▸case-01 A developer needs to run local administrative CLI commands acting as 'deployer@my-project.iam.gserviceaccount.com' without generating or storing long-lived JSON key files on their machine. How should they execute these commands and what IAM role must be granted to their user account? | pass→pass | 20,423 | 10,234 | -50% | 1 | 1 | 0% | 1,532 | 1,629 | +6% | 0 | 0 | — |
▸case-02 A Kubernetes deployment on GKE needs to read objects from a Cloud Storage bucket. Instead of generating service account keys and storing them in Kubernetes secret objects, what native GKE identity mapping mechanism and IAM role binding should be configured? | pass→pass | 7,321 | 7,905 | +8% | 1 | 1 | 0% | 1,412 | 2,135 | +51% | 0 | 0 | — |
▸case-03 A microservice running on Cloud Run needs to connect to a Compute Engine virtual machine hosted at private IP 10.128.0.5 within a GCP VPC network. How can outbound network traffic from Cloud Run be directed into the private VPC network? | pass→pass | 12,556 | 15,353 | +22% | 1 | 1 | 0% | 1,884 | 2,834 | +50% | 0 | 0 | — |
▸case-08 A DevOps engineer needs to configure the local Docker CLI on a build worker machine to authenticate against Google Artifact Registry in region 'us-central1' at 'us-central1-docker.pkg.dev'. What gcloud command configures Docker credentials for this host? | pass→pass | 3,563 | 4,638 | +30% | 1 | 1 | 0% | 449 | 1,043 | +132% | 0 | 0 | — |
▸case-04 An enterprise security mandate requires that Google Kubernetes Engine clusters only run container images that have been cryptographically signed during CI, blocking any unsigned container images at deployment time. Which GCP feature and policy component should be enabled? | pass→pass | 5,350 | 20,690 | +287% | 1 | 1 | 0% | 852 | 1,476 | +73% | 0 | 0 | — |
▸case-05 A Cloud Function written in Node.js needs to retrieve a database password at runtime without hardcoding secrets or passing sensitive values in plaintext environment variables. What GCP service and IAM role should be used? | pass→pass | 5,044 | 6,801 | +35% | 1 | 1 | 0% | 998 | 1,619 | +62% | 0 | 0 | — |
▸case-06 An application writes daily log files to a Cloud Storage bucket named 'app-logs-prod'. Log files older than 30 days must automatically move to Nearline storage, and log files older than 365 days must be permanently deleted. How should this be automated without writing cron jobs? | pass→pass | 9,652 | 10,583 | +10% | 1 | 1 | 0% | 1,813 | 2,057 | +13% | 0 | 0 | — |
▸case-07 A security compliance team requires that BigQuery datasets in 'analytics-prod' cannot be exported to Cloud Storage buckets outside the approved organization boundary, even if a user holds project administrative permissions. What security perimeter mechanism should be configured? | pass→pass | 8,440 | 9,810 | +16% | 1 | 1 | 0% | 1,141 | 1,848 | +62% | 0 | 0 | — |
▸case-09 A Cloud Build pipeline step executes 'kubectl apply' to deploy updated manifests to a GKE cluster, but fails with HTTP 403 authorization errors. Which IAM role must be granted to the Cloud Build service account? | pass→pass | 9,736 | 179,270 | +1741% | 1 | 1 | 0% | 1,386 | 1,810 | +31% | 0 | 0 | — |
▸case-10 A team wants to run production Kubernetes workloads on GCP where Google automatically manages node provisioning, node scaling, OS patching, and cluster security hardening without requiring node pool administration. Which GKE operating mode should be selected? | pass→pass | 3,691 | 5,815 | +58% | 1 | 1 | 0% | 606 | 1,181 | +95% | 0 | 0 | — |
▸case-11 An engineering team wants a managed GCP continuous delivery service to orchestrate progressive canary deployments across staging and production GKE clusters with automated release gates. Which native service handles this pipeline? | pass→pass | 5,332 | 8,407 | +58% | 1 | 1 | 0% | 841 | 1,756 | +109% | 0 | 0 | — |
▸case-12 A developer is creating a Cloud SQL for PostgreSQL instance that must only be reachable via private IP from instances inside a custom VPC. What network connection requirement must be established in the VPC before assigning a private IP to Cloud SQL? | fail→pass | 5,640 | 7,477 | +33% | 1 | 1 | 0% | 757 | 1,650 | +118% | 0 | 0 | — |
