Google Cloud Professional Cloud DevOps Engineer Practice Exam

• A. Create an alerting policy on quota utilization at 80 percent that pages the platform team to file an increase request
• B. Enable Quota Adjuster for the project and select the Compute Engine CPU quota in Cloud Quotas Correct answer
• C. Set a quota override on the engineering folder that raises the regional CPU limit for every project beneath it
• D. Write a Cloud Scheduler job that calls the Cloud Quotas API hourly to raise the CPU quota by 20 percent

Option B is correct because Quota Adjuster, enabled per project in Cloud Quotas, automatically raises a supported quota such as Compute Engine CPUs as usage nears the limit, with no request automation to maintain. Option A only alerts and still needs a manual request, option C is not a way to raise a quota above the granted limit (overrides can only lower or cap consumption), and option D calls an API that cannot grant increases on its own.

• A. Apply the Cloud Foundation Toolkit bootstrap module once, then run all later changes through the CI/CD project it creates Correct answer
• B. Create the projects in the console, then give a Terraform service account Organization Administrator and download its key for the pipeline
• C. Deploy Config Connector on a GKE cluster in a manually created project and let it create the remaining projects and bindings
• D. Run Infrastructure Manager from an administrator's Cloud Shell session to deploy each future change directly from the terminal

Option A is correct because the Cloud Foundation Toolkit bootstrap module creates the seed project, Terraform service account and CI/CD project in one repeatable run, after which every change goes through the reviewed pipeline. Option B relies on console-created projects and a downloaded key with excessive privilege, option C needs a manually created project and cluster first, and option D applies changes directly from a terminal with no review.

• A. Add startup scripts to the instance templates that download and install the current patches from a bucket on boot
• B. Schedule VM Manager OS patch deployments that install updates on the running instances every month
• C. Build the image with Packer in Cloud Build, test it, and publish it to a custom image family the templates use Correct answer
• D. Snapshot a patched VM every week and create the boot disk of each instance template from the latest snapshot

Option C is correct because a Packer build in Cloud Build runs whenever the image definition changes, and publishing to an image family lets instance templates that reference the family pick up the newest tested image without being edited. Options A and B patch at boot or on running instances rather than producing a tested image, and option D produces an untested, unhardened snapshot-based disk.

• A. Set create_before_destroy = true in the lifecycle block of the address resource
• B. Set ignore_changes = all in the lifecycle block of the address resource
• C. Set prevent_destroy = true in the lifecycle block of the address resource Correct answer
• D. Create a project lien on the production project to block its deletion

Option C is correct because prevent_destroy = true makes Terraform fail any plan that would destroy the resource, regardless of who approves it. Option A only changes the order of replacement, option B ignores attribute changes instead of blocking destruction, and option D protects the project from deletion rather than the address resource.

• A. Configure a postdeploy hook that runs the migration Job once the new Pods are serving, and roll back the target if the hook fails.
• B. Configure a predeploy hook on the target's stage that runs the migration Job image, so that a failed hook fails the rollout before any Pods change. Correct answer
• C. Include the migration Job in the rendered manifests with a sync-wave annotation, so that it is applied ahead of the Deployment.
• D. Add a Cloud Build step ahead of the release creation command that runs the migration against the production database for the new commit.

Option B is correct because a Cloud Deploy predeploy hook runs a container job before the rollout deploys anything, and a failed hook fails the rollout so the running version stays untouched. Option A runs after the new Pods already serve traffic. Option C relies on Argo-style sync waves, which Cloud Deploy does not honour, and option D runs against production outside the target's rollout.

• A. Set the trigger event to push a new tag and enter a tag regular expression such as ^v[0-9]+\.[0-9]+\.[0-9]+$ Correct answer
• B. Set the trigger event to push to a branch on main and add a first build step that exits when the commit has no tag attached
• C. Set the trigger event to push to a branch and enter a branch regular expression such as ^v[0-9]+\.[0-9]+\.[0-9]+$
• D. Set the trigger event to a pull request against main and add an included files filter that matches the version file

Option A is correct because a push-tag trigger with a tag regular expression fires only for matching tags and never for branch pushes. Option B still fires on every branch push and only wastes a build, option C applies the pattern to branch names rather than tags, and option D reacts to pull requests.

• A. Run Packer from a Cloud Run job that a repository webhook starts, authenticating with a service account key kept in Secret Manager.
• B. Run Packer in a Cloud Build step on merge, using the build's service account with image and instance creation roles. Correct answer
• C. Run Packer on a long-lived build VM that polls the repository each hour and uses the VM's default Compute Engine service account.
• D. Run Packer from a Cloud Workstations configuration that engineers start after each merge, using their own user credentials.

