Latest Google Professional-Cloud-DevOps-Engineer Dumps for success in Actual Exam Mar-2026]
Realistic Professional-Cloud-DevOps-Engineer 100% Pass Guaranteed Download Exam Q&A
NEW QUESTION # 77
Your organization wants to collect system logs that will be used to generate dashboards in Cloud Operations for their Google Cloud project. You need to configure all current and future Compute Engine instances to collect the system logs and you must ensure that the Ops Agent remains up to date. What should you do?
- A. Install the Ops Agent on the Compute Engine image by using a startup script
- B. Use the gcloud CLI to install the Ops Agent on each VM listed in the Cloud Asset Inventory
- C. Select all VMs with an Agent status of Not detected on the Cloud Operations VMs dashboard Then select Install agents
- D. Use the gcloud CLI to create an Agent Policy.
Answer: D
NEW QUESTION # 78
You are analyzing Java applications in production. All applications have Cloud Profiler and Cloud Trace installed and configured by default. You want to determine which applications need performance tuning. What should you do?
Choose 2 answers
- A. Examine the heap usage Of the application. If the usage is low, mark the application for optimization.
- B. Examine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the memory resource allocation.
- C. 17 Examine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the local disk storage allocation.
- D. Examine the wall-clock time and the CPU time Of the application. If the difference is substantial, increase the CPU resource allocation.
- E. O Examine the latency time, the wall-clock time, and the CPU time of the application. If the latency time is slowly burning down the error budget, and the difference between wall-clock time and CPU time is minimal, mark the application for optimization.
Answer: D,E
Explanation:
The correct answers are A and D)
Examine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the CPU resource allocation. This is a good way to determine if the application is CPU-bound, meaning that it spends more time waiting for the CPU than performing actual computation. Increasing the CPU resource allocation can improve the performance of CPU-bound applications1.
Examine the latency time, the wall-clock time, and the CPU time of the application. If the latency time is slowly burning down the error budget, and the difference between wall-clock time and CPU time is minimal, mark the application for optimization. This is a good way to determine if the application is I/O-bound, meaning that it spends more time waiting for input/output operations than performing actual computation. Increasing the CPU resource allocation will not help I/O-bound applications, and they may need optimization to reduce the number or duration of I/O operations2.
Answer B is incorrect because increasing the memory resource allocation will not help if the application is CPU-bound or I/O-bound. Memory allocation affects how much data the application can store and access in memory, but it does not affect how fast the application can process that data.
Answer C is incorrect because increasing the local disk storage allocation will not help if the application is CPU-bound or I/O-bound. Disk storage affects how much data the application can store and access on disk, but it does not affect how fast the application can process that data.
Answer E is incorrect because examining the heap usage of the application will not help to determine if the application needs performance tuning. Heap usage affects how much memory the application allocates for dynamic objects, but it does not affect how fast the application can process those objects. Moreover, low heap usage does not necessarily mean that the application is inefficient or unoptimized.
NEW QUESTION # 79
Your company runs applications in Google Kubernetes Engine (GKE) that are deployed following a GitOps methodology.
Application developers frequently create cloud resources to support their applications. You want to give developers the ability to manage infrastructure as code, while ensuring that you follow Google-recommended practices. You need to ensure that infrastructure as code reconciles periodically to avoid configuration drift.
What should you do?
- A. Install and configure Config Connector in Google Kubernetes Engine (GKE).
- B. Create a Job resource with a Terraform docker image to execute terraforrm plan and terraform apply commands.
- C. Create a Pod resource with a Terraform docker image to execute terraform plan and terraform apply commands.
- D. Configure Cloud Build with a Terraform builder to execute plan and apply commands.
Answer: A
Explanation:
The best option to give developers the ability to manage infrastructure as code, while ensuring that you follow Google-recommended practices, is to install and configure Config Connector in Google Kubernetes Engine (GKE).
Config Connector is a Kubernetes add-on that allows you to manage Google Cloud resources through Kubernetes. You can use Config Connector to create, update, and delete Google Cloud resources using Kubernetes manifests.Config Connector also reconciles the state of the Google Cloud resources with the desired state defined in the manifests, ensuring that there is no configuration drift1.
