Professional Cloud Developer

My comment is still waiting approval too.

Took the exam 2 weeks and got pass, however, NOT A SINGLE question is from here! Although it is still good for practice purpose, DO NOT just remember these questions to take the exam.

-- My comment above is still waiting approval after two weeks, it seems someone doesn't want it to be published.

Selected Answer: A
A. gsutil cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/
gsutil is the correct tool because:
It's the dedicated command-line tool for Google Cloud Storage operations
Specifically designed for file and bucket management in GCS
Supports efficient file transfer between local systems and Cloud Storage
Provides reliable upload capabilities with automatic retry mechanisms
The command structure:
gsutil cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/
cp: Copy command
[LOCAL_OBJECT]: Source file path
gs://: Protocol identifier for Google Cloud Storage
[DESTINATION_BUCKET_NAME]: Target bucket name

As updates to the Google Cloud SDK, the `gcloud` tool now includes a `storage` command group that allows you to interact with Google Cloud Storage (GCS) similarly to how you would with `gsutil` command

Selected Answer: A
A. gsutil cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/
This command is used to copy files from local storage to Google Cloud Storage. It’s the correct option for uploading data as part of a migration process that will be consumed by Cloud Dataproc.

Selected Answer: A
Answer: A 
Cloud Storage => gsutil. Doesn't matter how the files are going to be consumed, the task is to upload them.

Selected Answer: B
Anyone took exam recently, what percent of questions came from examtopics?

Anyone took exam recently, what percent of questions came from examtopics?

Selected Answer: A
gsutil cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/

The exam is totally different from the one presented in the dump, it proves TOTALLY DIFFERENT.
Please update the questions with the original exam!!

There was a lot of GKE especially with istio.

Took the exam two days ago, only 4 of the questions from this set appeared in the actual exam, remaining 56 were new questions. Even after the June 2nd update, I don't see any of the new questions here.

Cloud Storage is the key here so answer is A

You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (Pll) is leaking into certain log entry fields. All Pll entries begin with the text userinfo. You want to capture these log entries in a secure location for later review and prevent them from leaking to Stackdriver Logging. What should you do?
"A. Create a basic log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink.
B. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, and then copy the entries to a Cloud Storage bucket.
C. Create an advanced log filter matching userinfo, configure a log export in the Stackdriver console with Cloud Storage as a sink, and then configure a tog exclusion with userinfo as a filter.
D. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, create an advanced log filter matching userinfo, and then configure a log export in the Stackdriver console with Cloud Storage as a sink."

Your product is currently deployed in three Google Cloud Platform (GCP) zones with your users divided between the zones. You can fail over from one zone to another, but it causes a 10-minute service disruption for the affected users. You typically experience a database failure once per quarter and can detect it within five minutes. You are cataloging the reliability risks of a new real-time chat feature for your product. You catalog the following information for each risk.
The chat feature requires a new database system that takes twice as long to successfully fail over between zones. You want to account for the risk of the new database failing in one zone. What would be the values for the risk of database failover with the new system?
A. MTTD: 5
MTTR: 10
MTBF: 90
Impact: 33%
B. MTTD:5
MTTR: 20
MTBF: 90
Impact: 33%
C. MTTD:5
MTTR: 10
MTBF: 90
Impact 50%
D. MTTD:5
MTTR: 20
MTBF: 90
Impact: 50%

any possibility to have all DevOps questions?

Standard tier is less cost compared to http load balance ingress and kubernates cluster.

Q. Devops
You support the backend of a mobile phone game that runs on a Google Kubernetes Engine (GKE) cluster. The application is serving HTTP requests from users. You need to implement a solution that will reduce the network cost. What should you do?

"A. Configure the VPC as a Shared VPC Host project.
B. Configure your network services on the Standard Tier.
C. Configure your Kubernetes cluster as a Private Cluster.
D. Configure a Google Cloud HTTP Load Balancer as Ingress."

ans : B

Q. Devops
You support the backend of a mobile phone game that runs on a Google Kubernetes Engine (GKE) cluster. The application is serving HTTP requests from users. You need to implement a solution that will reduce the network cost. What should you do?

"A. Configure the VPC as a Shared VPC Host project.
B. Configure your network services on the Standard Tier.
C. Configure your Kubernetes cluster as a Private Cluster.
D. Configure a Google Cloud HTTP Load Balancer as Ingress."

Ans:A
https://cloud.google.com/storage/docs/uploading-objects

You want to upload files from an on-premises virtual machine to Google Cloud Storage as part of a data migration. These files will be consumed by Cloud
DataProc Hadoop cluster in a GCP environment.
Which command should you use?

The more number of node less read latency hence i will go with option A and C

I think the answer should be A) + something.
They wants 99.999% availability - only multi-regional instance fits this. To minimize read latency nam-asia-eur1 instance works best as it has replicas in Noth America, Europe and Asia regions.


