Your organization operates multiple Google Kubernetes Engine (GKE) clusters across staging and production environments. All production clusters are enrolled in the Regular release channel to ensure baseline operational stability. Due to strict corporate security policies, your team must ensure that newly published security patches are automatically applied to the control plane and nodes as quickly as possible without waiting for GKE's multi-week qualification period, while still strictly honoring configured maintenance windows and exclusions. Which configuration should you apply to meet these requirements?

Enable accelerated patch auto-upgrades on the production clusters enrolled in the Regular release channel.: What accelerated patch auto-upgrades are Accelerated patch auto-upgrades is a GKE feature designed for clusters enrolled in a release channel (such as Rapid, Regular, or Stable). When a new patch release is introduced to a release channel, GKE initially makes it available for new cluster creation and manual upgrades before qualifying it over a multi-day or multi-week window to become an automatic upgrade target. How it meets the requirements Automated rapid patching: Enabling accelerated patch auto-upgrades instructs GKE to automatically upgrade the cluster to newly available patch versions immediately, skipping the standard auto-upgrade target qualification delay. Honors operational guardrails: While the feature accelerates the timing of patch eligibility, GKE still strictly adheres to defined maintenance windows, maintenance exclusions, and rollout sequencing. Maintains channel stability: It applies specifically to patch updates within the enrolled minor version, leaving minor version transitions under standard channel release cadence. Key advantages Eliminates manual intervention when rolling out critical security patches. Minimizes the exposure window for newly discovered Common Vulnerabilities and Exposures (CVEs). Works seamlessly alongside maintenance exclusions and surge or blue-green node upgrade strategies. Preserves the stability benefits of being on the Regular minor release track. Why this is optimal This approach provides an automated, policy-compliant pipeline for rapid vulnerability remediation without requiring manual CLI interventions or moving production clusters to the higher-churn Rapid channel.

Gke Accelerated Patch Auto Upgrades Configuration | Professional Cloud DevOps Engineer

AdvancedProfessional Cloud DevOps Engineer

A mission-critical e-commerce application is deployed across three zones using a regional Managed Instance Group (MIG) with a target size of 30 VM instances (10 instances per zone). During operational hours, the application cannot tolerate any reduction in its baseline serving capacity, as dropping below 30 active instances will cause immediate request latency spikes and service degradation. A security patch requires updating the operating system image across the fleet by rolling out a new instance template. Which update policy configuration should you apply to execute an automated rolling update without dropping below the required 30 serving instances?

Safe and secure patching and upgrading practices

AdvancedProfessional Cloud DevOps Engineer

Your enterprise runs a critical web application on regional Compute Engine Managed Instance Groups (MIGs) across staging and production environments. You are tasked with implementing an automated patching and lifecycle promotion pipeline that strictly adheres to immutable infrastructure principles and minimizes the blast radius of potential regressions. The deployment strategy must satisfy the following requirements: Patches must be validated in staging before promotion to production. The production rollout must first be verified against real user traffic using a canary release targeting 10% of the instance fleet. If Cloud Monitoring alert thresholds (such as an elevated HTTP 5xx error rate) are breached during the canary phase, the system must automatically roll back to the previous stable state. Which strategy should you implement?

Safe and secure patching and upgrading practices

AdvancedProfessional Cloud DevOps Engineer

A DevOps team is centralizing application and access audit logs into BigQuery to satisfy strict data protection regulations (such as GDPR and HIPAA). The log management design must satisfy the following access and compliance requirements: Specific sensitive attributes (such as user identifiers and IP addresses) must be masked with hashing or nullification for general DevOps engineers during routine troubleshooting. Compliance officers must have access to the unmasked raw data within the same table. Engineers must only be permitted to query and view log records that originated from their assigned geographic region. The solution must prevent data duplication and avoid maintaining separate regional tables or physical clones. Which strategy should the DevOps team implement in BigQuery to meet these requirements?

Handling sensitive data (e.g., using log processors to redact personally identifiable information [PII], protected health information [PHI])

AdvancedProfessional Cloud DevOps Engineer

Your organization uses an external CI/CD pipeline running in an external cloud provider to deploy application infrastructure. The pipeline needs to decrypt sensitive deployment configuration files using a Cloud KMS key before initiating rollout. To meet strict security compliance, your implementation must satisfy the following requirements: Eliminate long-lived service account keys by using Workload Identity Federation Enforce the principle of least privilege on Cloud KMS resources Prevent identity spoofing by mapping stable, non-reusable external claims Maintain a non-repudiable audit trail for all federated impersonation events Which configuration should you implement?

Key management (e.g., Cloud Key Management Service)

AdvancedProfessional Cloud DevOps Engineer

Your team is preparing to execute a canary deployment for a high-traffic e-commerce microservice exposed via a Global External Application Load Balancer. You need to design a controlled traffic shift that gradually redirects incoming HTTP(S) requests from the baseline backend service to a newly deployed canary backend service while preserving high availability and predictable failover. Which configuration and runtime behavior correctly describes how the Global External Application Load Balancer executes this traffic redirection?

Draining/redirecting traffic

IntermediateProfessional Cloud Architect

Instance Template and Regional Managed Instance Group

Infrastructure orchestration, resource configuration, and patch management

Professional Cloud DevOps Engineer

Gke Accelerated Patch Auto Upgrades Configuration

Related questions

Instance Template and Regional Managed Instance Group

Professional Cloud DevOps Engineer

Gke Accelerated Patch Auto Upgrades Configuration

What accelerated patch auto-upgrades are

How it meets the requirements

Key advantages

Why this is optimal

Related questions

Instance Template and Regional Managed Instance Group

What accelerated patch auto-upgrades are

How it meets the requirements

Key advantages

Why this is optimal