Your team will start developing a new application using microservices architecture on Kubernetes Engine. As part of the development lifecycle, any code change that has been pushed to the remote develop branch on your GitHub repository should be built and tested automatically. When the build and test are successful, the relevant microservice will be deployed automatically in the development environment. You want to ensure that all code deployed in the development environment follows this process. What should you do?
Answer(s): C
The correct answer is C . This option leverages Cloud Build's capabilities for Continuous Integration (CI) and establishes a complete automated pipeline. A Cloud Build trigger, specifically linked to the development branch, automatically initiates the build process upon code pushes. This process includes testing the code, building a container image, and securely storing the image in Container Registry, which is essential for container management. Subsequently, a separate deployment pipeline monitors for these new images in the registry. When a new image is detected, it automatically deploys the associated microservice to the development Kubernetes cluster. This approach ensures that the deployment process is automated, consistent, and controlled. Restricting deployment access to the deployment tool enhances security and ensures a well-defined CI/CD process. Options A and B are unsuitable because relying on local pre-commit or remote post-commit hooks places the burden of build and deployment on developers, which can be inconsistent and error-prone. Option D lacks a dedicated deployment pipeline for image promotion, making it less robust and more difficult to manage. Additionally, Vulnerability Scanning does not serve as a substitute for tests. Option C represents the best practice for implementing automated CI/CD pipelines in cloud environments.Supporting Concepts:Cloud Build: A serverless CI/CD platform for building, testing, and deploying applications. https://cloud.google.com/build/docs Container Registry: A private Docker registry for storing container images. https://cloud.google.com/container-registry/docs Continuous Integration (CI): The practice of frequently integrating code changes into a shared repository. Continuous Deployment (CD): The practice of automatically deploying code changes to production or testing environments. Kubernetes Engine: Google's managed Kubernetes service for orchestrating containerized applications. https://cloud.google.com/kubernetes-engine Deployment Pipelines: Automated processes that define the steps to deploy an application to a specific environment.
Your operations team has asked you to help diagnose a performance issue in a production application that runs on Compute Engine. The application is dropping requests that reach it when under heavy load. The process list for affected instances shows a single application process that is consuming all available CPU, and autoscaling has reached the upper limit of instances. There is no abnormal load on any other related systems, including the database. You want to allow production traffic to be served again as quickly as possible. Which action should you recommend?
Answer(s): D
The correct answer is D. Increase the maximum number of instances in the autoscaling group. Here's why:The problem is that the application is overwhelmed with requests, leading to CPU saturation on the Compute Engine instances. Autoscaling, designed to automatically adjust resources based on demand, has already reached its maximum limit, indicating the current instance count isn't enough to handle the load.Options A, B, and C address symptoms rather than the core issue. Option A, changing the autoscaling metric to memory usage, doesn't address the immediate CPU bottleneck and may not trigger scaling under the current conditions. Option B, restarting instances, provides temporary relief but doesn't prevent the issue from reoccurring. Option C, restarting the application process on each instance, is also a temporary solution and would require manual intervention, hindering rapid recovery.Increasing the maximum number of instances (Option D) is the most effective immediate action. It enables the autoscaler to provision more instances, effectively distributing the workload and relieving pressure on existing instances. This will allow the application to serve requests again, providing immediate relief while the root cause of the CPU usage is investigated. Once traffic is flowing, a deeper investigation into the application's resource usage and potential optimizations is necessary. It's important to understand why the application is consuming so much CPU and implement code or configuration changes to prevent this from happening again. However, in the short term, the most immediate way to resolve the request drops is to increase the number of instances.Authoritative Links for Further Research:Autoscaling Compute Engine: https://cloud.google.com/compute/docs/autoscaling Compute Engine Instance Groups: https://cloud.google.com/compute/docs/instance-groups Monitoring with Cloud Monitoring: https://cloud.google.com/monitoring/
You are implementing the infrastructure for a web service on Google Cloud. The web service needs to receive and store the data from 500,000 requests per second. The data will be queried later in real time, based on exact matches of a known set of attributes. There will be periods where the web service will not receive any requests. The business wants to keep costs low. Which web service platform and database should you use for the application?
