A rightsized Compute Engine workload continuously uses 100 vCPUs and their associated memory in one region. It briefly scales to 400 vCPUs during weekly processing.
The baseline will remain throughout the next year, but burst demand is uncertain. Finance has approved a one-year resource-based commitment. Your priority is to cover predictable usage while minimizing unused committed resources.
How should you size the commitment?
Cover peak usage of 400 vCPUs and memory, including the weekly processing requirement.
Cover average CPU and memory usage, combining baseline and burst consumption across the week.
Cover baseline usage of 100 vCPUs and memory, leaving additional burst consumption uncommitted.
Cover the midpoint between baseline and peak CPU and memory usage to accommodate variability.
C
The continuous baseline is the predictable resource usage available to consume the commitment throughout its term. Peak, average, and midpoint sizing exceed that baseline and introduce unused committed resources during lower-demand periods. The stated objective prioritizes predictable coverage and minimizing unused commitment, rather than covering uncertain bursts.
Optimizing performance and cost
25
Select One
After a release, a Go service needs more Compute Engine instances to handle the same request rate. CPU utilization has increased, while downstream-service latency and request payload sizes are unchanged.
Before changing machine types or scaling limits, you need to identify which functions account for the additional CPU consumption.
Which investigation is most useful?
Compare Cloud Profiler CPU profiles across the previous and current application versions.
Compare Cloud Trace dependency-span durations across the previous and current application versions.
Compare VPC Flow Logs for instances running the previous and current application versions.
Compare autoscaling recommendations for instance groups running the previous and current application versions.
A
CPU profiles attribute CPU consumption to application call stacks, allowing comparison between releases. Dependency spans show downstream timing, flow logs describe network activity, and autoscaling recommendations describe capacity requirements. Those alternatives do not directly identify functions consuming additional CPU.
Optimizing performance and cost
24
Select One
A batch workload runs on standard Compute Engine VMs. The team wants to reduce cost by using Spot VMs. Tasks run for hours and can resume from checkpoints. A scheduler retries interrupted tasks on replacement workers.
Losing all progress from an interrupted task is unacceptable. Writing a checkpoint takes several minutes. Retried tasks must not publish duplicate results.
Which TWO application changes should you make?
Write checkpoints to Cloud Storage when workers receive the VM shutdown signal.
Save checkpoints on Local SSD and reload them when replacement workers start.
Write periodic checkpoints to durable storage throughout each task's execution.
Publish results idempotently using a stable identifier for each logical task.
C
Periodic durable checkpoints preserve progress independently of shutdown timing. Stable task identifiers with idempotent publication prevent retries from producing duplicate results. A several-minute checkpoint cannot depend on Spot's best-effort shutdown period, and Local SSD does not provide durable recovery on replacement workers.
Optimizing performance and cost
23
Select Two
D
An application on Compute Engine writes structured JSON logs containing an email field and diagnostic fields. The Ops Agent sends these entries to Cloud Logging.
Policy requires that email values never be transmitted to Cloud Logging. The remaining fields must stay available for troubleshooting.
Which approach meets the requirement?
Restrict access to the email field in the destination log bucket.
Exclude entries containing email from the project's default log sink.
Remove the email field in the agent's processing pipeline before export.
Remove the email field in a Pub/Sub consumer downstream of a log sink.
C
Removing the field before export prevents transmission to Cloud Logging while retaining the other fields. Field-access restrictions apply after ingestion. Sink exclusions operate after receipt and exclude matching entries from a destination. A downstream Pub/Sub consumer also processes data after Cloud Logging has received it.
Implementing observability and troubleshooting
22
Select One
A GKE Standard cluster has pending Pods. Cluster autoscaling is enabled, and the node pool is below its maximum size. The Pods would fit on additional nodes of that pool.
Autoscaler logs report scale.up.error.quota.exceeded. The corresponding managed instance group identifies exhausted regional CPU quota.
What should you do?
Increase the node pool's maximum size so that the autoscaler can request more nodes.
Lower the Horizontal Pod Autoscaler's CPU target so that additional replicas trigger node provisioning.
Increase the containers' CPU limits so that existing nodes can accommodate the pending workloads.
Increase the regional CPU quota or release other resources that consume the same quota.
