GCP Professional Cloud Developer Practice Questions¶
40 scenario-based questions weighted by exam domain.
Exam Domain Breakdown¶
| Domain | Weight | Questions |
|---|---|---|
| Designing highly scalable, available, and reliable cloud-native applications | 26% | 10 |
| Building and testing applications | 20% | 8 |
| Deploying applications | 18% | 7 |
| Integrating Google Cloud services | 22% | 9 |
| Managing deployed applications | 14% | 6 |
Cert page: exams/gcp/cloud-developer/
Domain 1: Designing Highly Scalable, Available, and Reliable Cloud-Native Applications (Questions 1-10)¶
Question 1¶
Scenario: A startup is building a social media application expecting rapid growth from 10,000 to 10 million users. They need a database solution that can handle high read/write throughput, scale horizontally without downtime, and support complex queries for user feeds. Cost optimization is important in early stages. Which database solution is BEST?
A. Cloud Spanner with regional configuration, provisioned with enough nodes for the full 10 million users from day one B. Bigtable for all data storage, with row keys designed around user IDs and timestamps for each feed C. Firestore in Native mode with composite indexes for the feed queries, which scales automatically and has a free tier for early costs D. Cloud SQL with read replicas, moving to larger machine types as the read and write load grows
Answer
**Correct: C** **Why:** Firestore in Native mode provides automatic horizontal scaling, real-time synchronization (useful for social feeds), offline support for mobile apps, and a generous free tier for cost optimization in early stages. Composite indexes support complex queries for feeds. Cloud SQL (D) requires manual scaling and has replication lag. Spanner (A) is powerful but expensive for startups. Bigtable (B) is optimized for time-series, not social app queries. **Key Concept:** [Firestore Overview](https://cloud.google.com/firestore/docs/overview)Question 2¶
Scenario: An e-commerce application needs to process orders with guaranteed exactly-once delivery. Orders must be processed in the sequence received from each customer, but orders from different customers can be processed in parallel. What messaging architecture supports this?
A. Pub/Sub with pull subscriptions, where each worker acknowledges a message after it has processed it B. Direct HTTP calls from the order service to the processor, with retry logic and exponential backoff C. Pub/Sub with ordering keys set to the customer ID and exactly-once delivery enabled on a pull subscription D. Cloud Tasks with named tasks per order, so that a task name deduplicates repeated submissions
Answer
**Correct: C** **Why:** Pub/Sub ordering keys ensure messages with the same key (customer ID) are delivered in order. Exactly-once delivery (through Dataflow or subscriber logic with acknowledgment) ensures no duplicate processing. Different customers have different keys, enabling parallel processing. Pull subscriptions alone (A) don't guarantee ordering. Cloud Tasks (D) is for task queuing, not event streaming. Direct HTTP (B) doesn't guarantee delivery or ordering. **Key Concept:** [Pub/Sub Ordering](https://cloud.google.com/pubsub/docs/ordering)Question 3¶
Scenario: A gaming company needs to store player session data that must persist across server restarts, be accessible globally with low latency, and automatically expire after 24 hours of inactivity. What storage solution meets these requirements?
A. Memorystore for Redis with TTL and replication, using a Standard tier instance in the main region B. Firestore in a multi-region location with a TTL policy on an expiry timestamp field that the app resets on activity C. Cloud SQL with scheduled cleanup jobs that delete the expired sessions every night D. Cloud Storage with lifecycle policies that delete session objects after a set number of days
Answer
**Correct: B** **Why:** Firestore provides global distribution through multi-region instances with strong consistency, automatic TTL policies for document expiration, and persistence across server restarts. It's designed for real-time data that needs global access. Memorystore (A) is regional and primarily for caching. Cloud Storage (D) has high latency for session data. Cloud SQL (C) requires manual cleanup and doesn't scale globally as easily. **Key Concept:** [Firestore TTL Policies](https://cloud.google.com/firestore/docs/ttl)Question 4¶
Scenario: A financial application needs to ensure that a money transfer operation (debit from one account, credit to another) either completes fully or not at all, even across service boundaries in a microservices architecture. How should this be implemented?
A. Implement optimistic locking with retry logic on each account row, using a version column to detect conflicts B. Use a single Cloud SQL database for all services so that one ACID transaction covers the debit and the credit C. Implement the Saga pattern with compensating transactions, orchestrated by Cloud Workflows or Cloud Tasks across the services D. Use distributed transactions with two-phase commit across the services, with a coordinator that holds locks
Answer
**Correct: C** **Why:** The Saga pattern handles distributed transactions by breaking them into local transactions with compensating actions for rollback. Cloud Workflows or Cloud Tasks can orchestrate the saga, ensuring that if the credit fails, the debit is reversed. This maintains loose coupling in microservices. Two-phase commit (D) creates tight coupling and doesn't scale. Single database (B) defeats microservices benefits. Optimistic locking (A) doesn't handle cross-service consistency. **Key Concept:** [Saga Pattern](https://cloud.google.com/learn/what-is-microservices-architecture)Question 5¶
Scenario: An IoT platform receives millions of sensor readings per second from devices worldwide. Data must be ingested, processed for anomalies in real-time, stored for analysis, and made available for dashboards with sub-second latency. What architecture supports these requirements?
