern gcr.io/altostrat-images/.
- C. Create a custom builder for Cloud Build that will only push images to gcr.io/altostrat-images.
- D. Add logic to the deployment pipeline to check that all manifests contain only images from gcr.io/altostrat- images.
正解：A
質問 # 96
Your company follows Site Reliability Engineering practices. You are the Incident Commander for a new. customer-impacting incident. You need to immediately assign two incident management roles to assist you in an effective incident response. What roles should you assign?
Choose 2 answers
- A. Customer Impact Assessor
- B. Operations Lead
- C. Engineering Lead
- D. Communications Lead
- E. External Customer Communications Lead
正解：B、E
質問 # 97
You have a pool of application servers running on Compute Engine. You need to provide a secure solution that requires the least amount of configuration and allows developers to easily access application logs for troubleshooting. How would you implement the solution on GCP?
- A. * Install the gsutil command line tool on your application servers.
* Write a script using gsutil to upload your application log to a Cloud Storage bucket, and then schedule it to run via cron every 5 minutes.
* Give the developers IAM Object Viewer access to view the logs in the specified bucket. - B. * Deploy the Stackdriver monitoring agent to the application servers.
* Give the developers the IAM Monitoring Viewer role to access Stackdriver and view metrics. - C. * Deploy the Stackdriver logging agent to the application servers.
* Give the developers the IAM Logs Private Logs Viewer role to access Stackdriver and view logs. - D. * Deploy the Stackdriver logging agent to the application servers.
* Give the developers the IAM Logs Viewer role to access Stackdriver and view logs.
正解：C
質問 # 98
You need to define Service Level Objectives (SLOs) for a high-traffic multi-region web application. Customers expect the application to always be available and have fast response times. Customers are currently happy with the application performance and availability. Based on current measurement, you observe that the 90th percentile of latency is 120ms and the 95th percentile of latency is 275ms over a 28-day window. What latency SLO would you recommend to the team to publish?
- A. 90th percentile - 250ms
95th percentile - 400ms - B. 90th percentile - 100ms
95th percentile - 250ms - C. 90th percentile - 150ms
95th percentile - 300ms - D. 90th percentile - 120ms
95th percentile - 275ms
正解：C
解説：
https://sre.google/sre-book/service-level-objectives/
質問 # 99
......
ベストGoogle Professional-Cloud-DevOps-Engineer学習ガイドと問題集は2023年に更新されました：https://www.passtest.jp/Google/Professional-Cloud-DevOps-Engineer-shiken.html
Professional-Cloud-DevOps-Engineer認定お試しPDF最新Professional-Cloud-DevOps-Engineer問題集：https://drive.google.com/open?id=1RWe883tulgeFBfdBfjcmvMNWrQTgsWg2