Download Google Cloud Professional Cloud Developer Ultimate Exam and more Exams Technology in PDF only on Docsity!
Developer Ultimate Exam
Question 1. Which Google Cloud service is best suited for running stateless, containerized micro-services with automatic scaling and per-request concurrency control? A) Compute Engine B) Cloud Run C) Cloud Functions D) App Engine Standard Answer: B Explanation: Cloud Run executes containers in a fully managed environment, automatically scaling based on incoming requests and allowing you to set maximum concurrency per instance. Question 2. When choosing between GKE Autopilot and GKE Standard, which statement is true? A) Autopilot lets you manually provision node pools. B) Standard provides a fully managed control plane but you manage the nodes. C) Autopilot automatically patches the operating system of the nodes you create. D) Standard does not support custom machine types. Answer: B Explanation: GKE Standard gives you a managed control plane while you are responsible for node provisioning, whereas Autopilot abstracts node management completely. Question 3. Which Cloud Run deployment option enables a service to be available in multiple regions with traffic routed to the nearest region? A) Single-region deployment
Developer Ultimate Exam
B) Multi-regional (global) domain mapping C) Traffic split D) Cloud Run for Anthos Answer: B Explanation: Mapping a Cloud Run service to a global domain with Cloud Load Balancing lets requests be served from the nearest region where the service is deployed. Question 4. In Cloud Functions, which trigger type is most appropriate for processing objects uploaded to Cloud Storage? A) HTTP trigger B) Cloud Pub/Sub trigger C) Cloud Storage trigger D) Scheduler trigger Answer: C Explanation: Cloud Functions can be directly triggered by Cloud Storage events such as object creation or deletion. Question 5. Which App Engine environment should you select if you need support for custom native binaries and unlimited request time? A) Standard environment B) Flexible environment C) Cloud Run D) GKE Autopilot Answer: B Explanation: The App Engine Flexible environment runs on Compute Engine VMs, allowing custom binaries and no request-time limits, unlike the Standard environment.
Developer Ultimate Exam
Explanation: Archive is the lowest-cost class for long-term storage with infrequent access, whereas Coldline is for less-frequent but more immediate access. Question 9. Which feature of Cloud Storage allows you to automatically delete objects after a defined period? A) Object versioning B) Lifecycle management C) Signed URLs D) Bucket policy only Answer: B Explanation: Lifecycle rules can transition objects to cheaper storage classes or delete them after a set age. Question 10. A developer wants to store session state in a managed in-memory cache with high availability. Which service should be used? A) Cloud SQL B) Cloud Memorystore for Redis C) Cloud Bigtable D) Cloud Filestore Answer: B Explanation: Cloud Memorystore provides fully managed Redis or Memcached instances suitable for fast, volatile data like session state. Question 11. Which load balancing type distributes traffic across multiple regions and provides cross-region failover? A) Internal TCP/UDP Load Balancer B) Network Load Balancer
Developer Ultimate Exam
C) Global HTTP(S) Load Balancer D) Internal HTTP(S) Load Balancer Answer: C Explanation: The Global HTTP(S) Load Balancer routes requests to the nearest healthy backend across regions. Question 12. To protect a public-facing API from DDoS attacks at the edge of Google’s network, which service should be configured? A) Cloud Armor B) VPC Service Controls C) Identity-Aware Proxy (IAP) D) Cloud NAT Answer: A Explanation: Cloud Armor provides edge-level DDoS protection and security policies for HTTP(S) traffic. Question 13. Which of the following defines a failure domain that spans multiple zones within a region? A) Zonal resources B) Regional resources C) Global resources D) Multi-regional resources Answer: B Explanation: Regional resources are replicated across zones in the same region, providing higher availability than zonal resources. Question 14. Which IAM principle is illustrated by granting a service account only the “roles/pubsub.publisher” role for a specific topic?