Config Connector follows the GitOps methodology, as it allows you to store your infrastructure configuration in a Git repository, and use tools such as Anthos Config Management or Cloud Source Repositories to sync the configuration to your GKE cluster.This way, you can use Git as the source of truth for your infrastructure, and enable reviewable and version-controlled workflows2.
Config Connector can be installed and configured in GKE using either the Google Cloud Console or the gcloud command-line tool. You need to enable the Config Connector add-on for your GKE cluster, and create a Google Cloud service account with the necessary permissions to manage the Google Cloud resources.You also need to create a Kubernetes namespace for each Google Cloud project that you want to manage with Config Connector3.
By using Config Connector in GKE, you can give developers the ability to manage infrastructure as code, while ensuring that you follow Google-recommended practices.You can also benefit from the features and advantages of Kubernetes, such as declarative configuration, observability, and portability4.
References:
1:Overview | Artifact Registry Documentation | Google Cloud
2: Deploy Anthos on GKE with Terraform part 1: GitOps with Config Sync | Google Cloud Blog
3: Installing Config Connector | Config Connector Documentation | Google Cloud
4: Why use Config Connector? | Config Connector Documentation | Google Cloud
NEW QUESTION # 80
You support an application deployed on Compute Engine. The application connects to a Cloud SQL instance to store and retrieve dat a. After an update to the application, users report errors showing database timeout messages. The number of concurrent active users remained stable. You need to find the most probable cause of the database timeout. What should you do?
- A. Determine whether there is an increased number of connections to the Cloud SQL instance.
- B. Use Cloud Security Scanner to see whether your Cloud SQL is under a Distributed Denial of Service (DDoS) attack.
- C. Check the serial port logs of the Compute Engine instance.
- D. Use Stackdriver Profiler to visualize the resources utilization throughout the application.
Answer: D
NEW QUESTION # 81
Your company runs services by using Google Kubernetes Engine (GKE). The GKE clusters in the development environment run applications with verbose logging enabled. Developers view logs by using the kubect1 logs command and do not use Cloud Logging. Applications do not have a uniform logging structure defined. You need to minimize the costs associated with application logging while still collecting GKE operational logs. What should you do?
- A. Add the severity >= DEBUG resource. type "k83 container" exclusion filter to the Default logging sink in the project associated with the development environment.
- B. Run the gcloud container clusters update logging=WORKLOAD command for the development cluster.
- C. Run the gcloud container clusters update --logging-SYSTEM command for the development cluster.
- D. Run the gcloud logging sinks update _Defau1t --disabled command in the project associated with the development environment.
Answer: C
NEW QUESTION # 82
As a Site Reliability Engineer, you support an application written in GO that runs on Google Kubernetes Engine (GKE) in production. After releasing a new version Of the application, you notice the application runs for about 15 minutes and then restarts. You decide to add Cloud Profiler to your application and now notice that the heap usage grows constantly until the application restarts. What should you do?
- A. Increase the CPU limit in the application deployment.
- B. Add high memory compute nodes to the cluster.
- C. Add Cloud Trace to the application, and redeploy.
- D. Increase the memory limit in the application deployment.
Answer: D
Explanation:
The correct answer is B, Increase the memory limit in the application deployment.
The application is experiencing a memory leak, which means that it is allocating memory that is not freed or reused. This causes the heap usage to grow constantly until it reaches the memory limit of the pod, which triggers a restart by Kubernetes. Increasing the memory limit in the application deployment can help mitigate the problem by allowing the application to run longer before reaching the limit. However, this is not a permanent solution, as the memory leak will still occur and eventually exhaust the available memory. The best solution is to identify and fix the source of the memory leak in the application code, using tools like Cloud Profiler and pprof12.
Reference:
Using Cloud Profiler with Go, Troubleshooting memory leaks. Profiling Go Programs, Heap profiles.
NEW QUESTION # 83
You are developing a Node.js utility on a workstation in Cloud Workstations by using Code OSS. The utility is a simple web page, and you have already confirmed that all necessary firewall rules are in place. You tested the application by starting it on port 3000 on your workstation in Cloud Workstations, but you need to be able to access the web page from your local machine. You need to follow Google-recommended security practices.
What should you do?
