Google Cloud Professional Cloud Developer Practice Exam

What the Google Cloud Professional Cloud Developer exam covers

• Designing Cloud-Native Applications251 questions
• Building and Testing Applications199 questions
• Deploying Applications145 questions
• Integrating Google Cloud Services168 questions

Free Google Cloud Professional Cloud Developer sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 763.

1. Question 1Designing Cloud-Native Applications

   You are building a web application that runs on multiple instances behind a load balancer and scales horizontally. Where should user session state be kept so that any instance can serve any user's request?

   • AIn a shared external store such as Memorystore for Redis that every instance can accessCorrect
   • BIn each instance's local process memory, which new instances inherit automatically on scale out
   • CIn each instance's local memory, relying on the autoscaler to replicate it to new instances
   • DIn local memory on the first instance, which then pushes it to instances added later
   ✓ Correct answer: A

   Each instance runs its own isolated process memory, so an instance added during a scale out event cannot see session data held only in another instance. Externalizing session state to a shared store such as Memorystore for Redis lets any instance serve any request and keeps the application layer stateless.

   Why the other options are wrong

   • BProcess memory is not shared between instances, so new instances start empty rather than inheriting state.
   • CAutoscalers do not replicate process memory between instances.
   • DThere is no mechanism that pushes one instance's in memory state to instances added later.
2. Question 2Designing Cloud-Native Applications

   A product page calls a personalization microservice to render tailored banners. During an incident, the personalization service is completely unavailable, and the team wants shoppers to still see the page with generic banners rather than an error page. Which design principle does this behavior represent?

   • ALoad shedding, deliberately rejecting a fixed percentage of all incoming requests outright
   • BGraceful degradation, falling back to reduced functionality rather than failing entirelyCorrect
   • CBlue green deployment, routing all traffic over to a previous stable service version
   • DHorizontal scaling, adding more personalization service instances to absorb the load
   ✓ Correct answer: B

   Graceful degradation means a system keeps serving a useful, if less tailored, experience when a non-critical dependency is unavailable, instead of surfacing an error to the user. Scaling, blue green deployment, and load shedding are all valid resilience techniques but describe capacity management or traffic routing rather than substituting a fallback experience.

   Why the other options are wrong

   • ALoad shedding intentionally rejects some requests to protect capacity, which is different from substituting reduced content for a failed call.
   • CBlue green deployment is a release strategy for shifting traffic between application versions, not a runtime fallback for a failed dependency call.
   • DAdding instances addresses capacity during load, but it does not describe substituting a fallback experience when a dependency is entirely down.
3. Question 3Designing Cloud-Native Applications

   A developer tries to connect to a Memorystore for Redis instance directly from her home laptop using its internal IP address and the connection fails. What is the most likely reason?

   • AMemorystore instances require a signed URL for every single connection attempt
   • BMemorystore instances are reachable only from within the same VPC, not the internetCorrect
   • CMemorystore instances require the client to authenticate with a service account key file
   • DMemorystore instances only accept connections from Cloud CDN edge locations
   ✓ Correct answer: B

   To reach the instance from outside the VPC, such as from a developer's laptop or from a serverless environment, traffic must go through a mechanism like a VPN, a bastion host, or a Serverless VPC Access connector that places the caller inside the VPC's network path. A direct connection from an arbitrary external network is expected to fail.

   Why the other options are wrong

   • ASigned URLs are a Cloud CDN and Cloud Storage access control mechanism, not something Redis clients use to connect.
   • CRedis connections use its own authentication mechanism such as an auth token, not a service account key file.
   • DCloud CDN edge locations serve cached HTTP content and have no special relationship to connecting to a Redis instance.
4. Question 4Designing Cloud-Native ApplicationsSelect all that apply

   An architecture review at Northwind Traders is deciding between Apigee and Cloud Endpoints for a new external partner API program. Which of the following reasons would justify choosing Apigee over Cloud Endpoints? Choose two.

