Free Access Google.Professional-Cloud-DevOps-Engineer.v2026-09-16.q209 Practice Test (Page 25)

Question 116

Your company runs applications in Google Kubernetes Engine (GKE) that are deployed following a GitOps methodology.
Application developers frequently create cloud resources to support their applications. You want to give developers the ability to manage infrastructure as code, while ensuring that you follow Google-recommended practices. You need to ensure that infrastructure as code reconciles periodically to avoid configuration drift.
What should you do?

A.Install and configure Config Connector in Google Kubernetes Engine (GKE).

B.Configure Cloud Build with a Terraform builder to execute plan and apply commands.

C.Create a Pod resource with a Terraform docker image to execute terraform plan and terraform apply commands.

D.Create a Job resource with a Terraform docker image to execute terraforrm plan and terraform apply commands.

Correct Answer: A

Explanation
The best option to give developers the ability to manage infrastructure as code, while ensuring that you follow Google-recommended practices, is to install and configure Config Connector in Google Kubernetes Engine (GKE).
Config Connector is a Kubernetes add-on that allows you to manage Google Cloud resources through Kubernetes. You can use Config Connector to create, update, and delete Google Cloud resources using Kubernetes manifests. Config Connector also reconciles the state of the Google Cloud resources with the desired state defined in the manifests, ensuring that there is no configuration drift1.
Config Connector follows the GitOps methodology, as it allows you to store your infrastructure configuration in a Git repository, and use tools such as Anthos Config Management or Cloud Source Repositories to sync the configuration to your GKE cluster. This way, you can use Git as the source of truth for your infrastructure, and enable reviewable and version-controlled workflows2.
Config Connector can be installed and configured in GKE using either the Google Cloud Console or the gcloud command-line tool. You need to enable the Config Connector add-on for your GKE cluster, and create a Google Cloud service account with the necessary permissions to manage the Google Cloud resources. You also need to create a Kubernetes namespace for each Google Cloud project that you want to manage with Config Connector3.
By using Config Connector in GKE, you can give developers the ability to manage infrastructure as code, while ensuring that you follow Google-recommended practices. You can also benefit from the features and advantages of Kubernetes, such as declarative configuration, observability, and portability4.
References:
1: Overview | Artifact Registry Documentation | Google Cloud
2: Deploy Anthos on GKE with Terraform part 1: GitOps with Config Sync | Google Cloud Blog
3: Installing Config Connector | Config Connector Documentation | Google Cloud
4: Why use Config Connector? | Config Connector Documentation | Google Cloud

Question 117

Your application artifacts are being built and deployed via a CI/CD pipeline. You want the CI/CD pipeline to securely access application secrets. You also want to more easily rotate secrets in case of a security breach.
What should you do?

A.Store secrets in a separate configuration file on Git. Provide select developers with access to the configuration file.

B.Encrypt the secrets and store them in the source code repository. Store a decryption key in a separate repository and grant your pipeline access to it.

C.Store secrets in Cloud Storage encrypted with a key from Cloud KMS. Provide the CI/CD pipeline with access to Cloud KMS via IAM.

D.Prompt developers for secrets at build time. Instruct developers to not store secrets at rest.

Question 118

You are running a web application that connects to an AlloyDB cluster by using a private IP address in your default VPC. You need to run a database schema migration in your CI/CD pipeline by using Cloud Build before deploying a new version of your application. You want to follow Google-recommended security practices. What should you do?

A.Set up a Cloud Build private pool to access the database through a static external IP address. Configure the database to only allow connections from this IP address. Execute the schema migration script in the private pool.

B.Create a service account that has permission to access the database. Configure Cloud Build to use this service account and execute the schema migration script in a private pool.

C.Add the database username and password to Secret Manager. When running the schema migration script, retrieve the username and password from Secret Manager.

D.Add the database username and encrypted password to the application configuration file. Use these credentials in Cloud Build to execute the schema migration script.

Question 119

Your organization wants to collect system logs that will be used to generate dashboards in Cloud Operations for their Google Cloud project. You need to configure all current and future Compute Engine instances to collect the system logs and you must ensure that the Ops Agent remains up to date. What should you do?

A.Use the gcloud CLI to install the Ops Agent on each VM listed in the Cloud Asset Inventory

B.Select all VMs with an Agent status of Not detected on the Cloud Operations VMs dashboard Then select Install agents

C.Use the gcloud CLI to create an Agent Policy.

D.Install the Ops Agent on the Compute Engine image by using a startup script

Question 120

You support a service with a well-defined Service Level Objective (SLO). Over the previous 6 months, your service has consistently met its SLO and customer satisfaction has been consistently high. Most of your service's operations tasks are automated and few repetitive tasks occur frequently. You want to optimize the balance between reliability and deployment velocity while following site reliability engineering best practices.
What should you do? (Choose two.)

A.Make the service's SLO more strict.

B.Increase the service's deployment velocity and/or risk.

C.Shift engineering time to other services that need more reliability.

D.Get the product team to prioritize reliability work over new features.

E.Change the implementation of your Service Level Indicators (SLIs) to increase coverage.

Other Version: 983Google.Professional-Cloud-DevOps-Engineer.v2026-03-30.q189; 2958Google.Professional-Cloud-DevOps-Engineer.v2025-09-27.q141; 1261Google.Professional-Cloud-DevOps-Engineer.v2023-01-21.q29; 2522Google.Professional-Cloud-DevOps-Engineer.v2022-06-30.q61; 2690Google.Professional-Cloud-DevOps-Engineer.v2022-04-13.q62; 65Google.Pass4surecert.Professional-Cloud-DevOps-Engineer.v2021-09-22.by.horace.37q.pdf

Latest Upload: 189Google.Professional-Cloud-DevOps-Engineer.v2026-09-16.q209; 154AAPC.CPC.v2026-09-16.q132; 116HP.HPE0-J82.v2026-09-16.q26; 185F5.303.v2026-09-16.q147; 170PaloAltoNetworks.NGFW-Engineer.v2026-09-16.q105; 127Workday.Workday-Pro-Recruiting.v2026-09-15.q19; 141ACAMS.CAMS-FCI.v2026-09-15.q36; 157VMware.250-614.v2026-09-15.q42; 185IAPP.CIPM.v2026-09-15.q217; 171VMware.2V0-13.25.v2026-09-14.q122

Question 116

Question 117

Question 118

Question 119

Question 120

Download PDF File