- A. Allow public IP addresses in the Cloud Workstations configuration.
- B. Click the preview link in the Code OSS panel.
- C. Run the gcloud compute start-iap-tunnel command to the Cloud Workstations VM.
- D. Use a browser running on a bastion host VM.
Answer: B
Explanation:
Cloud Workstations provides a secure way to preview web applications using built-in preview links, which expose internal ports only via authenticated and authorized access - no public IP exposure required.
"To preview your app, click the preview icon in the Code OSS panel, which securely tunnels the service to your browser."
- Cloud Workstations - Previewing your app
This adheres to Google's security best practices by avoiding public IPs or manual tunneling while enabling developer efficiency.
NEW QUESTION # 84
You are the Operations Lead for an ongoing incident with one of your services. The service usually runs at around 70% capacity. You notice that one node is returning 5xx errors for all requests. There has also been a noticeable increase in support cases from customers. You need to remove the offending node from the load balancer pool so that you can isolate and investigate the node. You want to follow Google-recommended practices to manage the incident and reduce the impact on users. What should you do?
- A. 1. Communicate your intent to the incident team.2. Perform a load analysis to determine if the remaining nodes can handle the increase in traffic offloaded from the removed node, and scale appropriately.3. When any new nodes report healthy, drain traffic from the unhealthy node, and remove the unhealthy node from service.
- B. 1. Communicate your intent to the incident team.2. Add a new node to the pool, and wait for the new node to report as healthy.3. When traffic is being served on the new node, drain traffic from the unhealthy node, and remove the old node from service.
- C. 1 . Drain traffic from the unhealthy node and remove the old node from service.2. Add a new node to the pool, wait for the new node to report as healthy, and then serve traffic to the new node.3. Monitor traffic to ensure that the pool is healthy and is handling traffic appropriately.4. Communicate your actions to the incident team.
- D. 1 . Drain traffic from the unhealthy node and remove the node from service.2. Monitor traffic to ensure that the error is resolved and that the other nodes in the pool are handling the traffic appropriately.3. Scale the pool as necessary to handle the new load.4. Communicate your actions to the incident team.
Answer: A
NEW QUESTION # 85
You are configuring connectivity across Google Kubernetes Engine (GKE) clusters in different VPCs You notice that the nodes in Cluster A are unable to access the nodes in Cluster B You suspect that the workload access issue is due to the network configuration You need to troubleshoot the issue but do not have execute access to workloads and nodes You want to identify the layer at which the network connectivity is broken What should you do?
- A. Use Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster
- B. Install a toolbox container on the node in Cluster A Confirm that the routes to Cluster B are configured appropriately
- C. Enable VPC Flow Logs in both VPCs and monitor packet drops
- D. Use a debug container to run the traceroute command from Cluster A to Cluster B and from Cluster B to Cluster A Identify the common failure point
Answer: A
Explanation:
Explanation
The best option for troubleshooting the issue without having execute access to workloads and nodes is to use Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B. Network Connectivity Center is a service that allows you to create, manage, and monitor network connectivity across Google Cloud, hybrid, and multi-cloud environments. You can use Network Connectivity Center to perform a Connectivity Test, which is a feature that allows you to test the reachability and latency between two endpoints, such as GKE clusters, VM instances, or IP addresses. By using Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B, you can identify the layer at which the network connectivity is broken, such as the firewall, routing, or load balancing.
NEW QUESTION # 86
You support a multi-region web service running on Google Kubernetes Engine (GKE) behind a Global HTTP'S Cloud Load Balancer (CLB). For legacy reasons, user requests first go through a third-party Content Delivery Network (CDN). which then routes traffic to the CLB. You have already implemented an availability Service Level Indicator (SLI) at the CLB level. However, you want to increase coverage in case of a potential load balancer misconfiguration. CDN failure, or other global networking catastrophe. Where should you measure this new SLI?
Choose 2 answers
- A. Metrics exported from the application servers
- B. Instrumentation coded directly in the client
- C. Your application servers' logs
- D. A synthetic client that periodically sends simulated user requests
- E. GKE health checks for your application servers
Answer: A,E
NEW QUESTION # 87
You have a set of applications running on a Google Kubernetes Engine (GKE) cluster, and you are using Stackdriver Kubernetes Engine Monitoring. You are bringing a new containerized application required by your company into production. This application is written by a third party and cannot be modified or reconfigured. The application writes its log information to /var/log/app_messages.log, and you want to send these log entries to Stackdriver Logging. What should you do?