D
Regional CPU quota is the identified constraint. Increasing it or releasing consumed quota removes that blocker, although provisioning still depends on resource availability. Raising the node-pool maximum or creating additional Pods does not increase quota. Container CPU limits do not change the project's Compute Engine allocation.
Implementing observability and troubleshooting
21
Select One
A service exports a request counter to Managed Service for Prometheus. Its labels include route, status class, user ID, and request ID. Metric ingestion volume grows rapidly.
Operators need request rates by route and status class. They use logs and traces to investigate individual requests.
Which change best reduces metric cardinality while preserving these workflows?
Remove user and request IDs from metric labels; retain them in logs and traces.
Hash user and request IDs before exporting them as values of the existing labels.
Increase the scrape interval while preserving the current metric labels and their values.
Embed user and request IDs in metric names; retain route and status as labels.
A
User and request IDs generate many distinct time series. Removing them from metric labels preserves the requested route and status aggregation while logs and traces retain detailed investigation. Hashing preserves distinct-value counts. A longer scrape interval reduces samples but not cardinality. Encoding identifiers in metric names moves rather than removes the problem.
Implementing observability and troubleshooting
20
Select One
A project has two log sinks:
- _Default sends application logs to the default log bucket.
- archive sends the same application logs to Cloud Storage.
Future DEBUG application logs must remain in Cloud Storage but must not be stored in the default log bucket. Other application logs must continue reaching both destinations.
What should you do?
Exclude DEBUG entries from archive and retain the existing _Default configuration.
Exclude DEBUG entries from _Default and retain the existing archive configuration.
Filter DEBUG entries in the application's logging agent and retain both sink configurations.
Exclude DEBUG entries from both sinks and increase the archive bucket's retention period.
B
The two sinks evaluate entries independently. A DEBUG exclusion on _Default prevents storage in that destination while leaving archive routing intact. Agent-side filtering prevents the entries from reaching either sink. Excluding them from archive, with or without longer retention, defeats the archive requirement.
Implementing observability and troubleshooting
19
Select One
A request passes through three HTTP services. Each exports spans to Cloud Trace, but the services' spans appear as separate traces. Application logs contain timestamps and request messages but are not linked to spans.
You need an end-to-end trace and navigation between spans and their associated logs.
Which TWO changes should you implement?
Inject trace context into outgoing requests and extract it before creating downstream spans.
Reuse the originating span ID in downstream services while retaining each service's generated trace ID.
Attach the originating service name to downstream spans and log entries as a shared label.
Populate Cloud Logging's trace and span fields using the application's active tracing context.
A
Context propagation allows downstream spans to participate in the originating trace, and Cloud Logging's trace and span fields link log entries to that context. Reusing a span ID with unrelated trace IDs does not establish parent-child relationships, and shared labels do not replace trace context.
Implementing observability and troubleshooting
18
Select Two
D
An application exports a classic Prometheus histogram named http_request_duration_seconds. All replicas use identical bucket boundaries. The metric contains only requests for the service being measured.
You need the service-wide estimated 95th-percentile latency over the last five minutes, combining requests across replicas.
Which query should you use?
avg(histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m])))
quantile(0.95, sum by (instance) (rate(http_request_duration_seconds_sum[5m])) / sum by (instance) (rate(http_request_duration_seconds_count[5m])))
histogram_quantile(0.95, sum by (le) (rate(http_request_duration_seconds_bucket[5m])))
max(histogram_quantile(0.95, sum by (instance, le) (rate(http_request_duration_seconds_bucket[5m]))))
C
Aggregate bucket rates across replicas while preserving the le bucket-boundary label, then calculate the quantile. The first query averages replica percentiles. The second calculates a percentile of per-instance mean latencies. The fourth selects the largest instance percentile. These are different statistics from the percentile of the combined request population.
Implementing observability and troubleshooting
17
Select One
A Cloud Run service sends 20% of traffic to a new revision and 80% to the previous revision. Errors occur only on the new revision. Traces identify a deterministic exception introduced by the release.
The previous revision is compatible with the current database schema and has sufficient scaling headroom.
What is the best immediate mitigation?
Increase the new revision's maximum instance count and maintain the existing traffic split.
Return all traffic to the previous revision and investigate the failing application change.
Increase request timeouts and enable additional retries for calls reaching the new revision.