   • AThe team wants the lowest cost option with no separate proxy component to manage at all
   • BThe program needs a built in developer portal and partner monetization plansCorrect
   • CThe backend is a gRPC service on GKE needing HTTP to gRPC transcoding
   • DThe backend is a single Cloud Function needing only basic API key validation
   • EThe program needs to front both Google Cloud backends and legacy on premises systems under one policy layerCorrect
   ✓ Correct answer: B, E

   Apigee's developer portal and monetization features, along with its ability to sit in front of hybrid backends spanning cloud and on premises systems, are its distinguishing strengths for an external partner program. A fully serverless option with no separate proxy to manage points toward Cloud API Gateway instead, and a simple Cloud Function needing only basic API key checks does not need Apigee's heavier feature set. A GKE hosted gRPC service needing HTTP to gRPC transcoding is a scenario that Cloud Endpoints with its Extensible Service Proxy is specifically built to handle.

   Why the other options are wrong

   • AWanting the lowest cost option with no separate proxy to manage describes the fully serverless Cloud API Gateway model rather than Apigee.
   • CA GKE hosted gRPC service needing HTTP to gRPC transcoding is a scenario that Cloud Endpoints with the Extensible Service Proxy is specifically designed to handle.
   • DA single Cloud Function needing only basic API key validation is a lightweight scenario better suited to Cloud API Gateway than to Apigee's enterprise feature set.
5. Question 5Building and Testing Applications

   Which statement accurately describes trunk-based development?

   • ADevelopers keep long lived feature branches open for several weeks or more before finally merging them
   • BDevelopers integrate small changes into main frequently using short lived branchesCorrect
   • CDevelopers commit only to personal forks that are never merged into main
   • DDevelopers merge into main exactly once per release cycle
   ✓ Correct answer: B

   In trunk-based development, developers avoid long lived branches and merge small increments into the trunk often, sometimes several times a day. This reduces merge conflicts and keeps main close to a releasable state, contrasting with workflows built around long lived feature branches.

   Why the other options are wrong

   • ALong lived feature branches are the opposite of trunk-based development.
   • CChanges are merged into the trunk, not kept in unmerged forks.
   • DTrunk-based development merges frequently, not once per release.
6. Question 6Building and Testing ApplicationsSelect all that apply

   A team is drafting internal guidance on connecting application code to Cloud SQL securely. Which three practices are accurate recommendations? (Choose three.)

   • AAssume the proxy removes the need for any database level user credentials entirely
   • BSize the application's connection pool with the number of concurrent serverless instances in mindCorrect
   • CGrant the connecting identity the Cloud SQL Client IAM role needed to establish the connectionCorrect
   • DStore the database root password directly in the application source code for convenient quick access during outages
   • EUse the Cloud SQL Auth Proxy or a language connector instead of a public IP with only a static passwordCorrect
   ✓ Correct answer: B, C, E

   The proxy or a language connector secures and authorizes the network path, but the connecting identity still needs an IAM role such as Cloud SQL Client, and pool sizing must reflect that each serverless instance keeps its own separate pool. Together these three practices prevent both security gaps and connection exhaustion.

   Why the other options are wrong

   • AThe proxy secures the network path and can support IAM database authentication, but a database user or IAM database identity is still required.
   • DEmbedding a root password directly in source code is a poor security practice regardless of how the connection is established.
7. Question 7Deploying Applications

   A team notices that their canary analysis only checks HTTP error rate, but a recent bad release actually caused a spike in downstream queue processing latency without raising HTTP errors. What should they add to their progressive delivery metrics to catch this class of issue in the future?

   • AA second HTTP error rate check on the exact same endpoint
   • BA much shorter manual approval timeout configured on the production target
   • CA higher starting canary traffic percentage used for safety
   • DA latency or throughput metric for the specific downstream dependencyCorrect
   ✓ Correct answer: D

   Since the regression showed up as slower queue processing rather than failed HTTP requests, a canary analysis that only watches request errors would miss it entirely, so including a metric tied to that specific downstream behavior gives visibility into this failure mode. Repeating the same HTTP check would not surface a problem that never manifested as an HTTP error in the first place.

