PREPARING FOR GOOGLE CLOUD CERTIFICATION: CLOUD ARCHITECT CERTIFICATE

Course 7 – Preparing for Your Professional Cloud Architect Journey

Week 1: Introduction to Professional Cloud Architect Certification

Coursera Study Guide

Click to Enroll in Coursera Google Cloud Architect Certificate

CONTENT

Welcome to Preparing for the Professional Cloud Architect Journey.

Learning Objectives

  • Describe the purpose and benefits of the PCA certification.
  • Explain the certification process.
  • Identify considerations involved in designing solution infrastructure that meets business and technical requirements.
  • Describe options for designing network, storage, and compute resources leveraging Google Cloud.
  • Explain the elements of a migration plan.
  • Recognize the potential for future solution improvements.
  • Determine the skills you need to develop in order to design and plan solution architecture leveraging Google Cloud.
  • Identify considerations involved in configuring network topologies, individual storage systems, and compute systems.
  • Determine the skills you need to develop in order to manage and provision solution infrastructure.
  • Explain recommended design practices to ensure security across a cloud solution.
  • Recognize aspects of designing for compliance.
  • Determine the skills you need to develop in order to apply Google’s recommended approach to designing for security and compliance.
  • Describe the technical and business processes involved in solution production.
  • Identify ways to optimize processes and develop procedures to ensure reliability of solutions in production.
  • Determine the skills you need to develop to optimize technical and business processes involved in producing a cloud solution.
  • Describe best practices for development and operations teams to ensure successful solution deployment.
  • Explain methods to interact with Google Cloud programmatically.
  • Explain methodologies for managing configuration and code updates and tools available for monitoring and analyzing KPIs.
  • Create a personalized study plan.
  • Review next steps.

DIAGNOSTIC QUESTIONS 1

1. Cymbal Direct drones continuously send data during deliveries. You need to process and analyze the incoming telemetry data. After processing, the data should be retained, but it will only be accessed once every month or two. Your CIO has issued a directive to incorporate managed services wherever possible. You want a cost-effective solution to process the incoming streams of data. What should you do?

  • Ingest data with IoT Core, process it with Dataprep, and store it in a Coldline Cloud Storage bucket.
  • Ingest data with IoT Core, and then publish to Pub/Sub. Use Dataflow to process the data, and store it in a Nearline Cloud Storage bucket. (CORRECT)
  • Ingest data with IoT Core, and then publish to Pub/Sub. Use BigQuery to process the data, and store it in a Standard Cloud Storage bucket.
  • Ingest data with IoT Core, and then store it in BigQuery.

Correct: Dataflow is a fully managed service that can be used to process both streams and batches of data. Nearline is a good fit because the data could be accessed every month.

2. Customers need to have a good experience when accessing your web application so they will continue to use your service. You want to define key performance indicators (KPIs) to establish a service level objective (SLO). Which KPI could you use?

  • Eighty-five percent of customers are satisfied users
  • Eighty-five percent of requests succeed when aggregated over 1 minute (CORRECT)
  • Low latency for > 85% of requests when aggregated over 1 minute
  • Eighty-five percent of requests are successful

Correct: This is specific, and you can reasonably expect to meet this KPI.

3. Cymbal Direct developers have written a new application. Based on initial usage estimates, you decide to run the application on Compute Engine instances with 15 Gb of RAM and 4 CPUs. These instances store persistent data locally. After the application runs for several months, historical data indicates that the application requires 30 Gb of RAM. Cymbal Direct management wants you to make adjustments that will minimize costs. What should you do?

  • Stop the instance, and then use the command gcloud compute instances set-machine-type VM_NAME –machine-type e2-standard-8. Start the instance again.
  • Stop the instance, and then use the command gcloud compute instances set-machine-type VM_NAME –machine-type e2-standard-8. Set the instance’s metadata to: preemptible: true. Start the instance again.
  • Stop the instance, and then use the command gcloud compute instances set-machine-type VM_NAME –machine-type 2-custom-4-30720. Start the instance again. (CORRECT)
  • Stop the instance, and then use the command gcloud compute instances set-machine-type VM_NAME –machine-type 2-custom-4-30720. Set the instance’s metadata to: preemptible: true. Start the instance again.

Correct: Custom instances are a good way to optimize costs. You don’t have to pay for resources you don’t need.

4. You are creating a new project. You plan to set up a Dedicated interconnect between two of your data centers in the near future and want to ensure that your resources are only deployed to the same regions where your data centers are located. You need to make sure that you don’t have any overlapping IP addresses that could cause conflicts when you set up the interconnect. You want to use RFC 1918 class B address space. What should you do?

  • Create a new project, leave the default network in place, and then use the default 10.x.x.x network range to create subnets in your desired regions.
  • Create a new project, delete the default VPC network, set up an auto mode VPC network, and then use the default 10.x.x.x network range to create subnets in your desired regions.
  • Create a new project, delete the default VPC network, set up a custom mode VPC network, and then use IP addresses in the 172.16.x.x address range to create subnets in your desired regions. (CORRECT)
  • Create a new project, delete the default VPC network, set up the network in custom mode, and then use IP addresses in the 192.168.x.x address range to create subnets in your desired zones. Use VPC Network Peering to connect the zones in the same region to create regional networks.

Correct: Custom networks give you full control.

5. Cymbal Direct is working with Cymbal Retail, a separate, autonomous division of Cymbal with different staff, networking teams, and data center. Cymbal Direct and Cymbal Retail are not in the same Google Cloud organization. Cymbal Retail needs access to Cymbal Direct’s web application for making bulk orders, but the application will not be available on the public internet. You want to ensure that Cymbal Retail has access to your application with low latency. You also want to avoid egress network charges if possible. What should you do?

  • Verify that the subnet range Cymbal Retail is using doesn’t overlap with Cymbal Direct’s subnet range, and then enable VPC Network Peering for the project. (CORRECT)
  • If Cymbal Retail does not have access to a Google Cloud data center, use Carrier Peering to connect the two networks.
  • Specify Cymbal Direct’s project as the Shared VPC host project, and then configure Cymbal Retail’s project as a service project.
  • Verify that the subnet Cymbal Retail is using has the same IP address range with Cymbal Direct’s subnet range, and then enable VPC Network Peering for the project.

Correct: VPC Peering allows for shared networking between organizations.

6. Cymbal Direct’s employees will use Google Workspace. Your current on-premises network cannot meet the requirements to connect to Google’s public infrastructure. What should you do?

  • Order a Dedicated Interconnect from a Google Cloud partner, and ensure that proper routes are configured.
  • Connect the network to a Google point of presence, and enable Direct Peering.
  • Order a Partner Interconnect from a Google Cloud partner, and ensure that proper routes are configured.
  • Connect the on-premises network to Google’s public infrastructure via a partner that supports Carrier Peering. (CORRECT)

Correct: Carrier Peering allows using a Google partner to connect to Google public infrastructure, such as Workspace or YouTube.