Create another revision from the new image and split the canary traffic between them.
B
The fault is isolated to the new revision, and the previous revision can serve the workload with the current schema. Returning traffic to it mitigates user impact. More instances, longer timeouts, or another revision using the faulty image do not resolve the deterministic exception.
Applying site reliability engineering practices
16
Select One
An on-call team pages when a service's one-hour error-budget burn rate exceeds a threshold. After a short, severe failure is resolved, the one-hour calculation remains elevated and continues triggering pages.
The team wants to retain detection of sustained high burn while requiring evidence that the problem is still occurring.
How should it change the alert condition?
Replace the one-hour condition with a five-minute condition using the same burn-rate threshold.
Keep the one-hour condition and raise its burn-rate threshold to reduce pages following recovery.
Require either the one-hour or the five-minute burn rate to exceed the same threshold.
Require both the one-hour and the five-minute burn rates to exceed the same threshold.
D
The long window establishes significant budget consumption, and the short window confirms that high burn is continuing. Requiring both conditions allows the alert to clear after recovery. OR retains the stale long-window trigger. Using only a short window loses the longer-window check, and raising the threshold reduces sensitivity.
Applying site reliability engineering practices
15
Select One
During a major incident, several teams change production settings independently. Some changes reverse earlier mitigations. Stakeholder questions also interrupt the engineers restoring service.
You need to reorganize the response using Google's incident-management practices.
Which TWO actions should you take?
Assign each engineering team an incident commander who authorizes changes within that team's service boundary.
Establish one incident commander and a communications lead to coordinate the response and stakeholder updates.
Assign incident command to the primary debugger and have that engineer approve changes while investigating.
Coordinate production changes through the operations lead and record actions and outcomes in a shared log.
B
One incident commander coordinates the overall response, while a communications lead handles updates. Coordinating modifications through operations and keeping a shared record reduces conflicting changes. Independent command structures fragment coordination, and combining command with primary debugging creates a bottleneck.
Applying site reliability engineering practices
14
Select Two
D
A service has a request-based availability SLO of 99.9%. At evaluation time, its rolling window contains exactly 20,000,000 eligible requests, including 15,000 failures.
Use this fixed request population for the calculation.
What proportion of the window's error budget remains?
25%.
75%.
0.025%.
0.075%.
A
The allowed failure fraction is 1 - 0.999 = 0.001, so the budget allows 20,000,000 x 0.001 = 20,000 failures. With 15,000 failures, 5,000 remain, which is 5,000 / 20,000 = 25% of the error budget. Seventy-five percent has been consumed. The smaller percentages describe fractions of total requests, not the proportion of error budget remaining.
Applying site reliability engineering practices
13
Select One
A checkout service runs in three regions with substantially different request volumes. Its availability SLO is the percentage of eligible checkout requests that succeed globally.
Each region exports successful-request and total-eligible-request counters.
How should you calculate the global availability SLI for an evaluation window?
Calculate each region's success percentage and take the arithmetic mean across the three regions.
Calculate each region's success percentage and use the lowest regional percentage for the window.
Sum successful requests across regions and divide by the sum of eligible requests across regions.
Calculate regional success percentages and weight them by each region's provisioned instance count.
C
The SLI is successful eligible requests divided by total eligible requests. Aggregating counts before division weights regions by actual request volume. An arithmetic mean weights regions equally, the minimum measures the worst region, and instance weighting does not represent the defined request population.
Applying site reliability engineering practices
12
Select One
A continuous-training pipeline produces a fraud-detection model daily. New models sometimes improve aggregate accuracy while reducing recall for a small, business-critical customer segment.
The team wants automatic promotion that prevents this regression. It has evaluation data representing the current production population.
Which promotion gate should it implement?
Compare training loss with the deployed model and require successful prediction-endpoint health checks.
Compare both models on evaluation data and enforce aggregate and customer-segment quality thresholds.
Compare aggregate accuracy with the deployed model and require successful model-signature validation.
Compare both models' serving latency and require matching input schemas and prediction-output formats.
B
Evaluation must measure both overall quality and the critical customer segment. Aggregate improvements can conceal segment regressions. Training loss is not a substitute for evaluation on representative data. Health checks, signatures, schemas, and serving latency test other properties, not the specified predictive-quality requirement.
