Professional Cloud Architect · Domain 6: Ensuring solution and operations excellence · 12% of the exam
Task 6.6: Ensuring the reliability of solutions in production (e.g., chaos engineering, penetration testing, and load testing)
Fault injection and chaos testing, load testing at production scale, penetration testing within Google Cloud's rules, and DR drills.
Study it
Chaos engineering, load testing and penetration testing
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Google Cloud documentation page that proves it.
Question 1 · choose 1
A security team plans to run a penetration test next month against the web application and VMs in the company's own Google Cloud projects. What does the team need to do with respect to Google?
AOpen a support case asking Google to approve the test, and wait for written approval
BUpgrade the support plan so that Google support can authorize the test window
CRoute the test traffic through Cloud Armor so that Google can see it is authorized
DNo notice needed; follow the Acceptable Use Policy and Terms of Service on its own projects
Show the answer and why
AOpen a support case asking Google to approve the test, and wait for written approval
Incorrect
No approval is required, so waiting for one would only delay the test.
BUpgrade the support plan so that Google support can authorize the test window
Incorrect
Support plans have nothing to do with permission to test your own projects.
CRoute the test traffic through Cloud Armor so that Google can see it is authorized
Incorrect
Cloud Armor protects applications; it is not a channel for declaring tests to Google.
DNo notice needed; follow the Acceptable Use Policy and Terms of Service on its own projects
Correct
Google does not require notification for penetration tests; the tests must follow the Acceptable Use Policy and Terms of Service and affect only the customer's projects.
Penetration testing is part of ensuring reliability and security in production. On Google Cloud it needs no prior notice, only adherence to the policies and a scope limited to your own resources.
A team plans its first chaos experiment in production: shutting down nodes in one zone of a multi-zone GKE cluster. Following the reliability pillar's guidance on testing recovery from failures, which TWO preparations should the team make? (Choose TWO.)
ATell operations and application owners the schedule, scope and impact
BKeep the experiment secret from on-call staff to get a true reaction
CStart with a full regional disconnection to cover the worst case
DHave automated monitoring and a manual rollback procedure ready first
ETurn off the alerting policies for the cluster during the test
Show the answer and why
ATell operations and application owners the schedule, scope and impact
Correct
The guidance asks teams to inform stakeholders about a test's schedule, scope and potential impact in advance.
BKeep the experiment secret from on-call staff to get a true reaction
Incorrect
Surprising responders risks a real incident and goes against informing stakeholders.
CStart with a full regional disconnection to cover the worst case
Incorrect
Beginning with the largest failure maximizes risk before smaller scenarios are understood.
DHave automated monitoring and a manual rollback procedure ready first
Correct
Tests in production need safety measures such as automated monitoring and manual rollback procedures.
ETurn off the alerting policies for the cluster during the test
Incorrect
Silencing alerts removes the safety signal that tells the team to stop.
Chaos engineering is planned, not reckless: stakeholders are told, safety measures are ready, and findings feed a postmortem.
A team wants regular automated scanning of its public web application on GKE for common vulnerabilities such as cross-site scripting and mixed content, as part of its production security testing. Which Google Cloud capability fits?
AWeb Security Scanner in Security Command Center
BArtifact Analysis scanning of the container images
CCloud Armor preconfigured WAF rules on the load balancer
DVPC Flow Logs analyzed with Observability Analytics
Show the answer and why
AWeb Security Scanner in Security Command Center
Correct
Web Security Scanner crawls public App Engine, GKE and Compute Engine web applications and identifies vulnerabilities and misconfigurations.
BArtifact Analysis scanning of the container images
Incorrect
Scanning images does not test the running web application for flaws such as cross-site scripting.
CCloud Armor preconfigured WAF rules on the load balancer
Incorrect
WAF rules block attacks; they do not test the application for weaknesses.
DVPC Flow Logs analyzed with Observability Analytics
Incorrect
Flow logs show network traffic, not application vulnerabilities.
Penetration-style testing of running applications complements image scanning and WAF protection. Web Security Scanner automates part of that testing for public apps.
A Cloud SQL for MySQL instance runs with high availability. The team has never seen a failover and does not know how the application's connection handling will behave. What should the architect recommend?
AWait for a real zone outage, since HA fails over automatically anyway when needed
BInitiate a manual failover in a planned window and observe the application
CDelete the primary instance to force the standby to take over
DCreate a read replica and send the application's writes to it
Show the answer and why
AWait for a real zone outage, since HA fails over automatically anyway when needed
Incorrect
Waiting for a real outage means learning about connection problems during an incident.
BInitiate a manual failover in a planned window and observe the application
Correct
Testing failover is recommended so you can see how your application responds when the instance fails over.
CDelete the primary instance to force the standby to take over
Incorrect
Deleting the instance destroys it; it is not a failover test.
DCreate a read replica and send the application's writes to it
Incorrect
Read replicas do not accept writes and do not exercise the HA failover.
Reliability in production depends on recovery mechanisms that have been exercised. Cloud SQL lets you trigger a failover to test the application's behavior.
Services on GKE use Cloud Service Mesh. The team wants to verify in a staging-like production slice that callers handle a slow or failing downstream service correctly, by adding delays and errors to a share of requests without changing any code. What should the architect use?
ANode auto-repair turned off on the downstream service's node pool
BA Cloud Armor rate-limiting rule placed on the downstream service
CA fault injection policy on the route that adds delays and aborts
DA smaller CPU limit on the downstream Pods to slow their responses
Show the answer and why
ANode auto-repair turned off on the downstream service's node pool
Incorrect
Auto-repair settings change how unhealthy nodes are handled; they do not inject latency or errors into requests.
BA Cloud Armor rate-limiting rule placed on the downstream service
Incorrect
Cloud Armor rate limiting does not inject delays or errors into calls between services inside the mesh.
CA fault injection policy on the route that adds delays and aborts
Correct
Cloud Service Mesh fault injection introduces errors and latency on requests to simulate failures such as high latency and service overload.
DA smaller CPU limit on the downstream Pods to slow their responses
Incorrect
This changes the service's resources unpredictably rather than injecting controlled faults.
Fault injection is a controlled chaos technique: the mesh adds failures to chosen traffic so teams can test resilience without modifying applications.