A. Devices → Pub/Sub → Dataflow (streaming) → BigQuery + Bigtable → Looker, scaling with the load B. Devices → Pub/Sub → Cloud Storage → BigQuery, loading the stored files in hourly batches C. Devices → Compute Engine → Cloud SQL → custom dashboard, with an instance group that autoscales on CPU D. Devices → Cloud Functions → Cloud SQL → Looker Studio, one invocation per sensor reading
Answer
**Correct: A** **Why:** Pub/Sub handles high-throughput ingestion with global endpoints. Dataflow streaming processes data in real-time for anomaly detection. BigQuery stores data for analytical queries. Bigtable provides low-latency reads for dashboard queries requiring sub-second response. Looker connects to both. Cloud Functions (D) don't scale for millions per second. Batch to Cloud Storage (B) isn't real-time. Compute Engine (C) requires manual scaling. **Key Concept:** [IoT Reference Architecture](https://cloud.google.com/architecture/connected-devices)Question 6¶
Scenario: A media company's video processing pipeline occasionally fails midway through processing. They need to ensure that failed jobs can be retried from where they left off rather than restarting from the beginning. What design pattern addresses this?
A. Full transaction rollback on failure, so the job restarts at its first step B. Synchronous processing with immediate retry, repeating the failed step until it works C. Processing without state management, so that any worker can pick up a failed job and start it again from step one D. Idempotent operations with checkpointing, saving progress to Cloud Storage or Firestore at intervals
Answer
**Correct: D** **Why:** Idempotent operations can be safely retried without side effects. Checkpointing saves progress at intervals (e.g., in Cloud Storage or Firestore), allowing processing to resume from the last checkpoint on retry. This is essential for long-running jobs. Rollback (A) loses all progress. Synchronous retry (B) still restarts from beginning. Stateless processing (C) can't resume from failure points. **Key Concept:** [Designing for Reliability](https://cloud.google.com/architecture/scalable-and-resilient-apps)Question 7¶
Scenario: A ride-sharing application needs to match riders with nearby drivers in real-time. The system must handle 100,000 concurrent location updates per minute and return matches within 100ms. What architecture supports this?
A. Use Cloud Functions with in-memory caching of the latest driver positions inside each function instance B. Use Memorystore for Redis with geospatial commands (GEOADD, GEORADIUS) C. Store locations in BigQuery and compute distances with UDFs D. Store locations in Cloud SQL with spatial queries on an indexed geometry column in the database
Answer
**Correct: B** **Why:** Redis geospatial commands are optimized for this exact use case - GEOADD stores locations, GEORADIUS finds nearby points with sub-millisecond latency. Memorystore for Redis handles high throughput with automatic scaling. Cloud SQL (D) spatial queries have higher latency. BigQuery (C) is for analytics, not real-time queries. Cloud Functions (A) don't share state between instances. **Key Concept:** [Memorystore for Redis](https://cloud.google.com/memorystore/docs/redis/redis-overview)Question 8¶
Scenario: An application needs to call multiple independent external APIs to assemble a response. Each API has variable latency (50-500ms). The application should return as quickly as possible while being resilient to individual API failures. How should this be designed?
A. Call the APIs in parallel with async/await, using timeouts and fallback values for failures B. Call the APIs one after another and aggregate the results at the end C. Use a single API gateway that aggregates all external APIs behind one endpoint and returns their responses D. Cache all API responses indefinitely so requests never wait on an external call
Answer
**Correct: A** **Why:** Parallel calls ensure total latency is the maximum of individual calls, not the sum. Timeouts prevent slow APIs from blocking the response. Fallback values (e.g., cached data, defaults) handle failures gracefully, implementing the circuit breaker pattern. Sequential calls (B) have cumulative latency. API gateway (C) still needs parallel calling logic. Indefinite caching (D) serves stale data. **Key Concept:** [Resilient Applications](https://cloud.google.com/architecture/scalable-and-resilient-apps#use_circuit_breakers)Question 9¶
Scenario: A batch processing system runs nightly jobs that vary dramatically in resource needs - some jobs need 2 CPUs for 10 minutes, others need 64 CPUs for 2 hours. The company wants to minimize costs while ensuring jobs complete on time. What compute solution is BEST?
A. Batch, with a machine type chosen per job type, creating VMs for each job and deleting them when it finishes B. Dataflow with autoscaling, running each nightly job as a pipeline with workers sized per stage C. Dedicated Compute Engine VMs sized for the largest job, left running so each job starts at once D. GKE Standard with a fixed node pool sized for the largest job, running the nightly jobs as Jobs
Answer
**Correct: A** **Why:** Batch is a managed service that creates the Compute Engine VMs each job needs and deletes them afterward, so you pay only while jobs run. A 64-CPU job gets a large machine type, which fits better than Cloud Run jobs (limited to 8 vCPU). This minimizes costs for variable workloads. Dedicated VMs (C) waste resources during light jobs. A fixed GKE node pool (D) pays for idle nodes between jobs. Dataflow (B) is for data processing pipelines, not general batch jobs. **Key Concept:** [Batch](https://docs.cloud.google.com/batch/docs/get-started)Question 10¶
Scenario: A content platform serves static assets (images, videos) to users globally. They need to minimize latency for users worldwide, handle traffic spikes during viral content, and reduce origin server load. What configuration provides this?