Building and implementing CI/CD pipelines
11
Select One
A Cloud Run service uses a third-party API credential stored in Secret Manager. The application can reread a credential file before opening each new connection.
Existing instances must obtain rotated credentials without a new revision or instance restart. The runtime service account currently cannot access the secret.
Which TWO actions should you take?
Grant Secret Manager Secret Accessor to the runtime service account on the secret.
Expose the secret through an environment variable that references its latest version.
Grant Secret Manager Secret Accessor to the Cloud Build service account on the secret.
Mount the secret's latest version and read the file before opening new connections.
A
The runtime identity needs secret-access permission, and a mounted secret that references latest lets the application obtain rotated values when it rereads the file. Environment variables are resolved at instance startup, and granting the build identity access does not authorize the runtime identity.
Building and implementing CI/CD pipelines
10
Select Two
D
A Cloud Build pipeline downloads dependencies from a repository hosted on a Compute Engine VM with an internal IP address. The VM is in the company's VPC, and the repository must remain inaccessible from the public internet.
The build currently runs in the default pool and cannot connect to the repository.
Which change should you make?
Grant the build service account Compute Network User on the subnet containing the repository VM.
Create a Serverless VPC Access connector and associate it with the build service account's project.
Configure Cloud NAT for the repository subnet and allow the repository port from the NAT address.
Use a Cloud Build private pool connected to the VPC through a private services connection.
D
A private pool connected through private services access can reach resources in the VPC. IAM permissions do not create network connectivity. Serverless VPC Access is not the connection mechanism for default-pool build workers. Cloud NAT does not provide inbound access from those workers to the private repository.
Building and implementing CI/CD pipelines
9
Select One
A Cloud Deploy pipeline deploys an application to GKE. A containerized integration test must run after deployment, and a failed test must fail the rollout's verification job.
The test currently runs in Cloud Build before the Cloud Deploy release is created.
What should you change?
Run the integration test during the image build and attach its result to the release's deployment metadata.
Require target approval and have the approver review the integration-test result before authorizing the rollout.
Define the test in Skaffold's verify configuration and enable verification in the delivery pipeline stage.
Add a promotion automation delay and use its duration to accommodate the integration test after deployment.
C
Cloud Deploy runs verification containers through Skaffold verification configuration, with verification enabled in the delivery pipeline stage. Build-time tests run before deployment. Approval reviews existing evidence, and an automation delay does not execute a verification job or evaluate its result.
Building and implementing CI/CD pipelines
8
Select One
A production GKE cluster must reject application images unless they have passed integration tests and the organization's vulnerability policy. Artifact Analysis scanning is enabled, but an image that failed the policy was still deployed.
The team needs enforcement at deployment time.
Which design should it implement?
Attest image digests after both checks pass; enforce an attestation requirement with Binary Authorization.
Scan image digests continuously; configure vulnerability alerts and assign remediation to the deployment team.
Generate provenance for each build; require immutable tags and restrict deployments to the release service account.
Record test results as image metadata; configure continuous validation to report images missing successful results.
A
The pipeline issues an attestation after both checks pass, and Binary Authorization enforces that requirement at deployment. Scanning and alerts identify findings but do not themselves block admission. Provenance and immutable tags do not prove the two checks passed. Continuous validation reports policy violations rather than providing this deployment-time gate.
Building and implementing CI/CD pipelines
7
Select One
A team uses Cloud Build, Artifact Registry, and Cloud Deploy to release an application to staging and production. An audit finds that production sometimes runs different image content from staging, although both images identify the same source commit.
Which TWO changes establish that production uses the artifact tested in staging?
Rebuild the source commit for production using the build configuration that produced the staging image.
Bind the Cloud Deploy release to the built image's digest when creating the release.
Deploy a shared candidate tag and configure staging and production to resolve that tag independently.
Promote the staging-tested Cloud Deploy release to the production target in the delivery pipeline.
B
An image digest identifies immutable content. Binding the release to that digest and promoting the staging-tested release to production preserves the artifact selection. Rebuilding the same commit can produce different content because dependencies or build inputs change, and a mutable tag resolved independently by each environment does not establish content identity.
Building and implementing CI/CD pipelines
6
Select Two
D
A central operations team needs dashboards and alerting policies that query metrics from 20 application projects. Application teams must continue writing metrics to their existing projects.
