Hard Difficulty Questions

Set an organization policy that denies N2D machine types, then create a separate policy at the project level to allow them for the exception project.

Why wrong: Project-level policies cannot override parent denies; they can only add more restrictions.

Use an audit-only policy and rely on a team to review and approve machine type usage.

Why wrong: Audit-only does not prevent non-compliant resources from being created.

Place each subsidiary in its own folder and set the machine type restriction only on folders that require it.

Why wrong: This does not enforce a global policy; some folders may not have the restriction.

Use a branch protection rule in Cloud Source Repositories.

Why wrong: Does not enforce signed commits.

Use Cloud Functions to validate commits after push.

Why wrong: Reactive and not enforceable.

Use a pre-receive hook in Cloud Source Repositories.

Why wrong: Pre-receive hooks are not supported in Cloud Source Repositories.

Enable Cloud Audit Logging and set up alerts on bucket deletion.

Why wrong: Reactive, not preventive.

Set a bucket IAM policy denying storage.objects.delete for developers.

Why wrong: This restricts object deletion, not bucket deletion.

Use an organization policy to disable bucket deletion across the org.

Why wrong: Too restrictive; prevents necessary deletions.

Use Cloud Build triggers with branch filters.

Why wrong: Useful for automation but not specifically for security/reliability of deployments.

Push all artifacts to a public Container Registry.

Why wrong: Public registry is insecure.

Enable Cloud Build service account with Editor role.

Why wrong: Too permissive; use least privilege.

Number of requests per second.

Why wrong: Request volume alone does not indicate a problem.

CPU utilization at 50%.

Why wrong: 50% utilization is not critical; might be normal.

Memory usage trend.

Why wrong: Memory trends are not immediate page triggers unless critical.

Shorten the SLO compliance window from 30 days to 7 days.

Why wrong: Shorter window makes SLO more sensitive but may cause false alarms.

Change the SLO to 99.9% to allow more error budget.

Why wrong: Does not improve alerting; weakens SLO.

Reduce the error budget burn rate alert threshold from 10% to 5% per hour.

Why wrong: May increase noise but not specific to regional failures.

Use Cloud Scheduler to run a script that checks error budget and rolls back if needed.

Why wrong: Script solution is brittle; not a managed service.

Implement a canary deployment strategy with manual approval steps.

Why wrong: Manual approval delays rollback; not fully automated.

Configure Cloud Build to automatically revert the last commit if error budget is consumed.

Why wrong: Cloud Build is for building containers, not for rollback orchestration.

Enforce a mandatory peer review for all Cloud Armor configuration changes.

Why wrong: Reduces risk but not foolproof; human error can still occur.

Revoke the junior engineer's access to Cloud Armor and grant read-only access.

Why wrong: Doesn't prevent mistakes by other engineers.

Enable Cloud Armor security policy logs and create alerting for blocked traffic spikes.

Why wrong: Detects incidents but doesn't prevent.

Enable Managed Service for Prometheus in one cluster and have other clusters forward metrics to it

Why wrong: Each cluster must have the managed collection enabled independently.

Use Cloud Monitoring agent on nodes in each cluster

Why wrong: Managed Service for Prometheus uses its own collection, not the legacy agent.

Set up a separate workspace per cluster

Why wrong: This defeats the purpose of multi-cluster monitoring; a single workspace is needed.

The transaction is using stale reads

Why wrong: Stale reads bypass locks and are faster.

The transaction is not using a read-write transaction

Why wrong: Read-only transactions are typically faster, not slower.

The transaction is too large

Why wrong: Large transactions can be slow but less common than hot spots.

The rule priority is set to 1000, which is too low.

Why wrong: Lower priority number means higher precedence; 1000 is default, not problematic.

The source range covers all IPs, causing excessive traffic.

Why wrong: Source range alone does not cause latency.

The firewall rule has logging enabled, which adds overhead.

Why wrong: Logging may add minor overhead but not significant latency.

The instance is using a multi-region configuration with too many read-only replicas.

Why wrong: Read-only replicas do not affect write latency.

The application is using stale reads for write transactions.

Why wrong: Stale reads are for read-only transactions.

The number of splits is too low, causing hotspots.

Why wrong: Low splits cause hotspots but not uniform latency increase.

Use HTTP/2 for faster connection reuse.

Why wrong: Cloud Run supports HTTP/2 but it's not a primary performance factor.

Configure VPC egress through Cloud NAT for lower latency.

Why wrong: NAT adds latency; direct egress is faster.

VPC flow logs

Why wrong: VPC flow logs show packet-level traffic, not health check results.

Cloud Audit Logs (Admin Activity)

Why wrong: Audit logs track administrative actions, not health checks.

Instance serial port output logs

Why wrong: Serial port logs show OS-level boot and console messages.

Rotate keys manually every 90 days.

Why wrong: Manual rotation is error-prone and not recommended.

Embed keys in application code.

Why wrong: Insecure.

Store keys in Cloud Storage with public access.

Why wrong: Insecure.

Identify the person responsible for the incident.

Why wrong: Postmortems are blameless; they focus on systems, not individuals.

Implement a solution immediately.

Why wrong: Implementation happens during incident response, not postmortem.

Use log-based metrics instead of custom metrics.

Why wrong: Log-based metrics incur logging costs, which may offset monitoring savings.

Aggregate metrics into buckets and export to BigQuery for analysis.

Why wrong: Exporting does not reduce ingestion cost; aggregation into buckets is not a standard Cloud Monitoring feature.

Reduce the sampling rate of all custom metrics to 1 minute.

Why wrong: Lower sampling may reduce data points but not necessarily cost if the metric volume remains high.

It adds a label called 'container_' to all metrics.

Why wrong: metricRelabelings modifies metric labels, but here it drops based on __name__.

It only keeps metrics whose name starts with 'container_'.

Why wrong: The action is drop, so it removes matching metrics, not keeps them.

It renames all metrics with the prefix 'container_' to remove the prefix.

Why wrong: The action is 'drop', not 'replace' or 'keep'.

Real-time user feedback

Why wrong: User feedback is not a real-time metric, and not typically on a dashboard.

Security audit logs

Why wrong: Security logs are not directly relevant for service performance incidents.

Alert on the burn rate over a 5-minute window with a threshold of 0.5.

Why wrong: A 5-minute window is too short and may cause noisy alerts due to transient spikes.

Alert on the error budget remaining with a threshold of 50%.

Why wrong: This alerts after 50% is already consumed, missing the opportunity for early intervention.

Alert on the SLI value directly with a threshold of 99.9%.

Why wrong: This measures actual performance, not error budget consumption, and may not directly indicate budget depletion.