Option B is correct because a Cloud Build step uses the build's service account through short-lived tokens, so no key is stored, and it runs on every merge in your project. Options A, C and D rely on a stored key, an over-privileged default VM service account, or a manual start with personal credentials, so none gives an automatic, credential-free build.

• A. gcloud artifacts docker images build us-docker.pkg.dev/my-proj/apps/web
• B. gcloud builds submit --tag us-docker.pkg.dev/my-proj/apps/web
• C. gcloud run deploy web --image us-docker.pkg.dev/my-proj/apps/web
• D. gcloud builds submit --pack image=us-docker.pkg.dev/my-proj/apps/web Correct answer

Option D is correct because gcloud builds submit --pack uses Cloud Native Buildpacks to detect the Python app and build and push the image without a Dockerfile. Option B needs a Dockerfile or build config, option A is not a real command, and option C deploys an existing image rather than building one.

• A. Share command between the outgoing and incoming engineers so that either one can direct responders
• B. Brief the incoming engineer on the current state and open actions, and state explicitly that they now hold the incident commander role Correct answer
• C. Stay as incident commander until the root cause is found, and let the incoming engineer shadow the response
• D. Close the incident and open a new one for the new shift, so the timeline starts clean for the incoming engineer
• E. Record hypotheses, mitigations tried and action owners in the shared incident log that the new commander reads Correct answer

Options B and E are correct because a handoff works only when one named person holds command and the new commander can see what has been tried. An explicit briefing with a stated transfer of the role, plus a shared log of hypotheses, mitigations and owners, keeps the response coordinated. Sharing command (A) leaves it unclear who decides, staying on as commander (C) delays the handoff, and closing and reopening the incident (D) loses the timeline.

• A. Switch to a windows-based SLI that marks each minute good when its success ratio meets a threshold, so that every period weighs equally Correct answer
• B. Keep the request-based SLI and raise the SLO target from 99.9% to 99.99% over the same 30 days, so that failures in low-traffic hours consume more budget
• C. Add a latency SLI and require both SLIs to be met in each minute, so that overnight degradation is counted against the budget
• D. Shorten the compliance period to 24 hours, so that the overnight outage forms a larger share of the requests measured

Option A is correct because a windows-based SLI scores each minute as good or bad regardless of how many requests it held, so a three-hour overnight outage counts as 180 bad minutes and cannot be hidden by daytime volume. Option B only changes the target, option C adds a latency condition that does not fix the volume weighting, and option D shortens the period but still weights by request count.

• A. Move to weekly automated releases with a canary rollout, and let the unused error budget absorb the added change risk Correct answer
• B. Raise the SLO target to 99.99% to match the measured result, and keep the change board as the control on every release
• C. Keep the SLO and the fortnightly cadence, and carry the unused budget forward into the next quarter's allowance
• D. Replace the change board with a daily approval meeting and a second approver per release, keeping reliability at the measured level

Option A is correct because a service that never uses more than a small part of its budget is over-protected, and the error budget exists to be spent on release velocity; automated weekly canary releases do that safely. Option B tightens the target and keeps the manual gate, option C carries budget forward, which error budgets do not do, and option D adds more approval overhead.

• A. A rolling period of 28 days that moves forward continuously Correct answer
• B. A calendar period of one month that restarts on the first day
• C. A calendar period of one day that restarts at midnight
• D. A calendar period of one week that restarts on the first day

Option A is correct because a rolling window continuously drops the oldest data and adds the newest, so the budget always reflects recent user experience and is never reset on a fixed date. Options B, C and D are calendar periods, which restart on a fixed date and restore the full budget at that point.

• A. Add the prometheus.io/scrape and prometheus.io/port annotations to the Pod template and redeploy the Deployment
• B. Install the Ops Agent on the cluster nodes with a Prometheus receiver that scrapes the Pods on the metrics port
• C. Create a PodMonitoring resource in the service's namespace that selects the label app: ledger and scrapes the port named metrics Correct answer
• D. Create a ServiceMonitor resource in the service's namespace that selects the label app: ledger and scrapes the port named metrics

Option C is correct because managed collection discovers scrape targets only through PodMonitoring (or ClusterPodMonitoring) resources, which select Pods by label and name the port to scrape. Option A uses annotations that managed collection ignores, option B relies on an agent path that is not how managed collection works on GKE, and option D uses the ServiceMonitor kind of the Prometheus Operator, which managed collection does not read.