7. Cymbal Direct is evaluating database options to store the analytics data from its experimental drone deliveries. You’re currently using a small cluster of MongoDB NoSQL database servers. You want to move to a managed NoSQL database service with consistent low latency that can scale throughput seamlessly and can handle the petabytes of data you expect after expanding to additional markets. What should you do?

  • Extract the data from MongoDB. Insert the data into Firestore using Datastore mode.
  • Create a Bigtable instance, extract the data from MongoDB, and insert the data into Bigtable. (CORRECT)
  • Extract the data from MongoDB. Insert the data into Firestore using Native mode.
  • Extract the data from MongoDB, and insert the data into BigQuery.

Correct: Bigtable is ideal for IoT, gives consistently sub-10ms latency, and can be used at a petabyte scale.

8. You are working with a client who is using Google Kubernetes Engine (GKE) to migrate applications from a virtual machine–based environment to a microservices-based architecture. Your client has a complex legacy application that stores a significant amount of data on the file system of its VM. You do not want to re-write the application to use an external service to store the file system data. What should you do?

  • In Cloud Shell, create a YAML file defining your Deployment called deployment.yaml. Create a Deployment in GKE by running the command kubectl apply -f deployment.yaml
  • In Cloud Shell, create a YAML file defining your Container called build.yaml. Create a Container in GKE by running the command gcloud builds submit –config build.yaml .
  • In Cloud Shell, create a YAML file defining your StatefulSet called statefulset.yaml. Create a StatefulSet in GKE by running the command kubectl apply -f statefulset.yaml (CORRECT)
  • In Cloud Shell, create a YAML file defining your Pod called pod.yaml. Create a Pod in GKE by running the command kubectl apply -f pod.yaml

Correct: A StatefulSet represents a group of persistent Pods. The YAML file will define a PersistentVolumeClaim (PVC) that allows for an application to retain state. A StatefulSet is commonly used with applications like databases.

9. You are working in a mixed environment of VMs and Kubernetes. Some of your resources are on-premises, and some are in Google Cloud. Using containers as a part of your CI/CD pipeline has sped up releases significantly. You want to start migrating some of those VMs to containers so you can get similar benefits. You want to automate the migration process where possible. What should you do?

  • Manually create a GKE cluster, and then use Migrate for Anthos to set up the cluster, import VMs, and convert them to containers. (CORRECT)
  • Use Migrate for Anthos to automate the creation of Compute Engine instances to import VMs and convert them to containers. (WRONG)
  • Manually create a GKE cluster. Use Cloud Build to import VMs and convert them to containers.
  • Use Migrate for Compute Engine to import VMs and convert them to containers.

Correct: You must initially create a GKE cluster. Then you can use Migrate for Anthos to set up the cluster and import the VMs.

10. Cymbal Direct has created a proof of concept for a social integration service that highlights images of its products from social media. The proof of concept is a monolithic application running on a single SuSE Linux virtual machine (VM). The current version requires increasing the VM’s CPU and RAM in order to scale. You would like to refactor the VM so that you can scale out instead of scaling up. What should you do?

  • Move the existing codebase and VM provisioning scripts to git, and attach external persistent volumes to the VMs.
  • Make sure that the application declares any dependent requirements in a requirements.txt or equivalent statement so that they can be referenced in a startup script. Specify the startup script in a managed instance group template, and use an autoscaling policy.
  • Make sure that the application declares any dependent requirements in a requirements.txt or equivalent statement so that they can be referenced in a startup script, and attach external persistent volumes to the VMs.
  • Use containers instead of VMs, and use a GKE autoscaling deployment. (CORRECT)

Correct: Treating each app as one or more stateless processes means externalizing state to a separate database service. This allows for more concurrent processing.

KNOWLEDGE CHECK 1

1. What could Cymbal Direct use to estimate costs for their Google Cloud environment?

  • Average Compute Instance CPU
  • Cloud Pricing Calculator (CORRECT)
  • KPIs
  • ROI

Correct: The Cloud pricing calculator allows you to estimate the costs for Google Cloud Products and Services.

2. If you have a business requirement to minimize costs, what are two things you could do?

  • Follow Google’s rightsizing recommendations (CORRECT)
  • Cap costs by creating a budget in Google Cloud
  • Do not run instances when they are not being used (CORRECT)
  • Migrate to Kubernetes from VMs
  • Use a managed service

Correct: Google will evaluate your instance’s usage, and make recommendations on how to save money or improve performance by resizing them.

Correct: Only running, and thus paying for, instances when they are needed, is a great way to save costs. Using tools like GKE autoscaling clusters, or managed instance groups are a great way to save money.

DIAGNOSTIC QUESTIONS 2

1. Cymbal Direct must meet compliance requirements. You need to ensure that employees with valid accounts cannot access their VPC network from locations outside of its secure corporate network, including from home. You also want a high degree of visibility into network traffic for auditing and forensics purposes. What should you do?

  • Ensure that all users install Cloud VPN. Enable VPC Flow Logs for the networks you need to monitor.
  • Enable VPC Service Controls, define a network perimeter to restrict access to authorized networks, and enable VPC Flow Logs for the networks you need to monitor. (CORRECT)
  • Enable Identity-Aware Proxy (IAP) to allow users to access services securely. Use Google Cloud’s operations suite to view audit logs for the networks you need to monitor.
  • Enable VPC Service Controls, and use Google Cloud’s operations suite to view audit logs for the networks you need to monitor.

Correct: Enabling VPC Service Controls lets you define a network perimeter. VPC Flow Logs lets you log network-level communication to Compute Engine instances.

2. You are working with a client who has built a secure messaging application. The application is open source and consists of two components. The first component is a web app, written in Go, which is used to register an account and authorize the user’s IP address. The second is an encrypted chat protocol that uses TCP to talk to the backend chat servers running Debian. If the client’s IP address doesn’t match the registered IP address, the application is designed to terminate their session. The number of clients using the service varies greatly based on time of day, and the client wants to be able to easily scale as needed. What should you do?

  • Deploy the web application using the App Engine standard environment with a global external HTTP(S) load balancer and a network endpoint group. Use an unmanaged instance group for the backend chat servers. Use an external network load balancer to load-balance traffic across the backend chat servers.
  • Deploy the web application using the App Engine flexible environment with a global external HTTP(S) load balancer and a network endpoint group. Use an unmanaged instance group for the backend chat servers. Use an external network load balancer to load-balance traffic across the backend chat servers.
  • Deploy the web application using the App Engine standard environment with a global external HTTP(S) load balancer and a network endpoint group. Use a managed instance group for the backend chat servers. Use a global SSL proxy load balancer to load-balance traffic across the backend chat servers.
  • Deploy the web application using the App Engine standard environment with a global external HTTP(S) load balancer and a network endpoint group. Use a managed instance group for the backend chat servers. Use an external network load balancer to load-balance traffic across the backend chat servers. (CORRECT)

Correct: Using App Engine allows for dynamic scaling based on demand, as does a managed instance group. Using an external network load balancer preserves the client’s IP address.

