Google Practice Questions, Discussions & Exam Topics by our Authors
Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to a Kubernetes cluster in the production environment. The security auditor is concerned that developers or opera...
Let's analyze the available options based on the goal of enforcing approvals for code changes before they are deployed to production, ensuring that security and process control are maintained.
Option A: Configure the build system with protected branches that require pull request approval.
- Pros: Protecting branches and requiring pull request approval is a common practice to ensure that code changes undergo peer review before they are merged. It adds a layer of human validation and ensures that code changes are inspected before being pushed to production.
- Cons: This addresses the code approval process within the version control system, but it doesn't fully address the deployment approval process. It does not enforce approval within the build pipeline or Kubernetes deployment process after code is merged. Therefore, it doesn't ensure that changes are properly validated before deployment, which is the primary concern.
- Use Case: Suitable for ensuring code review at the version control level, but it doesn't cover the full process of approval during automated deployments.
Option B: Use an Admission Controller to verify that incoming requests originate from approved sources.
- Pros: Kubernetes Admission Controllers can be used to enforce policies at the point of deployment. They can intercept and validate requests (e.g., for creating or modifying resources) before they are applied to the cluster. This can be used to enforce approval policies based on source or other criteria.
- Cons: While Admission Controllers can help manage resource creation and modification, they don’t directly enforce a formal approval workflow for deployments. They’re more focused on controlling what gets deployed to the cluster, rather than enforcing human approval of code changes or deployments.
- Use Case: This could be useful for enforcing specific deployment policies but doesn't directly solve the problem of ensuring approval for code changes before deployment.
Option C: Leverage Kubernetes Role-Based Access Control (RBAC) to restrict access to only approved users.
- Pros: RBAC helps in manag...
Author: Deepak · Last updated Jul 10, 2026
You support a stateless web-based API that is deployed on a single Compute Engine instance in the europe-west2-a zone. The Service Level Indicator (SLI) for service availability is below the specified Service Level Objective (SLO). A postmortem has revealed that requests to the API regularly time out. The time outs ...
To improve the service availability, it's essential to address the root cause of the issue: the service running out of memory due to high traffic, resulting in timeouts. Let's evaluate the options based on this:
Option A: Change the specified SLO to match the measured SLI
- Reasoning: Changing the SLO to match the current SLI would not solve the underlying issue. It would merely adjust expectations rather than improving performance. The goal is to resolve the timeout issues caused by resource constraints, not to lower the standards for availability.
- Rejection: This option doesn't solve the issue of memory exhaustion or improve the service's ability to handle traffic.
Option B: Move the service to higher-specification compute instances with more memory
- Reasoning: Moving to more powerful instances with higher memory can help mitigate the issue if the service is out of memory due to high traffic. However, this approach is limited by the capacity of a single instance and may not scale effectively in the long term if the traffic continues to grow. It does not address high availability, redundancy, or load balancing.
- Rejection: This option could help in the short term but doesn't provide scalability, redundancy, or availability in the long term. Additionally, it does not address the problem of being unable to handle high request rates.
Option C: Set up additional service instances in other zones and load balance the traffic between all instances
- Reasoning: This option improves availability and scalability. By setting up additional instances in different zones, the servic...
Author: Siddharth · Last updated Jul 10, 2026
You are running a real-time gaming application on Compute Engine that has a production and testing environment. Each environment has their own Virtual Private
Cloud (VPC) network. The application frontend and backend servers are located on different subnets in the environment's VPC. You suspect there is a malicious process communi...
To capture network traffic for analysis in the context of a potentially malicious process on production frontend servers, let's evaluate the options:
Key Requirements:
- Traffic capture for analysis: We need to ensure that network traffic is captured for analysis, specifically for identifying any intermittent malicious processes.
- Production environment first: Since the suspicious activity is in the production environment, we need to focus primarily on it, but we should consider testing before applying changes to production.
Option A: Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 0.5.
- Reasoning: Enabling VPC Flow Logs with a sample volume of 0.5 means that only 50% of traffic will be logged, which may not provide a comprehensive view of the network traffic, especially if the malicious process is intermittent. While this may reduce the overhead, it might miss critical traffic patterns.
- Rejection: A sample rate of 0.5 is too low for capturing the intermittent malicious activity, which may require a more complete capture of traffic. Additionally, focusing only on the production environment without testing first increases the risk of potential issues.
Option B: Enable VPC Flow Logs on the production VPC network frontend and backend subnets only with a sample volume scale of 1.0.
- Reasoning: A sample rate of 1.0 ensures that 100% of the traffic is captured. This is ideal for identifying malicious processes, as you will capture all traffic between the frontend and backend servers. However, this option only focuses on the production environment, which could be risky without first testing in a non-production environment to ensure that the flow logging won't cause performance or operational issues.
- Selected Option: This option strikes a balance by providing full traffic capture (100% sample rate) for the production environment, making it the best option for detecting intermittent malicious activity.
Option C: Enable VPC Flow Logs on th...
Author: Liam123 · Last updated Jul 10, 2026
Your team of Infrastructure DevOps Engineers is growing, and you are starting to use Terraform to manage infrastructure. You need a way to implement code vers...
To determine the best option for versioning and sharing Terraform code with your team, let's evaluate each of the choices:
Option A: Store the Terraform code in a version-control system. Establish procedures for pushing new versions and merging with the master.
- Reasoning: A version-control system (VCS), such as Git, is the most suitable solution for managing Terraform code. It allows for:
- Versioning: You can track changes to the code and revert to previous versions if needed.
- Collaboration: Multiple team members can contribute to the codebase. It provides clear mechanisms for merging, branching, and managing conflicts.
- Auditability: You can track who made changes and why, which is important for both security and maintenance.
- Best Practice: VCS is a standard in modern DevOps workflows. It is well-suited for team collaboration, ensuring that everyone works on the same version of the code.
- Selected Option: This option is the most efficient and widely used for infrastructure as code (IaC) in teams.
Option B: Store the Terraform code in a network shared folder with child folders for each version release. Ensure that everyone works on different files.
- Reasoning: While this method may allow team members to access files, it has several drawbacks:
- No Versioning: Without a version-control system, it’s difficult to track changes, merge code, or handle conflicts.
- Scalability Issues: As your team grows, managing the versions manually becomes cumbersome and error-prone.
- Risk of Conflicts: Without proper versioning, team members are likely to overwrite each other's work, causing disruptions.
- Rejection: This method does not provide the versioning, auditing, or collaboration features necessary for efficient Terraform management.
Option C: Store the Terraform code in a Cloud Storage bucket using object versioning. Give access to the bucket to every team member so they can download the files.
- Reasoning: While Cloud Stor...
Author: Madison · Last updated Jul 10, 2026
You are using Stackdriver to monitor applications hosted on Google Cloud Platform (GCP). You recently deployed a new application, but its logs are not appearing on the Stac...
To troubleshoot the issue of logs not appearing on the Stackdriver dashboard for the newly deployed application, let’s evaluate each option:
Option A: Confirm that the Stackdriver agent has been installed in the hosting virtual machine.
- Reasoning: Stackdriver relies on the installation of the Stackdriver agents (such as the Ops Agent or Fluentd) to collect logs from applications running on virtual machines (VMs). If these agents are not installed or configured correctly, logs will not be sent to Stackdriver, which could be the reason why the logs are not appearing on the dashboard.
- Rejection: This is the most likely cause. Ensuring that the agent is installed and running on the VM is a crucial first step in troubleshooting log visibility in Stackdriver.
- Selected Option: This is the best option to check first as missing or misconfigured agents are the most common cause of missing logs.
Option B: Confirm that your account has the proper permissions to use the Stackdriver dashboard.
- Reasoning: Having proper permissions is essential to view logs in Stackdriver. However, if you can access the Stackdriver dashboard and view other logs, it indicates that your permissions are likely correct. The issue seems to be with the application’s logs not appearing, which points to a configuration or agent issue rather than a permissions issue.
- Rejection: While permissions are important, this option is less likely the cause, assuming you can view other logs or access the dashboard.
Option C: Confirm that port 25 has been opened i...
Author: Maya2022 · Last updated Jul 10, 2026
Your organization recently adopted a container-based workflow for application development. Your team develops numerous applications that are deployed continuously through an automated build pipeline to the production environment. A recent security audit alerted your team that the code pushed to production could contain vulnerabilities and that the existing tooling around virtual machine (VM) vulne...
To ensure the security and patch level of all code running through the pipeline, let's evaluate the options based on the context of a containerized application development workflow:
Option A: Set up Container Analysis to scan and report Common Vulnerabilities and Exposures (CVEs).
- Reasoning: Container Analysis is a security tool specifically designed to scan container images for vulnerabilities, including known CVEs. By integrating it into your pipeline, you can automatically identify and report vulnerabilities in the containers as they are built or deployed. This solution is highly effective for ensuring that any vulnerabilities are detected before containers are deployed into production, making it directly applicable to your use case of security and patching in a containerized environment.
- Selected Option: This is the best option because it is tailored for containers, helps track vulnerabilities effectively, and integrates well with the continuous integration pipeline.
Option B: Configure the containers in the build pipeline to always update themselves before release.
- Reasoning: While it’s important to keep containers updated, automatically updating containers right before release can introduce new issues or changes that haven’t been fully tested. This approach may lead to unstable deployments if updates are not properly validated, and it doesn’t provide a clear mechanism for detecting and addressing vulnerabilities in the specific versions of dependencies or container images.
- Rejection: This option doesn't directly address the need to track and manage vulnerabilities. It's more about general patch management, but it lacks the granularity of vulnerability scanning, leaving your pipeline less secure.
Option C: Reconfigure the existing operating system vulnerability software to exist inside the container.
- Reasoning: Operating system vulnerability software typically c...
Author: Ava · Last updated Jul 10, 2026
You use Cloud Build to build your application. You want to reduce the build time while minimizing cost...
To reduce build time while minimizing cost and development effort, let's evaluate each option based on key factors such as speed, cost-efficiency, and simplicity:
A) Use Cloud Storage to cache intermediate artifacts.
- Explanation: Caching intermediate artifacts in Cloud Storage can reduce redundant processing in future builds by reusing previously built components. This can significantly improve build time by not having to rebuild unchanged parts of the application. It’s also cost-effective because it reduces the need to perform redundant tasks, saving both compute resources and time.
