Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your DevOps team is instrumenting a distributed microservices application using OpenTelemetry SDKs to export span telemetry directly into Google Cloud Trace. Part of the application is deployed on a Google Kubernetes Engine (GKE) cluster configured with custom node access scopes, while legacy service components run in an on-premises data center.
All services must securely authenticate, correlate distributed calls, and successfully publish trace spans to Cloud Trace. Which configuration satisfies these requirements?
Assign the Service Usage Admin (roles/serviceusage.serviceUsageAdmin) role to the on-premises service account, configure GKE nodes with the https://www.googleapis.com/auth/servicecontrol scope, and configure the OpenTelemetry SDK to write traces to BigQuery.
Assign the Logs Writer (roles/logging.logWriter) role to the on-premises service account, configure GKE nodes with the https://www.googleapis.com/auth/monitoring.write scope, and export OpenTelemetry traces as JSON logs directly to Cloud Logging sinks.
Assign the Cloud Trace User (roles/cloudtrace.user) role to the on-premises service account, configure GKE nodes with the https://www.googleapis.com/auth/cloud-platform.read-only scope, and configure OpenTelemetry to rely exclusively on custom baggage items for trace correlation.
Assign the Cloud Trace Agent (roles/cloudtrace.agent) role to the on-premises service account using Application Default Credentials, ensure GKE nodes include the https://www.googleapis.com/auth/trace.append access scope, and configure OpenTelemetry context propagators for W3C TraceContext headers.
Assign the Service Usage Admin (roles/serviceusage.serviceUsageAdmin) role to the on-premises service account, configure GKE nodes with the https://www.googleapis.com/auth/servicecontrol scope, and configure the OpenTelemetry SDK to write traces to BigQuery.
Assign the Logs Writer (roles/logging.logWriter) role to the on-premises service account, configure GKE nodes with the https://www.googleapis.com/auth/monitoring.write scope, and export OpenTelemetry traces as JSON logs directly to Cloud Logging sinks.
Assign the Cloud Trace User (roles/cloudtrace.user) role to the on-premises service account, configure GKE nodes with the https://www.googleapis.com/auth/cloud-platform.read-only scope, and configure OpenTelemetry to rely exclusively on custom baggage items for trace correlation.
Assign the Cloud Trace Agent (roles/cloudtrace.agent) role to the on-premises service account using Application Default Credentials, ensure GKE nodes include the https://www.googleapis.com/auth/trace.append access scope, and configure OpenTelemetry context propagators for W3C TraceContext headers.
This configuration establishes the necessary IAM authentication, platform authorization scopes, and OpenTelemetry context propagation protocols required to collect, stitch together, and export distributed traces to Google Cloud Trace from both Google Cloud Platform (GCP) and hybrid environments.
StudyCerts
StudyCertsroles/cloudtrace.agent) IAM role, made discoverable through Application Default Credentials (ADC) via the GOOGLE_APPLICATION_CREDENTIALS environment variable or default file paths.https://www.googleapis.com/auth/trace.append scope to permit worker nodes to write telemetry spans to the Cloud Trace API endpoint.traceparent or B3) injected into and extracted from HTTP request headers to preserve Trace ID and Parent Span ID across network boundaries.roles/cloudtrace.agent role grants only the permissions needed to write trace data (cloudtrace.traces.patch), avoiding unnecessary administrative rights.This approach directly satisfies all security, networking, and tracing runtime constraints described in Google Cloud Observability best practices for hybrid deployments.