• A. Set record_log_file_path to true on the file receiver so that the agent joins the lines read from one file
• B. Add a parse_multiline processor with a Java language_exceptions rule to the file receiver's logging pipeline Correct answer
• C. Add a parse_regex processor that matches the timestamp at the start of each line to the same pipeline
• D. Shorten the receiver's wildcard_refresh_interval so that the agent reads each trace in a single pass

Option B is correct because the Ops Agent parse_multiline processor with the java language_exceptions rule joins the lines of a stack trace into one log entry. Option A only records the file path as a label, option C parses single lines and does not join them, and option D changes how often new files are discovered, not how lines are grouped.

• A. Install the Ops Agent in the container image and map level to severity with a modify_fields processor
• B. Create a sink with a filter on jsonPayload.level that routes the error lines to the _Required log bucket
• C. Add an exclusion to the _Default sink that drops entries whose jsonPayload.level is below ERROR
• D. Write the level in a field named severity and the text in a field named message in each JSON line Correct answer

Option D is correct because Cloud Logging maps the special JSON fields severity and message from structured stdout lines to the entry's severity and text, so renaming level and msg gives each entry the right severity. Option A needs an agent that Cloud Run does not run, and options B and C only route or drop entries without changing their severity.

• A. Request traces for calls between the Pods of your workload
• B. Container stdout and stderr output from your workload's Pods Correct answer
• C. Data Access audit logs for reads of Kubernetes objects through the API server
• D. System metrics for the cluster, such as container CPU and memory usage Correct answer
• E. CPU profiles of the running containers, collected at regular intervals

Options B and D are correct because a default GKE Autopilot cluster sends system and workload logs, including container stdout and stderr, to Cloud Logging, and system metrics such as container CPU and memory to Cloud Monitoring. Option A needs instrumentation and an exporter, option C Data Access audit logs are off by default, and option E profiling needs the Profiler agent.

• A. Switch the flame graph to the Heap profile type and look for the classes that hold the most retained memory after the release
• B. Use the Compare to option on the CPU time profile to diff the new version against the previous one and open the widest new frame
• C. Switch the flame graph to the Wall time profile type and look for wide frames that wait on locks, connections or downstream calls Correct answer
• D. Raise the CPU request of the Pods so that the profiler agent has enough CPU to collect more samples per profile

Option C is correct because low CPU with high latency means requests are waiting rather than computing, and the Wall time profile type shows time spent blocked on locks, connections and downstream calls. Option A shows retained memory, not waiting time. Option B diffs the CPU profile, which has no frame above 3%. Option D adds CPU to a service that is already under 20% utilization.

• A. Contention, which lists the functions where goroutines wait on a lock, along with the time spent waiting there
• B. Threads, which lists the goroutines that exist at the time of each profile
• C. Allocated heap, which lists the functions that allocate the most memory over the profile period Correct answer
• D. Heap, which lists the functions holding the most live memory at the time of each profile, grouped by the call path that allocated it

Option C is correct because the Allocated heap profile shows the functions that allocate the most memory over the profile period, including objects that are freed quickly, which is what feeds the garbage collector. Option D shows live memory only, so short-lived garbage does not appear. Options A and B cover lock waits and goroutine counts, which do not point to allocation.

• A. The load balancer's request_count metric, grouped by response_code_class and by proxy_continent
• B. The span durations that Cloud Trace shows for the slowest requests of the checkout service in the GKE backends
• C. The load balancer's backend_latencies metric against the application's own 120 ms p95, both at the 95th percentile
• D. The load balancer's total_latencies metric against its backend_latencies metric, both at the 95th percentile and grouped by proxy_continent Correct answer

Option D is correct because total_latencies includes the time to deliver the response to the client, while backend_latencies stops when the backend has answered. The gap between them, grouped by proxy_continent, shows the time spent between the load balancer and users in each region. Options A, B and C either do not measure latency, stay inside the backend, or compare against an application metric that omits the network leg.

• A. Set the aligner to delta with a one-minute alignment period
• B. Group by the service label with the count reducer
• C. Set the aligner to rate with a one-minute alignment period Correct answer
• D. Group by the service label with the sum reducer Correct answer
• E. Set the aligner to mean with a one-minute alignment period

Options C and D are correct because the rate aligner turns the cumulative counter into a per-second value over each one-minute window, and grouping by the service label with the sum reducer adds the Pods of each service into one line. Delta (A) gives the change per period rather than per second, mean (E) leaves the counter climbing, and the count reducer (B) counts time series instead of adding their rates.