   Why the other options are wrong

   • AAdding a duplicate HTTP error rate check does not introduce any new visibility into the downstream latency issue that was actually missed.
   • BShortening the approval timeout affects how quickly a human must act, it does not add any new signal for catching this metric gap.
   • CIncreasing the starting canary percentage would expose more traffic to the same undetected problem rather than helping detect it.
8. Question 8Deploying ApplicationsSelect all that apply

   Which three trigger categories are supported for invoking a Cloud Function (2nd gen)? Choose three.

   • ADirect polling triggers configured on the function itself
   • BHTTP triggers for direct invocation from clientsCorrect
   • CPub/Sub message triggers routed through EventarcCorrect
   • DCloud Storage object triggers routed through EventarcCorrect
   • EManual triggers requiring console based invocation only
   ✓ Correct answer: B, C, D

   HTTP triggers expose a callable URL, while Eventarc standardizes delivery of events from sources like Pub/Sub and Cloud Storage into a common trigger format the function consumes. Functions do not implement their own polling logic to detect changes, and invocation is not restricted to manual action in the console since triggers and direct calls both work.

   Why the other options are wrong

   • A2nd gen functions are event driven and do not implement polling logic themselves to check for changes.
   • EFunctions can be invoked programmatically or by their configured trigger, invocation is not limited to manual console action.
9. Question 9Integrating Google Cloud Services

   A logistics application publishes shipment update events using ordering keys equal to shipment ID. Two different shipments publish events around the same time. What ordering guarantee applies?

   • AEach shipment ID's events arrive in publish order, other IDs are not guaranteedCorrect
   • BEvents across all shipments are delivered in strict global publish order
   • CEvents are delivered in order only if they are published within the same one second window
   • DEvents are reordered alphabetically by shipment ID before being delivered to subscribers
   ✓ Correct answer: A

   Pub/Sub delivers messages carrying the same ordering key in the sequence they were successfully published, but it makes no promise about the relative order of messages that carry different ordering keys, even if they were published close together in time.

   Why the other options are wrong

   • BPub/Sub does not guarantee any ordering across different ordering keys, only within the same key.
   • COrdering is determined by the key and publish sequence, not by a shared time window such as messages published in the same second.
   • DPub/Sub delivers messages for a key in publish order, it does not reorder messages alphabetically by any field.
10. Question 10Integrating Google Cloud ServicesSelect all that apply

    A team is formally defining an SLO for their notifications API for the first time. Choose two components they must define for the SLO to be meaningful.

    • AA fixed sampling ratio for trace collection
    • BAn indicator that measures the user experienceCorrect
    • CA minimum number of running service instances
    • DA dedicated on call rotation for incidents
    • EA target value over a set compliance periodCorrect
    ✓ Correct answer: B, E

    An SLO is fundamentally a target applied to an SLI, so a team must first choose what to measure, such as successful request ratio or latency, and then set a numeric goal like 99.9 percent along with the time window it applies to, such as 30 days. An on call rotation is an operational practice that may respond to SLO breaches but is not part of the SLO definition itself, a minimum instance count is an infrastructure setting, and a trace sampling ratio is an unrelated tracing configuration.

    Why the other options are wrong

    • AA trace sampling ratio configures how much tracing data is collected, it has no role in defining an SLO's indicator or target.
    • CA minimum instance count is an infrastructure scaling setting, it is not part of how an SLO itself is defined.
    • DAn on call rotation is an operational response mechanism, it is not one of the components that mathematically defines an SLO.

Related Google resources

• Google Cloud Professional Cloud Developer study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Google Cloud Professional Cloud Security Engineer practice examRelated
• Google Cloud Professional Cloud Network Engineer practice examRelated
• Associate Google Workspace Administrator practice examRelated

Google Cloud Professional Cloud Developer practice exam FAQ