- A. Use the default Stackdriver Kubernetes Engine Monitoring agent configuration.
- B. Install Kubernetes on Google Compute Engine (GCE> and redeploy your applications. Then customize the built-in Stackdriver Logging configuration to tail the log file in the application's pods and write to Stackdriver Logging.
- C. Write a script to tail the log file within the pod and write entries to standard output. Run the script as a sidecar container with the application's pod. Configure a shared volume between the containers to allow the script to have read access to /var/log in the application container.
- D. Deploy a Fluentd daemonset to GKE. Then create a customized input and output configuration to tail the log file in the application's pods and write to Slackdriver Logging.
Answer: D
Explanation:
https://cloud.google.com/architecture/customizing-stackdriver-logs-fluentd Besides the list of default logs that the Logging agent streams by default, you can customize the Logging agent to send additional logs to Logging or to adjust agent settings by adding input configurations. The configuration definitions in these sections apply to the fluent-plugin-google-cloud output plugin only and specify how logs are transformed and ingested into Cloud Logging. https://cloud.google.com/logging/docs/agent/logging/configuration#configure
NEW QUESTION # 88
You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (Pll) is leaking into certain log entry fields. All Pll entries begin with the text userinfo. You want to capture these log entries in a secure location for later review and prevent them from leaking to Stackdriver Logging. What should you do?
- A. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, and then copy the entries to a Cloud Storage bucket.
- B. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, create an advanced log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
- C. Create an advanced log filter matching userinfo, configure a log export in the Stackdriver console with Cloud Storage as a sink, and then configure a tog exclusion with userinfo as a filter.
- D. Create a basic log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
Answer: A
Explanation:
Explanation
https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76
NEW QUESTION # 89
Your company runs applications in Google Kubernetes Engine (GKE). Several applications rely on ephemeral volumes. You noticed some applications were unstable due to the DiskPressure node condition on the worker nodes. You need to identify which Pods are causing the issue, but you do not have execute access to workloads and nodes.
What should you do?
- A. Check the metric by using Metrics Explorer.
- B. Locate all the Pods with emptyDir volumes. Use the du -sh * command to measure volume disk usage.
- C. Check the node/ephemeral_storage/used_bytes metric by using Metrics Explorer.
- D. Locate all the Pods with emptyDir volumes. use the df-h command to measure volume disk usage.
Answer: C
Explanation:
The correct answer is A. Check the node/ephemeral_storage/used_bytes metric by using Metrics Explorer.
The node/ephemeral_storage/used_bytes metric reports the total amount of ephemeral storage used by Pods on each node1.You can use Metrics Explorer to query and visualize this metric and filter it by node name, namespace, or Pod name2. This way, you can identify which Pods are consuming the most ephemeral storage and causing disk pressure on the nodes. You do not need to have execute access to the workloads or nodes to use Metrics Explorer.
The other options are incorrect because they require execute access to the workloads or nodes, which you do not have.The df -h and du -sh * commands are Linux commands that can measure disk usage, but you need to run them inside the Pods or on the nodes, which is not possible in your scenario34.
Reference:
Monitoring metrics for Kubernetes system components, Node metrics, node/ephemeral_storage/used_bytes.
Using Metrics Explorer, Querying metrics.How do I find out disk space utilization information using Linux command line?, df command.How to check disk space in Linux from the command line, du command.
NEW QUESTION # 90
You encounter a large number of outages in the production systems you support. You receive alerts for all the outages that wake you up at night. The alerts are due to unhealthy systems that are automatically restarted within a minute. You want to set up a process that would prevent staff burnout while following Site Reliability Engineering practices. What should you do?
- A. Distribute the alerts to engineers in different time zones.
- B. Eliminate unactionable alerts.
- C. Redefine the related Service Level Objective so that the error budget is not exhausted.
- D. Create an incident report for each of the alerts.