▸case-13 A cloud engineer frequently switches between managing resources in 'dev-project' and 'prod-project' on their workstation using the gcloud CLI. Instead of re-authenticating or setting environment variables repeatedly, what gcloud CLI feature manages separate named profiles? | pass→pass | 5,032 | 3,462 | -31% | 1 | 1 | 0% | 905 | 1,051 | +16% | 0 | 0 | — |
▸case-14 Compute Engine instances in VPC network 'app-vpc' need to resolve custom private domain names like 'db.internal.corp' to private IP addresses without broadcasting those records to public DNS resolvers. What GCP DNS configuration is required? | pass→pass | 7,740 | 9,229 | +19% | 1 | 1 | 0% | 1,440 | 2,093 | +45% | 0 | 0 | — |
▸case-15 A data team has a BigQuery dataset containing confidential user tables. They want external analyst teams to query aggregated summary statistics without granting those analysts read permissions on the underlying table data. What BigQuery dataset feature solves this permission issue? | pass→pass | 5,950 | 8,381 | +41% | 1 | 1 | 0% | 916 | 1,945 | +112% | 0 | 0 | — |
▸case-16 An enterprise requires a private, high-capacity 10 Gbps physical network link connecting an on-premises data center to Google Cloud with low latency, strict SLA guarantees, and no public internet transit. Which GCP hybrid connectivity service satisfies this requirement? | pass→pass | 6,838 | 8,103 | +18% | 1 | 1 | 0% | 939 | 1,599 | +70% | 0 | 0 | — |
▸case-17 An infrastructure team uses native GCP declarative IaC templates written in Jinja2 and YAML to provision Compute Engine instances and network resources. Which native GCP tool processes these infrastructure templates? | pass→pass | 3,828 | 3,561 | -7% | 1 | 1 | 0% | 588 | 1,029 | +75% | 0 | 0 | — |
▸case-18 A global banking platform requires a SQL-compliant database in GCP that guarantees strong transactional consistency (ACID) and multi-region replication with horizontal scaling across geographic continents. Which GCP database service meets these requirements? | pass→pass | 6,923 | 7,975 | +15% | 1 | 1 | 0% | 1,117 | 1,672 | +50% | 0 | 0 | — |
▸case-19 A cloud security architect wants to prevent any developer from assigning external public IP addresses to Compute Engine VM instances across all projects in the GCP organization. What organization policy constraint enforces this rule? | pass→pass | 6,076 | 5,804 | -4% | 1 | 1 | 0% | 945 | 1,344 | +42% | 0 | 0 | — |
▸case-20 In a multi-project organization, a central networking project hosts shared subnets. An application project team wants to deploy a GKE cluster attached directly to subnets inside the central host project. What GCP network architecture and IAM role allow this configuration? | pass→pass | 13,509 | 13,143 | -3% | 1 | 1 | 0% | 1,904 | 2,540 | +33% | 0 | 0 | — |
▸case-21 An infrastructure engineer needs to grant an AWS EKS pod running in Kubernetes namespace 'default' read access to an Amazon S3 bucket without embedding long-lived AWS IAM access keys in Kubernetes secrets. How is IAM role mapping configured for EKS pods? | pass→pass | 14,740 | 12,274 | -17% | 1 | 1 | 0% | 2,337 | 2,829 | +21% | 0 | 0 | — |
▸case-22 A cloud administrator managing Microsoft Azure infrastructure wants to automatically move Azure Blob Storage blobs in container 'archive-data' to Cool storage tier after 30 days using Azure CLI commands or policies. What Azure command configures this lifecycle policy? | pass→pass | 8,451 | 6,543 | -23% | 1 | 1 | 0% | 1,693 | 1,870 | +10% | 0 | 0 | — |
▸case-23 A developer running a local k3s Kubernetes cluster on a laptop wants to expose an HTTP web service using Traefik v2 ingress custom resource definitions. What Kubernetes resource kind and API group must be declared in the YAML file? | pass→pass | 8,333 | 5,541 | -34% | 1 | 1 | 0% | 1,263 | 1,499 | +19% | 0 | 0 | — |