Cloud DevOps Engineer Advanced Practice Exam: Hard Questions 2025

Your enterprise is migrating to Google Cloud and must bootstrap an organization for 40 teams. Requirements: least-privilege by default, strong separation between prod and non-prod, centralized networking, and the ability for app teams to self-serve new projects via automation. Security requires that only centrally managed service accounts can create projects and that all projects inherit mandatory org policies (no external IPs by default, restricted services, CMEK where applicable). What is the best approach?

A regulated company wants to centrally manage organization policies and IAM bindings using GitOps. Changes must be reviewed and applied automatically, but only from an approved pipeline identity. The security team also wants to prevent out-of-band changes in the console from persisting. Which design best meets these requirements with strong guardrails?

You maintain a CI/CD pipeline deploying to GKE. Builds are triggered on pull requests and merges. A recent supply-chain incident prompted new requirements: (1) only signed images can be deployed, (2) provenance must be verifiable, (3) deploy must be blocked if vulnerabilities above a severity threshold are found, and (4) policy enforcement must happen at deploy time even if artifacts were built earlier. What is the best solution on Google Cloud?

A platform team is standardizing release strategies for microservices on Cloud Run. They want progressive delivery with canary releases, automated rollback based on SLO-based error budgets, and minimal custom orchestration code. Deployments should also support traffic splitting and quick promotion. What is the best approach?

A mono-repo contains 60 services. Only a subset should be rebuilt and redeployed on each change. You must reduce CI time while ensuring correct dependency rebuilds. Requirements: (1) avoid rebuilding unaffected services, (2) detect changes that impact shared libraries, (3) keep pipelines maintainable, and (4) provide deterministic behavior across branches. Which design is best?

Your SRE team runs a multi-region user-facing service on GKE with an external HTTP(S) load balancer. During an incident, latency increased and error rate spiked only for users in one geography. Metrics show the GKE pods are healthy, but backend 5xx errors increased and the load balancer is still sending traffic to an unhealthy zone intermittently. You need a design that reduces time-to-detect and ensures traffic is drained quickly when a zone degrades, without overreacting to transient blips. What should you do?

A team has an SLO of 99.9% for a critical API. They currently page on any 5-minute error-rate breach, causing frequent alert fatigue during minor deploys even though monthly availability remains within SLO. They want an alerting strategy aligned to error budgets that catches rapid, catastrophic failures quickly while reducing noise from small, short-lived regressions. What should you implement?

A batch processing pipeline runs on GKE and uses autoscaling. After a recent change, costs increased sharply. Investigation shows nodes are underutilized but cannot scale down; many pods have requests far higher than actual usage, and some use local PersistentVolumes. You must reduce costs while keeping job throughput stable and avoiding data loss. What is the best approach?

Your service uses Cloud Spanner and is experiencing periodic high tail latency during peak hours. CPU utilization is moderate, but you observe increased lock waits and aborted transactions. The team proposes adding more nodes, but finance wants evidence and a plan that optimizes both performance and cost. What should you do first?

A production incident occurred after a Terraform apply unintentionally replaced a critical managed instance group due to a change in an immutable field. The rollout caused downtime despite having health checks. You must redesign operations to reduce the blast radius of IaC changes, ensure safer rollouts, and enable rapid recovery. What is the best solution?