3. Cymbal Direct’s user account management app allows users to delete their accounts whenever they like. Cymbal Direct also has a very generous 60-day return policy for users. The customer service team wants to make sure that they can still refund or replace items for a customer even if the customer’s account has been deleted. What can you do to ensure that the customer service team has access to relevant account information?

  • Temporarily disable the account for 30 days. Export account information to Cloud Storage, and enable lifecycle management to delete the data in 60 days. (CORRECT)
  • Ensure that the user clearly understands that after they delete their account, all their information will also be deleted. Remind them to download a copy of their order history and account information before deleting their account. Have the support agent copy any open or recent orders to a shared spreadsheet.
  • Restore a previous copy of the user information database from a snapshot. Have a database administrator capture needed information about the customer.
  • Disable the account. Export account information to Cloud Storage. Have the customer service team permanently delete the data after 30 days.

Correct: This takes a lazy deletion approach and allows support or administrators to restore data later if necessary.

4. Cymbal Direct wants to create a pipeline to automate the building of new application releases. What sequence of steps should you use?

  • Set up a source code repository. Run unit tests. Check in code. Deploy. Build a Docker container.
  • Check in code. Set up a source code repository. Run unit tests. Deploy. Build a Docker container.
  • Set up a source code repository. Check in code. Run unit tests. Build a Docker container. Deploy. (CORRECT)
  • Run unit tests. Deploy. Build a Docker container. Check in code. Set up a source code repository.

Correct: Each step is dependent on the previous step. These are in the right order.

5. Your existing application runs on Ubuntu Linux VMs in an on-premises hypervisor. You want to deploy the application to Google Cloud with minimal refactoring. What should you do?

  • Set up a Google Kubernetes Engine (GKE) cluster, and then create a deployment with an autoscaler.
  • Isolate the core features that the application provides. Use App Engine to deploy each feature independently as a microservice.
  • Use a Dedicated or Partner Interconnect to connect the on-premises network where your application is running to your VPC: Configure an endpoint for a global external HTTP(S) load balancer that connects to the existing VMs.
  • Write Terraform scripts to deploy the application as Compute Engine instances. (CORRECT)

Correct: Terraform lets you manage how you deploy and manage a variety of services in Google Cloud, such as Compute Engine. You can also use Cloud Deployment Manager for this purpose.

6. Cymbal Direct needs to use a tool to deploy its infrastructure. You want something that allows for repeatable deployment processes, uses a declarative language, and allows parallel deployment. You also want to deploy infrastructure as code on Google Cloud and other cloud providers. What should you do?

  • Automate the deployment with Terraform scripts. (CORRECT)
  • Automate the deployment with Cloud Deployment Manager.
  • Use Google Kubernetes Engine (GKE) to create deployments and manifests for your applications.
  • Develop in Docker containers for portability and ease of deployment.

Correct: Terraform lets you automate and manage resources in multiple clouds

7. Cymbal Direct wants to allow partners to make orders programmatically, without having to speak on the phone with an agent. What should you consider when designing the API?

  • The API backend should be loosely coupled. Clients should not be required to know too many details of the services they use. REST APIs using gRPC should be used for all external APIs.
  • The API backend should be tightly coupled. Clients should know a significant amount about the services they use. REST APIs using gRPC should be used for all external APIs.
  • The API backend should be loosely coupled. Clients should not be required to know too many details of the services they use. For REST APIs, HTTP(S) is the most common protocol. (CORRECT)
  • The API backend should be tightly coupled. Clients should know a significant amount about the services they use. For REST APIs, HTTP(S) is the most common protocol used.

Correct: Loose coupling has several benefits, including maintainability, versioning, and reduced complexity. Clients not knowing the backend systems means that these systems can be more easily replaced or modified, and HTTP(S) is the most common protocol used for external REST APIs.

8. Cymbal Direct wants a layered approach to security when setting up Compute Engine instances. What are some options you could use to make your Compute Engine instances more secure?

  • Use labels to allow traffic only from certain sources and ports. Turn on Secure boot and vTPM.
  • Use labels to allow traffic only from certain sources and ports. Use a Compute Engine service account.
  • Use network tags to allow traffic only from certain sources and ports. Turn on Secure boot and vTPM. (CORRECT)
  • Use network tags to allow traffic only from certain sources and ports. Use a Compute Engine service account.

Correct: You can use network tags with firewall rules to automatically associate instances when they are created. Secure boot and vTPM protect the OS from being compromised.

9. You have deployed your frontend web application in Kubernetes. Based on historical use, you need three pods to handle normal demand. Occasionally your load will roughly double. A load balancer is already in place. How could you configure your environment to efficiently meet that demand?

  • Edit your pod’s configuration file and change the number of replicas to six.
  • Edit your deployment’s configuration file and change the number of replicas to six.
  • Use the “kubectl autoscale” command to change the pod’s maximum number of instances to six.
  • Use the “kubectl autoscale” command to change the deployment’s maximum number of instances to six. (CORRECT)

Correct: This will allow Kubernetes to scale the number of pods automatically, based on a condition like CPU load or requests per second.

10. You need to deploy a load balancer for a web-based application with multiple backends in different regions. You want to direct traffic to the backend closest to the end user, but also to different backends based on the URL the user is accessing. Which of the following could be used to implement this?

  • The request is received by the global external HTTP(S) load balancer. A global forwarding rule sends the request to a target proxy, which checks the URL map and selects the backend service. The backend service sends the request to Compute Engine instance groups in multiple regions. (CORRECT)
  • The request is matched by a URL map and then sent to a global external HTTP(S) load balancer. A global forwarding rule sends the request to a target proxy, which selects a backend service. The backend service sends the request to Compute Engine instance groups in multiple regions.
  • The request is received by the SSL proxy load balancer, which uses a global forwarding rule to check the URL map, then sends the request to a backend service. The request is processed by Compute Engine instance groups in multiple regions.
  • The request is matched by a URL map and then sent to a SSL proxy load balancer. A global forwarding rule sends the request to a target proxy, which selects a backend service and sends the request to Compute Engine instance groups in multiple regions.

Correct: This is the right order of operations.

KNOWLEDGE CHECK 2

1. Which Storage Class should you use for data that is going to be accessed at least once every two weeks?

  • Standard (CORRECT)
  • Nearline
  • Coldline
  • Archive

Correct: Standard is appropriate for frequent use.

2. Which network configuration would ensure low latency for US drone pilots?

  • Only deploy resources to Regions in Europe
  • Only deploy resources to Regions in Asia
  • Only deploy resources to Regions in the US (CORRECT)
  • Deploy resources globally

Correct: Only deploy resources to Regions in the US

DIAGNOSTIC QUESTIONS 3

1. Your client created an Identity and Access Management (IAM) resource hierarchy with Google Cloud when the company was a startup. Your client has grown and now has multiple departments and teams. You want to recommend a resource hierarchy that follows Google-recommended practices. What should you do?