As for second answer - I do not have strong opinion.. As per documentation "Adding nodes gives each replica more CPU and RAM, which increases the replica's throughput" and they recommend to choose number of nodes to "keep high priority total CPU utilization under 65%". So nodes are not about SLA and read latency. From another hand spanner "Cloud Spanner automatically replicates your data between regions with strong consistency guarantees" so no DataFlow pipeline needed to replicate data, unless the app has other DBs and ETL between Spanner and that DBs.

Selected Answer: AC
To achieve 99.999% availability and minimize read latency for a globally distributed user base, the company should:
- Deploy a multi-regional Cloud Spanner instance with the "nam-asia-eur1" configuration (Option A). This setup will provide the geographical distribution of data across three continents — North America, Asia, and Europe. The multi-regional nature of this option is designed to maintain high availability and ensure users across these regions experience low latency when accessing the database.
- Ensure that the Cloud Spanner instance has a minimum of three nodes (Option C). This configuration will contribute to the high availability and fault tolerance of the database. Spanner's built-in replication across these nodes in different regions will further support the five nines (99.999%) availability target, while also providing scalability for read operations.

Selected Answer: AC
Let's think about all possible answers: 
 - B does not make sense, as "nam3" is not the global configuration we want;
 - D is not ok, 'cause 1 node is not enough
 - E is not enough, as we want a global configuration;
 - F is totally unrelated.

Selected Answer: AC
AC are best suited here.

there is `nam3` 
https://cloud.google.com/spanner/docs/instance-configurations

Selected Answer: AC
99.999% availability and reduce latency
Option A gives us 99.999% availability (think its typo in region name)
Option C is about compute capacity, more nodes -> less latency
https://cloud.google.com/spanner/docs/instances#compute-capacity
B - there is no such multi-region configuration nam3
D - its better to create cluster with 3 nodes, not 1
E,F - overengineering

Selected Answer: AC
A - global and provides 99.999% availability
C - more nodes - less latency

There is according to their documentation: https://cloud.google.com/spanner/docs/instance-configurations#three_continents

Selected Answer: AC
3 regions at least, and for those that says there is no region "man-asia-eur1", take a look at the console, its multiregion nomenclature!

There is no region called ""nam-asia-eur1""
A is wrong, 
B&C is correct

Selected Answer: AC
We need multi-regin db (spanner) to satisfy 99,999% SLA and have multi-node to ensure resource needed.

C because the number of nodes increases the computational capabilities ( queries for seconds and so minor latency), F to cover worldwide availability; A it's wrong because the configuration "nam-asia-eur1" not exist, Google suggests "nam-eur-asia1" o "nam-eur-asia3", D it's wrong because the number of nodes is too few; E is too expensive a solution

https://cloud.google.com/spanner/docs/instances

Above link supports A for "users across the globe" as per qn

https://cloud.google.com/spanner/docs/latency

Above link supports C for "minimize the read latency "

i think that the answer is A & F. 
A becouse minimize the latency compared to B. 
F becouse is the best way to import data: https://cloud.google.com/spanner/docs/import-non-spanner
The answers B & C is not possible because the number of node depends to amount of the data, that we don't know.

Your company wants to expand their users outside the United States for their popular application. The company wants to ensure 99.999% availability of the database for their application and also wants to minimize the read latency for their users across the globe.
Which two actions should they take? (Choose two.)

C.Add a build step in the cloudbuild.yaml file before the promotion step with the arguments:
-name: gcr.io/cloud-builders/gsutil
args: ['cp','-r','gs://webphotos-staging','gs://webphotos-prod']
waitFor: ['-']

You should add a build step in the cloudbuild.yaml file before the promotion step with the arguments shown above. This build step will use the gsutil tool to copy the photos from the webphotos-staging bucket to the webphotos-prod bucket. The -r flag tells gsutil to copy all files in the bucket recursively, and the waitFor parameter tells Cloud Build to wait for this step to complete before continuing with the promotion step.

Selected Answer: C
https://cloud.google.com/storage/docs/gsutil/commands/cp

Your development team is using Cloud Build to promote a Node.js application built on App Engine from your staging environment to production. The application relies on several directories of photos stored in a Cloud Storage bucket named webphotos-staging in the staging environment. After the promotion, these photos must be available in a Cloud Storage bucket named webphotos-prod in the production environment. You want to automate the process where possible. What should you do?

Option A: TCP Proxy Load Balancer
Not Ideal for Web Applications: TCP load balancers are better suited for applications that use TCP protocols, not HTTP/HTTPS.
SSH Access: While you could potentially use a TCP load balancer for SSH, it's not the recommended approach.
Option B: Open Firewall Rules
Major Security Risk: Exposing your web servers directly to the internet with public IP addresses is a significant security vulnerability.
Option C: Cloud Identity-Aware Proxy (IAP) for SSH
Not Designed for SSH: IAP is primarily designed for secure access to web applications, not for SSH. While you could potentially use IAP for SSH, it's not a standard or recommended practice.