- Why rejected?: This is a valid approach, but it requires setting up caching strategies (like cloud build caches), and it's more effective when the build process involves repeated tasks or dependencies. It might not reduce build time immediately unless the build involves significant reuse of artifacts.
- When to use: This is most useful when you have dependencies or parts of the application that don’t change frequently.
B) Run multiple Jenkins agents to parallelize the build.
- Explanation: Jenkins agents can distribute the work across multiple machines to parallelize tasks. However, this introduces additional complexity in terms of setup and maintenance. It also doesn’t directly reduce the time for individual builds within Cloud Build, which is your primary tool in this case.
- Why rejected?: Jenkins is not natively integrated with Cloud Build, so using it in conjunction with Cloud Build adds unnecessary complexity, increasing the development effort and maintenance overhead.
- When to use: This could be used when working in a Jenkins-heavy environment or when you're using Jenkins for a broader CI/CD pipel...
Author: Krishna · Last updated Jul 10, 2026
You support a web application that is hosted on Compute Engine. The application provides a booking service for thousands of users. Shortly after the release of a new feature, your monitoring dashboard shows that all users are experiencing latency at l...
In this scenario, the goal is to mitigate the impact of latency at login, which is affecting all users. Let's evaluate each option:
A) Roll back the recent release.
- Explanation: If the issue arose immediately after a new feature release, the problem may be related to the code changes introduced. Rolling back the release would quickly remove the potential cause of the issue and restore service to its previous, functional state.
- Why rejected?: While this is a valid option, rolling back immediately may not be the best first step because you might not yet fully understand the root cause of the issue. It's a drastic measure that can be avoided if the problem is due to something less severe (such as an underlying resource constraint or misconfiguration).
- When to use: This is useful when you are sure the release caused the issue, and you need to immediately restore the previous stable state. However, it's better to gather more information first.
B) Review the Stackdriver monitoring.
- Explanation: Reviewing Stackdriver monitoring (now called Google Cloud Operations suite) can provide valuable insights into the root cause of the issue. Metrics such as CPU usage, memory usage, response times, and error rates can help pinpoint whether the problem is related to application performance, resource usage, or a particular component.
- Why selected?: This is the best first step because it allows you to identify the root cause of the issue. By analyzing Stackdriver logs and metrics, you can determine if the problem is related to infrastructure, code changes, or resource constraints. This step helps avoid unnecessary actions like rolling back or redeploying without sufficie...
Author: RadiantJaguar56 · Last updated Jul 10, 2026
You are deploying an application that needs to access sensitive information. You need to ensure that this information is encrypted and the risk ...
To ensure that sensitive information is encrypted and minimizes the risk of exposure in case of a breach, let's evaluate each option:
A) Store the encryption keys in Cloud Key Management Service (KMS) and rotate the keys frequently.
- Explanation: Cloud KMS is a managed service designed to securely store and manage cryptographic keys. It ensures that sensitive data is encrypted with strong encryption standards, and key rotation can be automated. Frequent key rotation reduces the risk of key compromise. By using KMS, you can manage access control, monitor key usage, and ensure that only authorized services can decrypt the sensitive data.
- Why selected?: This is the best option because it follows security best practices. Storing encryption keys in KMS reduces the risk of exposing them and allows you to enforce encryption policies. Frequent key rotation is a critical measure to limit the window of exposure in case of a breach.
- When to use: This is ideal when managing sensitive data that requires strong encryption at rest and minimal exposure of keys.
B) Inject the secret at the time of instance creation via an encrypted configuration management system.
- Explanation: Using an encrypted configuration management system to inject secrets at the time of instance creation can be a useful method for ensuring that secrets are securely managed. However, if secrets are stored or managed improperly within the system or on the instance itself, there is still a risk of exposure (e.g., through accidental loggings, misconfigurations, or improper access controls).
- Why rejected?: While this method can be effective for securing secrets in transit, there is a greater risk of exposure due to improper handling on the instance. It also doesn’t address key management and rotation in a centralized, secure way like Cloud KMS does.
- When to use: This method can be useful in environments where a c...
Author: Liam123 · Last updated Jul 10, 2026
You encounter a large number of outages in the production systems you support. You receive alerts for all the outages that wake you up at night. The alerts are due to unhealthy systems that are automatically restarted within a minute. You want to set up a proce...
To address the issue of frequent, unactionable alerts waking up staff at night and to prevent burnout while following Site Reliability Engineering (SRE) practices, let’s evaluate each option:
A) Eliminate unactionable alerts.
- Explanation: Elimination of unactionable alerts is a crucial step in reducing alert fatigue. Alerts that are triggered for transient issues that resolve themselves automatically (e.g., systems restarting within a minute) do not require human intervention. By filtering out such alerts, the number of notifications can be minimized, ensuring that only critical issues that need attention are raised.
- Why selected?: This is the best first step. It directly addresses the core issue of too many alerts, many of which are unnecessary and not actionable. Eliminating these alerts helps reduce noise, allowing engineers to focus on meaningful incidents. It is aligned with SRE best practices, as it ensures that alerting systems are meaningful and don’t result in unnecessary disturbance to on-call staff.
- When to use: This should be implemented immediately to reduce alert fatigue, especially when the alerts are mostly triggered by transient and self-healing issues.
B) Create an incident report for each of the alerts.
- Explanation: Creating incident reports for every alert could result in unnecessary overhead, especially when the issue is resolved automatically within a minute. Incident reports are valuable for major outages or complex incidents, but for minor, transient issues, generating incident reports would add more work without providing significant value.
- Why rejected?: While documenting significant incidents is important, automating incident reporting for every alert could lead to a lot of unnecessary paperwork and reduce the focus on actual, high-priority problems. It also doesn’t directly address the issue of alert fatigue.
- When to use: This would be useful when dealing with major incidents that require detailed analysis, but not for regular, small ou...
Author: Sophia Clark · Last updated Jul 10, 2026
You have migrated an e-commerce application to Google Cloud Platform (GCP). You want to prepare the application for the upcoming busy seas...
To prepare the e-commerce application for the upcoming busy season on Google Cloud Platform (GCP), let’s evaluate each option based on its effectiveness in ensuring scalability, performance, and resource management:
A) Load test the application to profile its performance for scaling.
- Explanation: Load testing simulates heavy traffic on the application to measure its behavior under stress. This approach is essential to understand the application's performance bottlenecks and help in designing an effective scaling strategy. Load testing provides insights into how the application will scale, the maximum capacity it can handle, and where optimizations are needed.
- Why selected?: This is the best option because it allows you to identify weaknesses in the system, such as slow response times, failures under load, or inadequate resources, ahead of time. By profiling the performance, you can make informed decisions about scaling strategies, resource requirements, and infrastructure optimizations. This approach is proactive and helps ensure that the application can handle high traffic loads.
- When to use: This is ideal for preparing for the busy season as it allows for proper benchmarking and capacity planning. It's also essential if you're unsure about how your application will behave under peak traffic conditions.
B) Enable AutoScaling on the production clusters, in case there is growth.
- Explanation: Enabling AutoScaling ensures that the application can automatically scale up or down based on demand. This is a useful feature for handling traffic spikes without manual intervention, but it assumes that the application is already prepared to scale properly. AutoScaling works best when you know how the application performs and have determined the appropriate thresholds for scaling.
- Why rejected?: While AutoScaling is important and should be used, it should not be the first step. Enabling AutoScaling without understanding the application's performance during peak loads can lead to misconfigurations or missed opportunities for optimization. It’s more of a reactive measure once you have the necessary performance data from...
Author: Ravi Patel · Last updated Jul 10, 2026
You support a web application that runs on App Engine and uses CloudSQL and Cloud Storage for data storage. After a short spike in website traffic, you notice a big increase in latency for all user requests, increase in CPU use, and the number of processes running the application. Initial troubleshooting reveals:
* After the initial spike in traffic, load levels returned to normal but users still experience high latency.
* Requests for content from the CloudSQL database and images from Cloud Storage show the same high latency.
* No changes were made to the we...
Given the situation you've described, the issue seems to be related to the application struggling to handle traffic spikes effectively, even though load levels have returned to normal. The high latency for both CloudSQL database requests and Cloud Storage image retrievals points toward potential infrastructure issues rather than code changes.
Let's review each option:
A) Upgrade the GCS buckets to Multi-Regional
This option is about improving the storage performance by moving data closer to users by using multi-regional storage. However, Cloud Storage performance issues aren't likely the root cause based on the described symptoms, especially since there has been no mention of regional failures or geographically distant users being impacted. Moreover, you haven't observed errors specific to GCS access, just latency.
- Rejected: This is unlikely to be the cause of the high latency across both CloudSQL and GCS, which suggests a broader issue.
B) Enable high availability on the CloudSQL instances
CloudSQL high availability is a feature that replicates the database across multiple zones to ensure that the database remains available even during failures. While this might improve uptime and reduce risk of database downtime, it won't address the immediate performance or latency problems, as the issue seems to be with the increased load causing performance degradation after the traffic spike.
- Rejected: This is focused on improving availability, not performance during high traffic, which doesn't directly address your latency problem.
C) Move the...
Author: David · Last updated Jul 10, 2026
Your application runs on Google Cloud Platform (GCP). You need to implement Jenkins for deploying application releases to GCP. You want to streamline the release proces...
To implement Jenkins for deploying application releases to Google Cloud Platform (GCP), you want to streamline the process, lower operational toil, and ensure security for user data. Let’s evaluate each option in this context:
A) Implement Jenkins on local workstations
Implementing Jenkins on local workstations would mean running Jenkins on individual developer machines. This setup would likely lead to high levels of manual maintenance and lack of scalability. It also introduces potential security risks due to varying levels of access control, and it would be hard to ensure consistent environments for all developers. Additionally, this approach does not leverage the scalability and automation benefits of the cloud.
- Rejected: This is not a scalable or secure approach for enterprise-level deployments, especially in a cloud environment like GCP.
B) Implement Jenkins on Kubernetes on-premises
Running Jenkins on Kubernetes on-premises could work for certain scenarios, but this would require maintaining on-prem infrastructure, including hardware, network configuration, and storage, as well as ensuring proper security measures are in place. While Kubernetes offers scalability, this solution introduces additional overhead in managing the infrastructure and may not fully leverage GCP's native tools and services.