  • Keep all resources in one project, and use a flat resource hierarchy to reduce complexity and simplify management.
  • Keep all resources in one project, but change the resource hierarchy to reflect company organization.
  • Use a flat resource hierarchy and multiple projects with established trust boundaries.
  • Use multiple projects with established trust boundaries, and change the resource hierarchy to reflect company organization. (CORRECT)

Correct: Because the environment has evolved, update the IAM resource hierarchy to reflect the changes. Use projects to group resources that share the same trust boundary.

2. Cymbal Direct’s social media app must run in a separate project from its APIs and web store. You want to use Identity and Access Management (IAM) to ensure a secure environment. How should you set up IAM?

  • Use separate service accounts for each component (social media app, APIs, and web store) with basic roles to grant access.
  • Use one service account for each component (social media app, APIs, and web store) with basic roles to grant access.
  • Use separate service accounts for each component (social media app, APIs, and web store) with predefined or custom roles to grant access. (CORRECT)
  • Use one service account for each component (social media app, APIs, and web store) with predefined or custom roles to grant access.  

Correct: Using separate service accounts for each component allows you to grant only the access needed to each service account with either a predefined or custom role.

3. Michael is the owner/operator of “Zneeks,” a retail shoe store that caters to sneaker aficionados. He regularly works with customers who order small batches of custom shoes. Michael is interested in using Cymbal Direct to manufacture and ship custom batches of shoes to these customers. Reasonably tech-savvy but not a developer, Michael likes using Cymbal Direct’s partner purchase portal but wants the process to be easy. What is an example of a user story that could describe Michael’s persona?

  • As a shoe retailer, Michael wants to send Cymbal Direct custom purchase orders so that batches of custom shoes are sent to his customers. (CORRECT)
  • Michael is a tech-savvy owner/operator of a small business.
  • Zneeks is a retail shoe store that caters to sneaker aficionados.
  • Michael is reasonably tech-savvy but needs Cymbal Direct’s partner purchase portal to be easy

Correct: “As a [type of user], I want to [do something] so that I can [get some benefit]” is the standard format for a user story.

4. Cymbal Direct has an application running on a Compute Engine instance. You need to give the application access to several Google Cloud services. You do not want to keep any credentials on the VM instance itself. What should you do?

  • Create a service account for each of the services the VM needs to access. Associate the service accounts with the Compute Engine instance.
  • Create a service account and assign it the project owner role, which enables access to any needed service.
  • Create a service account for the instance. Use Access scopes to enable access to the required services.
  • Create a service account with one or more predefined or custom roles, which give access to the required services. (CORRECT)

Correct: This gives the flexibility and granularity needed to allow access to multiple services, without giving access to unnecessary services.

5. 1Cymbal Direct wants to use Identity and Access Management (IAM) to allow employees to have access to Google Cloud resources and services based on their job roles. Several employees are project managers and want to have some level of access to see what has been deployed. The security team wants to ensure that securing the environment and managing resources is simple so that it will scale. What approach should you use?

  • Grant access by assigning custom roles to groups. Use multiple groups for better control. Give access as low in the hierarchy as possible to prevent the inheritance of too many abilities from a higher level.
  • Grant access by assigning predefined roles to groups. Use multiple groups for better control. Give access as low in the hierarchy as possible to prevent the inheritance of too many abilities from a higher level. (CORRECT)
  • Give access directly to each individual for more granular control. Give access as low in the hierarchy as possible to prevent the inheritance of too many abilities from a higher level.
  • Grant access by assigning predefined roles to groups. Use multiple groups for better control. Make sure you give out access to all the children in a hierarchy under the level needed, because child resources will not automatically inherit abilities.

Correct: This follows recommended practices regarding organizational policies.

6. You have several Compute Engine instances running NGINX and Tomcat for a web application. In your web server logs, many login failures come from a single IP address, which looks like a brute force attack. How can you block this traffic?

  • Edit the Compute Engine instances running your web application, and enable Google Cloud Armor. Create a Google Cloud Armor policy with a default rule action of “Allow.” Add a new rule that specifies the IP address causing the login failures as the Condition, with an action of “Deny” and a deny status of “403,” and accept the default priority (1000).
  • Ensure that an HTTP(S) load balancer is configured to send traffic to the backend Compute Engine instances running your web server. Create a Google Cloud Armor policy with a default rule action of “Deny.” Add a new rule that specifies the IP address causing the login failures as the Condition, with an action of “Deny” and a deny status of “403,” and accept the default priority (1000). Add the load balancer backend service’s HTTP-backend as the target.
  • Ensure that an HTTP(S) load balancer is configured to send traffic to the backend Compute Engine instances running your web server. Create a Google Cloud Armor policy with a default rule action of “Allow.” Add a new rule that specifies the IP address causing the login failures as the Condition, with an action of “Deny” and a deny status of “403,” and accept the default priority (1000). Add the load balancer backend service’s HTTP-backend as the target. (CORRECT)
  • Ensure that an HTTP(S) load balancer is configured to send traffic to your backend Compute Engine instances running your web server. Create a Google Cloud Armor policy using the instance’s local firewall with a default rule action of “Allow.” Add a new local firewall rule that specifies the IP address causing the login failures as the Condition, with an action of “Deny” and a deny status of “403,” and accept the default priority (1000).

Correct: Configuring a Google Cloud Armor rule to prevent that IP address from accessing the HTTP-backend on the load balancer will prevent access.

7. Cymbal Direct needs to make sure its new social media integration service can’t be accessed directly from the public internet. You want to allow access only through the web frontend store. How can you prevent access to the social media integration service from the outside world, but still allow access to the APIs of social media services?

  • Remove external IP addresses from the VM instances running the social media service and place them in a private VPC behind Cloud NAT. Any SSH connection for management should be done with Identity-Aware Proxy (IAP) or a bastion host (jump box) after allowing SSH access from IAP or a corporate network. (CORRECT)
  • Limit access to the external IP addresses of the VM instances using firewall rules and place them in a private VPC behind Cloud NAT. Any SSH connection for management should be done with Identity-Aware Proxy (IAP) or a bastion host (jump box) after allowing SSH access from IAP or a corporate network.
  • Limit access to the external IP addresses of the VM instances using a firewall rule to block all outbound traffic. Any SSH connection for management should be done with Identity-Aware Proxy (IAP) or a bastion host (jump box) after allowing SSH access from IAP or a corporate network.
  • Remove external IP addresses from the VM instances running the social media service and place them in a private VPC behind Cloud NAT. Any SSH connection for management should be restricted to corporate network IP addresses by Google Cloud Armor.

Correct: Using Cloud NAT will prevent inbound access from the outside world but will allow connecting to social media APIs outside of the VPC. Using IAP or a bastion host allows for management by SSH, but without the complexity of using VPNs for user access.

