Google Professional Cloud Developer Practice Exams
Last updated on Oct 24,2026- Exam Code: Professional Cloud Developer
- Exam Name: Professional Cloud Developer
- Certification Provider: Google
- Latest update: Oct 24,2026
You have an application deployed in Google Kubernetes Engine (GKE). You need to update the application to make authorized requests to Google Cloud managed services. You want this to be a one-time setup, and you need to follow security best practices of auto-rotating your security keys and storing them in an encrypted store. You already created a service account with appropriate access to the Google Cloud service.
What should you do next?
- A . Assign the Google Cloud service account to your GKE Pod using Workload Identity.
- B . Export the Google Cloud service account, and share it with the Pod as a Kubernetes Secret.
- C . Export the Google Cloud service account, and embed it in the source code of the application.
- D . Export the Google Cloud service account, and upload it to HashiCorp Vault to generate a dynamic service account for your application.
A
Explanation:
https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity
Applications running on GKE might need access to Google Cloud APIs such as Compute Engine API, BigQuery Storage API, or Machine Learning APIs.
Workload Identity allows a Kubernetes service account in your GKE cluster to act as an IAM service account. Pods that use the configured Kubernetes service account automatically authenticate as the IAM service account when accessing Google Cloud APIs. Using Workload Identity allows you to assign distinct, fine-grained identities and authorization for each application in your cluster.
You recently deployed a Go application on Google Kubernetes Engine (GKE). The operations team has noticed that the application’s CPU usage is high even when there is low production traffic. The operations team has asked you to optimize your application’s CPU resource consumption. You want to determine which Go functions consume the largest amount of CPU.
What should you do?
- A . Deploy a Fluent Bit daemonset on the GKE cluster to log data in Cloud Logging. Analyze the logs to get insights into your application code’s performance.
- B . Create a custom dashboard in Cloud Monitoring to evaluate the CPU performance metrics of your application.
- C . Connect to your GKE nodes using SSH. Run the top command on the shell to extract the CPU utilization of your application.
- D . Modify your Go application to capture profiling data. Analyze the CPU metrics of your application in flame graphs in Profiler.
D
Explanation:
https://cloud.google.com/profiler/docs/about-profiler
Cloud Profiler is a statistical, low-overhead profiler that continuously gathers CPU usage and memory-allocation information from your production applications. It attributes that information to the source code that generated it, helping you identify the parts of your application that are consuming the most resources, and otherwise illuminating your applications performance characteristics.
https://cloud.google.com/profiler/docs
Your security team is auditing all deployed applications running in Google Kubernetes Engine. After completing the audit, your team discovers that some of the applications send traffic within the cluster in clear text. You need to ensure that all application traffic is encrypted as quickly as possible while minimizing changes to your applications and maintaining support from Google.
What should you do?
- A . Use Network Policies to block traffic between applications.
- B . Install Istio, enable proxy injection on your application namespace, and then enable mTLS.
- C . Define Trusted Network ranges within the application, and configure the applications to allow traffic only from those networks.
- D . Use an automated process to request SSL Certificates for your applications from Let’s Encrypt and add them to your applications.
You are using the Cloud Client Library to upload an image in your application to Cloud Storage. Users of the application report that occasionally the upload does not complete and the client library reports an HTTP 504 Gateway Timeout error. You want to make the application more resilient to errors.
What changes to the application should you make?
- A . Write an exponential backoff process around the client library call.
- B . Write a one-second wait time backoff process around the client library call.
- C . Design a retry button in the application and ask users to click if the error occurs.
- D . Create a queue for the object and inform the users that the application will try again in 10 minutes.
You recently joined a new team that has a Cloud Spanner database instance running in production. Your manager has asked you to optimize the Spanner instance to reduce cost while maintaining high reliability and availability of the database.
What should you do?
- A . Use Cloud Logging to check for error logs, and reduce Spanner processing units by small increments until you find the minimum capacity required.
- B . Use Cloud Trace to monitor the requests per sec of incoming requests to Spanner, and reduce Spanner processing units by small increments until you find the minimum capacity required.
- C . Use Cloud Monitoring to monitor the CPU utilization, and reduce Spanner processing units by small increments until you find the minimum capacity required.
- D . Use Snapshot Debugger to check for application errors, and reduce Spanner processing units by small increments until you find the minimum capacity required.
C
Explanation:
https://cloud.google.com/spanner/docs/compute-capacity#increasing_and_decreasing_compute_capacity
You have containerized a legacy application that stores its configuration on an NFS share. You need to deploy this application to Google Kubernetes Engine (GKE) and do not want the application serving traffic until after the configuration has been retrieved.
What should you do?
- A . Use the gsutil utility to copy files from within the Docker container at startup, and start the service using an ENTRYPOINT script.
- B . Create a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.
- C . Use the COPY statement in the Dockerfile to load the configuration into the container image.
Verify that the configuration is available, and start the service using an ENTRYPOINT script. - D . Add a startup script to the GKE instance group to mount the NFS share at node startup. Copy the configuration files into the container, and start the service using an ENTRYPOINT script.
B
Explanation:
Reference: https://cloud.google.com/compute/docs/instances/startup-scripts/linux
The development teams in your company want to manage resources from their local environments. You have been asked to enable developer access to each team’s Google Cloud projects. You want to maximize efficiency while following Google-recommended best practices.
What should you do?
- A . Add the users to their projects, assign the relevant roles to the users, and then provide the users
with each relevant Project ID. - B . Add the users to their projects, assign the relevant roles to the users, and then provide the users with each relevant Project Number.
- C . Create groups, add the users to their groups, assign the relevant roles to the groups, and then provide the users with each relevant Project ID.
- D . Create groups, add the users to their groups, assign the relevant roles to the groups, and then provide the users with each relevant Project Number.
You recently deployed your application in Google Kubernetes Engine, and now need to release a new version of your application. You need the ability to instantly roll back to the previous version in case there are issues with the new version.
Which deployment model should you use?
- A . Perform a rolling deployment, and test your new application after the deployment is complete.
- B . Perform A/B testing, and test your application periodically after the new tests are implemented.
- C . Perform a blue/green deployment, and test your new application after the deployment is.
complete. - D . Perform a canary deployment, and test your new application periodically after the new version is deployed.
You are planning to migrate a MySQL database to the managed Cloud SQL database for Google Cloud. You have Compute Engine virtual machine instances that will connect with this Cloud SQL instance. You do not want to whitelist IPs for the Compute Engine instances to be able to access Cloud SQL.
What should you do?
- A . Enable private IP for the Cloud SQL instance.
- B . Whitelist a project to access Cloud SQL, and add Compute Engine instances in the whitelisted project.
- C . Create a role in Cloud SQL that allows access to the database from external instances, and assign the
Compute Engine instances to that role. - D . Create a CloudSQL instance on one project. Create Compute engine instances in a different project.
Create a VPN between these two projects to allow internal access to CloudSQL.
C
Explanation:
Reference: https://cloud.google.com/sql/docs/mysql/connect-external-app
You are deploying your application to a Compute Engine virtual machine instance with the Stackdriver Monitoring Agent installed. Your application is a unix process on the instance. You want to be alerted if the unix process has not run for at least 5 minutes. You are not able to change the application to generate metrics or logs.
Which alert condition should you configure?
- A . Uptime check
- B . Process health
- C . Metric absence
- D . Metric threshold
B
Explanation:
Reference: https://cloud.google.com/monitoring/alerts/concepts-indepth