Developer Ultimate Exam
Question 17. Which Google Cloud service is used to host a private container registry for custom Docker images? A) Artifact Registry B) Cloud Container Builder C) Cloud Source Repositories D) Cloud Functions Answer: A Explanation: Artifact Registry supports Docker images (and other artifacts) with fine-grained IAM controls. Question 18. When integrating a large language model using Gemini APIs, which GCP service can you use to securely store the API key and rotate it automatically? A) Cloud Scheduler B) Secret Manager C) Cloud Tasks D) Cloud Logging Answer: B Explanation: Secret Manager securely stores API keys and supports automatic rotation policies. Question 19. Which testing level validates that a function correctly interacts with a Cloud Pub/Sub topic? A) Unit test B) Integration test C) Load test D) Smoke test Answer: B
Developer Ultimate Exam
Explanation: Integration tests verify interactions between components, such as publishing to or pulling from Pub/Sub. Question 20. In Cloud Build, which feature allows you to enforce that every container image is scanned for vulnerabilities before it is pushed to Artifact Registry? A) Build triggers B) Substitutions C) Cloud Build “security” step with Container Analysis D) Cloud Deploy Answer: C Explanation: Cloud Build can invoke Container Analysis to scan images for known vulnerabilities as part of the build pipeline. Question 21. Which Google Cloud service provides binary authorization to ensure only trusted images are deployed to GKE? A) Binary Authorization B) Cloud Armor C) Cloud IAM D) Cloud KMS Answer: A Explanation: Binary Authorization enforces policies that only signed, trusted container images can be run on GKE. Question 22. Which deployment strategy sends a small percentage of traffic to a new version while keeping the rest on the stable version? A) Blue/Green B) Canary C) Rolling update
Developer Ultimate Exam
A) Terraform B) Cloud Deployment Manager C) Ansible D) Pulumi Answer: B Explanation: Deployment Manager uses declarative configuration files to create and manage GCP resources. Question 26. When using Terraform to manage GCP resources, which file typically contains provider configuration? A) main.tf B) variables.tf C) providers.tf D) outputs.tf Answer: C Explanation: The providers.tf file is conventionally used to configure the GCP provider block. Question 27. Which Kubernetes-native tool can be used to synchronize GCP resources (e.g., Cloud SQL instances) with Kubernetes Custom Resource Definitions? A) Config Connector B) Cloud Deployment Manager C) Anthos Config Management D) Cloud Scheduler Answer: A Explanation: Config Connector maps GCP resources to Kubernetes CRDs, allowing declarative management via kubectl.
Developer Ultimate Exam
Question 28. Which Google Cloud service enables asynchronous, at-least-once messaging between microservices without requiring a dedicated server? A) Cloud Tasks B) Cloud Scheduler C) Pub/Sub D) Cloud Run Answer: C Explanation: Pub/Sub provides durable, asynchronous messaging with at-least-once delivery semantics. Question 29. Eventarc is primarily used for: A) Scheduling cron jobs. B) Triggering Cloud Run services based on changes in Cloud Storage, Firestore, or other GCP services. C) Managing API keys. D) Performing real-time log analysis. Answer: B Explanation: Eventarc routes events from various GCP sources to Cloud Run, Cloud Functions, or other services. Question 30. Which service is best suited for executing background tasks that need guaranteed processing order and retry semantics? A) Cloud Scheduler B) Cloud Tasks C) Pub/Sub FIFO subscription D) Cloud Run Jobs
Developer Ultimate Exam
C) Cloud Trace D) Cloud Profiler Answer: B Explanation: Log-based metrics in Cloud Monitoring can be defined from filtered log entries, such as 5xx status codes. Question 34. In Cloud Monitoring, what does an SLI (Service Level Indicator) represent? A) The contractual penalty for downtime. B) A quantitative measure of a service’s performance (e.g., latency). C) The target availability percentage. D) The cost of the service. Answer: B Explanation: An SLI is a metric that reflects a specific aspect of service performance, used to compute SLOs. Question 35. Which Cloud Trace feature helps you identify the most time-consuming functions in a request’s call graph? A) Span filtering B) Latency heatmap C) Trace waterfall view D) Log-based trace aggregation Answer: C Explanation: The waterfall view visualizes each span’s duration, highlighting hotspots in the execution path. Question 36. What is the primary purpose of Cloud Profiler? A) Collecting heap dumps.