8. Cymbal Direct is experiencing success using Google Cloud and you want to leverage tools to make your solutions more efficient. Erik, one of the original web developers, currently adds new products to your application manually. Erik has many responsibilities and requires a long lead time to add new products. You need to create an App Engine application to let Cymbal Direct employees add new products instead of waiting for Erik. However, you want to make sure that only authorized employees can use the application. What should you do?

  • Set up Cloud VPN between the corporate network and the Google Cloud project’s VPC network. Allow users to connect to the App Engine instance.
  • Use Google Cloud Armor to restrict access to the corporate network’s external IP address. Configure firewall rules to allow only HTTP(S) access.
  • Create a Google group and add authorized employees to it. Configure Identity-Aware Proxy (IAP) to the App Engine application as a HTTP-resource. Add the group as a principle with the role “Project Owner.”
  • Create a Google group and add authorized employees to it. Configure Identity-Aware Proxy (IAP) to the App Engine application as a HTTP-resource. Add the group as a principle with the role “IAP-secured Web App User.” (CORRECT)

Correct: You could use individual accounts to give out access instead of a group, and by doing so you make access more manageable. Identity-Aware Proxy is a great tool for exactly this kind of issue.

9. You’ve recently created an internal App Engine application for developers in your organization. The application lets developers clone production Cloud SQL databases into a project specifically created to test code and deployments. Your previous process was to export a database to a Cloud Storage bucket, and then import the SQL dump into a legacy on-premises testing environment database with connectivity to Google Cloud via Cloud VPN. Management wants to incentivize using the new process with Cloud SQL for rapid testing and track how frequently rapid testing occurs. How can you ensure that the developers use the new process?

  • Use an ACL on the Cloud Storage bucket. Create a read-only group that only has viewer privileges, and ensure that the developers are in that group.
  • Leave the ACLs on the Cloud Storage bucket as-is. Disable Cloud VPN, and have developers use Identity-Aware Proxy (IAP) to connect. Create an organization policy to enforce public access protection.
  • Use predefined roles to restrict access to what the developers are allowed to do. Create a group for the developers, and associate the group with the Cloud SQL Viewer role. Remove the “cloudsql.instances.export” ability from the role.
  • Create a custom role to restrict access to what developers are allowed to do. Create a group for the developers, and associate the group with your custom role. Ensure that the custom role does not have “cloudsql.instances.export.” (CORRECT)

Correct: In this scenario, using a predefined role is inappropriate because the most appropriate predefined role, Cloud SQL Viewer, contains the cloudsql.instances.export capability, which would allow the database to be exported.

10. Your client is legally required to comply with the Payment Card Industry Data Security Standard (PCI-DSS). The client has formal audits already, but the audits are only done periodically. The client needs to monitor for common violations to meet those requirements more easily. The client does not want to replace audits but wants to engage in continuous compliance and catch violations early. What would you recommend that this client do?

Responses:

  • Enable the Security Command Center (SCC) dashboard, asset discovery, and Security Health Analytics in the Premium tier. Export or view the PCI-DSS Report from the SCC dashboard’s Compliance tab. (CORRECT)
  • Enable the Security Command Center (SCC) dashboard, asset discovery, and Security Health Analytics in the Standard tier. Export or view the PCI-DSS Report from the SCC dashboard’s Compliance tab.
  • Enable the Security Command Center (SCC) dashboard, asset discovery, and Security Health Analytics in the Premium tier. Export or view the PCI-DSS Report from the SCC dashboard’s Vulnerabilities tab.
  • Enable the Security Command Center (SCC) dashboard, asset discovery, and Security Health Analytics in the Standard tier. Export or view the PCI-DSS Report from the SCC dashboard’s Vulnerabilities tab.

Correct: The reports relating to compliance vulnerabilities are on the Compliance tab. To use the Security Health Analytics that scan for common compliance vulnerabilities, you must use the Premium tier.

KNOWLEDGE CHECK 3

1. Cymbal Direct has chosen to use multiple projects for their environment. How do you describe this choice?

  • Unnecessary. Using multiple projects adds little to no benefits.
  • Using multiple projects only adds security benefits.
  • Using multiple projects adds both security and other benefits. (CORRECT)
  • Using multiple projects requires creating separate IAM policies at each project level

Correct: in all but the simplest environments, having multiple projects can be very beneficial. You get security benefits, but also can manage each project independently, with their own resources, policies, and billing.

2. What type of data might be inadvertently picked up by a drone during a delivery?

  • Healthcare data regulated by privacy laws
  • Financial data regulated by banking laws
  • Classified government data
  • Video of private property (CORRECT)

Correct: Video of private property could include potential privacy violations depending on the jurisdiction and what the video is of. For example, the California Consumer Privacy Act could prohibit retaining photos of the customer as proof of delivery

DIAGNOSTIC QUESTIONS 4

1. You are asked to implement a lift and shift operation for Cymbal Direct’s Social Media Highlighting service. You compose a Terraform configuration file to build all the necessary Google Cloud resources. What is the next step in the Terraform workflow for this effort?

  • Commit the configuration file to your software repository.
  • Run terraform plan to verify the contents of the Terraform configuration file.
  • Run terraform apply to deploy the resources described in the configuration file.
  • Run terraform init to download the necessary provider modules. (CORRECT)

Correct: Running init in the directory containing your Terraform configuration file ensures that the correct plugins are loaded for the providers and resources requested.

2. You have implemented a manual CI/CD process for the container services required for the next implementation of the Cymbal Direct’s Drone Delivery project. You want to automate the process. What should you do?

  • Implement and reference a source repository in your Cloud Build configuration file.
  • Implement a build trigger that applies your build configuration when a new software update is committed to Cloud Source Repositories. (CORRECT)
  • Specify the name of your Container Registry in your Cloud Build configuration. Configure and push a manifest file into an environment repository in Cloud Source Repositories.
  • Configure and push a manifest file into an environment repository in Cloud Source Repositories.

Correct: Configuring a build trigger automates the CI/CD process based on when the software is posted to a repository.

3. You have an application implemented on Compute Engine. You want to increase the durability of your application. What should you do?

  • Implement a scheduled snapshot on your Compute Engine instances. (CORRECT)
  • Implement a regional managed instance group.
  • Monitor your application’s usage metrics and implement autoscaling. WRONG
  • Perform health checks on your Compute Engine instances.

Correct: Durability ensures that your data is protected and available. Snapshots are a viable way of backing up your data in Compute Engine.

4. Developers on your team frequently write new versions of the code for one of your applications. You want to automate the build process when updates are pushed to Cloud Source Repositories. What should you do?

  • Implement a Cloud Build configuration file with build steps.
  • Implement a build trigger that references your repository and branch. (CORRECT)
  • Set proper permissions for Cloud Build to access deployment resources.
  • Upload application updates and Cloud Build configuration files to Cloud Source Repositories.

