Free Access Google.Professional-Cloud-DevOps-Engineer.v2026-09-16.q209 Practice Test (Page 32)

Question 151

You are designing a new Google Cloud organization for a client. Your client is concerned with the risks associated with long-lived credentials created in Google Cloud. You need to design a solution to completely eliminate the risks associated with the use of JSON service account keys while minimizing operational overhead. What should you do?

A.Use custom versions of predefined roles to exclude all iam.serviceAccountKeys. * service account role permissions.

B.Apply the constraints/iam.disableserviceAccountKeycreation constraint to the organization.

C.Apply the constraints/iam. disableServiceAccountKeyUp10ad constraint to the organization.

D.Grant the roles/ iam.serviceAccountKeyAdmin IAM role to organization administrators only.

Correct Answer: B

The correct answer is B. Apply the constraints/iam.disableServiceAccountKeyCreation constraint to the organization.
According to the Google Cloud documentation, the constraints/iam.disableServiceAccountKeyCreation constraint is an organization policy constraint that prevents the creation of user-managed service account keys1.User-managed service account keys are long-lived credentials that can be downloaded as JSON or P12 files and used to authenticate as a service account2.These keys pose severe security risks if they are leaked, stolen, or misused by unauthorized entities34.By applying this constraint to the organization, you can completely eliminate the risks associated with the use of JSON service account keys and enforce a more secure alternative for authentication, such as Workload Identity or short-lived access tokens12. This also minimizes operational overhead by avoiding the need to manage, rotate, or revoke user-managed service account keys.
The other options are incorrect because they do not completely eliminate the risks associated with the use of JSON service account keys. Option A is incorrect because it only restricts the IAM permissions to create, list, get, delete, or sign service account keys, but it does not prevent existing keys from being used or leaked.
Option C is incorrect because it only disables the upload of user-managed service account keys, but it does not prevent the creation or download of such keys. Option D is incorrect because it only limits the IAM role that can create and manage service account keys, but it does not prevent the keys from being distributed or exposed to unauthorized entities.
Reference:
Disable user-managed service account key creation, Disable user-managed service account key creation.
Service accounts, User-managed service accounts.Help keep your Google Cloud service account keys safe, Help keep your Google Cloud service account keys safe.Stop Downloading Google Cloud ServiceAccount Keys!, Stop Downloading Google Cloud Service Account Keys! [Service Account Keys], Service Account Keys. [Disable user-managed service account key upload], Disable user-managed service account key upload.
[Granting roles to service accounts], Granting roles to service accounts.

Question 152

You support a high-traffic web application and want to ensure that the home page loads in a timely manner. As a first step, you decide to implement a Service Level Indicator (SLI) to represent home page request latency with an acceptable page load time set to 100 ms. What is the Google-recommended way of calculating this SLI?

A.Buckelize Ihe request latencies into ranges, and then compute the percentile at 100 ms.

B.Bucketize the request latencies into ranges, and then compute the median and 90th percentiles.

C.Count the number of home page requests that load in under 100 ms, and then divide by the total number of home page requests.

D.Count the number of home page requests that load in under 100 ms. and then divide by the total number of all web application requests.

Question 153

A.Buckelize Ihe request latencies into ranges, and then compute the percentile at 100 ms.

B.Count the number of home page requests that load in under 100 ms. and then divide by the total number of all web application requests.

C.Bucketize the request latencies into ranges, and then compute the median and 90th percentiles.

D.Count the number of home page requests that load in under 100 ms, and then divide by the total number of home page requests.

Question 154

Your company uses a CI/CD pipeline with Cloud Build and Artifact Registry to deploy container images to Google Kubernetes Engine (GKE). Images are tagged with the latest commit hash and promoted to production after successful testing in the development and pre-production environments. A recent production deployment caused the application to fail due to untested integration functionality, requiring a disruptive manual rollback.
During the rollback, you noticed many old and unused container images accumulating in Artifact Registry.
You need to improve rollout and rollback management and clean up the old container images. What should you do?

A.Adopt Cloud Deploy for managing deployments, and schedule a Cloud Build job for container image cleanup.

B.Deploy Cloud Service Mesh across the GKE clusters, and manually clean up Artifact Registry images.

C.Adopt Cloud Deploy for managing deployments, and implement an Artifact Registry cleanup policy.

D.Set up a rollback pipeline in Cloud Build, and implement an Artifact Registry cleanup policy.

Question 155

You need to build a CI/CD pipeline for a containerized application in Google Cloud Your development team uses a central Git repository for trunk-based development You want to run all your tests in the pipeline for any new versions of the application to improve the quality What should you do?

A.1. Install a Git hook to require developers to run unit tests before pushing the code to a central repositoryIf all tests are successful build a container2. Trigger Cloud Build to deploy the application container to a testing environment, and run integrationtests and acceptance tests3. If all tests are successful tag the code as production ready Trigger Cloud Build to build and deploy the application container to the production environment

B.1. Install a Git hook to require developers to run unit tests before pushing the code to a central repository2. Trigger Cloud Build to build the application container Deploy the application container to a testing environment, and run integration tests3. If the integration tests are successful deploy the application container to your production environment. and run acceptance tests

C.1. Trigger Cloud Build to run unit tests when the code is pushed If all unit tests are successful, build and push the application container to a central registry.2. Trigger Cloud Build to deploy the container to a testing environment, and run integration tests and acceptance tests3. If all tests are successful the pipeline deploys the application to the production environment and runs smoke tests

D.1. Trigger Cloud Build to build the application container and run unit tests with the container2. If unit tests are successful, deploy the application container to a testing environment, and run integration tests3. If the integration tests are successful the pipeline deploys the application container to the production environment After that, run acceptance tests

Other Version: 983Google.Professional-Cloud-DevOps-Engineer.v2026-03-30.q189; 2958Google.Professional-Cloud-DevOps-Engineer.v2025-09-27.q141; 1261Google.Professional-Cloud-DevOps-Engineer.v2023-01-21.q29; 2522Google.Professional-Cloud-DevOps-Engineer.v2022-06-30.q61; 2690Google.Professional-Cloud-DevOps-Engineer.v2022-04-13.q62; 65Google.Pass4surecert.Professional-Cloud-DevOps-Engineer.v2021-09-22.by.horace.37q.pdf

Latest Upload: 172Google.Professional-Cloud-DevOps-Engineer.v2026-09-16.q209; 150AAPC.CPC.v2026-09-16.q132; 116HP.HPE0-J82.v2026-09-16.q26; 185F5.303.v2026-09-16.q147; 169PaloAltoNetworks.NGFW-Engineer.v2026-09-16.q105; 127Workday.Workday-Pro-Recruiting.v2026-09-15.q19; 141ACAMS.CAMS-FCI.v2026-09-15.q36; 157VMware.250-614.v2026-09-15.q42; 185IAPP.CIPM.v2026-09-15.q217; 170VMware.2V0-13.25.v2026-09-14.q122

Question 151

Question 152

Question 153

Question 154

Question 155

Download PDF File