Google Professional-Cloud-Developer 問題集

質問 1：
You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant access to your application following the principle of least privilege. What should you do?
A. Create a user-managed service account with the Storage Admin Identity and Access Management (IAM) role.
B. Create a user-managed service account with the Project Editor Identity and Access Management (IAM) role.
C. Create a user-managed service account with a custom Identity and Access Management (IAM) role.
D. Use the default service account linked to the Cloud Run revision in production.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
You have an application controlled by a managed instance group. When you deploy a new version of the application, costs should be minimized and the number of instances should not increase. You want to ensure that, when each new instance is created, the deployment only continues if the new instance is healthy. What should you do?
A. Perform a rolling-action with maxHealthy set to 1, maxUnhealthy set to 0.
B. Perform a rolling-action with maxHealthy set to 0, maxUnhealthy set to 1.
C. Perform a rolling-action with maxSurge set to 0, maxUnavailable set to 1
D. Perform a rolling-action with maxSurge set to 1, maxUnavailable set to 0.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 3：
You have an application deployed in Google Kubernetes Engine (GKE). You need to update the application to make authorized requests to Google Cloud managed services. You want this to be a one-time setup, and you need to follow security best practices of auto-rotating your security keys and storing them in an encrypted store. You already created a service account with appropriate access to the Google Cloud service. What should you do next?
A. Export the Google Cloud service account, and share it with the Pod as a Kubernetes Secret.
B. Assign the Google Cloud service account to your GKE Pod using Workload Identity.
C. Export the Google Cloud service account, and upload it to HashiCorp Vault to generate a dynamic service account for your application.
D. Export the Google Cloud service account, and embed it in the source code of the application.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Your team is creating a serverless web application on Cloud Run. The application needs to access images stored in a private Cloud Storage bucket. You want to give the application Identity and Access Management (IAM) permission to access the images in the bucket, while also securing the services using Google-recommended best practices What should you do?
A. Enforce signed URLs for the desired bucket Create and update the Cloud Run service to use a user -managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account
B. Enforce public access prevention for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
C. Enforce signed URLs for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
D. Enforce public access prevention for the desired bucket. Create and update the Cloud Run service to use a user-managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account.
正解：B

質問 5：
You want to create "fully baked" or "golden" Compute Engine images for your application. You need to bootstrap your application to connect to the appropriate database according to the environment the application is running on (test, staging, production). What should you do?
A. When creating the Compute Engine instance, add a tag with the name of the database to be connected.
In your application, query the Compute Engine API to pull the tags for the current instance, and use the tag to construct the appropriate database connection string.
B. When creating the Compute Engine instance, create a metadata item with a key of "DATABASE" and a value for the appropriate database connection string. In your application, query the metadata server for the "DATABASE" value, and use the value to connect to the appropriate database.
C. When creating the Compute Engine instance, create a metadata item with a key of "DATABASE" and a value for the appropriate database connection string. In your application, read the "DATABASE" environment variable, and use the value to connect to the appropriate database.
D. Embed the appropriate database connection string in the image. Create a different image for each environment.
正解：B

質問 6：
You are a developer at a large organization. You have an application written in Go running in a production Google Kubernetes Engine (GKE) cluster. You need to add a new feature that requires access to BigQuery.
You want to grant BigQuery access to your GKE cluster following Google-recommended best practices. What should you do?
A. Create a Google service account with BigQuery access. Add the Google service account JSON key as a Kubernetes secret, and configure the application to use this secret.
B. Create a Google service account with BigQuery access. Add the JSON key to Secret Manager, and use the Go client library to access the JSON key.
C. Create a Google service account and a Kubernetes service account. Configure Workload Identity on the GKE cluster, and reference the Kubernetes service account on the application Deployment.
D. Create a Google service account with BigQuery access. Add the Google service account JSON key to Secret Manager, and use an init container to access the secret for the application to use.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You have an application in production. It is deployed on Compute Engine virtual machine instances controlled by a managed instance group. Traffic is routed to the instances via a HTTP(s) load balancer. Your users are unable to access your application. You want to implement a monitoring technique to alert you when the application is unavailable.
Which technique should you choose?
A. Managed instance group - heath checks
B. Smoke tests
C. Cloud Load Balancing - heath checks
D. Stackdriver uptime checks
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 8：
You recently developed an application that monitors a large number of stock prices. You need to configure Pub/Sub to receive a high volume messages and update the current stock price in a single large in-memory database The downstream service needs only the most up-to-date prices in the in-memory database to perform stock trading transactions Each message contains three pieces of information
* Stock symbol
* Stock price
* Timestamp for the update
.
How should you set up your Pub/Sub subscription?
A. Create a push subscription with exactly-once delivery enabled
B. Create a pull subscription with both ordering and exactly-once delivery turned off
C. Create a pull subscription with exactly-once delivery enabled
D. Create a push subscription with both ordering and exactly-once delivery turned off
正解：A

質問 9：
You are deploying your application on a Compute Engine instance that communicates with Cloud SQL. You will use Cloud SQL Proxy to allow your application to communicate to the database using the service account associated with the application's instance. You want to follow the Google-recommended best practice of providing minimum access for the role assigned to the service account. What should you do?
A. Assign the Project Editor role.
B. Assign the Cloud SQL Client role.
C. Assign the Cloud SQL Editor role.
D. Assign the Project Owner role.
正解：B
解説: (Topexam メンバーにのみ表示されます)