A. Cloud Storage with signed URLs only, issued by the application to each user for every asset B. Cloud Storage with a multi-region bucket, which replicates objects across regions inside one large geographic area C. Compute Engine instances in each region serving content from local disks behind a load balancer D. Cloud Storage with Cloud CDN enabled
Answer
**Correct: D** **Why:** Cloud CDN caches content at Google's edge locations worldwide, providing low latency to users regardless of location. It handles traffic spikes through edge caching without impacting origin. Cloud Storage serves as the origin. Multi-regional buckets (B) provide redundancy but not edge caching. Regional Compute Engine (C) doesn't provide global edge presence. Signed URLs (A) provide security but not performance. **Key Concept:** [Cloud CDN](https://cloud.google.com/cdn/docs/overview)Domain 2: Building and Testing Applications (Questions 11-18)¶
Question 11¶
Scenario: A development team wants to run integration tests that require a Cloud SQL database. Tests should be isolated, run in CI/CD, and not affect production data. The database schema is complex with many tables. What is the BEST approach?
A. Use the Auth Proxy with a dedicated test instance, rolling back the transaction after each test B. Use the production database, with test data prefixes to find and delete test rows C. Mock all database interactions in tests, replacing the Cloud SQL client with in-memory stubs everywhere in the codebase D. Create a new Cloud SQL instance for every test run and delete it as soon as the pipeline finishes the run
Answer
**Correct: A** **Why:** A dedicated test instance ensures isolation from production. Cloud SQL Auth Proxy provides secure access from CI/CD. Transaction rollback after each test (or test suites) ensures test isolation without recreating the database. This balances realism with practicality. Production database (B) risks data corruption. Instance per run (D) is slow and expensive. Mocking (C) doesn't test actual database behavior. **Key Concept:** [Cloud SQL Auth Proxy](https://cloud.google.com/sql/docs/mysql/sql-proxy)Question 12¶
Scenario: A team needs to test their Cloud Functions locally before deployment. The functions interact with Pub/Sub, Firestore, and Cloud Storage. How can they set up a local development environment that mimics production?
A. Deploy to a development project and test there after every code change B. Write unit tests that mock all GCP services, replacing each client library call with a stub response C. Run the Functions Framework locally, pointed at the Firestore and Pub/Sub emulators D. Use production services with test data in a separate bucket
Answer
**Correct: C** **Why:** The Functions Framework allows running Cloud Functions locally. Firebase Emulator Suite provides local emulation of Firestore and other Firebase services. Pub/Sub emulator simulates Pub/Sub locally. This enables rapid iteration without cloud costs or affecting other developers. Deploying to dev (A) is slower. Pure mocks (B) don't catch integration issues. Production services (D) risk data issues and incur costs. **Key Concept:** [Functions Framework](https://cloud.google.com/functions/docs/functions-framework)Question 13¶
Scenario: A company wants to ensure their container images don't contain known vulnerabilities before deployment to GKE. They also want to block deployment of images that haven't been scanned. How should this be implemented?
A. Use only official base images from Docker Hub, which are guaranteed to contain no known vulnerabilities B. Scan images after deployment and fix the issues in the next release, with an alert to the team C. Manual security review before deployment, with an engineer checking each image against a vulnerability list D. Enable Container Analysis scanning and Binary Authorization with attestation requirements
Answer
**Correct: D** **Why:** Container Analysis automatically scans images in Artifact Registry for vulnerabilities. Binary Authorization can require attestations (including vulnerability scan results) before images can be deployed to GKE, blocking non-compliant images. This creates a secure software supply chain. Manual review (C) doesn't scale. Official images (A) still need scanning. Post-deployment scanning (B) is reactive, not preventive. **Key Concept:** [Binary Authorization](https://cloud.google.com/binary-authorization/docs/overview)Question 14¶
Scenario: A development team needs to manage application configuration that varies between development, staging, and production environments. Configuration includes feature flags, API endpoints, and database connection strings. What is the BEST approach?
A. Use environment variables injected at deployment time for each environment, with secrets kept in Secret Manager B. Hard-code the configuration, with if/else branches that choose the values for each environment C. Use a single configuration file for all environments and edit it by hand before each deployment D. Store all configuration, including the secrets, in the application repository next to the code
Answer
**Correct: A** **Why:** Environment variables allow the same application code to run in different environments with different configuration. Secret Manager securely stores sensitive values like database credentials, accessible via APIs. This follows the 12-factor app methodology. Hard-coding (B) requires code changes for config changes. Repository storage (D) risks exposing secrets. Single config (C) doesn't support environment-specific needs. **Key Concept:** [Secret Manager](https://cloud.google.com/secret-manager/docs/overview)Question 15¶
Scenario: A team is developing a machine learning model training pipeline. They need to track experiments, compare model versions, and reproduce results. The pipeline uses Agent Platform (formerly Vertex AI) for training. How should they manage this?
