You save $69.98
A cloud platform review identifies this problem: A team wants to send ten percent of Cloud Run traffic to a candidate build. What is the most appropriate action?
Configure explicit Cloud Run revision traffic percentages and monitor metrics. Cloud Run supports traffic splitting between revisions. This is the most direct intervention for the specified requirement.
Shift traffic to the previous healthy Cloud Run revision. This belongs to another task scenario: A Cloud Run revision has a regression and must be rolled back without deleting history. It does not meet the immediate requirement of the current stem, which requires configure explicit cloud run revision traffic percentages and monitor metrics.
Configure Horizontal Pod Autoscaler with relevant metrics support. This is an appropriate response to a different situation: A GKE deployment must scale the number of replicas based on CPU usage. It does not directly correct the condition described here; the more targeted change is configure explicit cloud run revision traffic percentages and monitor metrics.
Inspect its health checks startup scripts and instance template before updating. That change targets the separate case a managed instance group recreates unhealthy replicas continuously after deployment. The current case instead calls for configure explicit cloud run revision traffic percentages and monitor metrics.
A deployment runbook reports: An application needs lower-latency high-throughput block storage than its current disk type provides. Which action should the administrator prioritize?
Select a suitable Hyperdisk configuration with supported performance and machine limits. Hyperdisk offers eligible configurable performance characteristics. This is the most direct intervention for the specified requirement.
Check machine family SKU availability and regional quotas before creating instance templates. This belongs to another task scenario: A project plans autoscaling with a machine family unavailable in its planned region. It does not meet the immediate requirement of the current stem, which requires select a suitable hyperdisk configuration with supported performance and machine limits.
Choose a supported Compute Engine custom machine type in an eligible machine family. That change targets the separate case a compute workload needs an uncommon combination of vcpu and memory sizes. The current case instead calls for select a suitable hyperdisk configuration with supported performance and machine limits.
Schedule ephemeral compute jobs or supported managed batch execution rather than maintaining idle VMs. This belongs to another task scenario: A high-throughput batch task only requires a few hours of parallel execution per week. It does not meet the immediate requirement of the current stem, which requires select a suitable hyperdisk configuration with supported performance and machine limits.
An administrator implements Choose a minimal predefined or custom role containing the required list permissions because A storage operator needs permission to list objects but not delete bucket contents. Which follow-up evidence is decisive?
Listing works while object delete requests remain denied. IAM permissions can separate object reads from deletes. This is the most relevant evidence for the exact correction.
The developer accesses the approved bucket and not unrelated data. This would test the separate scenario: A developer needs access to one Cloud Storage bucket rather than every bucket in a project. It is not decisive evidence for this change. Verify listing works while object delete requests remain denied instead.
The role permits the approved actions but omits unauthorized operations. That observation corresponds to an engineering team has a permission need not met exactly by standard roles, rather than the specific remediation being tested. The required evidence is listing works while object delete requests remain denied.
The report identifies direct inherited and conditional access paths where supported. This would test the separate scenario: A security engineer needs a tool to inspect who can read a critical secret across inherited IAM policies. It is not decisive evidence for this change. Verify listing works while object delete requests remain denied instead.
A Google Cloud administrator must address this condition: A new business unit needs its own Google Cloud organization boundary. Which response is best?
Follow supported standalone organization onboarding and domain identity prerequisites. Organizations anchor Google Cloud resource administration and associated identity. This is the most direct intervention for the specified requirement.
Verify Cloud Identity domain administration and assign authorized organization roles. This belongs to another task scenario: A team needs to connect a standalone organization to corporate Cloud Identity controls. It does not meet the immediate requirement of the current stem, which requires follow supported standalone organization onboarding and domain identity prerequisites.
Apply a supported organization policy constraint at the correct ancestor. This is an appropriate response to a different situation: An organization needs one prohibition applied to projects in several departments. It does not directly correct the condition described here; the more targeted change is follow supported standalone organization onboarding and domain identity prerequisites.
Create a dedicated Google Cloud project under the approved folder. That change targets the separate case a team needs a separate cost and access boundary for its new application. The current case instead calls for follow supported standalone organization onboarding and domain identity prerequisites.
An administrator implements Use approved Cloud Foundation Toolkit or Fabric FAST patterns with controlled input variables because An organization needs secure reusable infrastructure patterns across project teams. Which follow-up evidence is decisive?
A new environment reproduces the defined landing zone controls. Foundation toolkits provide reusable Google Cloud deployment building blocks. This is the most relevant evidence for the exact correction.
Kubernetes reconciliation brings supported cloud resources to desired state. This is relevant in another situation: A company wants to provision cloud resources through a Kubernetes-style control plane. It does not establish the outcome of the specified fix, which should be a new environment reproduces the defined landing zone controls.
The expected Kubernetes resources match the approved chart version. This would test the separate scenario: An application requires repeatable installation of Kubernetes charts to GKE. It is not decisive evidence for this change. Verify a new environment reproduces the defined landing zone controls instead.
Unauthorized identities cannot retrieve state and authorized plans still work. This is relevant in another situation: A cloud engineer has a state file containing sensitive deployment attributes in a public repository. It does not establish the outcome of the specified fix, which should be a new environment reproduces the defined landing zone controls.
An administrator delays fixing A Dataflow streaming pipeline's backlog grows after message volume increases. Which risk is the closest consequence?
A healthy worker count alone does not prove streaming timeliness. Dataflow job metrics expose streaming capacity and lag. This is the primary consequence of leaving the stated issue unresolved.
A terminated pipeline can be failed or cancelled rather than successful. This is the failure mode of a different case: An operator needs to distinguish a stopped Dataflow job from a successful terminal state. For the current condition, the more direct consequence is a healthy worker count alone does not prove streaming timeliness.
