Give You Free Regular Updates on Professional-Cloud-DevOps-Engineer Exam Questions Dec 04, 2025 [Q88-Q108]

admin Professional-Cloud-DevOps-Engineer Google December 4, 2025

Rate this post

Give You Free Regular Updates on Professional-Cloud-DevOps-Engineer Exam Questions Dec 04, 2025

Achieve the Professional-Cloud-DevOps-Engineer Exam Best Results with Help from Google Certified Experts

QUESTION 88
Your company’s security team needs to have read-only access to Data Access audit logs in the _Required bucket You want to provide your security team with the necessary permissions following the principle of least privilege and Google-recommended practices. What should you do?

Assign the roles/logging, viewer role to each member of the security team

Assign the roles/logging. viewer role to a group with all the security team members

Assign the roles/logging.privateLogViewer role to each member of the security team

Assign the roles/logging.privateLogviewer role to a group with all the security team members

QUESTION 89
You are creating and assigning action items in a postmodern for an outage. The outage is over, but you need to address the root causes. You want to ensure that your team handles the action items quickly and efficiently.
How should you assign owners and collaborators to action items?

Assign one owner for each action item and any necessary collaborators.

Assign multiple owners for each item to guarantee that the team addresses items quickly

Assign collaborators but no individual owners to the items to keep the postmortem blameless.

Assign the team lead as the owner for all action items because they are in charge of the SRE team.

QUESTION 90
You are building and running client applications in Cloud Run and Cloud Functions Your client requires that all logs must be available for one year so that the client can import the logs into their logging service You must minimize required code changes What should you do?

Update all images in Cloud Run and all functions in Cloud Functions to send logs to both Cloud Logging and the client’s logging service Ensure that all the ports required to send logs are open in the VPC firewall

Create a Pub/Sub topic subscription and logging sink Configure the logging sink to send all logs into the topic Give your client access to the topic to retrieve the logs

Create a storage bucket and appropriate VPC firewall rules Update all images in Cloud Run and all functions in Cloud Functions to send logs to a file within the storage bucket

Create a logs bucket and logging sink. Set the retention on the logs bucket to 365 days Configure the logging sink to send logs to the bucket Give your client access to the bucket to retrieve the logs

QUESTION 91
Your company is developing applications that are deployed on Google Kubernetes Engine (GKE). Each team manages a different application. You need to create the development and production environments for each team, while minimizing costs. Different teams should not be able to access other teams’ environments. What should you do?

Create one GCP Project per team. In each project, create a cluster for Development and one for Production. Grant the teams IAM access to their respective clusters.

Create one GCP Project per team. In each project, create a cluster with a Kubernetes namespace for Development and one for Production. Grant the teams IAM access to their respective clusters.

Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Identity Aware Proxy so that each team can only access its own namespace.

Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Kubernetes Role-based access control (RBAC) so that each team can only access its own namespace.

QUESTION 92
You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields. You want to prevent these fields from being written in new log entries as quickly as possible. What should you do?

Use the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in flight.

Use the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log entries in flight.

Wait for the application developers to patch the application, and then verify that the log entries are no longer exposing PII.

Stage log entries to Cloud Storage, and then trigger a Cloud Function to remove the fields and write the entries to Stackdriver via the Stackdriver Logging API.

QUESTION 93
Your team has recently deployed an NGINX-based application into Google Kubernetes Engine (GKE) and has exposed it to the public via an HTTP Google Cloud Load Balancer (GCLB) ingress. You want to scale the deployment of the application’s frontend using an appropriate Service Level Indicator (SLI). What should you do?

Configure the horizontal pod autoscaler to use the average response time from the Liveness and Readiness probes.

Configure the vertical pod autoscaler in GKE and enable the cluster autoscaler to scale the cluster as pods expand.

Install the Stackdriver custom metrics adapter and configure a horizontal pod autoscaler to use the number of requests provided by the GCLB.

Expose the NGINX stats endpoint and configure the horizontal pod autoscaler to use the request metrics exposed by the NGINX deployment.

QUESTION 94
You are using Terraform to manage infrastructure as code within a Cl/CD pipeline You notice that multiple copies of the entire infrastructure stack exist in your Google Cloud project, and a new copy is created each time a change to the existing infrastructure is made You need to optimize your cloud spend by ensuring that only a single instance of your infrastructure stack exists at a time. You want to follow Google-recommended practices What should you do?