- Rejected: This adds complexity in terms of infrastructure management and doesn't fully utilize GCP's cloud-native features, which would simplify operations and improve scalability.
C) Implement Jenkins on Google Cloud Functions
Google Cloud Functions are designed for event-driven, serverless execution, typically used for runnin...
Author: Harper · Last updated Jul 10, 2026
You are working with a government agency that requires you to archive application logs for seven years. You need to configure Stackdriver to export and st...
The government agency requires you to archive application logs for seven years, and the goal is to minimize storage costs while ensuring compliance with the retention requirement. Let’s break down each option:
A) Create a Cloud Storage bucket and develop your application to send logs directly to the bucket
While storing logs in a Cloud Storage bucket could be a cost-effective option, developing the application to send logs directly to the bucket would introduce unnecessary complexity. This would involve manual handling of the logs in the application code, adding development overhead and potentially leading to maintenance issues. Additionally, this approach would bypass Stackdriver's built-in log management features, such as filtering, indexing, and automated export.
- Rejected: This is a manual approach that adds complexity and doesn’t leverage Stackdriver's native capabilities.
B) Develop an App Engine application that pulls the logs from Stackdriver and saves them in BigQuery
BigQuery is ideal for running complex queries on large datasets, but storing logs in BigQuery is not cost-effective for long-term storage. BigQuery is optimized for analytics and querying, and using it as a storage solution for logs would be expensive, especially given the seven-year retention requirement. Logs do not need the level of querying and analysis that BigQuery provides, and the cost of storing logs here would be significantly higher than using Cloud Storage.
- Rejected: BigQuery is not the best fit for archiving logs for extended periods, especially if cost minimization is a priority.
C) Create an export in Stackdriver and configure Cloud Pub/Su...
Author: SolarFalcon11 · Last updated Jul 10, 2026
You support a trading application written in Python and hosted on App Engine flexible environment. You want to customize the error information b...
You want to customize the error information being sent to Stackdriver Error Reporting for a trading application running in the App Engine flexible environment. Let’s evaluate each option:
A) Install the Stackdriver Error Reporting library for Python, and then run your code on a Compute Engine VM
Although the Stackdriver Error Reporting library can be installed on Compute Engine VMs, this option introduces unnecessary complexity. You would need to manage infrastructure, handle VM scaling, and ensure proper configuration, which defeats the purpose of using App Engine's managed service. Additionally, the trading application is already hosted on App Engine, so moving it to Compute Engine would add operational overhead and would not benefit from App Engine’s automatic scaling and other features.
- Rejected: This requires unnecessary management and infrastructure overhead.
B) Install the Stackdriver Error Reporting library for Python, and then run your code on Google Kubernetes Engine
While Google Kubernetes Engine (GKE) provides containerized management, using it for this scenario would involve additional complexity related to managing Kubernetes clusters, scaling, and orchestration. App Engine’s flexible environment already supports easy deployment, scaling, and integrates well with Stackdriver, which is a much more straightforward solution in this case.
- Rejected: GKE is over-engineered for this use case, especially since App Engine is already being used.
C) Install the Stackdriver Error Reporting library for Python, and then run your code on App Engine flexible environment
App Engine's flexible environment supports installing libraries and running custom code, including St...
Author: Zain · Last updated Jul 10, 2026
You need to define Service Level Objectives (SLOs) for a high-traffic multi-region web application. Customers expect the application to always be available and have fast response times. Customers are currently happy with the application performance and availability. Based on current measurement, you observe that the
90
percentile of la...
When defining Service Level Objectives (SLOs) for a high-traffic multi-region web application, it’s important to consider both availability and latency. Since customers are satisfied with performance and availability, we need to choose latency thresholds that maintain this satisfaction while keeping the goals reasonable and achievable. Let's evaluate each option based on the observed latency measurements:
Key Observations:
- 90th percentile latency: 120ms
- 95th percentile latency: 275ms
These percentiles indicate how the majority of users experience the latency, with 90% of requests falling below 120ms and 95% of requests falling below 275ms.
A) 90 percentile = 100ms, 95 percentile = 250ms
This option sets the 90th percentile latency slightly below the observed 120ms (at 100ms) and the 95th percentile latency slightly below 275ms (at 250ms). This is very aggressive and could potentially be unrealistic given the current measurements, as the observed 90th percentile latency is already 120ms. While this would set a strong performance goal, it may be difficult to meet and could result in unrealistic expectations.
- Rejected: This may set a goal that's too aggressive, and achieving this consistently could lead to underperformance or increased operational pressure.
B) 90 percentile = 120ms, 95 percentile = 275ms
This option sets the 90th percentile latency to exactly match the current measurement (120ms) and the 95th percentile latency to match the observed value of 275ms. This choice aligns directly with current performance and reflects the status quo while still providing a clear and achievable SLO. Given that customers are satisfied with the current performance, this SLO would be a reasonable target and ensures no over-pr...
Author: SolarFalcon11 · Last updated Jul 10, 2026
You support a large service with a well-defined Service Level Objective (SLO). The development team deploys new releases of the service multiple times a week.
If a major incident causes the service to miss its SLO, you want the development team to shift its foc...
To ensure that the development team shifts its focus from features to improving service reliability when a major incident occurs, it's crucial to have a clear and pre-established process that aligns all stakeholders, provides measurable reliability goals, and encourages a balanced approach between new features and reliability improvements. Let’s analyze the options:
A) Develop an appropriate error budget policy in cooperation with all service stakeholders:
- Explanation: An error budget policy allows you to set a threshold (error budget) for acceptable service outages or degraded performance, which can be tied to the Service Level Objective (SLO). If the error budget is exhausted (i.e., if the service has missed the SLO too many times), the development team is required to prioritize reliability work until the error budget is restored.
- Key Factors: This approach is proactive and helps balance reliability and feature development over time. The development team will know when to focus on reliability versus when they can continue with feature development. It aligns all stakeholders on the priorities and enables better decision-making.
- Why other options are rejected:
- B would potentially create conflict with product priorities and may hinder business goals, making it less flexible.
- C would limit the development team’s ability to release features quickly, which could be a disadvantage in fast-paced environments.
- D would prevent releases entirely when out of SLO, but it doesn't provide a structured way to deal with this, potentially harming feature release schedules and creating friction.
B) Negotiate with the product team to always prioritize service reliability over releasing new features:
- Exp...
Author: GlowingTiger · Last updated Jul 10, 2026
Your company is developing applications that are deployed on Google Kubernetes Engine (GKE). Each team manages a different application. You need to create the development and production environments for each team, while minimizing...
When considering the development and production environments for each team, we must balance cost, security, and ease of management. Let’s analyze each option carefully:
A) Create one GCP Project per team. In each project, create a cluster for Development and one for Production. Grant the teams IAM access to their respective clusters.
- Explanation: This option separates projects per team, ensuring each team has control over its own GKE clusters. By creating distinct development and production clusters for each team, we maintain clear separation and minimal interference. IAM policies can restrict access at the project level.
- Why rejected: While this ensures access control, maintaining separate clusters for development and production per team can become costly as each cluster has its own associated costs. Additionally, the overhead of managing multiple clusters per team could add complexity to the system.
B) Create one GCP Project per team. In each project, create a cluster with a Kubernetes namespace for Development and one for Production. Grant the teams IAM access to their respective clusters.
- Explanation: In this approach, you would use namespaces within a single GKE cluster per team for both development and production environments. IAM can be used to control access to the entire cluster.
- Why rejected: While this approach minimizes costs by having fewer clusters, it still involves IAM access to the entire cluster. This might not provide the necessary level of isolation between development and production environments at the cluster level, which is critical for security and risk mitigation.
C) Create a Development and a Production GKE cluster in separate projects. In each cluster, create a Kubernetes namespace per team, and then configure Identity Aware Proxy (IAP) so that each team can only access its own namespa...
Author: Mia · Last updated Jul 10, 2026
Some of your production services are running in Google Kubernetes Engine (GKE) in the eu-west-1 region. Your build system runs in the us-west-1 region. You want to push the container images from your build system to a scalable ...
To maximize bandwidth and minimize latency for pushing container images from a build system in the us-west-1 region to a GKE cluster in the eu-west-1 region, we should consider factors such as geographic proximity, scalability, and network optimization.
Let’s analyze the options:
A) Push the images to Google Container Registry (GCR) using the gcr.io hostname.
- Explanation: Using the `gcr.io` hostname refers to the default Google Container Registry, which is a multi-region registry.
- Why rejected: This option does not optimize for proximity between the build system and the GKE cluster. Since `gcr.io` is a global endpoint, the images may have to traverse more network distance than necessary, especially considering the geographical distance between us-west-1 (build system) and eu-west-1 (GKE cluster), leading to potential bandwidth inefficiencies.
B) Push the images to Google Container Registry (GCR) using the us.gcr.io hostname.
- Explanation: Using the `us.gcr.io` hostname directs the push to a Google Container Registry in the us region, which is geographically close to the build system in us-west-1.
- Key Factors: While this might be efficient for pushing the images from the build system (located in the us-west-1 region), it does not optimize the image transfer to the eu-west-1 region where the GKE cluster is located. The transfer between the registry and the cluster would still incur long-distance latency between the us and eu regions, resulting in lower bandwidth efficiency for deployments.
C) Push the images to Google Container Registry (GCR) using the eu.gcr.io hostname.
- Explanation: Using the `eu.gcr.io` hostname directs the push to a Google Container Registry i...
Author: Aarav2020 · Last updated Jul 10, 2026
You manage several production systems that run on Compute Engine in the same Google Cloud Platform (GCP) project. Each system has its own set of dedicated Compute Engine instances. You...
To determine the cost of running each system on Google Cloud Platform (GCP) when using Compute Engine instances, we need an approach that allows us to break down costs based on the systems they represent. The solution should offer flexibility, be easy to implement, and allow detailed tracking of resources consumed by each system.
Let’s analyze the options:
A) In the Google Cloud Platform Console, use the Cost Breakdown section to visualize the costs per system.