A. Use Git branches for each experiment, committing the parameters and metrics to a text file in the branch B. Save model files to Cloud Storage with manual versioning, using a folder name with the date for each run C. Use Experiments on Agent Platform to track runs and compare model versions, with Agent Platform Pipelines to make each run reproducible D. Store experiment results in spreadsheets that the team updates by hand after each training run finishes
Answer
**Correct: C** **Why:** Experiments on Agent Platform tracks metrics, parameters, and artifacts for each training run, enabling comparison. Agent Platform Pipelines captures the entire workflow as code, ensuring reproducibility. Metadata is automatically logged. Spreadsheets (D) are error-prone and don't capture artifacts. Manual versioning (B) doesn't track parameters and metrics. Git branches (A) don't track runtime metrics. **Key Concept:** [Experiments on Agent Platform](https://cloud.google.com/vertex-ai/docs/experiments/intro-vertex-ai-experiments)Question 16¶
Scenario: A microservices application has intermittent failures that are difficult to reproduce. The team needs to understand the flow of requests across services and identify where latency or errors occur. What observability solution helps with this?
A. Application logs in Cloud Logging, searched by timestamp across the services to rebuild each request path B. Cloud Monitoring metrics only, with dashboards of the request rate and error rate for each service C. Use Cloud Trace for distributed tracing across the services, combined with Cloud Profiler for code-level performance D. Custom logging in each service, writing a request ID into a different log format in every team
Answer
**Correct: C** **Why:** Cloud Trace provides distributed tracing, showing request flow across services with latency breakdowns. This reveals which service causes delays or errors. Cloud Profiler identifies code-level performance issues. Together they provide comprehensive observability. Logs (A, D) show individual events but not request flow. Metrics (B) show aggregates but not individual request paths. **Key Concept:** [Cloud Trace](https://cloud.google.com/trace/docs/overview)Question 17¶
Scenario: A developer needs to test error handling code paths, including simulating network failures, service unavailability, and timeout scenarios. The application uses gRPC for service communication. How can they reliably test these scenarios?
A. Use fault injection with Istio or test doubles that simulate failures B. Disable network connectivity during tests, so that every outbound call fails the same way each time C. Wait for random production failures and record how the application behaves when they occur D. Hope the error handling code is correct, and review it once during the next scheduled code audit
Answer
**Correct: A** **Why:** Istio service mesh provides fault injection capabilities - injecting delays, HTTP errors, and gRPC failures between services. Test doubles (mocks/stubs) can also simulate failures. This enables systematic testing of error paths. Waiting for production failures (C) is unreliable and risky. Disabling network (B) is blunt and doesn't test specific failure modes. Hope (D) isn't a testing strategy. **Key Concept:** [Istio Fault Injection](https://istio.io/latest/docs/tasks/traffic-management/fault-injection/)Question 18¶
Scenario: A team wants to automate code review checks including linting, security scanning, and test coverage requirements. Pull requests should not be mergeable until all checks pass. They use GitHub for source control. How should this be implemented?
A. Trust developers to run linting, scans, and tests locally before they push, and note the results in the PR description B. Run checks only after merging, with a nightly job that reverts failing commits C. Manual code review only, with a senior engineer checking style, security, and coverage D. Cloud Build triggers on pull requests, with GitHub branch protection requiring the status checks
Answer
**Correct: D** **Why:** Cloud Build can trigger on GitHub pull requests, running linting, security scans (e.g., with tools like Snyk or Trivy), and tests. GitHub branch protection rules can require these status checks to pass before merging. This automates quality gates. Manual review (C) misses automated checks. Post-merge checks (B) are too late. Trusting local runs (A) isn't enforceable. **Key Concept:** [Cloud Build GitHub Integration](https://cloud.google.com/build/docs/automating-builds/github/build-repos-from-github)Domain 3: Deploying Applications (Questions 19-25)¶
Question 19¶
Scenario: A web application needs to be deployed with zero downtime. The team wants to gradually shift traffic to new versions and automatically roll back if error rates increase. The application runs on GKE. What deployment strategy supports this?
A. Recreate deployment - stop old, start new, accepting a short outage while the new pods start B. Canary deployment with GKE Gateway and Cloud Deploy C. Blue-green deployment with manual DNS switching, moving all traffic once the green side looks healthy D. Deploy directly to production nodes by copying the new build onto each node one at a time
Answer
**Correct: B** **Why:** Canary deployments route a small percentage of traffic to the new version initially. GKE Gateway (or Istio) enables traffic splitting. Cloud Deploy can automate promotion with verification, including automatic rollback based on Cloud Monitoring metrics (error rates). Recreate (A) causes downtime. Manual blue-green (C) doesn't have automatic rollback. Direct deployment (D) risks full outage on failure. **Key Concept:** [Cloud Deploy](https://cloud.google.com/deploy/docs/overview)Question 20¶
Scenario: A company has multiple microservices that need to be deployed together as they have interdependencies. Some services need database migrations to run before deployment. How should this deployment be orchestrated?