Developer Ultimate Exam
B) Continuously sampling CPU and memory usage of production workloads to identify hot code paths. C) Capturing full request payloads. D) Managing IAM policies. Answer: B Explanation: Cloud Profiler samples applications in production to show where CPU and memory are spent, aiding optimization. Question 37. Which log export destination allows you to run ad-hoc SQL queries over your logs? A) Cloud Storage B) Pub/Sub C) BigQuery D) Cloud Monitoring Answer: C Explanation: Exporting logs to BigQuery enables SQL analysis over log data. Question 38. When troubleshooting a VPC connectivity issue, which log type provides information about allowed/denied traffic at the subnet level? A) Cloud Audit Logs B) VPC Flow Logs C) Cloud DNS Logs D) Cloud Router Logs Answer: B Explanation: VPC Flow Logs capture network flow metadata, useful for diagnosing connectivity problems.
Developer Ultimate Exam
Explanation: Archive is designed for infrequently accessed data with long-term retention requirements. Question 42. When configuring a Cloud SQL instance for high availability, which option must be enabled? A) Read replicas B) Regional instance with failover replica C) Automatic backups only D) Private IP only Answer: B Explanation: Enabling a regional instance with a failover replica creates a synchronous replica in another zone for HA. Question 43. Which of the following best describes the “cold start” phenomenon in serverless platforms? A) The time taken to spin up a new VM instance. B) The latency incurred when the first request triggers the creation of a new container instance. C) The delay caused by DNS propagation. D) The period before a load balancer becomes active. Answer: B Explanation: Cold start refers to the initialization latency when a serverless platform provisions a new instance to handle an incoming request. Question 44. Which GKE feature automatically scales the number of pods in a deployment based on CPU utilization? A) Vertical Pod Autoscaler B) Horizontal Pod Autoscaler
Developer Ultimate Exam
C) Cluster Autoscaler D) Node Auto-provisioning Answer: B Explanation: The Horizontal Pod Autoscaler adjusts replica count based on observed metrics like CPU usage. Question 45. In Cloud Run, what does the “max-requests-per-container” setting control? A) Maximum number of simultaneous connections. B) Maximum number of requests an instance can handle before it is terminated. C) Maximum number of concurrent requests per instance (concurrency). D) Maximum request payload size. Answer: C Explanation: This setting defines the concurrency level—how many requests a single instance can process at once. Question 46. Which of the following is a recommended practice for managing API keys used by a mobile app? A) Embed the key directly in the app binary. B) Store the key in a public Cloud Storage bucket. C) Use the API Gateway’s API key verification and rotate keys regularly via Secret Manager. D) None of the above. Answer: C Explanation: API Gateway can validate API keys, and storing them in Secret Manager enables rotation and secure access.
Developer Ultimate Exam
Explanation: The Global HTTP(S) Load Balancer combined with Cloud CDN serves content from the nearest edge point. Question 50. Which of the following best describes the purpose of a “service mesh” such as Anthos Service Mesh? A) To provide a managed relational database. B) To handle traffic routing, observability, and security between microservices without code changes. C) To store large binary artifacts. D) To schedule batch jobs. Answer: B Explanation: A service mesh adds a transparent layer for traffic management, telemetry, and security across services. Question 51. Which IAM role provides read-only access to all GCP resources in a project? A) roles/editor B) roles/owner C) roles/viewer D) roles/browser Answer: C Explanation: The Viewer role grants read-only permissions across the project. Question 52. Which of the following is NOT a valid way to authenticate a service running on GKE to access Secret Manager? A) Using a workload identity binding. B) Storing a service account key file inside the container.
Developer Ultimate Exam
C) Using Application Default Credentials with the node’s service account. D) Enabling Workload Identity and assigning the appropriate IAM role. Answer: B Explanation: Storing keys inside containers is insecure and not recommended; workload identity or ADC should be used. Question 53. What is the primary benefit of using Cloud Run Jobs over Cloud Run Services for batch workloads? A) Jobs support HTTP triggers. B) Jobs guarantee at-least-once execution without concurrency. C) Jobs run to completion and then stop, without a permanent endpoint. D) Jobs are only available in GKE. Answer: C Explanation: Cloud Run Jobs are designed for finite, non-HTTP workloads that terminate after execution. Question 54. Which Cloud Storage feature enables temporary, time-limited access to a private object without exposing credentials? A) Public bucket policy B) Signed URL C) CORS configuration D) Object versioning Answer: B Explanation: Signed URLs grant time-bound access to a specific object using a cryptographic signature. Question 55. Which Cloud Logging feature allows you to route logs from a specific GKE namespace to a Pub/Sub topic?
