Professional Cloud DevOps Engineer Free Sample Questions

This is the most secure and tamper-resistant solution. Binary Authorization is a service specifically designed to enforce deployment-time policies on GKE. By creating a cryptographic attestation (a signature proving the image passed all checks) in a secure build environment and requiring that attestation in the GKE cluster's policy, you create a strong, auditable link. This enforcement happens at the GKE control plane level and cannot be easily bypassed, even by project owners, without modifying the Binary Authorization policy itself, which can be tightly controlled.

For a user journey that depends on multiple components in series, the overall availability is the product of the individual component availabilities. Each component represents a potential point of failure for the entire transaction. Therefore, the composite SLO is calculated by multiplying the individual SLOs: 0.9995 * 0.999 * 0.9999 ≈ 0.9984, or 99.84%. This demonstrates that serial dependencies decrease overall reliability.

GKE uses a managed Fluentd DaemonSet as its default logging agent on each node. When a user deploys another log-forwarding DaemonSet, especially one that also tries to read from standard log locations like /var/log, it can create resource contention or configuration conflicts. The most common issue is that the custom agent 'steals' the log files or interferes with the default agent's ability to read them, effectively stopping the flow of logs to Cloud Logging for that entire node.

Config Connector is specifically designed for this use case. It is a Kubernetes addon that allows you to manage GCP resources (like Pub/Sub topics, Cloud SQL instances, etc.) as Kubernetes Custom Resource Definitions (CRDs). This enables teams familiar with kubectl and YAML manifests to use the same tools and workflows to manage both their applications and their underlying cloud infrastructure, fitting their existing skillset perfectly.

While Cloud Trace is excellent for inter-service latency, Cloud Profiler is crucial for intra-service latency. If a trace shows a specific service is slow, Profiler is the next step to pinpoint the exact function or code path within that service causing high CPU usage or lock contention, which are common causes of latency.

Cloud Trace is the primary tool for understanding latency in a distributed microservices architecture. By analyzing the trace waterfall for a slow request, you can visually identify which service-to-service call is taking the longest time, immediately narrowing down the scope of the investigation.

Cloud Storage is the recommended and standard backend for Terraform on GCP. When configured as a backend, it stores the state file centrally. Crucially, the GCS backend for Terraform natively supports state locking by creating a lock object in the bucket while an operation is in progress. This prevents other users from running terraform apply concurrently, thus avoiding state file corruption and conflicts.

This statement is false. An error budget is derived from the Service Level Objective (SLO), which is an internal reliability target. It is not directly tied to the Service Level Agreement (SLA), which is an external, often legally binding, contract with customers. The SLO is typically stricter than the SLA to provide a buffer. The error budget is the amount of acceptable 'unreliability' (100% - SLO) that can be 'spent' on new releases, maintenance, or unavoidable failures without alerting engineers, whereas violating an SLA has financial or contractual consequences.

This approach is the most cost-effective. A log sink forwards logs to a destination like BigQuery before they are processed for exclusion. This means all logs, including debug logs, are sent to BigQuery for cheap, long-term storage and powerful analytical querying. The exclusion filter then prevents the expensive debug logs from being ingested and stored in the standard Cloud Logging buckets, which are optimized for real-time access and have higher storage costs. This meets both requirements efficiently.

This role grants the necessary permissions (artifactregistry.repositories.uploadArtifacts) to push the newly built container image to the specified Artifact Registry repository.

This role provides permissions to create and manage Cloud Run revisions, services, and configurations, which is exactly what is needed to deploy the new image.

To deploy a new revision to Cloud Run, the deploying identity (the Cloud Build service account) needs permission to act as the runtime service account of the Cloud Run service (iam.serviceAccounts.actAs). This role grants that permission.

This SRE practice balances cost optimization with reliability. Instead of a 'big bang' change, a canary release allows you to test the recommendation on a small percentage of live traffic. By creating a new instance template and performing a rolling update to a subset of the managed instance group, you can compare the performance SLIs (latency, error rate, CPU utilization) of the new machine type against the existing baseline. If performance degrades, you can easily roll back with minimal user impact.