A. Use cron jobs to coordinate deployments, scheduling each service a few minutes after the one before B. Use Cloud Deploy with a delivery pipeline defining stages and dependencies C. Deploy services manually in the correct order, following the written runbook for each release D. Deploy all services simultaneously, and let each one retry its connections until its dependencies are up
Answer
**Correct: B** **Why:** Cloud Deploy delivery pipelines can define deployment stages, ordering, and promotion rules. Pre-deploy hooks can run database migrations. Parallel targets can deploy independent services simultaneously while respecting dependencies. Manual deployment (C) is error-prone. Simultaneous deployment (D) ignores dependencies. Cron jobs (A) are timing-based, not dependency-aware. **Key Concept:** [Cloud Deploy Pipelines](https://cloud.google.com/deploy/docs/deploy-app-hooks)Question 21¶
Scenario: A stateless API application needs to scale from 0 to handle sporadic traffic patterns with unpredictable bursts. Cold start time should be minimal. The application is containerized. Which compute option is BEST?
A. GKE Autopilot with HPA and baseline pods B. Cloud Functions for containers, running the image per request C. Compute Engine with managed instance groups, autoscaling on CPU and keeping at least one VM running at all times D. Cloud Run with minimum instances set to 0, scaling on demand, and concurrency tuned per instance
Answer
**Correct: D** **Why:** Cloud Run scales to zero (cost savings during no traffic) and scales up rapidly on demand. Setting minimum instances > 0 eliminates cold starts if needed, but for cost optimization with sporadic traffic, 0 minimum works. Concurrency tuning optimizes instance utilization. GKE Autopilot (A) has higher baseline costs. Compute Engine (C) has slower scaling. Cloud Functions (B) is for event-driven, not HTTP APIs with containers. **Key Concept:** [Cloud Run Autoscaling](https://cloud.google.com/run/docs/configuring/min-instances)Question 22¶
Scenario: A team needs to deploy infrastructure and applications together in a repeatable way. They want to define both GKE clusters and the applications running on them as code. What approach provides this?
A. Separate teams managing infrastructure and applications, each using its own tools and release schedule B. Terraform for infrastructure with Config Connector for Kubernetes resources C. Manual deployment through Cloud Console, following a wiki checklist D. gcloud commands in shell scripts kept in the repository
Answer
**Correct: B** **Why:** Terraform manages GCP infrastructure as code (VPCs, GKE clusters, etc.). Config Connector allows defining GCP resources as Kubernetes manifests, bridging infrastructure and application deployment in a unified GitOps workflow. This enables full infrastructure-as-code. Manual deployment (C) isn't repeatable. Shell scripts (D) lack state management. Separate teams (A) create coordination overhead. **Key Concept:** [Config Connector](https://cloud.google.com/config-connector/docs/overview)Question 23¶
Scenario: An application deployed on Cloud Run needs to access a Cloud SQL database. The connection should be secure without exposing the database to the public internet. How should this be configured?
A. Whitelist Cloud Run's IP range in the Cloud SQL firewall so that only those addresses can connect B. Store credentials in environment variables C. Use Cloud SQL Auth Proxy as a sidecar with private IP and VPC connector D. Enable public IP on Cloud SQL and use SSL, with authorized networks limited to the service's address range
Answer
**Correct: C** **Why:** Cloud Run can use VPC connectors to access resources on private IPs. Cloud SQL Auth Proxy handles authentication and encrypts the connection. This keeps the database on private IP only (no public exposure) while enabling secure access. IP whitelisting (A) requires public IP. Public IP with SSL (D) exposes the database to internet. Credentials in env vars (B) addresses authentication, not network security. **Key Concept:** [Cloud Run VPC Connector](https://cloud.google.com/run/docs/configuring/connecting-vpc)Question 24¶
Scenario: A company requires that all deployments to production are approved by a security team and have passed all tests. They want an audit trail of who approved each deployment. How should this be implemented?
A. Email approval threads from the security team, archived in a shared mailbox for the auditors B. Cloud Deploy with approval requirements for production target and IAM logging C. Shared production credentials for approved deployers, rotated quarterly by the platform team D. Verbal approval before deployment, confirmed in the team chat by the engineer who runs it
Answer
**Correct: B** **Why:** Cloud Deploy supports approval workflows where specific roles must approve before promotion to production. All approvals are logged with IAM identity, providing audit trail. This integrates with existing IAM for authorization. Verbal (D) and email (A) approvals aren't enforceable or auditable. Shared credentials (C) eliminate accountability. **Key Concept:** [Cloud Deploy Approvals](https://cloud.google.com/deploy/docs/promote-release)Question 25¶
Scenario: An organization uses GitOps for deployments - all changes go through Git pull requests. They need the actual state of their GKE clusters to match the desired state in Git automatically. What tool provides this?