- Explanation: The Cost Breakdown section in the GCP Console provides an overview of spending across all resources but doesn’t offer fine-grained breakdowns based on specific systems. It can give an overall view of costs, but it doesn’t allow cost allocation per system without further configurations.
- Why rejected: This option doesn’t offer detailed granularity that you need to track costs per specific system. It’s more general and won’t allow you to distinguish costs between the multiple systems running on Compute Engine instances.
B) Assign all instances a label specific to the system they run. Configure BigQuery billing export and query costs per label.
- Explanation: Labels in GCP are an effective way to categorize resources. By assigning labels to your Compute Engine instances based on the system they run, you can then export billing data to BigQuery and query the costs by label. This method provides a detailed, scalable way to track costs per system as each instance is associated with a specific label.
- Key Factors: This is a flexible and powerful solution, as it allows you to tag resources according to the system they belong to and then use BigQuery for detailed cost analysis. Labels are easy to manage and maintain, and BigQuery offers robust querying capabilities for analyzing cost data.
- Why this option is selected: This approach is ideal for your use case. It provides the level of granularity needed to track costs per system and integrates well with GCP’s billing and analysis tools. It’s also easy to set up and scale.
C) ...
Author: Liam · Last updated Jul 10, 2026
You use Cloud Build to build and deploy your application. You want to securely incorporate database credentials and other application secrets into the build pipeline...
Incorporating sensitive data such as database credentials and application secrets into the Cloud Build pipeline should be done securely and with minimal development overhead. Let’s evaluate the options based on factors like security, manageability, and ease of integration with Cloud Build.
A) Create a Cloud Storage bucket and use the built-in encryption at rest. Store the secrets in the bucket and grant Cloud Build access to the bucket.
- Explanation: Using Cloud Storage with built-in encryption at rest can protect the secrets stored in the bucket. You can then grant Cloud Build access to the bucket to fetch the secrets during the build process.
- Why rejected: While Cloud Storage with encryption at rest does provide some level of security, this solution lacks the fine-grained control and management features required for securely handling secrets. It doesn’t allow for integration with a key management service (KMS) for managing the encryption keys, which is considered best practice for securing secrets. This approach is also more error-prone when managing access and decryption.
B) Encrypt the secrets and store them in the application repository. Store a decryption key in a separate repository and grant Cloud Build access to the repository.
- Explanation: This method involves encrypting secrets and storing them in the application repository, while the decryption key is stored in a separate repository.
- Why rejected: Storing secrets and keys in code repositories, even in separate ones, introduces the risk of accidental exposure, particularly if the repository access is misconfigured. It is also not a scalable or secure approach for managing sensitive information. Repositories aren’t designed to handle secrets securely, and this increases the complexity of managing decryption keys.
C) Use client-side encryption to encrypt the secrets and store them in a Cloud Storage bucket. Store a decryption key in the bucket and grant Cloud Build access to the bucket.
- Explanation: This opti...
Author: GlowingTiger · Last updated Jul 10, 2026
You support a popular mobile game application deployed on Google Kubernetes Engine (GKE) across several Google Cloud regions. Each region has multiple
Kubernetes clusters. You receive a report that none of the users in a specific region can connect to the application...
To resolve the incident in the region where users cannot connect to the application, the most appropriate first step is to gather information to diagnose the root cause. Let's go over each option:
A) Reroute the user traffic from the affected region to other regions that don't report issues.
- While rerouting traffic can temporarily mitigate the impact on users, it doesn't help resolve the underlying issue in the affected region. This option only masks the problem, so it's not the best first step. It's more of a temporary solution if you need to reduce the severity of the issue while troubleshooting.
- This can be useful in a scenario where the issue is critical, and you need to ensure service continuity while investigating.
- Rejected: Not a proactive diagnostic approach.
B) Use Stackdriver Monitoring to check for a spike in CPU or memory usage for the affected region.
- Checking for resource utilization is a good idea to identify any obvious performance-related issues (e.g., resource exhaustion). However, it might not necessarily reveal the root cause of connectivity issues, as the problem could be related to network issues, service failures, or other factors unrelated to CPU or memory spikes.
- Rejected: Too specific and might not address the root cause ...
Author: CrystalWolfX · Last updated Jul 10, 2026
You are writing a postmortem for an incident that severely affected users. You want to prevent similar incidents in the future. Which two of the follo...
In writing a postmortem for an incident that severely affected users, it is important to focus on providing actionable insights and clear steps for future improvements, as well as explaining what went wrong. Let's go through the options:
A) An explanation of the root cause of the incident.
- This is an essential section for a postmortem. Understanding the root cause allows you to explain why the incident happened and helps in identifying systemic issues that need to be addressed. This is key to preventing similar issues in the future.
- Selected: Critical for identifying and understanding what went wrong.
B) A list of employees responsible for causing the incident.
- While it might be tempting to point fingers, the focus of a postmortem should be on the systems, processes, and conditions that led to the incident. A list of individuals responsible would create a blame culture, which is counterproductive in a Site Reliability Engineering (SRE) context. The goal is to learn and improve, not to assign blame.
- Rejected: Blame-oriented and not productive in a postmortem.
C) A list of action items to prevent a recurrence of the incident.
- This is crucial for ensuring the incident does not happen again. By including specific action items, you can outline the steps to fix underlying issues and improve the system, process...
Author: Mia · Last updated Jul 10, 2026
You are ready to deploy a new feature of a web-based application to production. You want to use Google Kubernetes Engine (GKE) to perform a phas...
To perform a phased rollout of a new feature to only half of the web server pods in Google Kubernetes Engine (GKE), you want to ensure a gradual deployment that can be controlled and adjusted if necessary. Let's go through the options:
A) Use a partitioned rolling update.
- A partitioned rolling update is a good choice here, as it allows you to update a specific subset of your pods while leaving the rest unchanged. You can specify the number of replicas in different "partitions," and Kubernetes will perform the update gradually, targeting the specified partition first. This enables you to achieve the phased rollout you're aiming for without affecting the entire set of pods.
- Selected: The best option for controlling phased rollout to a specific subset of pods.
B) Use Node taints with NoExecute.
- Node taints with NoExecute are used to prevent pods from being scheduled on specific nodes or to evict pods from nodes under certain conditions. While it can be useful for managing pod placement based on node conditions, it does not provide a way to perform a controlled rollout of features. It would not help in this case as it focuses on node-level control rather than pod-level updates.
- Rejected: Not useful for controlling phased deployment of feature updates.
C) Use a...
Author: Henry · Last updated Jul 10, 2026
You are responsible for the reliability of a high-volume enterprise application. A large number of users report that an important subset of the application's functionality `" a data intensive reporting feature `" is consistently failing with an HTTP 500 error. When you investigate your application's dashboards, you notice a strong correlation between the failures and a metric that represents the size of an internal queue used for generating reports. You trace the failures to a reporting backend that is experiencing ...
To define a Service Level Indicator (SLI) for the availability of the report generation feature, the SLI should focus on user-facing reliability, specifically how often users can successfully generate reports. The SLI should measure the availability of the feature in a way that directly reflects the user experience and functionality. Let’s evaluate each option:
A) As the I/O wait times aggregated across all report generation backends.
- While monitoring I/O wait times across backends is crucial for performance troubleshooting, this metric does not directly measure the availability or user-facing success of the report generation feature. High I/O wait times can be a sign of an issue, but they are an internal metric and not a direct reflection of service availability.
- Rejected: Not user-facing and doesn't measure success or failure of report generation requests.
B) As the proportion of report generation requests that result in a successful response.
- This is the most appropriate SLI for availability. By measuring the proportion of successful report generation requests (i.e., the number of successful responses divided by the total number of requests), you directly measure the reliability and availability of the feature from the user's perspective. An HTTP 500 error would result in a failed request, which is exactly what needs to be tracked for availability.
- Selected: Directly measures the success or failure of the feature as experienced by users.
C) As the application's report gen...
Author: Evelyn · Last updated Jul 10, 2026
You have an application running in Google Kubernetes Engine. The application invokes multiple services per request but responds too slowly. You need to identify which d...
To identify which downstream service or services are causing the delay in your application, the key requirement is to trace the path of a request as it moves through various services and pinpoint where the slowdowns occur. Let’s evaluate each option:
A) Analyze VPC flow logs along the path of the request.
- VPC flow logs can provide insights into network traffic, but they are more focused on network-level data, such as IP addresses, ports, and traffic flow. While useful for diagnosing network connectivity issues or security concerns, they do not provide visibility into the application-layer performance or which specific services are causing delays.
- Rejected: VPC flow logs don't provide the granularity needed to identify application-level delays in downstream services.
B) Investigate the Liveness and Readiness probes for each service.
- Liveness and Readiness probes are important for ensuring that services are healthy and able to accept traffic, but they are not designed to measure the performance or latency of requests within the services. They only indicate if a service is up or ready to receive traffic, but they don't give any insight into delays caused by specific services.
- Rejected: They help monitor service health, not performance or delays.
C) Create a Dataflow pipeline to analyze service metrics in real time.
- Google Cloud Dataflow is a fully managed service for str...
Author: ThunderBear · Last updated Jul 10, 2026
You are creating and assigning action items in a postmodern for an outage. The outage is over, but you need to address the root causes. You want to ensure that your team handles the action items qui...
When assigning owners and collaborators to action items in a postmortem for an outage, it’s crucial to focus on accountability, efficiency, and clarity. Each option has its strengths and weaknesses based on these criteria.
Option A: Assign one owner for each action item and any necessary collaborators
- Selected option: This is generally the best practice. Assigning one owner ensures that accountability is clear and that someone is specifically responsible for ensuring the action item is completed on time. Collaborators can assist but do not have the same ownership. This minimizes ambiguity, allows for focused follow-through, and encourages ownership of results.
- Why others are rejected:
- Option B dilutes responsibility (too many owners), leading to confusion about who is driving each action item.
- Option C, where th...
Author: Isabella · Last updated Jul 10, 2026
Your development team has created a new version of their service's API. You need to deploy the new versions of the API with the least disruption to third-party developers...
In deploying a new version of an API with minimal disruption to third-party developers and end users, it is essential to ensure a smooth transition from the old version to the new one. The key objectives are:
1. Providing notice to users: Third-party developers need adequate time and information to adapt their applications.
2. Minimizing downtime: Ensure that both versions of the API coexist for a period, allowing users to transition without immediate disruption.
