Google Cloud Certified Professional Cloud DevOps Engineer (PCDOE) practice questions

Domain coverage 5 domains

• Applying Site Reliability Engineering principles
• Building and implementing CI/CD pipelines
• Implementing service monitoring strategies
• Managing service incidents
• Optimizing service performance and cost

Sample questions 8 of 75 shown

1. Q1 Bootstrapping a Google Cloud organization for DevOps

   Your company runs applications in Google Kubernetes Engine (GKE). Application developers frequently create cloud resources to support their applications. You need to give developers the ability to manage infrastructure as code while adhering to Google-recommended practices. You want to manage infrastructure as code through Kubernetes Custom Resource Definitions (CRDs) and ensure that your chosen setup can be supported by the Google Cloud Support Portal. What should you do?

   1. Configure Cloud Build with a Terraform builder to execute the terraform plan and terraform apply commands.
   2. Install and configure Crossplane in GKE.
   3. Configure a GitHub Action with a Terraform builder to execute the terraform plan and terraform apply commands as part of the pull request process.
   4. Install and configure Config Connector in GKE.

   D. Config Connector manages GCP resources via Kubernetes CRDs as IaC with Google Cloud Support Portal compatibility. Crossplane (B) is open-source, not Google-supported.
2. Q2 Bootstrapping a Google Cloud organization for DevOps

   Your company runs services on Google Cloud. Each team runs their applications in a dedicated project. New teams and projects are created regularly. Your security team requires that all logs are processed by a security information and event management (SIEM) system. The SIEM ingests logs by using Pub/Sub. You must ensure that all existing and future logs are scanned by the SIEM. What should you do?

   1. Create an organization-level aggregated sink with a siem log bucket as the destination. Set an inclusion filter to include all logs.
   2. Create a folder-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each folder.
   3. Create an organization-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs.
   4. Create a project-level logging sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each project.

   C. Organization-level aggregated log sink with Pub/Sub destination captures logs from all current and future projects in one configuration.
3. Q3 Bootstrapping a Google Cloud organization for DevOps

   Your company allows teams to self-manage Google Cloud projects, including project-level Identity and Access Management (IAM). You are concerned that the team responsible for the Shared VPC project might accidentally delete the project, so a lien has been placed on the project. You need to design a solution to restrict Shared VPC project deletion to those with the resourcemanager.projects.updateLiens permission at the organization level. What should you do?

   1. Instruct teams to only perform IAM permission management as code with Terraform.
   2. Enable VPC Service Controls for the container.googleapis.com API service.
   3. Revoke the resourcemanager.projects.updateLiens permission from all users associated with the project.
   4. Enable the compute.restrictXpnProjectLienRemoval organization policy constraint.

   D. compute.restrictXpnProjectLienRemoval org policy prevents Shared VPC project deletion by restricting lien removal to org-level permission holders.
4. Q4 Bootstrapping a Google Cloud organization for DevOps

   Your organization is running multiple Google Kubernetes Engine (GKE) clusters in a project. You need to design a highly-available solution to collect and query both domain-specific workload metrics and GKE default metrics across all clusters, while minimizing operational overhead. What should you do?

   1. Use Prometheus operator to install Prometheus in every cluster and scrape the metrics. Configure remote-write to one central Prometheus. Query the central Prometheus instance.
   2. Enable managed collection on every GKE cluster. Query the metrics in BigQuery.
   3. Use Prometheus operator to install Prometheus in every cluster and scrape the metrics. Ensure that a Thanos sidecar is enabled on every Prometheus instance. Configure Thanos in the central cluster. Query the central Thanos instance.
   4. Enable managed collection on every GKE cluster. Query the metrics in Cloud Monitoring.

   D. GKE Managed Collection sends metrics to Cloud Monitoring for all clusters with zero operational overhead.
5. Q5 Bootstrapping a Google Cloud organization for DevOps

   Your company stores a large volume of infrequently used data in Cloud Storage. The projects in your company's CustomerService folder access Cloud Storage frequently, but store very little data. You want to enable Data Access audit logging across the company to identify data usage patterns. You need to exclude the CustomerService folder projects from Data Access audit logging. What should you do?