A. Helm charts stored in Git, installed by an engineer with helm upgrade whenever a chart changes B. Config Sync with a Git repository as source of truth C. kubectl apply from CI/CD after each merge, using a service account with cluster-admin access D. Cloud Deploy with manual promotion, where an approver moves each release between the targets
Answer
**Correct: B** **Why:** Config Sync continuously synchronizes Kubernetes configurations from a Git repository to GKE clusters. It detects drift and automatically reconciles, ensuring actual state matches desired state in Git. This is the GitOps model. kubectl in CI/CD (C) only applies on pipeline runs, not continuously. Helm (A) is a packaging format, not a sync mechanism. Cloud Deploy (D) requires manual or triggered promotion. **Key Concept:** [Config Sync](https://cloud.google.com/anthos-config-management/docs/config-sync-overview)Domain 4: Integrating Google Cloud Services (Questions 26-34)¶
Question 26¶
Scenario: An application needs to generate PDF reports from templates with customer data. Report generation can take 30-60 seconds. Users should be able to request a report and receive it via email without waiting. What architecture supports this?
A. Client-side PDF generation in the browser B. Cron job generating all reports nightly, so that users download yesterday's version in the morning C. Synchronous Cloud Function that generates and returns the PDF in the HTTP response to the user's request D. Cloud Tasks starting a Cloud Run job, which saves the PDF and emails a link via SendGrid
Answer
**Correct: D** **Why:** Cloud Tasks enables asynchronous processing - the request is accepted immediately while processing happens in the background. Cloud Run jobs can run longer tasks (up to 60 minutes). The completed PDF is stored in Cloud Storage with a signed URL sent via email. This provides good user experience without timeout issues. Synchronous function (C) risks timeouts. Nightly cron (B) doesn't support on-demand. Client-side (A) exposes data and logic. **Key Concept:** [Cloud Tasks](https://cloud.google.com/tasks/docs/dual-overview)Question 27¶
Scenario: A company needs to build a chatbot that can answer questions about their product catalog stored in Firestore. The bot should understand natural language and provide relevant responses. What GCP services support this?
A. Cloud Functions matching keywords in each message B. BigQuery loaded with the catalog C. Build custom NLP models from scratch, training intent and entity classifiers on the team's own data D. Dialogflow CX with Firestore integration for fulfillment
Answer
**Correct: D** **Why:** Dialogflow CX provides natural language understanding, intent detection, and conversation management. Webhook fulfillment can query Firestore to retrieve product information based on detected intents. This combines conversational AI with data retrieval. Custom NLP (C) requires ML expertise and data. Keyword matching (A) doesn't understand natural language. BigQuery (B) is for analytics, not conversational interfaces. **Key Concept:** [Dialogflow CX](https://cloud.google.com/dialogflow/cx/docs/basics)Question 28¶
Scenario: An application needs to process uploaded images by: detecting objects in the image, extracting any text, and storing the results. This should happen automatically when images are uploaded to Cloud Storage. What architecture implements this?
A. Cloud Storage trigger → Cloud Function → Vision AI (objects, OCR) → results in Firestore B. Scheduled batch processing of all images, run every hour by Cloud Scheduler against the bucket C. Client-side image processing before upload D. Manual processing through Cloud Console, with an analyst opening each new image and typing the results
Answer
**Correct: A** **Why:** Cloud Storage Eventarc triggers invoke Cloud Functions on object creation. Vision AI provides object detection and OCR capabilities via simple API calls. Results stored in Firestore enable querying and retrieval. This is event-driven and fully automated. Batch processing (B) adds delay. Manual processing (D) doesn't scale. Client-side (C) is unreliable and slow on mobile devices. **Key Concept:** [Vision AI](https://cloud.google.com/vision/docs/features-list)Question 29¶
Scenario: A retail application needs to provide real-time inventory updates to web and mobile clients. When inventory changes, all connected clients should see the update within 1 second. What approach provides this real-time capability?
A. Server-sent events from Cloud Functions, holding an open HTTP response for each connected client B. Firestore real-time listeners with client SDKs C. WebSocket server on Compute Engine, with a managed instance group behind a load balancer D. Clients poll the API every second and update the screen when the response differs
Answer
**Correct: B** **Why:** Firestore provides built-in real-time synchronization. Client SDKs (web, iOS, Android) can subscribe to document or collection changes, receiving updates pushed from Firestore automatically when data changes. No custom infrastructure needed. Polling (D) is inefficient and delays updates. Custom WebSocket (C) requires infrastructure management. Cloud Functions (A) don't maintain persistent connections. **Key Concept:** [Firestore Real-time Updates](https://cloud.google.com/firestore/docs/query-data/listen)Question 30¶
Scenario: A data processing pipeline needs to read from Pub/Sub, transform records, aggregate by key over time windows, and write to BigQuery. Transformations include calling an external API for enrichment. What service is BEST for this?
