You are responsible for creating development environments for your company's development team. You want to create environments with identical IDEs for all developers while ensuring that these environments are not exposed to public networks. You need to choose the most cost-effective solution without impacting developer productivity. What should you do?
Correct Answer: A
Comprehensive and Detailed 150 to 200 words of Explanation From Google Cloud DevOps guides documents: According to Google Cloud's documentation on Cloud Workstations, this service is specifically designed to provide managed, secure, and highly customizable development environments. By selecting a private cluster, you ensure that the workstations are not assigned public IP addresses, keeping them entirely off the public internet and satisfying the security requirement. This managed approach is superior to manual Compute Engine setups because it uses container-based configurations to provide identical IDEs and toolsets to every developer, which eliminates environment drift and boosts productivity. Regarding cost-effectiveness, the runningTimeout parameter is a vital mechanism. While idleTimeout is excellent for short-term inactivity, runningTimeout provides a definitive "hard stop" to ensure that workstations do not run indefinitely if a developer forgets to shut down their session at the end of a shift, thereby preventing runaway costs. This aligns with Google's SRE and DevOps best practices for cost optimization and resource management. Choosing Cloud Workstations over manual VM management (Options C and D) reduces the operational overhead of patching and maintaining individual machine images, allowing the team to focus on delivery rather than infrastructure maintenance.
Question 92
Your team is designing a new application for deployment both inside and outside Google Cloud Platform (GCP). You need to collect detailed metrics such as system resource utilization. You want to use centralized GCP services while minimizing the amount of work required to set up this collection system. What should you do?
Correct Answer: A
Explanation The easiest way to collect detailed metrics such as system resource utilization is to import the Stackdriver Profiler package, and configure it to relay function timing data to Stackdriver for further analysis. This way, you can use centralized GCP services without modifying your code or setting up additional tools.
Question 93
You want to share a Cloud Monitoring custom dashboard with a partner team What should you do?
Correct Answer: D
The best option for sharing a Cloud Monitoring custom dashboard with a partner team is to provide the partner team with the dashboard URL to enable the partner team to create a copy of the dashboard. A Cloud Monitoring custom dashboard is a dashboard that allows you to create and customize charts and widgets to display metrics, logs, and traces from your Google Cloud resources and applications. You can share a custom dashboard with a partner team by providing them with the dashboard URL, which is a link that allows them to view the dashboard in their browser. The partner team can then create a copy of the dashboard in their own project by using the Copy Dashboard option. This way, they can access and modify the dashboard without affecting the original one.
Question 94
You are troubleshooting a failed deployment in your CI/CD pipeline. The deployment logs indicate that the application container failed to start due to a missing environment variable. You need to identify the root cause and implement a solution within your CI/CD workflow to prevent this issue from recurring. What should you do?
Correct Answer: B
Question 95
You are configuring your CI/CD pipeline natively on Google Cloud. You want builds in a pre-production Google Kubernetes Engine (GKE) environment to be automatically load-tested before being promoted to the production GKE environment. You need to ensure that only builds that have passed this test are deployed to production. You want to follow Google-recommended practices. How should you configure this pipeline with Binary Authorization?
Correct Answer: B
The correct answer is B, Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity. According to the Google Cloud documentation, Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE) or Cloud Run1. Binary Authorization uses attestations to certify that a specific image has completed a previous stage in the CI/CD pipeline, such as passing a load test2. Attestations are signed by private keys that are associated with attestors, which are entities that verify the attestations3. To follow Google-recommended practices, you should store your private keys in Cloud Key Management Service (Cloud KMS), which is a secure and scalable service for managing cryptographic keys4. You should also use Workload Identity, which is a feature that allows Kubernetes service accounts to act as Google service accounts, to authenticate to Cloud KMS and sign attestations without having to manage or expose service account keys5. The other options are incorrect because they do not follow Google-recommended practices. Option A and option D require human intervention to sign the attestations, which is not scalable or automated. Option C exposes the service account JSON key as a Kubernetes Secret, which is less secure than using Workload Identity. Reference: Creating an attestor, Creating an attestor. Cloud Key Management Service Documentation, Overview. Attestations overview, Attestations overview. Using Workload Identity with Binary Authorization, Using Workload Identity with Binary Authorization. Binary Authorization, Binary Authorization.