Correct: Cloud Build triggers automate the build process when new files are placed into the name and branch of the repository that you specify.

5. Your development team used Cloud Source Repositories, Cloud Build, and Artifact Registry to successfully implement the build portion of an application’s CI/CD process.. However, the deployment process is erroring out. Initial troubleshooting shows that the runtime environment does not have access to the build images. You need to advise the team on how to resolve the issue. What could cause this problem?

  • The runtime environment does not have permissions to the Artifact Registry in your current project.
  • The runtime environment does not have permissions to Cloud Source Repositories in your current project.
  • The Artifact Registry might be in a different project. (CORRECT)
  • You need to specify the Artifact Registry image by name.

Correct: Permissions must be configured to give the runtime service account permissions to the Artifact Registry in another project.

6. You are implementing a disaster recovery plan for the cloud version of your drone solution. Sending videos to the pilots is crucial from an operational perspective. What design pattern should you choose for this part of your architecture?

  • Hot with a low recovery time objective (RTO) (CORRECT)
  • Warm with a high recovery time objective (RTO)
  • Cold with a low recovery time objective (RTO)
  • Hot with a high recovery time objective (RTO)

Correct: Safety and compliance require your application to have a low RTO, so you need a hot design pattern with minimal downtime.

7. The number of requests received by your application is nearing the maximum specified in your design. You want to limit the number of incoming requests until the system can handle the workload. What design pattern does this situation describe?

  • Applying a circuit breaker (CORRECT)
  • Applying exponential backoff
  • Increasing jitter
  • Applying graceful degradation

Correct: A circuit breaker limits requests based on a threshold that you specify.

8. The pilot subsystem in your Delivery by Drone service is critical to your service. You want to ensure that connections to the pilots can survive a VM outage without affecting connectivity. What should you do?

  • Configure proper startup scripts for your VMs.
  • Deploy a load balancer to distribute traffic across multiple machines.
  • Create persistent disk snapshots.
  • Implement a managed instance group. (CORRECT)        

Correct: Managed instance groups offer scaling and autohealing that automatically replaces the instances that are not responding.

9. Cymbal Direct wants to improve its drone pilot interface. You want to collect feedback on proposed changes from the community of pilots before rolling out updates systemwide. What type of deployment pattern should you implement?

  • You should implement canary testing.
  • You should implement A/B testing. (CORRECT)
  • You should implement a blue/green deployment.
  • You should implement an in-place release.

Correct: A/B testing is a pattern that lets you evaluate new proposed functionality.

10. You want to establish procedures for testing the resilience of the delivery-by-drone solution. How would you simulate a scalability issue?

  • Block access to storage assets in one of your zones.
  • Inject a bad health check for one or more of your resources.
  • Load test your application to see how it responds. (CORRECT)
  • Block access to all resources in a zone.

Correct: Designing for increased customer demand is one way to ensure scalability.

KNOWLEDGE CHECK 4

1. Cymbal Direct needs a database for their next project. They want to meet their business and technical objectives. What should they do?

  • Install MySQL on a Compute engine instance
  • Install CockroachDB on a managed instance group
  • Use a NoSQL database
  • Use a Managed Database Service (CORRECT)

Correct: Cymbal Direct has specified that they want to move to managed services wherever possible.

2. Cymbal Direct has decided to use Cloud Build. Which technical requirement justifies this decision?

  • Securely allow partner integration
  • Allow for streaming of IoT data from drones
  • Ensure that developers can deploy container based workloads (CORRECT)
  • Let partners order directly via API

Correct: Developers can build their container based workloads using Cloud Build.

DIAGNOSTIC QUESTIONS 5

1. Cymbal Direct is working on a social media integration service in Google Cloud. Mahesh is a non-technical manager who wants to ensure that the project doesn’t exceed the budget and responds quickly to unexpected cost increases. You need to set up access and billing for the project. What should you do?

Responses:

  • Assign the predefined Billing Account Administrator role to Mahesh. Create a project budget. Configure billing alerts to be sent to the Billing Administrator. Use resource quotas to cap how many resources can be deployed.
  • Assign the predefined Billing Account Administrator role to Mahesh. Create a project budget. Configure billing alerts to be sent to the Project Owner. Use resource quotas to cap how much money can be spent.
  • Use the predefined Billing Account Administrator role for the Billing Administrator group, and assign Mahesh to the group. Create a project budget. Configure billing alerts to be sent to the Billing Administrator. Use resource quotas to cap how many resources can be deployed. (CORRECT)
  • Use the predefined Billing Account Administrator role for the Billing Administrator group, and assign Mahesh to the group. Create a project budget. Configure billing alerts to be sent to the Billing Account Administrator. Use resource quotas to cap how much money can be spent.

Correct: Use groups with IAM to simplify management. Billing Alerts should be sent to the Billing Administrator. Quotas are based on the number of resources, such as instances or CPU, not budget.

2. Your organization is planning a disaster recovery (DR) strategy. Your stakeholders require a recovery time objective (RTO) of 0 and a recovery point objective (RPO) of 0 for zone outage. They require an RTO of 4 hours and an RPO of 1 hour for a regional outage. Your application consists of a web application and a backend MySQL database. You need the most efficient solution to meet your recovery KPIs. What should you do?

  • Use a global HTTP(S) load balancer. Deploy the web application as Compute Engine managed instance groups (MIG) in two regions, us-west and us-east. Configure the load balancer to use both backends. Use Cloud SQL with high availability (HA) enabled in us-east and a cross-region replica in us-west.
  • Use a global HTTP(S) load balancer. Deploy the web application as Compute Engine managed instance groups (MIG) in two regions, us-west and us-east. Configure the load balancer to the us-east backend. Use Cloud SQL with high availability (HA) enabled in us-east and a cross-region replica in us-west. Manually promote the us-west Cloud SQL instance and change the load balancer backend to us-west. (CORRECT)
  • Use a global HTTP(S) load balancer. Deploy the web application as Compute Engine managed instance groups (MIG) in two regions, us-west and us-east. Configure the load balancer to use both backends. Use Cloud SQL with high availability (HA) enabled in us-east and back up the database every hour to a multi-region Cloud Storage bucket. Restore the data to a Cloud SQL database in us-west if there is a failure.
  • Use a global HTTP(S) load balancer. Deploy the web application as Compute Engine managed instance groups (MIG) in two regions, us-west and us-east. Configure the load balancer to use both backends. Use Cloud SQL with high availability (HA) enabled in us-east and back up the database every hour to a multi-region Cloud Storage bucket. Restore the data to a Cloud SQL database in us-west if there is a failure and change the load balancer backend to us-west.

Correct: This solution ensures you meet RTO and RPO for both a zonal and regional outage. By adding the additional steps to manually change the load balancer and promote the Cloud SQL, you ensure the us-west region only accepts traffic after the database is ready to receive it.