A. Cloud Functions triggered by Pub/Sub, keeping a running total per key in a global variable B. Dataflow with Apache Beam SDK C. Cloud Run processing Pub/Sub messages, with a database table holding the window totals D. BigQuery scheduled queries that read the raw table and aggregate it on a fixed interval
Answer
**Correct: B** **Why:** Dataflow with Apache Beam provides streaming data processing with built-in windowing functions, exactly-once processing, and managed autoscaling. Beam supports calling external APIs within transforms. Dataflow handles the complexity of distributed streaming. Cloud Functions (A) don't support windowing. Cloud Run (C) can process messages but lacks built-in streaming primitives. BigQuery (D) can't call external APIs. **Key Concept:** [Dataflow Streaming](https://cloud.google.com/dataflow/docs/concepts/streaming-pipelines)Question 31¶
Scenario: An application needs to schedule a task to run at a specific time in the future (e.g., send a reminder email 24 hours before an appointment). The scheduled time is determined at runtime for each task. What service handles this?
A. Cloud Scheduler with dynamic cron expressions, creating a new job for each appointment B. Store tasks in a database and poll it from a worker that runs every minute C. Cloud Tasks with scheduled delivery time D. Cloud Functions with setTimeout that waits inside the function for 24 hours
Answer
**Correct: C** **Why:** Cloud Tasks allows specifying a scheduleTime for each task, delivering it to the handler at that specific time. This supports dynamic, per-task scheduling determined at runtime. Cloud Scheduler (A) is for recurring schedules, not one-time future execution. setTimeout in Functions (D) doesn't survive function termination. Database polling (B) is inefficient and requires always-on compute. **Key Concept:** [Cloud Tasks Scheduling](https://cloud.google.com/tasks/docs/creating-http-target-tasks)Question 32¶
Scenario: A healthcare application needs to redact PII (names, phone numbers, medical record numbers) from clinical notes before storing them for research. The redaction should be automated and comprehensive. What GCP service provides this?
A. Encrypt documents instead of redaction, using customer-managed keys on the storage bucket B. Regular expressions in code, one for each identifier type C. Cloud Data Loss Prevention (DLP) API with de-identification transforms D. Manual review of all documents by a trained compliance team before they are stored
Answer
**Correct: C** **Why:** Cloud DLP detects sensitive information types including PII and supports de-identification transforms (redaction, masking, tokenization). It handles healthcare-specific identifiers and can process documents at scale. Custom regex (B) misses variations and new patterns. Manual review (D) doesn't scale. Encryption (A) preserves data but doesn't enable research use of redacted content. **Key Concept:** [Cloud DLP De-identification](https://cloud.google.com/dlp/docs/deidentify-sensitive-data)Question 33¶
Scenario: An e-commerce application needs to send transactional emails (order confirmations, shipping updates) reliably. The system should handle high volumes during sales events and provide delivery tracking. How should this be implemented?
A. Cloud Tasks queue feeding a Cloud Run service that calls SendGrid, with delivery-status webhooks sent to Pub/Sub B. Client-side email sending from the customer's browser, using an email API key bundled in the app C. Direct SMTP from application servers, connecting to each recipient's mail server from the VM D. Store emails in a database for batch sending, with a scheduled job that sends them each hour
Answer
**Correct: A** **Why:** Cloud Tasks provides reliable queueing with retry logic. SendGrid (or similar services) handles email delivery at scale with delivery/open/click tracking. Webhooks push delivery status to Pub/Sub for processing and analytics. This is reliable and scalable. Direct SMTP (C) from cloud IPs often gets blocked. Batch sending (D) delays transactional emails. Client-side (B) exposes email infrastructure. **Key Concept:** [Cloud Tasks with External Services](https://cloud.google.com/tasks/docs/creating-http-target-tasks)Question 34¶
Scenario: An application needs to generate custom product recommendations for users based on their browsing history and purchase patterns. The recommendation model should be trained on historical data and serve predictions with low latency. What approach is recommended?
A. Pre-compute all recommendations nightly and store the lists by user in a table for the application B. Rule-based recommendations with hard-coded logic, such as showing the best sellers in the category C. Third-party recommendation SaaS only, with the browsing data exported to the vendor each day D. A managed retail recommendations service, or a custom model trained on Agent Platform (now part of the Gemini Enterprise Agent Platform) and served from an online endpoint
Answer
**Correct: D** **Why:** Google's managed retail recommendations service handles model training and serving. Alternatively, custom models can be trained and deployed to Agent Platform endpoints for low-latency predictions. This leverages ML for personalization. Rule-based (B) doesn't capture complex patterns. Nightly pre-compute (A) misses real-time behavior. Third-party only (C) may not integrate as well with GCP data. **Key Concept:** [Retail recommendations](https://docs.cloud.google.com/retail/docs/overview)Domain 5: Managing Deployed Applications (Questions 35-40)¶
Question 35¶
Scenario: A production application is experiencing intermittent latency spikes. The team needs to identify which service and code path is causing the slowdowns. Standard metrics show overall latency but not the root cause. What tool helps diagnose this?