Create a new pipeline to delete old infrastructure stacks when they are no longer needed

Confirm that the pipeline is storing and retrieving the terraform. if state file from Cloud Storage with the Terraform gcs backend

Verify that the pipeline is storing and retrieving the terrafom.tfstat* file from a source control

Update the pipeline to remove any existing infrastructure before you apply the latest configuration

QUESTION 95
You created a Stackdriver chart for CPU utilization in a dashboard within your workspace project. You want to share the chart with your Site Reliability Engineering (SRE) team only. You want to ensure you follow the principle of least privilege. What should you do?

Share the workspace Project ID with the SRE team. Assign the SRE team the Monitoring Viewer IAM role in the workspace project.

Share the workspace Project ID with the SRE team. Assign the SRE team the Dashboard Viewer IAM role in the workspace project.

Click “Share chart by URL” and provide the URL to the SRE team. Assign the SRE team the Monitoring Viewer IAM role in the workspace project.

Click “Share chart by URL” and provide the URL to the SRE team. Assign the SRE team the Dashboard Viewer IAM role in the workspace project.

QUESTION 96
Your company is developing applications that are deployed on Google Kubernetes Engine (GKE) Each team manages a different application You need to create the development and production environments for each team while you minimize costs Different teams should not be able to access other teams environments You want to follow Google-recommended practices What should you do?

Create one Google Cloud project per team In each project create a cluster for development and one for production Grant the teams Identity and Access Management (1AM) access to their respective clusters

Create one Google Cloud project per team In each project create a cluster with a Kubernetes namespace for development and one for production Grant the teams Identity and Access Management (1AM) access to their respective clusters.

Create a development and a production GKE cluster in separate projects In each cluster create a Kubernetes namespace per team and then configure Identity-Aware Proxy so that each team can only access its own namespace

Create a development and a production GKE cluster in separate projects In each cluster create a Kubernetes namespace per team and then configure Kubernetes role-based access control (RBAC) so that each team can only access its own namespace

QUESTION 97
You support the backend of a mobile phone game that runs on a Google Kubernetes Engine (GKE) cluster. The application is serving HTTP requests from users. You need to implement a solution that will reduce the network cost. What should you do?

Configure the VPC as a Shared VPC Host project.

Configure your network services on the Standard Tier.

Configure your Kubernetes cluster as a Private Cluster.

Configure a Google Cloud HTTP Load Balancer as Ingress.

QUESTION 98
Your application services run in Google Kubernetes Engine (GKE). You want to make sure that only images from your centrally-managed Google Container Registry (GCR) image registry in the altostrat-images project can be deployed to the cluster while minimizing development time. What should you do?

Create a custom builder for Cloud Build that will only push images to gcr.io/altostrat-images.

Use a Binary Authorization policy that includes the whitelist name pattern gcr.io/attostrat-images/.

Add logic to the deployment pipeline to check that all manifests contain only images from gcr.io/altostrat-images.

Add a tag to each image in gcr.io/altostrat-images and check that this tag is present when the image is deployed.

QUESTION 99
You are responsible for the reliability of a high-volume enterprise application. A large number of users report that an important subset of the application’s functionality – a data intensive reporting feature – is consistently failing with an HTTP 500 error. When you investigate your application’s dashboards, you notice a strong correlation between the failures and a metric that represents the size of an internal queue used for generating reports. You trace the failures to a reporting backend that is experiencing high I/O wait times. You quickly fix the issue by resizing the backend’s persistent disk (PD). How you need to create an availability Service Level Indicator (SLI) for the report generation feature. How would you define it?

As the I/O wait times aggregated across all report generation backends

As the proportion of report generation requests that result in a successful response

As the application’s report generation queue size compared to a known-good threshold

As the reporting backend PD throughout capacity compared to a known-good threshold

QUESTION 100
Some of your production services are running in Google Kubernetes Engine (GKE) in the eu-west-1 region.
Your build system runs in the us-west-1 region. You want to push the container images from your build system to a scalable registry to maximize the bandwidth for transferring the images to the cluster. What should you do?

Push the images to Google Container Registry (GCR) using the gcr.io hostname.

Push the images to Google Container Registry (GCR) using the us.gcr.io hostname.

Push the images to Google Container Registry (GCR) using the eu.gcr.io hostname.

Push the images to a private image registry running on a Compute Engine instance in the eu-west-1 region.

QUESTION 101
Your application runs on Google Cloud Platform (GCP). You need to implement Jenkins for deploying application releases to GCP. You want to streamline the release process, lower operational toil, and keep user data secure. What should you do?

Implement Jenkins on local workstations.

