Home Microsoft Exams Google Cloud Exams

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Terms Privacy Cookies About Pricing

© 2026 StudyCerts. All rights reserved.

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider.

Loading page

Home
Google Cloud Exams
Professional Cloud DevOps Engineer
Configuring and managing cloud development environments (e.g., Cloud Workstations, Cloud Shell)
A financial enterprise is establishing a secure cloud develo…

Professional Cloud DevOps Engineer

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Secure Development Environment Vpc Sc Cmek Psc

Section: Configuring and managing cloud development environments (e.g., Cloud Workstations, Cloud Shell)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

...

...

...

...

...

Explanations

...

View source documentation

Related questions

Keep the momentum going with these hand-picked practice scenarios

AdvancedProfessional Cloud DevOps Engineer

Your enterprise is deploying Google Cloud Workstations for a software development team requiring custom development tooling and internal security packages. You must establish a secure lifecycle and deployment workflow for these workstations that satisfies the following requirements: Workstation container images must automatically rebuild on a daily schedule to incorporate upstream base image security updates. Container images must reside in a private repository and undergo automated vulnerability scanning upon upload. Cloud Workstations must securely pull the private container images following least-privilege access control. Which combination of steps should you implement to satisfy these requirements?

Configuring and managing cloud development environments (e.g., Cloud Workstations, Cloud Shell)

AdvancedProfessional Cloud DevOps Engineer

A DevOps engineer needs to use Google Cloud Shell as a remote sandbox for running infrastructure orchestration scripts. To streamline development, the engineer connects to Cloud Shell directly from their local terminal using the Google Cloud CLI (gcloud) and mounts their persistent home directory. Which command should the engineer use to establish an interactive SSH session to Cloud Shell while ensuring their local gcloud credentials are automatically propagated and authorized inside the remote Cloud Shell environment?

Configuring and managing cloud development environments (e.g., Cloud Workstations, Cloud Shell)

AdvancedProfessional Cloud DevOps Engineer

Your organization operates a mission-critical, multi-region checkout API hosted on Google Cloud. You need to establish synthetic monitoring to proactively detect customer-impacting issues before real traffic is disrupted. Your monitoring strategy must fulfill the following operational requirements: Probe the checkout endpoint from multiple global geographic regions at a 1-minute frequency. Validate that the endpoint responds with an HTTP 200 OK, contains a specific JSON confirmation key in the response body, and passes TLS certificate validity verification. Generate an incident and notify on-call engineers via Slack and PagerDuty if the 99th percentile (p99) latency exceeds 250 ms across probes for a 5-minute rolling window. Which combination of actions should you configure in Google Cloud Monitoring to meet these requirements?

Creating synthetic monitors to proactively probe application endpoints and workflows

AdvancedProfessional Cloud DevOps Engineer

Your team uses Google Cloud Deploy to deliver microservices to a production Google Kubernetes Engine (GKE) cluster using a canary deployment strategy. You recently updated the delivery pipeline YAML configuration to enable automated deployment verification by setting verify: true under the canaryDeployment strategy. During the subsequent release rollout, the deployment phase succeeds, but the rollout immediately fails and halts during the verification phase before executing any test suites. Inspection of the clouddeploy-operations Pub/Sub notification logs confirms a JobRun failure with JobType: Verify. What is the root cause of this pipeline failure, and what action should you take to resolve it?

CI/CD pipeline issues

AdvancedProfessional Cloud DevOps Engineer

A DevOps team manages a business-critical microservice running on Google Kubernetes Engine (GKE). The team has defined an availability Service Level Objective (SLO) of 99.9% over a rolling 30-day window. Currently, the team experiences alert fatigue caused by transient error spikes triggering paging alerts, while simultaneously missing slow, steady budget drain that exhausts the monthly error budget before scheduled reviews. Which alerting strategy should the team implement in Cloud Monitoring to reliably detect both rapid and slow budget depletion while minimizing false positives?

Configuring alerting and alerting policies (e.g., SLIs, SLOs, cost control)

AdvancedProfessional Cloud Data Engineer

A retail enterprise wants to establish a decentralized data-sharing architecture to publish curated demand-forecasting datasets and file assets to hundreds of vendor partners and internal domain teams. The data architecture team needs to implement a solution that fulfills the following operational and financial requirements: Provide centralized discoverability and rich metadata annotations across all published SQL datasets and storage filesets. Enforce a cost-sharing model where the publishing team pays only for underlying data storage, while consumers incur the compute and query execution costs. Eliminate unnecessary data replication and maintenance overhead across consumer projects. Which combination of Google Cloud services and configurations should the enterprise implement?