A. Cloud Monitoring dashboards only B. Application logs searched for slow operations, comparing the timestamps by hand across services C. User feedback surveys sent to customers who reported slow pages, ranked by how many complaints each page received D. Cloud Trace for individual request latency, with Cloud Profiler for code-level analysis
Answer
**Correct: D** **Why:** Cloud Trace captures distributed traces showing latency breakdown across services for individual requests. Filtering for slow traces reveals which service causes delays. Cloud Profiler shows CPU and memory usage by code path, identifying expensive functions. Together they pinpoint the root cause. Dashboards (A) show aggregates. Logs (B) may not have timing info. User feedback (C) is too late. **Key Concept:** [Cloud Profiler](https://cloud.google.com/profiler/docs/about-profiler)Question 36¶
Scenario: A team needs to ensure their API maintains backward compatibility as it evolves. They want to detect breaking changes before deployment. What practice helps ensure API stability?
A. Allow any changes, notifying clients by email B. No API documentation, because it drifts and the code is the source of truth C. API versioning with automated contract tests, such as Protolock for gRPC or OpenAPI diff D. Never change the API, freezing the interface so that every client keeps working exactly as today
Answer
**Correct: C** **Why:** API versioning (v1, v2) allows evolution while maintaining old versions. Automated contract testing detects breaking changes - Protolock for gRPC protobuf schemas, OpenAPI diff for REST APIs. These can be integrated into CI to fail builds with breaking changes. No documentation (B) makes compatibility impossible to track. Any changes (A) breaks clients. Never changing (D) prevents improvement. **Key Concept:** [API Versioning Best Practices](https://google.aip.dev/185)Question 37¶
Scenario: An application running on Cloud Run needs to gracefully handle instance termination during scale-down. In-flight requests should complete, and cleanup tasks should run before shutdown. How is this achieved?
A. Use synchronous processing only B. Handle SIGTERM with graceful shutdown logic and set an appropriate request timeout C. Ignore termination signals, because Cloud Run always waits for all in-flight work to finish D. Disable autoscaling by pinning min and max instances to the same value, so scale-down never occurs
Answer
**Correct: B** **Why:** Cloud Run sends SIGTERM before termination, allowing up to 10 seconds (configurable) for graceful shutdown. Applications should handle SIGTERM, stop accepting new requests, complete in-flight requests, and run cleanup. Setting appropriate request timeout ensures requests complete. Ignoring signals (C) causes abrupt termination. Disabling autoscaling (D) prevents cost optimization. **Key Concept:** [Cloud Run Container Lifecycle](https://cloud.google.com/run/docs/container-contract#container-lifecycle)Question 38¶
Scenario: A team manages multiple microservices across development, staging, and production environments. They need to track which version of each service is deployed in each environment and quickly identify configuration differences. How should this be managed?
A. Check each service individually in the console of each environment, one project at a time B. Spreadsheet tracking deployments, updated by the engineer who runs each release C. Memory and tribal knowledge, with the longest-serving engineer answering questions in chat D. Cloud Deploy release inventory with Cloud Asset Inventory for resource configuration
Answer
**Correct: D** **Why:** Cloud Deploy tracks releases across targets (environments), showing which version is deployed where. Cloud Asset Inventory captures resource configurations across projects, enabling diff analysis between environments. This provides automated, accurate tracking. Spreadsheets (B) become outdated. Tribal knowledge (C) isn't reliable. Checking individually (A) is time-consuming and error-prone. **Key Concept:** [Cloud Asset Inventory](https://cloud.google.com/asset-inventory/docs/overview)Question 39¶
Scenario: An application's error rate suddenly increased after a deployment. The team needs to quickly identify which errors are new (introduced by the deployment) versus existing errors. They use Cloud Error Reporting. How can they make this determination?
A. Use Error Reporting's first-seen timestamps and filter the errors by service version B. Wait for user reports and compare their timestamps C. Read all error logs manually, scrolling back to the time of the deployment D. Assume all errors come from the new deployment, since the rate rose right after it went live
Answer
**Correct: A** **Why:** Cloud Error Reporting groups similar errors and tracks first/last occurrence. Filtering by service version (set via labels) shows errors specific to the new version. "First seen" timestamps after deployment indicate new errors. Errors seen before deployment are pre-existing. This enables rapid triage. Manual log reading (C) is slow. Assuming (D) may cause false positives. User reports (B) are delayed. **Key Concept:** [Error Reporting](https://cloud.google.com/error-reporting/docs/viewing-errors)Question 40¶
Scenario: A production system needs to maintain 99.9% availability SLO. The team needs to track error budget consumption, get alerts when approaching budget exhaustion, and make data-driven decisions about deployments vs. reliability work. What should they implement?
A. Cloud Monitoring SLOs with error budget alerts and burn rate policies B. Manual availability tracking in spreadsheets, updated by the on-call engineer each week C. Ignore SLOs and deploy whenever the team is ready, relying on customer complaints D. Monitor uptime only, with a ping check