   1. Enable Data Access audit logging for Cloud Storage at the organization level, and configure exempted principals to include users of the CustomerService folder.
   2. Enable Data Access audit logging for Cloud Storage at the organization level, with no additional configuration.
   3. Enable Data Access audit logging for Cloud Storage for all projects and folders other than the CustomerService folder.
   4. Enable Data Access audit logging for Cloud Storage for all projects and folders, and configure exempted principals to include users of the CustomerService folder.

   D. Organization-level Data Access audit logging with exempted principals excludes CustomerService folder users from logging.
6. Q6 Bootstrapping a Google Cloud organization for DevOps

   You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?

   1. 1. Create a Google service account.
   2. 1. Create a Google service account.
   3. 1. Create a Google service account.
   4. 1. Create a Google service account.

   C. Workload Identity links Kubernetes SA to Google SA via workloadIdentityUser role, enabling per-pod IAM without managing keys.
7. Q7 Bootstrapping a Google Cloud organization for DevOps

   You work for a healthcare company and regulations require you to create all resources in a United States-based region. You attempted to create a secret in Secret Manager but received the following error message: Constraint constraints/gcp.resourceLocations violated for [orgpolicy:projects/000000] attempting to create a secret in [global] You need to resolve the error while remaining compliant with regulations. What should you do?

   1. Remove the organization policy referenced in the error message.
   2. Create the secret with an automatic replication policy.
   3. Create the secret with a user-managed replication policy.
   4. Add the global region to the organization policy referenced in the error message.

   C. Secret Manager with user-managed replication to a US region satisfies the location org policy constraint. Automatic replication (B) uses 'global', violating the policy.
8. Q8 Bootstrapping a Google Cloud organization for DevOps

   You have a pool of application servers running on Compute Engine. You need to provide a secure solution that requires the least amount of configuration and allows developers to easily access application logs for troubleshooting. How would you implement the solution on GCP?

   1. ג€¢ Deploy the Stackdriver logging agent to the application servers. ג€¢ Give the developers the IAM Logs Viewer role to access Stackdriver and view logs.
   2. ג€¢ Deploy the Stackdriver logging agent to the application servers. ג€¢ Give the developers the IAM Logs Private Logs Viewer role to access Stackdriver and view logs.
   3. ג€¢ Deploy the Stackdriver monitoring agent to the application servers. ג€¢ Give the developers the IAM Monitoring Viewer role to access Stackdriver and view metrics.
   4. ג€¢ Install the gsutil command line tool on your application servers. ג€¢ Write a script using gsutil to upload your application log to a Cloud Storage bucket, and then schedule it to run via cron every 5 minutes. ג€¢ Give the developers the IAM Object Viewer access to view the logs in the specified bucket.

   A. IAP TCP forwarding tunnels RDP to Windows VMs without external IPs, based on identity and context.

Answer all 75 questions with instant feedback →

Reader reviews 153 ratings

• I passed PCDOE on my first try thanks to these practice questions. The unlimited retakes were essential for building confidence.

  ★★★★★ Nicole K.

• My colleague recommended this for PCDOE and I’m glad I listened. Passed on my first go after two weeks of solid study.

  ★★★★★ Logan T.

• Straight to the point. No filler, just good PCDOE practice questions with clear explanations. Exactly what I needed.

  ★★★★★★ Paisley K.

• I was preparing for the PCDOE exam while juggling a newborn at home. The flexibility of this platform was a lifesaver.

  ★★★★★★ Cooper D.

• Ended up buying three different PCDOE prep resources and this was by far the most helpful one. Don’t waste money on others.

  ★★★★★ Penelope W.

• This PCDOE practice test is no joke — questions are challenging but fair. If you can pass these, you’ll pass the real exam.

  ★★★★★★ William C.

Frequently asked questions

Free study resources

Community-verified analysis of 26 questions from real test-taker discussions — 12 deep analyses and 0 FAQs.

More Google exams