For this question, refer to the HipLocal case study.
A recent security audit discovers that HipLocal's database credentials for their Compute Engine-hosted MySQL databases are stored in plain text on persistent disks. HipLocal needs to reduce the risk of these credentials being stolen. What should they do?

• A.Create a service account and download its key. Use the key to authenticate to Cloud Key Management Service (KMS) to obtain the database credentials.
• B.Create a service account and download its key. Use the key to authenticate to Cloud Key Management Service (KMS) to obtain a key used to decrypt the database credentials.
• C.Create a service account and grant it the roles/iam.serviceAccountUser role. Impersonate as this account and authenticate using the Cloud SQL Proxy.
• D.Grant the roles/secretmanager.secretAccessor role to the Compute Engine service account. Store and access the database credentials with the Secret Manager API.

Comment: *

Name: *

Email: *

Verification: *

Your application is deployed on hundreds of Compute Engine instances in a managed instance group (MIG) in multiple zones. You need to deploy a new instance template to fix a critical vulnerability immediately but must avoid impact to your service. What setting should be made to the MIG after updating the instance template?

• A.Set the Max Surge to 100%.
• B.Set the Update mode to Opportunistic.
• C.Set the Maximum Unavailable to 100%.
• D.Set the Minimum Wait time to 0 seconds.

Comment: *

Name: *

Email: *

Verification: *

You plan to deploy a new application revision with a Deployment resource to Google Kubernetes Engine (GKE) in production. The container might not work correctly. You want to minimize risk in case there are issues after deploying the revision. You want to follow Google-recommended best practices. What should you do?

• A.Perform a rolling update with a PodDisruptionBudget of 80%.
• B.Perform a rolling update with a HorizontalPodAutoscaler scale-down policy value of 0.
• C.Convert the Deployment to a StatefulSet, and perform a rolling update with a PodDisruptionBudget of 80%.
• D.Convert the Deployment to a StatefulSet, and perform a rolling update with a HorizontalPodAutoscaler scale-down policy value of 0.

Comment: *

Name: *

Email: *

Verification: *

You have containerized a legacy application that stores its configuration on an NFS share. You need to deploy this application to Google Kubernetes Engine (GKE) and do not want the application serving traffic until after the configuration has been retrieved. What should you do?

• A.Use the gsutil utility to copy files from within the Docker container at startup, and start the service using an ENTRYPOINT script.
• B.Create a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.
• C.Use the COPY statement in the Dockerfile to load the configuration into the container image.
  Verify that the configuration is available, and start the service using an ENTRYPOINT script.
• D.Add a startup script to the GKE instance group to mount the NFS share at node startup. Copy the configuration files into the container, and start the service using an ENTRYPOINT script.

Comment: *

Name: *

Email: *

Verification: *

You need to containerize a web application that will be hosted on Google Cloud behind a global load balancer with SSL certificates. You don't have the time to develop authentication at the application level, and you want to offload SSL encryption and management from your application. You want to configure the architecture using managed services where possible What should you do?

• A.Host the application on Google Kubernetes Engine, and deploy cert-manager to manage SSL certificates.
• B.Host the application on Compute Engine, and configure Cloud Endpoints for your application.
• C.Host the application on Google Kubernetes Engine and use Identity-Aware Proxy (IAP) with Cloud Load Balancing and Google-managed certificates.
• D.Host the application on Google Kubernetes Engine, and deploy an NGINX Ingress Controller to handle authentication.

Comment: *

Name: *

Email: *

Verification: *