10 exam-style questions with answers and explanations, straight from our 1,031-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The CDE exam has 60 questions and runs 2 hours.
These 10 free CDE questions are organized by exam domain, so you can see how each part of the Professional Cloud DevOps Engineer blueprint is tested. Reveal the answer and explanation under each question.
A platform team grants a group the Viewer role at the folder level. That folder contains three projects, and one of them also has a separate IAM binding giving the same group the Editor role. What effective access does the group have on that one project?
Correct answer: A - Editor, because IAM policies are additive and the union of the roles applies
A team manages Google Cloud infrastructure declaratively and wants the platform to continuously reconcile resources back to their desired state, automatically correcting any manual change an engineer makes in the console. Which approach BEST meets this requirement?
Correct answer: C - Use Config Connector to manage the resources as Kubernetes objects
A GitHub Actions workflow must deploy to Google Cloud, but company policy applies the organization constraint that disables service account key creation. Which authentication method should the pipeline use?
Correct answer: A - Workload Identity Federation to exchange the runner's OIDC token for short-lived credentials
An enterprise runs dozens of GKE clusters across several regions and teams, and wants to manage configuration, policy, and multi-cluster services consistently across all of them as a single logical unit. Which Google Cloud construct is designed for this?
Correct answer: D - A fleet, the grouping used to manage clusters as one unit
A payments service is shipping a release that changes internal behavior in a way a mixed old-and-new fleet cannot tolerate. The team needs to revert to the previous version instantly and can afford to run a second full environment temporarily. Which deployment strategy fits BEST?
Correct answer: C - Blue/green, cutting all traffic over at once with the old version kept warm
A CI/CD pipeline builds a container image, runs it through staging tests, and then deploys to production. What is the Google-recommended practice for what gets deployed to production?
Correct answer: B - Promote the exact same immutable artifact that was tested in staging
A security team wants to guarantee that only container images that have passed vulnerability scanning and been signed by the approved build process can be deployed to a GKE cluster, blocking any untrusted image at deploy time. Which service enforces this?
Correct answer: C - Binary Authorization with an enforced attestation policy on the cluster
A team wants a managed, opinionated continuous delivery service to promote a release through dev, staging, and production targets, with a required manual approval before the production promotion. Which Google Cloud service provides this natively?
Correct answer: D - Cloud Deploy delivery pipelines with a required approval gate before prod
During an automated canary rollout, the new revision begins serving a small percentage of traffic. On what basis should the pipeline decide whether to advance the canary to the next phase or roll it back?
Correct answer: B - Application telemetry such as error rate and latency compared against thresholds
A team states: '99.9% of requests will complete in under 300 ms, measured over a rolling 28-day window.' In SRE terminology, this statement is an example of a(n):
Correct answer: B - Service Level Objective (SLO), the internal target set for the SLI
The CDE exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,021 more CDE questions with explanations.
Continue in the free practice test →
View plans