Implement Jenkins on Kubernetes on-premises

Implement Jenkins on Google Cloud Functions.

Implement Jenkins on Compute Engine virtual machines.

QUESTION 102
You support an application running on GCP and want to configure SMS notifications to your team for the most critical alerts in Stackdriver Monitoring. You have already identified the alerting policies you want to configure this for. What should you do?

Download and configure a third-party integration between Stackdriver Monitoring and an SMS gateway. Ensure that your team members add their SMS/phone numbers to the external tool.

Select the Webhook notifications option for each alerting policy, and configure it to use a third-party integration tool. Ensure that your team members add their SMS/phone numbers to the external tool.

Ensure that your team members set their SMS/phone numbers in their Stackdriver Profile. Select the SMS notification option for each alerting policy and then select the appropriate SMS/phone numbers from the list.

Configure a Slack notification for each alerting policy. Set up a Slack-to-SMS integration to send SMS messages when Slack messages are received. Ensure that your team members add their SMS/phone numbers to the external integration.

QUESTION 103
You support an application running on App Engine. The application is used globally and accessed from various device types. You want to know the number of connections. You are using Stackdriver Monitoring for App Engine. What metric should you use?

flex/connections/current

tcp_ssl_proxy/new_connections

tcp_ssl_proxy/open_connections

flex/instance/connections/current

QUESTION 104
You need to enforce several constraint templates across your Google Kubernetes Engine (GKE) clusters. The constraints include policy parameters, such as restricting the Kubernetes API. You must ensure that the policy parameters are stored in a GitHub repository and automatically applied when changes occur. What should you do?

Set up a GitHub action to trigger Cloud Build when there is a parameter change. In Cloud Build, run a gcloud CLI command to apply the change.

When there is a change in GitHub, use a web hook to send a request to Anthos Service Mesh, and apply the change.

Configure Anthos Config Management with the GitHub repository. When there is a change in the repository, use Anthos Config Management to apply the change.

Configure Config Connector with the GitHub repository. When there is a change in the repository, use Config Connector to apply the change.

QUESTION 105
You are deploying an application to Cloud Run. The application requires a password to start. Your organization requires that all passwords are rotated every 24 hours, and your application must have the latest password. You need to deploy the application with no downtime. What should you do?

Store the password in Secret Manager and send the secret to the application by using environment variables.

Store the password in Secret Manager and mount the secret as a volume within the application.

Use Cloud Build to add your password into the application container at build time. Ensure that Artifact Registry is secured from public access.

Store the password directly in the code. Use Cloud Build to rebuild and deploy the application each time the password changes.

QUESTION 106
You built a serverless application by using Cloud Run and deployed the application to your production environment You want to identify the resource utilization of the application for cost optimization What should you do?

Use Cloud Trace with distributed tracing to monitor the resource utilization of the application

Use Cloud Profiler with Ops Agent to monitor the CPU and memory utilization of the application

Use Cloud Monitoring to monitor the container CPU and memory utilization of the application

Use Cloud Ops to create logs-based metrics to monitor the resource utilization of the application

QUESTION 107
You want to share a Cloud Monitoring custom dashboard with a partner team What should you do?

Provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard

Export the metrics to BigQuery Use Looker Studio to create a dashboard, and share the dashboard with the partner team

Copy the Monitoring Query Language (MQL) query from the dashboard; and send the MQL query to the partner team

Download the JSON definition of the dashboard, and send the JSON file to the partner team

QUESTION 108
You need to define Service Level Objectives (SLOs) for a high-traffic multi-region web application. Customers expect the application to always be available and have fast response times. Customers are currently happy with the application performance and availability. Based on current measurement, you observe that the 90th percentile of latency is 120ms and the 95th percentile of latency is 275ms over a 28-day window. What latency SLO would you recommend to the team to publish?

90th percentile – 100ms95th percentile – 250ms

90th percentile – 120ms95th percentile – 275ms

90th percentile – 150ms95th percentile – 300ms

90th percentile – 250ms95th percentile – 400ms

The Professional-Cloud-DevOps-Engineer certification exam assesses a candidate’s proficiency in various areas, including designing and implementing continuous delivery pipelines, configuring infrastructure automation, monitoring, and logging systems, and managing and deploying services using container technology. Professional-Cloud-DevOps-Engineer exam is intended for professionals who have experience in DevOps practices, software development, and system administration.

Detailed New Professional-Cloud-DevOps-Engineer Exam Questions for Concept Clearance: https://www.validexam.com/Professional-Cloud-DevOps-Engineer-latest-dumps.html