Publishing datasets

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Are you ready for the Professional Cloud DevOps Engineer?

50 questions in the full practice test

More Configuring and managing cloud development environments (e.g., Cloud Workstations, Cloud Shell) practice questions

Get a free certification question with a full explanation every week.

Professional Cloud DevOps Engineer

Provider: Google Cloud
Passing score: 70%
Questions: 50
Duration: 90 minutes

Other sections in this exam

Bootstrapping and maintaining a Google Cloud organization
Building and implementing CI/CD pipelines, including continuous testing, for application, infrastructure, and machine learning workloads
Applying site reliability engineering practices
Implementing observability practices and troubleshooting issues
Optimizing performance and cost

Ask Scout

Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.

A financial enterprise is establishing a secure cloud development environment on Google Cloud to support sensitive application engineering workloads under strict regulatory compliance. The architecture must satisfy the following security specifications:

Dedicated source code repositories must be provisioned using Secure Source Manager and isolated privately without exposing endpoints to the public internet.
All repository data at rest must be encrypted with Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS.
Repository instances and development resources must be protected against data exfiltration by isolating the project within a VPC Service Controls perimeter.

Which configuration steps should the DevOps engineer implement?

Provision a Private Service Connect Secure Source Manager instance encrypted with a regional Cloud KMS symmetric key, include the project in a VPC Service Controls service perimeter, and specify Secure Source Manager as a restricted service.

Provision Secure Source Manager with VPC Network Peering across spoke networks, configure client-side token encryption using Secret Manager, and attach an Access Context Manager basic access level that permits all public IP ranges.

Provision a public Secure Source Manager instance with TLS enforcement, enable Cloud KMS asymmetric key encryption at the organization level, and use hierarchical firewall rules to deny external IP ingress.

Deploy a Compute Engine bastion host with an external IP address, configure OS Login with 2-step verification, and assign the Cloud IDS Admin role to developer service accounts.

Provision a Private Service Connect Secure Source Manager instance encrypted with a regional Cloud KMS symmetric key, include the project in a VPC Service Controls service perimeter, and specify Secure Source Manager as a restricted service.

What the Solution Is

This solution implements an enterprise-grade secure development environment by combining Secure Source Manager, Private Service Connect (PSC), Customer-Managed Encryption Keys (CMEK), and VPC Service Controls (VPC SC).

How It Meets the Requirements

Private Network Connectivity: Deploying Secure Source Manager with Private Service Connect ensures that all source repository communication occurs over private IP paths within Google Cloud's Software-Defined Network, completely eliminating public IP exposure.
Regulatory Encryption (CMEK): Utilizing regional symmetric keys in Cloud KMS to encrypt persistent repository storage grants full cryptographic ownership to the enterprise, ensuring compliance with standards such as FedRAMP High and HIPAA.
Data Exfiltration Mitigation: Adding the hosting project to a VPC Service Controls service perimeter and designating Secure Source Manager as a restricted service prevents unauthorized cross-boundary data transfers, API abuse, and external access.

Key Advantages

Zero Public Ingress: PSC keeps repository endpoints entirely internal to the VPC.
Granular Cryptographic Lifecycle: Administrators can immediately disable or destroy the CMEK key to render repository contents inaccessible during security incidents.
Perimeter-Enforced Boundary: VPC Service Controls restricts Google Cloud API communications, ensuring that only trusted identities within authorized network perimeters can interact with the development environment.
Compliance Assurance: Satisfies strict regulatory requirements for sensitive data storage, identity-centric access control, and network isolation.

Why This Is Optimal

This architecture directly aligns with Google Cloud security best practices by implementing defense-in-depth across the network, storage, and identity layers.

Provision Secure Source Manager with VPC Network Peering across spoke networks, configure client-side token encryption using Secret Manager, and attach an Access Context Manager basic access level that permits all public IP ranges.

Provision a public Secure Source Manager instance with TLS enforcement, enable Cloud KMS asymmetric key encryption at the organization level, and use hierarchical firewall rules to deny external IP ingress.

Deploy a Compute Engine bastion host with an external IP address, configure OS Login with 2-step verification, and assign the Cloud IDS Admin role to developer service accounts.