Selected Answer: D
Option D: The Best Practice
Security: Using a bastion host with a public IP address provides a secure jump point. Your web servers remain behind a firewall with private IP addresses, making them less vulnerable to direct attacks.
Scalability: Bastion hosts can be easily scaled and managed, allowing you to control access to your web server instances.
SSH Access: You can securely SSH into the bastion host and then tunnel to your web server instances.

"This document describes how to connect to a virtual machine (VM) instance through its internal IP address, using Identity-Aware Proxy (IAP) TCP forwarding."
https://cloud.google.com/compute/docs/connect/ssh-using-iap

Selected Answer: D
VM can only connect through IAM with public IP so C wouldn't work
bastion host is one of options instead - https://cloud.google.com/compute/docs/connect/ssh-internal-ip

D is wrong. 
Bastion host VMs You have a specific use case, like session recording, and you can't use IAP

i go for C
https://cloud.google.com/compute/docs/connect/ssh-using-iap
IAP TCP forwarding enables you to establish an encrypted tunnel over which you can forward SSH connections to VMs. When you connect to a VM that uses IAP, IAP wraps the SSH connection inside HTTPS before forwarding the connection to the VM. Then, IAP checks if the you have the required IAM permissions and if you do, grants access to the VM.

If you need to connect to a VM that doesn't have external IP addresses and you can't use IAP, review the other methods listed in Connection options for internal-only VMs.

Selected Answer: C
i would choose C: https://medium.com/@larry_nguyen/use-identity-aware-proxy-iap-instead-of-bastion-host-to-connect-to-private-virtual-machines-in-9885bc7c12dd

C is a valid approach, but it may not be the best option for all use cases.

Cloud IAP allows you to control access to resources in your project by using identity and access management (IAM) roles, which is a good way to secure SSH access. However, this option does not address the issue of securing incoming web traffic, which is a separate concern. Configuring the servers with private IP addresses behind an HTTP(s) load balancer would help with securing the web traffic, but it does not provide an additional layer of security for SSH access. Additionally, it does not have the concept of secure jump host, which is a security best practice in protecting your instances from unwanted incoming connections.

D. is a recommended way to configure the instances while following Google-recommended best practices.

This approach provides several benefits:

The web server instances are only accessible through the load balancer and not directly via their private IP addresses, which improves security.
The bastion host acts as a secure jump box that allows you to SSH into the web server instances, while only allowing incoming SSH connections on a specific IP address (the bastion host's public IP).
The firewall rules on the web server instances can be configured to only allow connections from the bastion host's IP, further reducing the attack surface.
It is a more recommended to have a bastion host that is authorized by your organization to connect to private instances this way it can provide a better security to your instances. And also in terms of compliance, it will also follow the best practices of your organization.

Selected Answer: C
C is the answer.

https://cloud.google.com/iap

Selected Answer: C
https://cloud.google.com/solutions/connecting-securely#storing_host_keys_by_enabling_guest_attributes
Answer C

Selected Answer: C
I feel both C and D are correct for this scenario. 
The only reason I would go with option C is that it would be easier to set up than setting up a bastion host.

Selected Answer: C
With TCP forwarding, IAP can protect SSH and RDP access to your VMs hosted on Google Cloud. Your VM instances don't even need public IP addresses.
https://cloud.google.com/iap

D should be the answer (https://cloud.google.com/solutions/connecting-securely#external) But the bastion host should also be protected by IAP

https://cloud.google.com/solutions/connecting-securely#external

You are developing a web application that will be accessible over both HTTP and HTTPS and will run on Compute Engine instances. On occasion, you will need to SSH from your remote laptop into one of the Compute Engine instances to conduct maintenance on the app. How should you configure the instances while following Google-recommended best practices?

Selected Answer: B
Collectd is used for Monitoring agents 
Fluentd is for cloud logging agent

Selected Answer: B
B is the answer.

https://cloud.google.com/stackdriver/docs/solutions/agents/ops-agent
The Ops Agent is the primary agent for collecting telemetry from your Compute Engine instances. Combining logging and metrics into a single agent, the Ops Agent uses Fluent Bit for logs, which supports high-throughput logging, and the OpenTelemetry Collector for metrics.

You can configure the Ops Agent to support parsing of log files from third-party applications.

You have a mixture of packaged and internally developed applications hosted on a Compute Engine instance that is running Linux. These applications write log records as text in local files. You want the logs to be written to Cloud Logging. What should you do?

.css-1hohgv6{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-flex-direction:row;-ms-flex-direction:row;flex-direction:row;gap:0px;}Exam.css-1cp477w{color:#4285F4;}Prepper

Exam
Prepper