Answer: B
Explanation:
Explanation
Eliminate bad monitoring : Unactionable alerts (i.e., spam)
https://cloud.google.com/blog/products/management-tools/meeting-reliability-challenges-with-sre-principles agree with kyubiblaze about having to remove unactionable items aka spam: "good monitoring alerts on actionable problems" @
https://cloud.google.com/blog/products/management-tools/meeting-reliability-challenges-with-sre-principles
NEW QUESTION # 91
You need to create a Cloud Monitoring SLO for a service that will be published soon. You want to verify that requests to the service will be addressed in fewer than 300 ms at least 90% Of the time per calendar month.
You need to identify the metric and evaluation method to use. What should you do?
- A. Select a latency metric for a window-based method of evaluation.
- B. Select an availability metric for a window-based method Of evaluation.
- C. Select a latency metric for a request-based method of evaluation.
- D. Select an availability metric for a request-based method of evaluation.
Answer: C
Explanation:
The correct answer is A. Select a latency metric for a request-based method of evaluation.
A latency metric measures how responsive your service is to users.For example, you can use thecloud.
googleapis.com/http/server/response_latenciesmetric to measure the latency of HTTP requests to your service1. A request-based method of evaluation counts the number of successful requests that meet a certain criterion, such as being below a latency threshold, and compares it to the number of all requests.For example, you can define an SLI as the ratio of requests with latency below 300 ms to all requests2. A request-based method of evaluation is suitable for measuring performance over time, such as per calendar month.You can set an SLO for the SLI to be at least 90%, which means that you expect 90% of the requests to have latency below 300 ms in a month3.
Reference:
Creating an SLO | Operations Suite | Google Cloud, Choosing a metric, Latency metric.Concepts in service monitoring | Operations Suite | Google Cloud, Service-level indicators, Request-based SLIs.Learn how to set SLOs - SRE tips | Google Cloud Blog, Setting SLOs.
NEW QUESTION # 92
You are configuring your CI/CD pipeline natively on Google Cloud. You want builds in a pre-production Google Kubernetes Engine (GKE) environment to be automatically load-tested before being promoted to the production GKE environment. You need to ensure that only builds that have passed this test are deployed to production. You want to follow Google-recommended practices. How should you configure this pipeline with Binary Authorization?
- A. Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity.
- B. Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using their personal private key.
- C. Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using a key stored in Cloud Key Management Service (Cloud KMS).
- D. Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) with a service account JSON key stored as a Kubernetes Secret.
Answer: A
Explanation:
The correct answer is B. Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity.
According to the Google Cloud documentation, Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE) or Cloud Run1.
Binary Authorization uses attestations to certify that a specific image has completed a previous stage in the CI
/CD pipeline, such as passing a load test2.Attestations are signed by private keys that are associated with attestors, which are entities that verify the attestations3.To follow Google-recommended practices, you should store your private keys in Cloud Key ManagementService (Cloud KMS), which is a secure and scalable service for managing cryptographic keys4.You should also use Workload Identity, which is a feature that allows Kubernetes service accounts to act as Google service accounts, to authenticate to Cloud KMS and sign attestations without having to manage or expose service account keys5.
The other options are incorrect because they do not follow Google-recommended practices. Option A and option D require human intervention to sign the attestations, which is not scalable or automated. Option C exposes the service account JSON key as a Kubernetes Secret, which is less secure than using Workload Identity.
NEW QUESTION # 93
Your company follows Site Reliability Engineering practices. You are the Incident Commander for a new. customer-impacting incident. You need to immediately assign two incident management roles to assist you in an effective incident response. What roles should you assign?
Choose 2 answers
- A. External Customer Communications Lead
- B. Engineering Lead
- C. Customer Impact Assessor
- D. Operations Lead
- E. Communications Lead
Answer: C,D
NEW QUESTION # 94
......
Accurate Professional-Cloud-DevOps-Engineer Answers 365 Days Free Updates: https://www.itexamsimulator.com/Professional-Cloud-DevOps-Engineer-brain-dumps.html
Professional-Cloud-DevOps-Engineer DUMPS Q&As with Explanations Verified & Correct Answers: https://drive.google.com/open?id=1rbBhG66S3Ng2CJzXkZSob4yyz3nPJmJX
