Google Professional Cloud Developer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Developer
- Exam Name: Professional Cloud Developer
- Certification Provider: Google
- Latest update: Oct 22,2026
For this question, refer to the HipLocal case study.
A recent security audit discovers that HipLocal’s database credentials for their Compute Engine-hosted MySQL databases are stored in plain text on persistent disks. HipLocal needs to reduce the risk of these credentials being stolen.
What should they do?
- A . Create a service account and download its key. Use the key to authenticate to Cloud Key Management Service (KMS) to obtain the database credentials.
- B . Create a service account and download its key. Use the key to authenticate to Cloud Key Management Service (KMS) to obtain a key used to decrypt the database credentials.
- C . Create a service account and grant it the roles/iam.serviceAccountUser role. Impersonate as this account and authenticate using the Cloud SQL Proxy.
- D . Grant the roles/secretmanager.secretAccessor role to the Compute Engine service account. Store and access the database credentials with the Secret Manager API.
D
Explanation:
https://cloud.google.com/secret-manager/docs/overview
You are developing an application that will store and access sensitive unstructured data objects in a Cloud Storage bucket. To comply with regulatory requirements, you need to ensure that all data objects are available for at least 7 years after their initial creation. Objects created more than 3 years
ago are accessed very infrequently (less than once a year). You need to configure object storage while ensuring that storage cost is optimized.
What should you do? (Choose two.)
- A . Set a retention policy on the bucket with a period of 7 years.
- B . Use IAM Conditions to provide access to objects 7 years after the object creation date.
- C . Enable Object Versioning to prevent objects from being accidentally deleted for 7 years after object creation.
- D . Create an object lifecycle policy on the bucket that moves objects from Standard Storage to Archive Storage after 3 years.
- E . Implement a Cloud Function that checks the age of each object in the bucket and moves the objects older than 3 years to a second bucket with the Archive Storage class. Use Cloud Scheduler to trigger the Cloud Function on a daily schedule.
AD
Explanation:
https://cloud.google.com/storage/docs/bucket-lock
This page discusses the Bucket Lock feature, which allows you to configure a data retention policy for a Cloud Storage bucket that governs how long objects in the bucket must be retained. The feature also allows you to lock the data retention policy, permanently preventing the policy from being reduced or removed.
https://cloud.google.com/storage/docs/storage-classes#archive
Archive storage is the lowest-cost, highly durable storage service for data archiving, online backup, and disaster recovery. Unlike the "coldest" storage services offered by other Cloud providers, your data is available within milliseconds, not hours or days.
Archive storage is the best choice for data that you plan to access less than once a year.
You are developing a corporate tool on Compute Engine for the finance department, which needs to authenticate users and verify that they are in the finance department. All company employees use G Suite.
What should you do?
- A . Enable Cloud Identity-Aware Proxy on the HTTP(s) load balancer and restrict access to a Google Group containing users in the finance department. Verify the provided JSON Web Token within the application.
- B . Enable Cloud Identity-Aware Proxy on the HTTP(s) load balancer and restrict access to a Google Group containing users in the finance department. Issue client-side certificates to everybody in the finance team and verify the certificates in the application.
- C . Configure Cloud Armor Security Policies to restrict access to only corporate IP address ranges.
Verify the provided JSON Web Token within the application. - D . Configure Cloud Armor Security Policies to restrict access to only corporate IP address ranges. Issue client side certificates to everybody in the finance team and verify the certificates in the application.
A
Explanation:
https://cloud.google.com/iap/docs/signed-headers-howto#securing_iap_headers
(https://cloud.google.com/endpoints/docs/openapi/authenticating-users-google-id).
https://cloud.google.com/armor/docs/security-policy-overview#:~:text=Google%20Cloud%20Armor%20security%20policies%20enable%20you%20to%20a llow%20or,Private%20Cloud%20(VPC)%20networks
"Google Cloud Armor security policies protect your application by providing Layer 7 filtering and by scrubbing incoming requests for common web attacks or other Layer 7 attributes to potentially block traffic before it reaches your load balanced backend services or backend buckets"
Your company has deployed a new API to a Compute Engine instance. During testing, the API is not behaving as expected. You want to monitor the application over 12 hours to diagnose the problem within the application code without redeploying the application.
Which tool should you use?
- A . Cloud Trace
- B . Cloud Monitoring
- C . Cloud Debugger logpoints
- D . Cloud Debugger snapshots
C
Explanation:
https://cloud.google.com/debugger/docs/using/logpoints
Logpoints allow you to inject logging into running services without restarting or interfering with the normal function of the service
Your application is deployed on hundreds of Compute Engine instances in a managed instance group (MIG) in multiple zones. You need to deploy a new instance template to fix a critical vulnerability immediately but must avoid impact to your service.
What setting should be made to the MIG after updating the instance template?
- A . Set the Max Surge to 100%.
- B . Set the Update mode to Opportunistic.
- C . Set the Maximum Unavailable to 100%.
- D . Set the Minimum Wait time to 0 seconds.
B
Explanation:
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups#type Alternatively, if an automated update is potentially too disruptive, you can choose to perform an opportunistic update. The MIG applies an opportunistic update only when you manually initiate the update on selected instances or when new instances are created. New instances can be created when you or another service, such as an autoscaler, resizes the MIG. Compute Engine does not actively initiate requests to apply opportunistic updates on existing instances.
You are evaluating developer tools to help drive Google Kubernetes Engine adoption and integration with your development environment, which includes VS Code and IntelliJ.
What should you do?
- A . Use Cloud Code to develop applications.
- B . Use the Cloud Shell integrated Code Editor to edit code and configuration files.
- C . Use a Cloud Notebook instance to ingest and process data and deploy models.
- D . Use Cloud Shell to manage your infrastructure and applications from the command line.
A
Explanation:
Reference: https://cloud.google.com/code
HipLocal’s data science team wants to analyze user reviews.
How should they prepare the data?
- A . Use the Cloud Data Loss Prevention API for redaction of the review dataset.
- B . Use the Cloud Data Loss Prevention API for de-identification of the review dataset.
- C . Use the Cloud Natural Language Processing API for redaction of the review dataset.
- D . Use the Cloud Natural Language Processing API for de-identification of the review dataset.
B
Explanation:
https://cloud.google.com/dlp/docs/deidentify-sensitive-data
You are writing from a Go application to a Cloud Spanner database. You want to optimize your application’s performance using Google-recommended best practices.
What should you do?
- A . Write to Cloud Spanner using Cloud Client Libraries.
- B . Write to Cloud Spanner using Google API Client Libraries
- C . Write to Cloud Spanner using a custom gRPC client library.
- D . Write to Cloud Spanner using a third-party HTTP client library.
A
Explanation:
https://cloud.google.com/apis/docs/cloud-client-libraries
“Cloud Client Libraries are the recommended option for accessing Cloud APIs programmatically, where available. Cloud Client Libraries use the latest client library models”
https://cloud.google.com/apis/docs/client-libraries-explained
https://cloud.google.com/go/docs/reference
Configure this pipeline to run a deployment step to the Test cluster
You are building a new API. You want to minimize the cost of storing and reduce the latency of serving images.
Which architecture should you use?
- A . App Engine backed by Cloud Storage
- B . Compute Engine backed by Persistent Disk
- C . Transfer Appliance backed by Cloud Filestore
- D . Cloud Content Delivery Network (CDN) backed by Cloud Storage