Poorly chosen storage class transitions can increase total storage costs. That exposure could arise for a cloud storage lifecycle rule accidentally moved hot data into an expensive retrieval class; it is not the closest risk here. The specified issue primarily leads to a healthy worker count alone does not prove streaming timeliness.
Without version history overwritten object content may be unrecoverable. This risk is more closely associated with a team needs to keep prior generations of important objects after accidental overwrites. The direct exposure in this scenario is a healthy worker count alone does not prove streaming timeliness.
After the team implements Grant the relevant service account token creator or impersonation permission with scope for the case An operations engineer must temporarily act as an authorized deployment service account, which result most directly demonstrates success?
The engineer runs a permitted command using temporary impersonated credentials. Service account impersonation uses delegated short-lived tokens. This is the most relevant evidence for the exact correction.
The script obtains a scoped token for only the target service account. That observation corresponds to an application uses organization-wide service account token creator for one deployment script, rather than the specific remediation being tested. The required evidence is the engineer runs a permitted command using temporary impersonated credentials.
Eligible impersonation records attribute the initiating identity and time. This is relevant in another situation: A platform team wants to audit who impersonated a privileged service account during an incident. It does not establish the outcome of the specified fix, which should be the engineer runs a permitted command using temporary impersonated credentials.
The troubleshooting operation completes before token expiry with no saved key. That observation corresponds to an administrator needs short-lived credentials for a machine identity during a troubleshooting window, rather than the specific remediation being tested. The required evidence is the engineer runs a permitted command using temporary impersonated credentials.
An administrator delays fixing A billing engineer sees a project under a billing account but costs still show the previous month's allocation. Which risk is the closest consequence?
Misinterpreting reporting lag can prompt incorrect repeated billing transfers. Cloud Billing usage reporting can include delayed charge adjustments. This is the primary consequence of leaving the stated issue unresolved.
Changing a project billing link without verifying new account status can disrupt services. That exposure could arise for a company has two billing accounts and must transfer one application project to another; it is not the closest risk here. The specified issue primarily leads to misinterpreting reporting lag can prompt incorrect repeated billing transfers.
Separate project identities do not require an independent billing account each. This risk is more closely associated with a finance team wants one central billing account paying for multiple application projects. The direct exposure in this scenario is misinterpreting reporting lag can prompt incorrect repeated billing transfers.
An unfiltered organization budget can obscure which project caused spending. That exposure could arise for a project should receive billing budget alerts only for production spend; it is not the closest risk here. The specified issue primarily leads to misinterpreting reporting lag can prompt incorrect repeated billing transfers.
A technical support ticket describes: A GKE application must authenticate to an external identity provider without copying cloud keys into a Secret. Which remedy is most defensible?
Use supported workload federation or short-lived credential exchange for the workload. Federated workload credentials avoid distributing long-lived secrets. This is the most direct intervention for the specified requirement.
Attach a dedicated service account and grant narrowly scoped storage permissions. That change targets the separate case a compute engine vm should read one storage bucket without storing static key files. The current case instead calls for use supported workload federation or short-lived credential exchange for the workload.
Use Workload Identity Federation with restricted external identity trust. This belongs to another task scenario: An engineer wants a CI job to deploy Google Cloud resources without downloading a JSON key. It does not meet the immediate requirement of the current stem, which requires use supported workload federation or short-lived credential exchange for the workload.
Configure Workload Identity Federation for GKE with appropriate Kubernetes service account authorization. This is an appropriate response to a different situation: A service runs on GKE and needs Cloud Storage access without a secret mounted in the Pod. It does not directly correct the condition described here; the more targeted change is use supported workload federation or short-lived credential exchange for the workload.
An administrator implements List Compute Engine instances with the correct project zone filters and status fields because A team needs to find all running VMs in one region before scheduled maintenance. Which follow-up evidence is decisive?
The resulting inventory lists the intended running instance IDs and zones. Compute Engine instance inventory exposes state and location information. This is the most relevant evidence for the exact correction.
The selected cluster node pool and Pod status are accurately recorded. This is relevant in another situation: An engineer needs to know which GKE clusters and nodes are active during an outage. It does not establish the outcome of the specified fix, which should be the resulting inventory lists the intended running instance ids and zones.
The admin connects using approved identity while unrestricted public SSH remains blocked. This would test the separate scenario: An operator must SSH into a Linux Compute Engine VM without opening public TCP 22. It is not decisive evidence for this change. Verify the resulting inventory lists the intended running instance ids and zones instead.
Replacement members become healthy without a recreate loop. That observation corresponds to a managed instance group recreates unhealthy replicas continuously after deployment, rather than the specific remediation being tested. The required evidence is the resulting inventory lists the intended running instance ids and zones.
A team ignores the problem A project should receive billing budget alerts only for production spend. What specific risk should its runbook record?
An unfiltered organization budget can obscure which project caused spending. Budgets can be scoped using project and service filters. This is the primary consequence of leaving the stated issue unresolved.
Actual spend only alerts may arrive too late for planned action. That exposure could arise for a company needs alerts based on forecast cost before the monthly threshold is reached; it is not the closest risk here. The specified issue primarily leads to an unfiltered organization budget can obscure which project caused spending.
Unnecessary invoice visibility expands financial information exposure. This is the failure mode of a different case: A cloud team wants cost accountability without granting all engineers access to corporate invoices. For the current condition, the more direct consequence is an unfiltered organization budget can obscure which project caused spending.
Unlinked projects can lose ability to provision paid resources. That exposure could arise for a new application project is not linked to any paying account and cannot use billable products; it is not the closest risk here. The specified issue primarily leads to an unfiltered organization budget can obscure which project caused spending.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (391 Questions, Last Updated on Oct 29, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