3. Supporting legacy users: Offering support for users still on the old version of the API until they have fully migrated.
Option A: Introduce the new version of the API. Announce deprecation of the old version of the API. Deprecate the old version of the API. Contact remaining users of the old API. Provide best effort support to users of the old API. Turn down the old version of the API.
- Why it's rejected: This option lacks a clear structure for informing and supporting the users of the old version before turning down the old version of the API. By announcing deprecation after introducing the new version, users may not have time to prepare for the change. The transition could be rushed and confusing, especially if the users are not well-informed.
Option B: Announce deprecation of the old version of the API. Introduce the new version of the API. Contact remaining users on the old API. Deprecate the old version of the API. Turn down the old version of the API. Provide best effort support to users of the old API.
- Why it's rejected: While this option starts with announcing deprecation (which is good), the sequence of introducing the new version, deprecating the old version, and contacting users isn't ideal. Ideally, the users should be contacted before the old version is deprecated to ensure they are informed and can migrate in a timely manner. The timeline could be too tight for users to adjust to the chang...
Author: VioletCheetah55 · Last updated Jul 10, 2026
You are running an application on Compute Engine and collecting logs through Stackdriver. You discover that some personally identifiable information (PII) is leaking into certain log entry fields. You want to prevent ...
To prevent personally identifiable information (PII) from leaking into log entries as quickly as possible, you need to act promptly and efficiently. The options provided each have strengths and weaknesses in terms of speed, ease of implementation, and effectiveness in addressing the issue.
Option A: Use the filter-record-transformer Fluentd filter plugin to remove the fields from the log entries in flight.
- Selected option: This option is the most immediate and efficient solution. The Fluentd filter-record-transformer plugin allows you to modify or filter log entries as they are being processed (in-flight), before they are written to the final destination (Stackdriver). This means that sensitive PII can be removed from the log entries before they are ever written, preventing further exposure.
- Why it's selected: Using this plugin directly modifies the logs as they are being collected, ensuring that the fields containing PII are not written at all. This allows you to address the issue quickly without requiring changes to the application code.
Option B: Use the fluent-plugin-record-reformer Fluentd output plugin to remove the fields from the log entries in flight.
- Why it's rejected: The fluent-plugin-record-reformer plugin is typically used to modify or reform log records when they are being output to a destination (like Stackdriver). While it can transform the log records, it operates later in the pipeline than the filter-record-transformer. This means some fields with PII may already be written to the logs before being processed by this plugin. There...
Author: Emma · Last updated Jul 10, 2026
You support a service that recently had an outage. The outage was caused by a new release that exhausted the service memory resources. You rolled back the release successfully to mitigate the impact on users. You are now in charge of the post-mortem for the outag...
When conducting a post-mortem for an outage, the goal is to identify the root causes and learn from the incident to prevent similar issues in the future. A post-mortem should follow Site Reliability Engineering (SRE) practices, which prioritize learning, process improvement, and system resilience over blame or superficial fixes.
Option A: Focus on developing new features rather than avoiding the outages from recurring.
- Why it's rejected: This option focuses on development rather than addressing the root cause of the outage. While developing new features is important for advancing the service, it is critical to first understand why the outage occurred and how to prevent future occurrences. Ignoring these factors could lead to similar issues down the line. SRE practices emphasize stability, reliability, and reducing future risks, so the focus should be on addressing and preventing outages rather than just adding new features.
Option B: Focus on identifying the contributing causes of the incident rather than the individual responsible for the cause.
- Selected option: This is the correct approach in an SRE post-mortem. SRE practices focus on blameless post-mortems, which prioritize finding systemic issues and contributing factors rather than pointing fingers at individuals. Understanding how the release exhausted memory resources, identifying flaws in the release process, monitoring, testing, or resource allocation, and improving the system's resilience is key. Focusing on contributing causes ensures that the team can learn from the incident and implement corrective measures that will prevent similar failures in the future.
- Why it's selected: By focusing on systemic causes, you avoid a blame culture, which encourages team collabora...
Author: Nia · Last updated Jul 10, 2026
You support a user-facing web application. When analyzing the application's error budget over the previous six months, you notice that the application has never consumed more than 5% of its error budget in any given time window. You hold a Service Level Objective (SLO) review with business stakeholders and confirm that the SLO is set appropriately. You want your application's SLO to...
To ensure that your application's Service Level Objectives (SLOs) reflect its observed reliability, while also balancing velocity, reliability, and business needs, it is important to make strategic adjustments that help align the SLOs with actual performance and are in line with the operational goals. Here's an analysis of each option:
Option A: Add more serving capacity to all of your application's zones.
- Why it's rejected: Adding more capacity to the application's zones is a general improvement to system reliability, but it doesn't directly address the issue of aligning your SLO to the observed reliability. If your error budget usage is low and your reliability is already high, scaling capacity may be unnecessary and might not effectively balance the error budget consumption. It's an action more focused on scaling the application rather than reflecting reliability more accurately.
- When it could be used: This option would be useful if the application was frequently hitting capacity limits and performance degradation was occurring due to resource shortages. However, this is not the case based on the information given, as the application has consistently consumed very little of its error budget.
Option B: Have more frequent or potentially risky application releases.
- Why it's rejected: This option would likely increase the likelihood of reliability issues and could lead to a higher consumption of your error budget. It might artificially increase your error budget consumption, but this is not a sustainable or healthy way to adjust your SLO. Introducing more risk into the system by releasing frequently without proper safeguards could hurt the application’s overall reliability and increase the risk of violating the SLO.
- When it could be used: This might be applicable if you are aiming to balance ...
Author: BlazingPhoenix22 · Last updated Jul 10, 2026
You support a service with a well-defined Service Level Objective (SLO). Over the previous 6 months, your service has consistently met its SLO and customer satisfaction has been consistently high. Most of your service's operations tasks are automated and few repetitive tasks occur frequently. You want to optimize the balanc...
To optimize the balance between reliability and deployment velocity while following Site Reliability Engineering (SRE) best practices, the right approach needs to consider both the importance of maintaining high reliability and the need for fast and efficient deployments.
Let's review each option:
A) Make the service's SLO more strict.
- Rejected. Making the SLO stricter would increase the pressure on reliability, potentially leading to slower deployment velocity. If the service has already been meeting its current SLO and customer satisfaction is high, there's no immediate need to increase the SLO's strictness. This could divert attention from optimization efforts and cause more overhead in operations, negatively impacting deployment speed.
- Key factor: It risks creating more constraints without improving overall service quality or speed.
B) Increase the service's deployment velocity and/or risk.
- Rejected. While increasing deployment velocity is desirable, increasing risk is not a good approach to optimizing reliability and velocity. It could lead to outages, degraded service, and customer dissatisfaction. Best practices focus on maintaining reliability while improving deployment frequency safely, not increasing the risk of failures.
- Key factor: The objective is to find a balance, not increase risk.
C) Shift engineering time to other services that need more reliability.
- Selected. This option makes sense if your current service is already meeting its SLO and customer satisfaction is high. By shifting focus to other services that may require more reliability, you are optimizing the use of engineering res...
Author: Sofia · Last updated Jul 10, 2026
Your company follows Site Reliability Engineering principles. You are writing a postmortem for an incident, triggered by a software change that severely affected users. You want...
When writing a postmortem for an incident, especially one triggered by a software change that severely affected users, the focus should be on ensuring that future incidents are prevented through the improvement of processes, testing, and communication. The goal is not to blame individuals but to create systemic improvements that enhance reliability and minimize risk.
A) Identify engineers responsible for the incident and escalate to senior management.
- Rejected. Focusing on blaming individuals is not aligned with Site Reliability Engineering (SRE) principles, which emphasize blameless postmortems and learning from incidents. The goal should be to understand the root cause of the issue, not to escalate and blame individuals. Escalating this to management without focusing on process improvements is counterproductive and does not contribute to preventing future incidents.
- Key factor: Blame undermines trust and doesn't drive the systemic improvements needed to prevent recurrence.
B) Ensure that test cases that catch errors of this type are run successfully before new software releases.
- Selected. This is an excellent approach. By ensuring that test cases are in place to catch errors like the one that caused the incident, you can reduce the risk of similar incidents in the future. Running comprehensive tests that target failure modes identified in the postmortem would help catch potential issues before they reach production. This proactive approach aligns with SRE best practices, as it strengthens the testing and validation phases.
- Key factor: Proactively addressing issues in th...
Author: FlamePhoenix2025 · Last updated Jul 10, 2026
Your organization uses a change advisory board (CAB) to approve all changes to an existing service. You want to revise this process to eliminate any negative impact ...
In the context of revising the Change Advisory Board (CAB) process to minimize negative impacts on software delivery performance, it's essential to focus on reducing bottlenecks and increasing the speed and reliability of software releases. The goal is to streamline the change approval process without compromising on governance or quality.
A) Replace the CAB with a senior manager to ensure continuous oversight from development to deployment.
- Rejected. Replacing the CAB with a senior manager still involves centralized control, which could introduce delays and create a bottleneck. This doesn't improve the software delivery performance or agility. The goal is to reduce bureaucracy and increase speed, not to add another layer of oversight. It's also likely to slow down decisions due to the involvement of a single person.
- Key factor: The focus should be on decentralizing control and automating approvals where possible to avoid delays.
B) Let developers merge their own changes, but ensure that the team's deployment platform can roll back changes if any issues are discovered.
- Selected. Allowing developers to merge their own changes (within a controlled, automated environment) speeds up the process and reduces dependency on an approval board. The ability to roll back changes ensures that if something goes wrong, there is a safety net, making this a low-risk option. This shift empowers developers, eliminates delays in the approval process, and aligns with the DevOps principle of continuous delivery.
- Key factor: It speeds up delivery without sacrificing the ability to recover from issues, supporting fast, iterative releases.
C) Move to a peer-review based process for individual changes that is enforced at code check-in time and supported by automated tests.
- Selected. A peer-review-based process that occurs at the time of code check-in, with automated testing, provides an effective balance between...