You want centralized monitoring without duplicating metric ingestion or maintaining equivalent dashboards in every application project.
Which design should you use?
Route application logs to a central log bucket and recreate the applications' monitoring data as log-based metrics.
Configure telemetry exporters in each application project to send an additional metric stream to the operations project.
Create matching dashboards in the application projects and grant the operations team Monitoring Viewer in each project.
Add the application projects to a metrics scope associated with a central operations project.
D
A metrics scope enables queries across monitored projects while metrics remain in their originating projects. This supports centralized dashboards and alerting. Duplicate exports add ingestion, separate dashboards add administration, and log-based metrics do not automatically reproduce the existing metric population.
Bootstrapping and maintaining a Google Cloud organization
5
Select One
Two infrastructure pipelines manage the same production Terraform configuration. Each downloads a state file, runs Terraform locally, and uploads the resulting state. Overlapping runs have caused conflicting updates.
You need Terraform to coordinate concurrent operations and retain recoverable state versions.
Which approach should you use?
Retain local state during execution and enable Object Versioning on the bucket receiving each pipeline's uploads.
Use the Cloud Storage remote backend with state locking and enable Object Versioning on its state bucket.
Store state in a private Git repository and require an approved pull request before merging each pipeline's updates.
Use a separate remote state object for each pipeline and refresh both states before applying infrastructure changes.
B
The Cloud Storage backend supports Terraform state locking, and Object Versioning provides recoverable object versions. Uploading local state to a versioned bucket does not coordinate concurrent Terraform operations. Git does not provide Terraform backend locking. Separate states for the same resources create competing ownership records.
Bootstrapping and maintaining a Google Cloud organization
4
Select One
A GitHub Actions workflow must impersonate a Google Cloud deployment service account through Workload Identity Federation. Service account keys are prohibited. Only the main branch of one repository in the company's GitHub organization may authenticate.
The workload identity pool and GitHub OIDC provider exist. The deployment service account already has its deployment permissions.
Which TWO configurations should you implement?
Restrict the provider condition using numeric repository and owner IDs and the main branch reference.
Grant Service Account User on the deployment service account to the repository's federated principal.
Grant Workload Identity User on the deployment service account to the repository's federated principal.
Use the repository URL as the provider audience and use audience validation to restrict repository access.
A
The provider condition restricts the accepted repository, owner, and branch. Numeric IDs avoid relying on names that could be reclaimed. Workload Identity User permits the federated principal to impersonate the service account. Service Account User serves a different purpose, and audience validation does not establish repository identity.
Bootstrapping and maintaining a Google Cloud organization
3
Select Two
C
An organization has Production and Development folders. A developer group has Compute Instance Admin (v1) at the organization level. Developers must retain this access in Development but lose it in Production. No other bindings grant the group these permissions.
You must implement the change through IAM allow policies with minimal ongoing administration.
What should you do?
Grant Compute Viewer on Production and remove the group's administrator bindings from individual production projects.
Remove the organization-level administrator binding and grant that role to the group on the Development folder.
Retain the organization-level binding and replace each production project's local policy with a viewer-only policy.
Move production projects into a new folder within the organization and grant the group Compute Viewer on that folder.
B
IAM allow permissions are inherited from ancestors. Moving the administrator grant to Development preserves access there and removes the inherited grant from Production. Child-level viewer policies do not subtract ancestor permissions. Moving projects to another folder under the same organization retains the organization-level grant.
Bootstrapping and maintaining a Google Cloud organization
2
Select One
A company uses Shared VPC. The networking team manages the host project, and an application team deploys Compute Engine VMs in an attached service project. The application team already has permission to create VMs.
The application team must use one designated shared subnet. It must not gain access to other shared subnets or permission to change network configuration.
Which IAM grant meets these requirements?
Compute Network User on the host project for the application team.
Compute Network Admin on the host project for the application team.
Compute Network User on the service project for the application team.
Compute Network User on the designated subnet for the application team.
D
A subnet-level Compute Network User grant permits use of the designated shared subnet. A host-project grant extends access beyond that subnet. Network Admin grants network-management permissions, while a service-project grant does not authorize use of the host project's subnet.
Bootstrapping and maintaining a Google Cloud organization
1
Select One
.png)
.svg)
