Google Professional-Cloud-DevOps-Engineer Actual Tests : Google Cloud Certified - Professional Cloud DevOps Engineer Exam

Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to a Kubernetes cluster in the production environment. The security auditor is concerned that developers or operators could circumvent automated testing and push code changes to production without approval. What should you do to enforce approvals?

• A. Enable binary authorization inside the Kubernetes cluster and configure the build pipeline as an attestor.
• B. Use an Admission Controller to verify that incoming requests originate from approved sources.
• C. Configure the build system with protected branches that require pull request approval.
• D. Leverage Kubernetes Role-Based Access Control (RBAC) to restrict access to only approved users.

You are deploying an application to Cloud Run. The application requires a password to start. Your organization requires that all passwords are rotated every 24 hours, and your application must have the latest password. You need to deploy the application with no downtime. What should you do?

• A. Store the password in Secret Manager and send the secret to the application by using environment variables.
• B. Store the password in Secret Manager and mount the secret as a volume within the application.
• C. Store the password directly in the code. Use Cloud Build to rebuild and deploy the application each time the password changes.
• D. Use Cloud Build to add your password into the application container at build time. Ensure that Artifact Registry is secured from public access.

Some of your production services are running in Google Kubernetes Engine (GKE) in the eu-west-1 region.
Your build system runs in the us-west-1 region. You want to push the container images from your build system to a scalable registry to maximize the bandwidth for transferring the images to the cluster. What should you do?

• A. Push the images to Google Container Registry (GCR) using the us.gcr.io hostname.
• B. Push the images to Google Container Registry (GCR) using the eu.gcr.io hostname.
• C. Push the images to a private image registry running on a Compute Engine instance in the eu-west-1 region.
• D. Push the images to Google Container Registry (GCR) using the gcr.io hostname.

You support a web application that runs on App Engine and uses CloudSQL and Cloud Storage for data storage. After a short spike in website traffic, you notice a big increase in latency for all user requests, increase in CPU use, and the number of processes running the application. Initial troubleshooting reveals:
After the initial spike in traffic, load levels returned to normal but users still experience high latency.
Requests for content from the CloudSQL database and images from Cloud Storage show the same high latency.
No changes were made to the website around the time the latency increased.
There is no increase in the number of errors to the users.
You expect another spike in website traffic in the coming days and want to make sure users don't experience latency. What should you do?

• A. Enable high availability on the CloudSQL instances.
• B. Upgrade the GCS buckets to Multi-Regional.
• C. Move the application from App Engine to Compute Engine.
• D. Modify the App Engine configuration to have additional idle instances.

Your company allows teams to self-manage Google Cloud projects, including project-level Identity and Access Management (IAM). You are concerned that the team responsible for the Shared VPC project might accidentally delete the project, so a lien has been placed on the project. You need to design a solution to restrict Shared VPC project deletion to those with the resourcemanager.projects.updateLiens permission at the organization level. What should you do?

• A. Instruct teams to only perform IAM permission management as code with Terraform.
• B. Enable VPC Service Controls for the container.googleapis.com API service.
• C. Revoke the resourcemanager.projects.updateLiens permission from all users associated with the project.
• D. Enable the compute.restrictXpnProjectLienRemoval organization policy constraint.