3. Your environment has multiple projects used for development and testing. Each project has a budget, and each developer has a budget. A personal budget overrun can cause a project budget overrun. Several developers are creating resources for testing as part of their CI/CD pipeline but are not deleting these resources after their tests are complete. If the compute resource fails during testing, the test can be run again. You want to reduce costs and notify the developer when a personal budget overrun causes a project budget overrun. What should you do?

  • Configure billing export to BigQuery. Create a Google Cloud budget for each project. Create a group for the developers in each project, and add them to the appropriate group. Create a notification channel for each group. Configure a billing alert to notify the group when their budget is exceeded. Modify the build scripts/pipeline to label all resources with the label “creator” set to the developer’s email address. Use spot (preemptible) instances wherever possible.
  • Configure billing export to BigQuery. Create a Google Cloud budget for each project. Configure a billing alert to notify billing admins and users when their budget is exceeded. Modify the build scripts/pipeline to label all resources with the label “creator” set to the developer’s email address. Use spot (preemptible) instances wherever possible.
  • Configure billing export to BigQuery. Create a Google Cloud budget for each project. Create a Pub/Sub topic for developer-budget-notifications. Create a Cloud Function to notify the developer based on the labels. Modify the build scripts/pipeline to label all resources with the label “creator” set to the developer’s email address. Use spot (preemptible) instances wherever possible. (CORRECT)
  • Configure billing export to BigQuery. Create a Google Cloud budget for each project. Create a Pub/Sub topic for developer-budget-notifications. Create a Cloud Function to notify the developer based on the labels. Modify the build scripts/pipeline to label all resources with the label “creator” set to the developer’s email address. Use spot (preemptible) instances wherever possible. Use Cloud Scheduler to delete resources older than 24 hours in each project.

Correct: You can have billing notifications sent to a Pub/Sub topic that triggers a Cloud Function. The function can then notify the appropriate developer.

4. Your client has adopted a multi-cloud strategy that uses a virtual machine-based infrastructure. The client’s website serves users across the globe. The client needs a single dashboard view to monitor performance in their AWS and Google Cloud environments. Your client previously experienced an extended outage and wants to establish a monthly service level objective (SLO) of no outage longer than an hour. What should you do?

  • In Cloud Monitoring, create an uptime check for the URL your clients will access. Configure it to check from multiple regions. Use the Cloud Monitoring dashboard to view the uptime metrics over time and ensure that the SLO is met. Recommend an SLO of 97% uptime per month.
  • In Cloud Monitoring, create an uptime check for the URL your clients will access. Configure it to check from multiple regions. Use the Cloud Monitoring dashboard to view the uptime metrics over time and ensure that the SLO is met. Recommend an SLO of 97% uptime per day. (CORRECT)
  • Authorize access to your Google Cloud project from AWS with a service account. Install the monitoring agent on AWS EC2 (virtual machines) and Compute Engine instances. Use Cloud Monitoring to create dashboards that use the performance metrics from virtual machines to ensure that the SLO is met.
  • Create a new project to use as an AWS connector project. Authorize access to the project from AWS with a service account. Install the monitoring agent on AWS EC2 (virtual machines) and Compute Engine instances. Use Cloud Monitoring to create dashboards that use the performance metrics from virtual machines to ensure that the SLO is met.

Correct: An SLO of no more than 3% downtime over the course of a day would mean that a downtime of more than 43 minutes would exceed it.

5. Cymbal Direct uses a proprietary service to manage on-call rotation and alerting. The on-call rotation service has an API for integration. Cymbal Direct wants to monitor its environment for service availability and ensure that the correct person is notified. What should you do?

  • Ensure that VPC firewall rules allow access from the IP addresses used by Google Cloud’s uptime-check servers. Create a Pub/Sub topic for alerting as a monitoring notification channel in Google Cloud’s operations suite. Create an uptime check for the appropriate resource’s internal IP address, with an alerting policy set to use the Pub/Sub topic. Create a Cloud Function that subscribes to the Pub/Sub topic to send the alert to the on-call API.
  • Ensure that VPC firewall rules allow access from the IP addresses used by Google Cloud’s uptime-check servers. Create a Pub/Sub topic for alerting as a monitoring notification channel in Google Cloud’s operations suite. Create an uptime check for the appropriate resource’s external IP address, with an alerting policy set to use the Pub/Sub topic. Create a Cloud Function that subscribes to the Pub/Sub topic to send the alert to the on-call API. (CORRECT)
  • Ensure that VPC firewall rules allow access from the on-call API. Create a Cloud Function to send the alert to the on-call API. Add Cloud Functions as a monitoring notification channel in Google Cloud’s operations suite. Create an uptime check for the appropriate resource’s external IP address, with an alerting policy set to use the Cloud Function.
  • Ensure that VPC firewall rules allow access from the IP addresses used by Google Cloud’s uptime-check servers. Add the URL for the on-call rotation API as a monitoring notification channel in Google Cloud’s operations suite. Create an uptime check for the appropriate resource’s internal IP address, with an alerting policy set to use the API.

Correct: Using Pub/Sub as a notification channel gives you flexibility to adapt how notifications are sent.

6. Cymbal Direct releases new versions of its drone delivery software every 1.5 to 2 months. Although most releases are successful, you have experienced three problematic releases that made drone delivery unavailable while software developers rolled back the release. You want to increase the reliability of software releases and prevent similar problems in the future. What should you do?

  • Adopt a “waterfall” development process. Maintain the current release schedule. Ensure that documentation explains how all the features interact. Ensure that the entire application is tested in a staging environment before the release. Ensure that the process to roll back the release is documented. Use Cloud Monitoring, Cloud Logging, and Cloud Alerting to ensure visibility.
  • Adopt a “waterfall” development process. Maintain the current release schedule. Ensure that documentation explains how all the features interact. Automate testing of the application. Ensure that the process to roll back the release is well documented. Use Cloud Monitoring, Cloud Logging, and Cloud Alerting to ensure visibility.
  • Adopt an “agile” development process. Maintain the current release schedule. Automate build processes from a source repository. Automate testing after the build process. Use Cloud Monitoring, Cloud Logging, and Cloud Alerting to ensure visibility. Deploy the previous version if problems are detected and you need to roll back.
  • Adopt an “agile” development process. Reduce the time between releases as much as possible. Automate the build process from a source repository, which includes versioning and self-testing. Use Cloud Monitoring, Cloud Logging, and Cloud Alerting to ensure visibility. Use a canary deployment to detect issues that could cause rollback. (CORRECT)

Correct: A modern CI/CD pipeline lets you release smaller changes more frequently and includes integrated testing. Using a canary deployment can let you detect issues before you deploy your new version at scale.

7. Cymbal Direct’s warehouse and inventory system was written in Java. The system uses a microservices architecture in GKE and is instrumented with Zipkin. Seemingly at random, a request will be 5-10 times slower than others. The development team tried to reproduce the problem in testing, but failed to determine the cause of the issue. What should you do?