Author: Olivia · Last updated Jul 10, 2026
Your organization has a containerized web application that runs on-premises. As part of the migration plan to Google Cloud, you need to select a deployment strategy and platform that meets the following acceptance criteria:
1. The platform must be able to direct traffic from Android devices to an Android-specific microservice.
2. The platform must allow for arbitrary ...
To select the appropriate deployment strategy and platform for migrating your containerized web application to Google Cloud while meeting the acceptance criteria, we need to focus on platforms that support traffic splitting, continuous testing, and directing traffic based on specific conditions (like user-agent or device type). Let's break down each option based on the acceptance criteria:
Acceptance Criteria:
1. Direct traffic from Android devices to an Android-specific microservice.
2. Allow for arbitrary percentage-based traffic splitting.
3. Continuous testing of multiple versions of any microservice.
A) Deploy the canary release of the application to Cloud Run. Use traffic splitting to direct 10% of user traffic to the canary release based on the revision tag.
- Rejected. While Cloud Run allows for traffic splitting based on revision tags, it doesn’t support advanced routing based on conditions like device type or user-agent headers. This means Cloud Run might not be able to direct traffic from Android devices to the Android-specific microservice, which is a key requirement.
- Key factor: Cloud Run supports basic traffic splitting but lacks flexibility for advanced routing based on user-agent or device-specific logic.
B) Deploy the canary release of the application to App Engine. Use traffic splitting to direct a subset of user traffic to the new version based on the IP address.
- Rejected. App Engine provides basic traffic splitting, but routing based on user-agent (e.g., Android devices) is not as flexible as required here. Additionally, targeting Android-specific traffic based on IP address isn't ideal or reliable for this use case, as IP addresses do not provide consistent or accurate identification of mobile devices.
- Key factor: Using IP address-based traffic splitting for mobile devices is not precise or scalable for directing traffic based on device type.
C) Deploy the canary release of the application to Compute Engine. Use Anthos Service Mesh with Comput...
Author: Liam · Last updated Jul 10, 2026
Your team is running microservices in Google Kubernetes Engine (GKE). You want to detect consumption of an error budget to protect c...
To detect consumption of an error budget and define release policies for microservices running on Google Kubernetes Engine (GKE), the focus should be on creating a Service Level Objective (SLO) and monitoring its burn rate (how quickly you're consuming your error budget). The goal is to ensure that service reliability is maintained while allowing for controlled releases and deployments.
Acceptance Criteria:
1. Detect error budget consumption: Error budget consumption typically refers to the difference between your SLO (desired service level) and your actual service performance (e.g., availability, latency).
2. Protect customers: By detecting error budget consumption early, you can prevent releasing potentially risky changes to production.
3. Define release policies: You should define release policies that limit deployments when the error budget is consumed or nearing exhaustion.
A) Create SLIs from metrics. Enable Alert Policies if the services do not pass.
- Rejected. This option suggests creating Service Level Indicators (SLIs), which measure the performance of the service, but it doesn't go far enough to track error budget consumption directly or define release policies based on that. While SLIs are useful, creating alert policies alone doesn’t necessarily reflect the true consumption of an error budget or link to SLOs, which are critical for release decision-making.
- Key factor: SLIs alone are useful, but you need to connect them to SLOs and error budgets to manage releases effectively.
B) Use the metrics from Anthos Service Mesh to measure the health of the microservices.
- Rejected. While Anthos Service Mesh provides powerful metrics for monitoring microservices, it doesn’t directly provide a mechanism for tracking error budgets or defining release policies based on SLO consumption. It helps with service observability, but to manage error budgets, you need a more struct...
Author: GlowingTiger · Last updated Jul 10, 2026
Your organization wants to collect system logs that will be used to generate dashboards in Cloud Operations for their Google Cloud project. You need to configure all current and future Compute Engine instances to collect ...
To properly configure system log collection for both current and future Compute Engine instances in Google Cloud while ensuring that the Ops Agent remains up to date, let’s evaluate the options one by one:
A) Use the gcloud CLI to install the Ops Agent on each VM listed in the Cloud Asset Inventory.
- Reasoning: This option requires manually installing the Ops Agent on each VM that is listed in the Cloud Asset Inventory. While this may be effective for current instances, it would not automatically apply to future instances. The process of manual installation for each VM could be cumbersome and time-consuming.
- Rejected: This option is not ideal because it doesn't scale well for future instances and doesn’t ensure that the Ops Agent remains up to date automatically.
B) Select all VMs with an Agent status of Not detected on the Cloud Operations VMs dashboard. Then select Install agents.
- Reasoning: This option provides a UI-based method to install the Ops Agent on VMs that don’t have it installed, based on the "Agent status" in Cloud Operations. This method works for VMs already in place, but like Option A, it’s reactive rather than proactive, and it doesn't automatically handle future instances.
- Rejected: While easier than Option A, it still requires manual intervention and does not guarantee ongoing updates or installation on new VMs.
C) Use the gcloud CLI to create an Agent Policy.
- Reasoning: This option allows you to create an Agent Policy that wo...
Author: Manish · Last updated Jul 10, 2026
Your company has a Google Cloud resource hierarchy with folders for production, test, and development. Your cyber security team needs to review your company's Google Cloud security posture to accelerate security issue identification and resolution. You need to centralize the logs generated by Google Cloud ...
Let's review the options available to centralize the logs generated by Google Cloud services from all projects inside your production folder, in order to enable alerting and near-real-time analysis.
A) Enable the Workflows API and route all the logs to Cloud Logging.
- Reasoning: Enabling the Workflows API helps in automating workflows in Google Cloud but is not directly related to centralizing logs or managing security posture. This option does not address the requirement of centralizing logs for near-real-time analysis and alerting.
- Rejected: While useful for automation, it is not relevant to the specific goal of centralizing logs from production projects for security monitoring.
B) Create a central Cloud Monitoring workspace and attach all related projects.
- Reasoning: Cloud Monitoring workspaces help aggregate monitoring data, but they focus on monitoring metrics and not directly on centralizing logs. While monitoring helps track the health and performance of resources, it doesn't help with logging and security posture reviews in terms of logs from Google Cloud services.
- Rejected: This option is more relevant for metrics and monitoring, rather than for centralized log management, which is essential for alerting and near-real-time analysis.
C) Create an aggregated log sink associated with the production folder that uses a Pub/Sub topic as the destination.
- Reasoning: A log sink with a Pub/Sub topic as the destination can centralize logs and send them to external systems or applications for processing. This option is useful for integrating logs with external systems but may n...
Author: Aarav · Last updated Jul 10, 2026
You are configuring the frontend tier of an application deployed in Google Cloud. The frontend tier is hosted in nginx and deployed using a managed instance group with an Envoy-based external HTTP(S) load balancer in front. The application is deployed entirely within the europe-west2 region, and only serves users ba...
To determine the most cost-effective network tier and load balancing configuration for an application deployed in Google Cloud, let's evaluate the available options based on the specific requirements:
Key Requirements:
- The frontend tier is hosted in nginx and deployed using a managed instance group.
- The application serves users only based in the United Kingdom.
- The application is deployed entirely within the europe-west2 region.
Considerations:
1. Network Tiers: Google Cloud provides two network tiers:
- Premium Tier: This tier uses Google’s global network, providing faster and more reliable routing, but at a higher cost.
- Standard Tier: This tier uses the public internet for routing, which may be less reliable but offers a lower cost.
2. Load Balancer Types:
- Global Load Balancer: Can distribute traffic across multiple regions, providing higher availability and reliability but may involve higher costs.
- Regional Load Balancer: Primarily used to distribute traffic within a specific region, ideal for serving traffic only from a specific region.
Evaluating Each Option:
A) Premium Tier with a global load balancer
- Reasoning: This option uses the Premium Tier, which utilizes Google’s global network, ensuring low-latency and highly reliable routing, but it also comes at a higher cost. The global load balancer is beneficial for distributing traffic across multiple regions, but in this case, since the application serves users only in the United Kingdom (and is deployed within europe-west2), the global nature of the load balancer is unnecessary.
- Rejected: This option is more expensive than necessary since the application only serves users in the UK and doesn't need global distribution. A regional load balancer would suffice.
B) Premium Tier with a regional load balancer
- Reasoning: This option uses the Premium Tier with a regional load balancer. T...
Author: Sofia · Last updated Jul 10, 2026
You recently deployed your application in Google Kubernetes Engine (GKE) and now need to release a new version of the application. You need the ability to instantly roll back to the previous version of the applic...
To determine the best deployment model for releasing a new version of your application in Google Kubernetes Engine (GKE) with the ability to instantly roll back to the previous version in case of issues, let’s evaluate each option.
Key Requirement:
- Instant rollback capability: The ability to quickly revert to the previous version of the application if the new version introduces issues.
- Testability: Ability to test the new version after deployment.
Evaluation of Deployment Models:
A) Perform a rolling deployment, and test your new application after the deployment is complete.
- Reasoning: A rolling deployment gradually replaces old versions of the application with the new version, updating instances one by one. This approach allows for continuous availability, but it doesn't allow for instant rollback. If there’s an issue after the deployment, rolling back requires undoing the changes, which may take time and can be complex. Testing after the deployment completes means you might have already exposed users to potential issues before detecting them.
- Rejected: While rolling deployments provide a smooth update process, they don’t allow for instant rollback and may expose the application to issues during the gradual deployment. This is not ideal if rollback needs to be instantaneous.
B) Perform A/B testing, and test your application periodically after the deployment is complete.
- Reasoning: A/B testing involves serving two versions of the application to different user groups and comparing their performance. This is useful for testing different features or versions but isn't intended for deployment in the context of quick rollback. A/B testing typically runs for longer periods to gather feedback and compare user behavior, and rollback is not instantaneous.
- Rejected: A/B testing isn't suitable for rapid deployment and instant rollback, as it’s designed for experimentation and comparison rather than de...
Author: Sofia2021 · Last updated Jul 10, 2026
You are building and deploying a microservice on Cloud Run for your organization. Your service is used by many applications internally. You are deploying a new release, and you need to test the new version extensively in the sta...
To deploy and test a new release of a microservice on Cloud Run while minimizing user and developer impact, we need to ensure that the new version is tested thoroughly before full deployment to production. We also need to manage traffic effectively to avoid interrupting users or developers.
