Select Two (Multi-Select) Questions

Number of requests per second.

Why wrong: Request volume alone does not indicate a problem.

CPU utilization at 50%.

Why wrong: 50% utilization is not critical; might be normal.

Memory usage trend.

Why wrong: Memory trends are not immediate page triggers unless critical.

In the cloudbuild.yaml, add a condition that checks if the branch name matches 'v*.*.*'.

Why wrong: Tags are not branch names.

Create a separate cloudbuild.yaml for production and use a branch filter '^main$' to trigger it.

Why wrong: Branch filter does not match tags.

Configure a manual approval step in Cloud Build that requires a production manager to approve before running the production deployment.

Why wrong: Approval does not restrict trigger to tags.

Rotate keys manually every 90 days.

Why wrong: Manual rotation is error-prone and not recommended.

Embed keys in application code.

Why wrong: Insecure.

Store keys in Cloud Storage with public access.

Why wrong: Insecure.

Monitor average latency because it is most representative of typical user experience.

Why wrong: Average latency can mask outliers and is not suitable for SLOs that require strict performance guarantees.

Monitor container CPU utilization as a proxy for application latency.

Why wrong: CPU utilization is an infrastructure metric that does not directly measure user-facing latency; it is not appropriate for SLO definition.

Use the number of running pods as the primary SLO indicator.

Why wrong: Pod count indicates availability but not performance; it is not a direct measure of service quality.

Use Istio mTLS for all service-to-service communication

Why wrong: mTLS adds encryption overhead, increasing latency rather than reducing it.

Increase the number of nodes in the cluster

Why wrong: More nodes may help with capacity but not necessarily reduce inter-service latency; could even add hops.

Exact code line numbers and commits that caused the incident.

Why wrong: Too detailed; focus on systemic issues.

A detailed analysis of the root cause only.

Why wrong: Also need impact and response.

An attribution of blame to the individual or team responsible.

Why wrong: Blameless culture is key.

Increase the target CPU utilization percentage to 90% so that pods are less likely to be added.

Why wrong: Increasing target CPU utilization actually delays scaling because it raises the threshold for scaling up.

Set the maxReplicas of the HPA to a value lower than the expected peak traffic to force faster scaling.

Why wrong: Lowering max replicas caps capacity and could lead to insufficient resources during bursts, worsening performance.

Increase the --horizontal-pod-autoscaler-sync-period flag to 30 seconds and increase the --horizontal-pod-autoscaler-upscale-delay flag to 5 minutes.

Why wrong: Increasing cooldown delays makes autoscaling less responsive, worsening latency spikes.

Use legacy SQL instead of standard SQL.

Why wrong: SQL dialect does not affect data scanning efficiency.

Use flat-rate pricing.

Why wrong: Flat-rate pricing changes billing model but does not reduce data scanned.

Increase the number of App Engine instances.

Why wrong: This may not address the root cause.

Enable Cloud CDN to cache responses.

Why wrong: Not suitable for dynamic content.

Disable caching to ensure fresh data.

Why wrong: Disabling caching worsens performance.

Use a Terraform module to create projects with labels.

Why wrong: This is not automatic; requires manual runs.

Use a folder-level constraint to enforce labels.

Why wrong: No folder-level label constraint exists.

Use Cloud Asset Inventory to monitor labels.

Why wrong: Monitoring does not apply labels automatically.

Notify the incident commander to take over coordination.

Why wrong: The incident commander is usually designated at the start of the incident response process, often before or right at declaration, not as a separate action after declaration.

Begin documenting the incident for a postmortem report.

Why wrong: Postmortem activities are conducted after the incident is resolved, not at the start.

Roll back the latest deployment to the previous stable version.

Why wrong: Rollback should be considered only after assessing the impact and potential side effects; not an immediate first step.

Cloud Shell and Cloud Source Repositories

Why wrong: Incorrect: Cloud Shell and Cloud Source Repositories provide development environments and version control, not organization-wide policy enforcement or naming conventions.

Cloud Deployment Manager and Cloud Audit Logs

Why wrong: Incorrect: Cloud Deployment Manager automates resource creation but does not centrally enforce policies or naming conventions across projects. Cloud Audit Logs track actions but do not enforce constraints.

Service Accounts and IAM roles

Why wrong: Service Accounts and IAM roles manage authentication and authorization but do not enforce resource naming conventions or organization policies. They are necessary for granting permissions but are not the tools that directly implement the required constraints.

Google Meet only.

Why wrong: Meet is for meetings, not ongoing collaboration.

Jira.

Why wrong: Jira is for issue tracking, not real-time collaboration.

Cloud Trace.

Why wrong: Trace is for latency analysis, not communication.

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Why wrong: This adds complexity; using Secret Manager is preferred.

Base64 encode secrets and store them in Cloud Build substitutions.

Why wrong: Substitutions are visible in build logs and not secure.

Use a centralized service account to create projects via API.

Why wrong: Not a recommended best practice; automate but not necessarily centralized.

Use a single project for all development environments.

Why wrong: Not recommended; use multiple projects for isolation.

Assign project creator role to all users by default.

Why wrong: Too permissive; should be limited.

Enable the Cloud Run API in the project.

Why wrong: The API must already be enabled for the pipeline to run.

Use a different service account for deployment.

Why wrong: Not a resolution; the current SA needs proper permissions.

Add the `run.routes.invoke` permission to a custom role.

Why wrong: The Invoker role already includes `run.routes.invoke`; the error is misleading but missing other permissions.

Create a separate billing account for each team.

Why wrong: Not necessary and adds complexity.

Grant all users the Project Creator role.

Why wrong: Insecure; should be limited.

Enable the Compute Engine API in every project.

Why wrong: Should be enabled only as needed.

Creating a log-based metric

Why wrong: Log-based metrics create metrics from logs, but they are not custom metric descriptors.

Using Terraform resource google_monitoring_metric_descriptor

Why wrong: Terraform can create descriptors, but the question asks for exactly two, and the most common are API and gcloud.

Deploying a Prometheus exporter with the Ops Agent

Why wrong: This collects metrics but does not create a metric descriptor.

Purchase 1-year committed use discounts for the worker nodes.

Why wrong: Committed use discounts require full-time usage; for a 2-hour job, the cost savings will not offset the commitment.

Migrate the workload to Cloud Functions.

Why wrong: Cloud Functions has a 9-minute execution timeout and is not suitable for long-running batch jobs.

Enable sustained use discounts by keeping the instances running 24/7.

Why wrong: Sustained use discounts are automatic; keeping instances idle increases cost.

Support for any VCS

Why wrong: Cloud Build supports common VCS but not 'any'.

Built-in security scanning

Why wrong: Security scanning is not built-in; you need additional tools.