  • Create metrics in Cloud Monitoring for your microservices to test whether they are intermittently unavailable or slow to respond to HTTPS requests. Use Cloud Profiler to determine which functions/methods in your application’s code use the most system resources. Use Cloud Trace to identify slow requests and determine which microservices/calls take the most time to respond. (CORRECT)
  • Create metrics in Cloud Monitoring for your microservices to test whether they are intermittently unavailable or slow to respond to HTTPS requests. Use Cloud Trace to determine which functions/methods in your application’s code use the most system resources. Use Cloud Profiler to identify slow requests and determine which microservices/calls take the most time to respond.
  • Use Error Reporting to test whether your microservices are intermittently unavailable or slow to respond to HTTPS requests. Use Cloud Profiler to determine which functions/methods in your application’s code use the most system resources. Use Cloud Trace to identify slow requests and determine which microservices/calls take the most time to respond.
  • Use Error Reporting to test whether your microservices are intermittently unavailable or slow to respond to HTTPS requests. Use Cloud Trace to determine which functions/methods in your application’s code Use the most system resources. Use Cloud Profiler to identify slow requests and determine which microservices/calls take the most time to respond.

Correct: Capturing metrics about the health of your microservices could identify an issue. Cloud Profiler can help find the functions or methods in your code that use unusual amounts of CPU, memory, or other system resources. This might indicate where to look for performance problems. Cloud Trace identifies which requests have the highest latency and narrows the scope to the microservices that cause the problem.

8. You are using Cloud Run to deploy a Flask web application named app.py written in Python. In your testing and staging environments, the application performed as expected. When the application was deployed to production, product search results displayed products that should have been filtered out based on the user’s preferences. The developer believes this performance issue would result from the ‘user.productFilter’ variable either not being set or not being evaluated correctly. You want visibility into what is happening, but also want to minimize user impact, because this is not a critical bug. What should you do?

  • Use ssh to connect to the Compute Engine instance where Cloud Run is running. Run the command ‘python3 -m pdb app.py’ to debug the application.
  • Use ssh to connect to the Compute Engine instance where Cloud Run is running. Use the command ‘pip install google-python-cloud-debugger’ to install Cloud Debugger. Use the ‘gcloud debug’ command to debug the application.
  • Modify the Dockerfile for the Cloud Run application. Change the RUN command to ‘python3 -m pdb /app.py’. Modify the script to import pdb. Deploy to Cloud Run as a canary build.
  • Modify the Dockerfile for the Cloud Run application. Add ‘RUN ‘pip install google-python-cloud-debugger’ to the Dockerfile. Modify the script to import googleclouddebugger. Use ‘gcloud debug’ to debug the application. (CORRECT)

Correct: This approach allows for debugging applications that run in production without disrupting the user.

9. Cymbal Direct has a new social media integration service that pulls images of its products from social media sites and displays them in a gallery of customer images on your online store. You receive an alert from Cloud Monitoring at 3:34 AM on Saturday. The store is still online, but the gallery does not appear. The CPU utilization is 30% higher than expected on the VMs running the service, which causes the managed instance group (MIG) to scale to the maximum number of instances. You verify that the issue is real by checking the site, and verify that it is not CPU-related by checking the incidents timeline. What should you do to resolve the issue?

  • Increase the maximum number of instances in the MIG and verify that this resolves the issue. Ensure that the ticket is annotated with your solution. Create a normal work ticket for the application developer with a link to the incident. Mark the incident as closed.
  • Check the incident documentation or labels to determine the on-call contact. Appoint an incident commander, and open a chat channel, or conference call for emergency response. Investigate and resolve the issue by increasing the maximum number of instances in the MIG, and verify that this resolves the issue. Mark the incident as closed.
  • Increase the maximum number of instances in the MIG and verify that this resolves the issue. Check the incident documentation or labels to determine the on-call contact. Appoint an incident commander, and open a chat channel, or conference call for emergency response. Investigate and resolve the root cause of the issue. Write a blameless post-mortem and identify steps to prevent the issue, to ensure a culture of continuous improvement.
  • Increase the maximum number of instances in the MIG and verify that this resolves the issue. (CORRECT)

Correct: This appropriately responds to the issue by increasing the number of instances and doesn’t require a “heroic effort” by having the developer or response team resolve the issue in the middle of the night.

10. You need to adopt Site Reliability Engineering principles and increase visibility into your environment. You want to minimize management overhead and reduce noise generated by the information being collected. You also want to streamline the process of reacting to analyzing and improving your environment, and to ensure that only trusted container images are deployed to production. What should you do?

  • Adopt Google Cloud’s operations suite to gain visibility into the environment. Use Cloud Trace for distributed tracing, Cloud Logging for logging, and Cloud Monitoring for monitoring, alerting, and dashboards. Only page the on-call contact about novel issues or events that haven’t been seen before. Use GNU Privacy Guard (GPG) to check container image signatures and ensure that only signed containers are deployed.
  • Adopt Google Cloud’s operations suite to gain visibility into the environment. Use Cloud Trace for distributed tracing, Cloud Logging for logging, and Cloud Monitoring for monitoring, alerting, and dashboards. Page the on-call contact when issues that affect resources in the environment are detected. Use GPG to check container image signatures and ensure that only signed containers are deployed.
  • Adopt Google Cloud’s operations suite to gain visibility into the environment. Use Cloud Trace for distributed tracing, Cloud Logging for logging, and Cloud Monitoring for monitoring, alerting, and dashboards. Only page the on-call contact about novel issues or events that haven’t been seen before. Use Binary Authorization to ensure that only signed container images are deployed. (CORRECT)
  • Adopt Google Cloud’s operations suite to gain visibility into the environment. Use Cloud Trace for distributed tracing, Cloud Logging for logging, and Cloud Monitoring for monitoring, alerting, and dashboards. Page the on-call contact when issues that affect resources in the environment are detected. Use Binary Authorization to ensure that only signed container images are deployed.

Correct: Google Cloud’s operations suite is tightly integrated with different components in the suite and other open source tools. It allows for streamlined analysis of issues without requiring additional management overhead to set up and maintain the tools.

KNOWLEDGE CHECK 5

1. How could Cymbal Direct design their code to maximize their savings by running spot (preemptable) instances?

  • Use an interpreted language like python.
  • Create an API for their software.
  • Externalize state. (CORRECT)
  • Use Cloud Monitoring to get performance info.

Correct: By externalizing state it is less likely that data will not be lost if the instance is stopped. This also makes it easier to scale horizontally.

2. How could Cymbal Direct save money for testing/development resources?

  • Have all developers sign up for the free $300 credit.
  • Provision resources only when needed using terraform. (CORRECT)
  • Give all developers the ability to provision resources for themselves.
  • Only use the smallest size compute engine instances.

Correct: Only paying for resources when being used would save money. Terraform would be a good tool to achieve this.

Previous – Course
Google Courses

Subscribe to our site

Get new content delivered directly to your inbox.