Answer(s): B
The optimal solution is B. Cloud Run and Cloud Bigtable. Let's break down why.Cloud Run excels at handling unpredictable workloads, scaling from zero to massive request volumes and back efficiently. Its serverless nature eliminates the need to manage infrastructure, reducing operational overhead and costs. This aligns perfectly with the stated requirement of handling 500,000 requests per second, but also periods of inactivity. (Reference: https://cloud.google.com/run/docs ).For the database, Cloud Bigtable is designed for low-latency reads and writes at scale, handling massive data volumes with ease. Its key-value storage model is ideal for querying based on exact matches of a known set of attributes, as specified in the question. The throughput of 500,000 writes per second is well within Bigtable's capacity. Additionally, Bigtable is cost-effective for highly variable workloads, as you only pay for the resources used. (Reference: https://cloud.google.com/bigtable/docs ).BigQuery, while great for analytics, is not designed for low-latency, high-throughput, real-time data storage and retrieval. Compute Engine, even with autoscaling, introduces infrastructure management overhead compared to Cloud Run's serverless approach. This makes Cloud Run and Bigtable a more cost-effective and efficient solution for the requirements described. Furthermore, the other options will not provide the real time, low latency lookups that Bigtable does for those exact matches.
You are developing an application using different microservices that should remain internal to the cluster. You want to be able to configure each microservice with a specific number of replicas. You also want to be able to address a specific microservice from any other microservice in a uniform way, regardless of the number of replicas the microservice scales to. You need to implement this solution on Google Kubernetes Engine. What should you do?
Answer(s): A
Here's a justification for why option A is the correct approach, along with supporting concepts and links:Option A, deploying microservices as Deployments and exposing them with Services, aligns perfectly with Kubernetes best practices for managing scalable, internal applications. Deployments ensure that a specified number of pod replicas are consistently running, handling potential failures and enabling horizontal scaling. Services provide a stable, logical entry point for accessing these dynamic pods. By creating a Service, Kubernetes assigns a cluster-internal DNS name (e.g., my-service.my-namespace.svc.cluster.local ) that clients can use to connect, regardless of how many pods are backing the service or which specific pod instance the client ultimately connects to. The service acts as a load balancer, distributing traffic across all active pods within its deployment. This abstraction insulates clients from changes in the underlying infrastructure, fulfilling the requirement for a uniform way to address microservices.Option B is incorrect because Ingress is designed for external access to services from outside the Kubernetes cluster, not for communication between microservices within the cluster. Option C is incorrect because directly managing pods would bypass benefits provided by Deployments such as self-healing and rolling updates. Option D is incorrect as well because Ingress is for external traffic and pods are not managed directly. Additionally, option D doesn't provide scalability for pods.Therefore, option A offers a robust and scalable solution that leverages Kubernetes capabilities for service discovery and load balancing, ensuring the reliability and uniformity of intra-cluster communication.Authoritative Links:Kubernetes Deployments: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ Kubernetes Services: https://kubernetes.io/docs/concepts/services-networking/service/ Kubernetes Ingress: https://kubernetes.io/docs/concepts/services-networking/ingress/
Your company has a networking team and a development team. The development team runs applications on Compute Engine instances that contain sensitive data. The development team requires administrative permissions for Compute Engine. Your company requires all network resources to be managed by the networking team. The development team does not want the networking team to have access to the sensitive data on the instances. What should you do?
Google Cloud best practice for separation of duties:Networking team manages network resources onlyDevelopment team manages compute resources—but NOT networkingDevelopment team must NOT access sensitive data belonging to other teamsNetworking team must NOT access the instances or their dataThe recommended Google solution is:Use a Shared VPCShared VPC allows:Centralized network administrationSeparate projects for teamsCompute resources can exist in one projectNetworking resources are controlled in another projectThe networking team cannot access VMs or their data (unless explicitly granted)Option C matches this design perfectly:C Host ProjectContains the Shared VPCNetwork Admin role → Networking teamThey manage subnets, firewalls, routes, etc.They do NOT get access to VM dataService ProjectNo VPC of its ownUses the Shared VPC from the host projectCompute Admin role → Development teamThey can create/manage Compute Engine VMsNo ability to alter the networkThis achieves clean separation of duties and is the recommended Google Cloud architecture.Why the Other Options Are WrongA: Two separate VPCs + Cloud VPNUnnecessary complexityCloud VPN is for hybrid or cross-region connectivity, NOT internal separationStill doesn't enforce clean separation of dutiesVery costly and non-recommendedB: One project with both teamsGives both teams access to everything in a single projectDevelopers could manage VPCsNetworking team could access VM metadata and maybe dataViolates zero-trust and separation-of-duties principlesD: Two VPCs + VPC PeeringPeering connects networks but does not isolate administrative responsibilities
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.