Let’s evaluate each option based on the requirements:
Key Requirements:
- Testing the new version extensively in staging and production environments.
- Minimizing impact on users and developers during testing and deployment.
- Gradual and controlled release to ensure that there are no disruptions.
Option Breakdown:
A) Deploy the new version of the service to the staging environment. Split the traffic, and allow 1% of traffic through to the latest version. Test the latest version. If the test passes, gradually roll out the latest version to the staging and production environments.
- Reasoning: This option introduces a canary release strategy by splitting the traffic and allowing only 1% to reach the new version initially. After testing, you gradually roll it out to staging and production. This allows for minimal disruption, and if issues arise, you can roll back quickly since only a small amount of traffic is affected.
- Selected: This is a good strategy for minimizing impact while allowing extensive testing in staging and production. It allows for gradual rollout and fast rollbacks, providing a good balance between thorough testing and risk management.
B) Deploy the new version of the service to the staging environment. Split the traffic, and allow 50% of traffic through to the latest version. Test the latest version. If the test passes, send all traffic to the latest version. Repeat for the production environment.
- Reasoning: This option is a more aggressive approach compared to Option A, as it allows 50% of the traffic to go to the new version during testing. While this provides more traffic to the new version for testing, it also increases the risk of user impact if there are any issues with the new version. This approach is not ideal if you want to minimize risk and impact.
- Rejected: The 50% traffic split is more disruptive compared to the 1% split in Option A, and can lead to a higher chance of user impact during testi...
Author: Krishna · Last updated Jul 10, 2026
You work for a global organization and run a service with an availability target of 99% with limited engineering resources.
For the current calendar month, you noticed that the service has 99.5% availability. You must ensure that your service meets the defined availability goals and can react to business changes, including the upcoming launch of new f...
To address your goals of maintaining 99% availability while reducing technical debt, minimizing operational costs, and adapting to new business changes (including upcoming feature launches), let's evaluate each of the options and explain the reasoning behind selecting the most appropriate one.
Option A: Add N+1 redundancy to your service by adding additional compute resources to the service.
- Pros: Adding N+1 redundancy (extra compute resources) ensures that there is always a backup to handle failures and can potentially increase the overall availability of the service.
- Cons: This option incurs additional operational costs. With limited engineering resources, adding redundant compute infrastructure could lead to higher ongoing costs (e.g., maintenance, monitoring) without necessarily addressing the root cause of any availability issues. Moreover, it might not align with efforts to reduce technical debt or eliminate inefficiencies.
- When to use: This option is useful when availability issues are caused by specific single points of failure that can be mitigated by hardware or resource redundancy. However, in this case, with 99.5% availability already achieved, this may not be necessary unless there is a very specific and identified risk of failure in a critical component.
Option B: Identify, measure, and eliminate toil by automating repetitive tasks.
- Pros: Automation of repetitive tasks (toil) reduces manual intervention, increases efficiency, and helps engineering resources focus on more strategic tasks. It directly addresses operational costs and technical debt by eliminating inefficiencies. Additionally, this can free up engineering time to focus on more complex problems or new features.
- Cons: While automation improves long-term efficiency, it does not immediately solve issues directly related to availability, especially in the context of limited engineering resources. However, it would support the goal of reducing technical debt over time.
- When to use: This is beneficial for long-term scalability and addressing technical debt. However, it is not a quick fix for maintaining the current availability target but rather part of an ongoing improvement process.
Option C: Define an error budget for your service level availability and minimize the remaining error budget.
- Pros: The concept of an error budget is central ...
Author: Sophia · Last updated Jul 10, 2026
You are developing the deployment and testing strategies for your CI/CD pipeline in Google Cloud. You must be able to:
* Reduce the complexity of release deployments and minimize the duration of deployment rollbacks.
* Test real production traffic with a gradual increase in the number ...
To meet the requirements of reducing deployment complexity, minimizing rollback durations, and testing with real production traffic in a controlled manner, let's evaluate the options based on their ability to fulfill these needs:
Option A: Recreate deployment and canary testing
- Pros: Recreate deployments are simple to implement and can quickly roll back by redeploying the previous version of the application. This can minimize the rollback duration. Canary testing allows for testing real production traffic with a small percentage of users, gradually increasing the number of affected users.
- Cons: Recreating deployments involve downtime as services are fully replaced, which can introduce risk and complexity if not well managed. Additionally, the recreate process might not be as smooth as other strategies when it comes to minimizing disruption. While canary testing is beneficial for gradual traffic testing, the recreation approach doesn't scale as well in large systems.
- When to use: This is suitable in situations where simplicity is prioritized over continuous service availability, but it may not meet the scalability or minimal disruption requirements for more complex applications.
Option B: Blue/green deployment and canary testing
- Pros: Blue/green deployment involves maintaining two separate environments (blue for the current version and green for the new version). This allows for near-zero downtime and enables easy rollbacks to the previous environment if something goes wrong. Coupled with canary testing, you can slowly direct a portion of real production traffic to the green environment to validate the new version.
- Cons: This method requires more infrastructure (the dual environment) and can be resource-intensive. However, it helps mitigate the risk of failed deployments and offers a controlled approach to testing with production traffic. It might also be less efficient for large-scale applications that are highly dynamic in terms of traffic.
- When to use: Ideal when you want near-zero downtime and have the resources to manage two separate environments. It’s excellent for high-availability services but can be costly in terms of infrastructure.
Option C: Rolling update deployment and A/B testing
- Pros: Rolling updates gradually deploy new versions of the application in stages, reducing downtime and allowing f...
Author: ThunderBear · Last updated Jul 10, 2026
You are creating a CI/CD pipeline to perform Terraform deployments of Google Cloud resources. Your CI/CD tooling is running in Google Kubernetes Engine (GKE) and uses an ephemeral Pod for each pipeline run. You must ensure that the pipelines that run in the Pods have the appropriate Identity and Access Management (IAM) permissions ...
To ensure that your CI/CD pipeline running in Google Kubernetes Engine (GKE) has the appropriate Identity and Access Management (IAM) permissions to perform Terraform deployments, it’s important to follow Google-recommended practices for identity management and authentication. Let's break down each option:
Option A: Create a new Kubernetes service account, and assign the service account to the Pods. Use Workload Identity to authenticate as the Google service account.
- Pros: This is the most recommended approach for managing identities in GKE. Workload Identity allows Kubernetes workloads (like Pods) to securely access Google Cloud resources using Google service accounts. It eliminates the need for handling service account keys (which can be a security risk) and follows best practices for identity management in GKE. The Kubernetes service account is associated with the Google service account, ensuring the Pods can authenticate with Google Cloud without directly managing keys.
- Cons: Slightly more configuration is required initially to set up Workload Identity, but it's a one-time setup that provides significant security and manageability benefits.
- When to use: This is the best option when following Google-recommended practices for identity management, especially in Kubernetes environments where you want secure and manageable access to Google Cloud resources.
Option B: Create a new JSON service account key for the Google service account, store the key as a Kubernetes secret, inject the key into the Pods, and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.
- Pros: This method allows the Pods to authenticate using a service account key, which can work in environments where Workload Identity is not an option or when you need more control over credentials.
- Cons: Storing service account keys as Kubernetes secrets is not recommended because it can introduce security risks. If the secret is leaked or compromised, it could allow unauthorized access to Google Cloud resources. Managing and rotating these keys manually also adds operational overhead.
- When to use: This is less ideal compared to Workload Identity, but might be used in legacy systems or where Workload Identity is not feasible for some reason.
Option C: Create a new Google service account, and assign the appropriate IAM permissions.
- Pros: Creating a service account and assigning the necessary IAM roles is a good practice, as it ensures that the service account has the required permissions to access Google Cloud resources.
- Cons: While this is an essential part of the process, it doesn't address the authentication method (i.e., how the CI/CD pipeline running in GKE will use this service account). Without ...
Author: Ella · Last updated Jul 10, 2026
You are the on-call Site Reliability Engineer for a microservice that is deployed to a Google Kubernetes Engine (GKE) Autopilot cluster. Your company runs an online store that publishes order messages to Pub/Sub, and a microservice receives these messages and updates stock information in the warehousing system. A sales event caused an increase in orders, and the stock information is not being updated quickly enough. This is causing a large number of orders to be accepted for products that are out of stock. You check the metrics for...
In this scenario, your goal is to ensure that stock information in the warehouse system is updated quickly enough to accurately reflect product inventory during a sales event. Let's evaluate the given options in terms of how they address this issue.
Option A: Decrease the acknowledgment deadline on the subscription.
- Pros: Decreasing the acknowledgment deadline in Pub/Sub ensures that messages are acknowledged and processed more quickly, reducing the likelihood of message processing timeouts and message re-delivery.
- Cons: While this can help with processing efficiency, it does not directly address the root cause of the issue—your microservice may still not be able to process the messages quickly enough if there are not enough resources or replicas to handle the increased load. Simply decreasing the acknowledgment deadline might lead to missed messages or overloading the microservice with messages that it can’t process within the reduced timeframe.
- When to use: This can be useful if the delay in message acknowledgment is the bottleneck, but in this case, the underlying issue seems to be insufficient processing capacity, not just the acknowledgment timeout.
Option B: Add a virtual queue to the online store that allows typical traffic levels.
- Pros: Adding a virtual queue could help by buffering traffic during high-demand periods. This allows your microservice to catch up when the system is overloaded.
- Cons: While this could reduce pressure on the microservice, it doesn’t address the root cause of the issue in the long term. Buffering orders might still result in delays, and customers could experience slower processing or worse, out-of-stock products if the warehouse system falls further behind.
- When to use: This could be a temporary workaround during high traffic events, but it doesn't provide a long-term solution to processing messages quickly. It introduces more complexity and isn't directly related to optimizing the microservice's performance.
Option C: Increase the number of Pod replicas.
- Pros: Increasing the number of Pod replicas is an effective way to scale out the...
Author: GlowingTiger · Last updated Jul 10, 2026
Your team deploys applications to three Google Kubernetes Engine (GKE) environments: development, staging, and production. You use GitHub repositories as your source of truth. You need to ensure that the three environments are consistent. You want to follow Google-recommended practices to e...
