Professional-Cloud-DevOps-Engineer 무료 덤프문제 온라인 액세스

You are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?

• A.Create a Google service account.
  Create a Kubernetes service account in a Workload Identity-enabled cluster.
  Link the Google service account with the Kubernetes service account by using the roles/iam.
  workloadIdentityUser role and iam.gke.io/gcp-service-account annotation.
  Map the Kubernetes service account to the workload.
  Repeat for each workload.
• B.Create a Google service account.
  Create a service account key for the Google service account.
  Create a Kubernetes secret with a service account key.
  Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path.
  Repeat for each workload.
• C.Create a Google service account.
  Create a node pool without taints, and set the Google service account as the default identity.
  Grant IAM permissions to the Google service account.
• D.Create a Google service account.
  Create a node pool, and set the Google service account as the default identity.
  Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations.
  Repeat for each workload.

You are monitoring a service that uses n2-standard-2 Compute Engine instances that serve large files. Users have reported that downloads are slow. Your Cloud Monitoring dashboard shows that your VMS are running at peak network throughput. You want to improve the network throughput performance. What should you do?

• A.Deploy a Cloud NAT gateway and attach the gateway to the subnet of the VMS.
• B.Change the machine type for your VMS to n2-standard-8.
• C.Deploy the Ops Agent to export additional monitoring metrics.
• D.Add additional network interface controllers (NICs) to your VMS.

You are the on-call Site Reliability Engineer for a microservice that is deployed to a Google Kubernetes Engine (GKE) Autopilot cluster. Your company runs an online store that publishes order messages to Pub/Sub and a microservice receives these messages and updates stock information in the warehousing system. A sales event caused an increase in orders, and the stock information is not being updated quickly enough. This is causing a large number of orders to be accepted for products that are out of stock You check the metrics for the microservice and compare them to typical levels.

You need to ensure that the warehouse system accurately reflects product inventory at the time orders are placed and minimize the impact on customers What should you do?

• A.Increase the number of Pod replicas
• B.Increase the Pod CPU and memory limits
• C.Decrease the acknowledgment deadline on the subscription
• D.Add a virtual queue to the online store that allows typical traffic levels

You have an application that runs on Cloud Run. You want to use live production traffic to test a new version of the application while you let the quality assurance team perform manual testing. You want to limit the potential impact of any issues while testing the new version, and you must be able to roll back to a previous version of the application if needed. How should you deploy the new version?
Choose 2 answers

• A.Deploy the new application version and use the -no-traffic option Route production traffic to the revision's URL.
• B.Deploy the application as a new Cloud Run service.
• C.Deploy a new Cloud Run revision with a tag and use the -no-traffic option.
• D.Deploy a new Cloud Run revision without a tag and use the -no-traffic option.
• E.Deploy the new application version and split traffic to the new version.

You are configuring Cloud Logging for a new application that runs on a Compute Engine instance with a public IP address. A user-managed service account is attached to the instance. You confirmed that the necessary agents are running on the instance but you cannot see any log entries from the instance in Cloud Logging. You want to resolve the issue by following Google-recommended practices. What should you do?

• A.Add the Logs Writer role to the service account.
• B.Export the service account key and configure the agents to use the key.
• C.Enable Private Google Access on the subnet that the instance is in.
• D.Update the instance to use the default Compute Engine service account.