Professional-Cloud-Developer 試験問題を無料オンラインアクセス

You need to redesign the ingestion of audit events from your authentication service to allow it to handle a large increase in traffic. Currently, the audit service and the authentication system run in the same Compute Engine virtual machine. You plan to use the following Google Cloud tools in the new architecture:
- Multiple Compute Engine machines, each running an instance of the
authentication service
- Multiple Compute Engine machines, each running an instance of the
audit service
- Pub/Sub to send the events from the authentication services.
How should you set up the topics and subscriptions to ensure that the system can handle a large volume of messages and can scale efficiently?

• A.Create one Pub/Sub topic. Create one push subscription with the endpoint pointing to a load balancer in front of the audit services.
• B.Create one Pub/Sub topic per authentication service. Create one push subscription per topic, with the endpoint pointing to one audit service.
• C.Create one Pub/Sub topic. Create one pull subscription per audit service instance to allow the services to share the messages.
• D.Create one Pub/Sub topic per authentication service. Create one pull subscription per topic to be used by one audit service.
• E.Create one Pub/Sub topic. Create one pull subscription to allow the audit services to share the messages.

You are developing an application that consists of several microservices running in a Google Kubernetes Engine cluster. One microservice needs to connect to a third-party database running on-premises. You need to store credentials to the database and ensure that these credentials can be rotated while following security best practices. What should you do?

• A.Store the credentials in an encrypted volume mount, and associate a Persistent Volume Claim with the client Pod.
• B.Store the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.
• C.Configure a service mesh to allow or restrict traffic from the Pods in your microservice to the database.
• D.Store the credentials in a sidecar container proxy, and use it to connect to the third-party database.

You are running a web application on Google Kubernetes Engine that you inherited. You want to determine whether the application is using libraries with known vulnerabilities or is vulnerable to XSS attacks. Which service should you use?

• A.Google Cloud Armor
• B.Web Security Scanner
• C.Error Reporting
• D.Debugger

You are developing an application using different microservices that must remain internal to the cluster. You want the ability to configure each microservice with a specific number of replicas.
You also want the ability to address a specific microservice from any other microservice in a uniform way, regardless of the number of replicas the microservice scales to. You plan to implement this solution on Google Kubernetes Engine. What should you do?

• A.Deploy each microservice as a Pod. Expose the Pod in the cluster using an Ingress, and use the Ingress IP address to address the Pod from other microservices within the cluster.
• B.Deploy each microservice as a Deployment. Expose the Deployment in the cluster using an Ingress, and use the Ingress IP address to address the Deployment from other microservices within the cluster.
• C.Deploy each microservice as a Deployment. Expose the Deployment in the cluster using a Service, and use the Service DNS name to address it from other microservices within the cluster.
• D.Deploy each microservice as a Pod. Expose the Pod in the cluster using a Service, and use the Service DNS name to address the microservice from other microservices within the cluster.

Your team plans to use AlloyDB as their database backend for an upcoming application release.
Your application is currently hosted in a different project and network than the AlloyDB instances.
You need to securely connect your application to the AlloyDB instance while keeping the projects isolated. You want to minimize additional operations and follow Google-recommended practices.
How should you configure the network for database connectivity?

• A.Provision a Shared VPC project where both the application project and the AlloyDB project are service projects.
• B.Use AlloyDB Auth Proxy and configure the application project's firewall to allow connections to port 5433.
• C.Ask the database team to provision AlloyDB databases in the same project and network as the application.
• D.Provision a service account from the AlloyDB project. Use this service account's JSON key file as the --credentials-file to connect to the AlloyDB instance.