To ensure that your three GKE environments (development, staging, and production) remain consistent, especially with regard to network policies and a logging DaemonSet, and to follow Google-recommended practices, let’s evaluate the options in terms of configuration management, policy enforcement, and synchronization.
Option A: Use Google Cloud Deploy to deploy the network policies and the DaemonSet. Use Cloud Monitoring to trigger an alert if the network policies and DaemonSet drift from your source in the repository.
- Pros: Google Cloud Deploy is a managed tool for deploying applications and resources in a Kubernetes environment, and Cloud Monitoring can track deviations from expected configurations. This approach could help you track configuration drift.
- Cons: While Cloud Monitoring can help detect drift, it is not a solution for proactively enforcing policies or synchronizing configurations. Monitoring alone does not address the enforcement of policies or continuous synchronization across environments. Furthermore, this approach lacks a strong mechanism to enforce consistency and manage configurations as a source of truth.
- When to use: This option is suitable for tracking deviations after they occur but does not provide a robust mechanism for ensuring configurations are continuously aligned with your source repository.
Option B: Use Google Cloud Deploy to deploy the DaemonSet and use Policy Controller to configure the network policies. Use Cloud Monitoring to detect drifts from the source in the repository and Cloud Functions to correct the drifts.
- Pros: Google Cloud Deploy would manage the DaemonSet deployment, and Policy Controller allows for enforcing policies (e.g., network policies) on your GKE clusters. Cloud Functions can help automatically correct deviations from the expected configuration, making this approach more proactive.
- Cons: Although the setup provides automated correction through Cloud Functions, this adds complexity to the solution and introduces potential latency in the correction process. The reliance on Cloud Functions to automatically fix drift can be error-prone if the drift is too complex to handle automatically.
- When to use: This can be helpful for automatic remediation, but it is a bit more complex and may introduce additional overhead in maintaining Cloud Functions for each configuration change. It may be an over-engineered solution for the problem at hand.
Option C: Use Cloud Build to render and deploy the network policies and the DaemonSet. Set up Config Sync to sync the configurations for the three environments.
- Pros: Cloud...
Author: Chloe · Last updated Jul 10, 2026
You are using Terraform to manage infrastructure as code within a CI/CD pipeline. You notice that multiple copies of the entire infrastructure stack exist in your Google Cloud project, and a new copy is created each time a change to the existing infrastructure is made. You need to optimize your cloud spend by ensuring that...
In this scenario, the key problem is ensuring that only one instance of your infrastructure stack exists at any time in your Google Cloud project. Terraform uses the `terraform.tfstate` file to track the state of infrastructure, and this state must be properly managed to avoid multiple copies of the same stack.
Let’s review the options:
A) Create a new pipeline to delete old infrastructure stacks when they are no longer needed.
- This option suggests deleting old infrastructure stacks when they are no longer needed. While this may help with cleanup, it doesn’t address the underlying issue of state management, which is crucial for ensuring that only one version of the infrastructure exists at any time. Additionally, the state management should be done automatically, and manually deleting stacks can lead to inconsistencies and human error.
- This approach would be risky as it doesn't ensure that Terraform will be aware of the deletion and may cause issues in subsequent runs. It’s not the best solution for this issue.
B) Confirm that the pipeline is storing and retrieving the terraform.tfstate file from Cloud Storage with the Terraform gcs backend.
- This is the recommended approach. By using the Google Cloud Storage (GCS) backend, Terraform can store and lock the state file in a central location. The GCS backend is highly reliable and can store the state across multiple pipeline runs, ensuring that Terraform has a single, accurate view of the infrastructure.
- It allows for state locking to prevent race conditions where multiple pipelines are applying changes at the same time. This setup ensures that only one instance of infrastructure exists at a time, as the state is shared across environments and controlled from a central place.
- This option addresses the root cause of the issue, which is state management.
C) Verify that the pipeline is storing and retrieving the terraform.tfstate file from a source control.
- Storing the `terraform.tfstate` file in source control is not ideal for Terraform workflows. The state file contains sensitive information ...
Author: CrimsonViperX · Last updated Jul 10, 2026
You are creating Cloud Logging sinks to export log entries from Cloud Logging to BigQuery for future analysis. Your organization has a Google Cloud folder named Dev that contains development projects and a folder named Prod that contains production projects. Log entries for development projects must be exported to dev_dataset, and log entries for production projects must be exp...
In this scenario, the goal is to export log entries from Cloud Logging to BigQuery, separating log entries for development (Dev) and production (Prod) projects, while minimizing the number of log sinks created. Additionally, the sinks should apply to future projects within the respective folders.
Let’s break down the options:
A) Create a single aggregated log sink at the organization level.
- This option is not optimal. While creating a log sink at the organization level would apply to all projects, it would not allow for filtering by folder (Dev or Prod) or project. A single aggregated sink would push all logs into a single destination without the necessary separation between Dev and Prod log entries. You would have to rely on filters that are not specific enough (e.g., based on resource labels or log types), making it difficult to separate logs into different datasets (dev_dataset and prod_dataset). This approach does not meet the requirement of creating separate sinks for Dev and Prod logs.
B) Create a log sink in each project.
- This approach would create the most administrative overhead. While this would provide precise control over which logs go into which dataset, it would require managing individual log sinks for each project. For a growing number of projects, especially future ones, this would become cumbersome. Additionally, if you add a new project to either Dev or Prod, you would need to manually create and configure the log sink in that project, making it difficult to scale. This method does not minimize the number of log sinks as required.
C) Create two aggregated log sinks at the organization level, and filter by project ID.
- This is a highly efficient solution. By creating two aggregated log sinks at the organization level (one for Dev and one for Prod), you can filter log entries by project ID (which corresponds to the folder structure) and direct them to the appropriate BigQuery dataset (dev_dataset for Dev projects and prod_dataset for Prod projects). This solution minimizes the number of sinks (only two), and ensures that future projects within the Dev and Prod folders will auto...
Author: Mia · Last updated Jul 10, 2026
Your company runs services by using multiple globally distributed Google Kubernetes Engine (GKE) clusters. Your operations team has set up workload monitoring that uses Prometheus-based tooling for metrics, alerts, and generating dashboards. This setup does not provide a method to view metrics globally across all clust...
In this scenario, the goal is to implement a scalable solution for globally querying metrics across multiple GKE clusters, using Prometheus-based tooling, while minimizing management overhead.
Let’s examine each option:
A) Configure Prometheus cross-service federation for centralized data access.
- Federation in Prometheus allows one Prometheus server to pull metrics from other Prometheus servers, creating a federated setup where a central Prometheus instance can aggregate metrics from multiple clusters.
- Problem: Cross-service federation typically works well for a small number of clusters or for specific use cases, but it can become complex and difficult to manage when dealing with multiple globally distributed clusters. The added complexity of managing federation across many clusters can increase operational overhead, especially as your environment scales.
- Conclusion: While it may work for certain scenarios, cross-service federation isn’t ideal for large-scale, globally distributed environments due to management overhead and the complexity of maintaining multiple Prometheus servers and configurations.
B) Configure workload metrics within Cloud Operations for GKE.
- Cloud Operations for GKE provides a fully managed solution for monitoring Kubernetes clusters, including automatic collection of metrics like CPU, memory, and more. This is tightly integrated with Google Cloud and simplifies monitoring.
- Problem: This option focuses on Google Cloud-native monitoring and may not be the best fit if you are already using Prometheus and want to stick with Prometheus-based tooling. While it reduces overhead, it doesn’t leverage your existing Prometheus setup and is less flexible if you need more advanced, custom metrics and querying capabilities.
- Conclusion: This is a good solution for native GKE monitoring but doesn’t align with the goal of maintaining Prometheus as your tool of choice for metrics and querying.
C) Configure Prometheus hierarchical federation for centralized data access.
- Hierarchical federation is an advanced form of federation where multiple Prometheus servers are arranged in a hierarchical model (e.g., child Prometheus servers sending data to parent servers). This setup works well for multi-cluster environments but comes with a higher level of complexity, especially in a globally distributed setup.
- Problem: While hierarchical federation helps with scalability, it still requires you to manage the ...
Author: StarryEagle42 · Last updated Jul 10, 2026
You need to build a CI/CD pipeline for a containerized application in Google Cloud. Your development team uses a central Git repository for trunk-based development. You want to run all your tests in the pip...
Let’s evaluate the different options in terms of best practices for a CI/CD pipeline for a containerized application, focusing on testing at each stage to improve the quality of the application:
Option A:
1. Install a Git hook to require developers to run unit tests before pushing the code to a central repository.
2. Trigger Cloud Build to build the application container. Deploy the application container to a testing environment, and run integration tests.
3. If the integration tests are successful, deploy the application container to your production environment, and run acceptance tests.
Pros:
- Developers run unit tests before pushing code to the central repository, which helps catch issues early.
- Cloud Build builds the container, runs integration tests, and deploys it to production if everything is successful.
Cons:
- Manual testing before pushing: Relying on developers to manually run unit tests with a Git hook could be error-prone or inconsistent.
- Lack of end-to-end automated testing: Running only integration tests and acceptance tests after deployment to production may not give comprehensive insight into application behavior.
- Not ideal for CI/CD: The approach isn’t fully automated for all stages. For trunk-based development and faster iteration, fully automated testing is preferable.
Option B:
1. Install a Git hook to require developers to run unit tests before pushing the code to a central repository. If all tests are successful, build a container.
2. Trigger Cloud Build to deploy the application container to a testing environment, and run integration tests and acceptance tests.
3. If all tests are successful, tag the code as production ready. Trigger Cloud Build to build and deploy the application container to the production environment.
Pros:
- Developers run unit tests before pushing code.
- Multiple test stages: integration tests and acceptance tests are automated in the pipeline.
- Clear separation between testing and production-ready tagging.
Cons:
- Manual step in the Git hook: Requiring developers to manually run unit tests before pushing can introduce inconsistencies.
- Lack of immediate feedback: The tests are run after deployment, meaning issues may be caught later in the process, potentially delaying the release.
- Overhead of manual tagging: Tagging code as "production-ready" adds a manual step, which could be automated.
Option C:
1. Trigger Cloud Build to build the application container, and run unit tests with the container.
2. If unit tests are successful, deploy the application container to a testing environment, an...
Author: VenomousSerpent42 · Last updated Jul 10, 2026
