Cloud DevOps Engineer Professional-Cloud-DevOps-Engineer Syllabus Exam Questions Answers

To exclude a subset of users or projects from Data Access audit logging, you use the exempted principals configuration. This allows you to selectively disable logs for specific groups, such as developers in the CustomerService folder.

"You can configure exempted principals so that audit logs are not generated for certain users, service accounts, or groups."

— Configuring Audit Logs

"Data Access logs are disabled by default because of their high volume, and you can enable them at the organization, folder, or project level."

— Audit Logs Overview

Thus, enabling audit logging org-wide and exempting a specific set of users (i.e., CustomerService folder) meets the need.

 The best option for mitigating the incident impact on users and enabling the developers to troubleshoot the issue is to change the selector on the Service app-svc to app: my-app, version: blue. A Service is a resource that defines how to access a set of Pods. A selector is a field that specifies which Pods are selected by the Service. By changing the selector on the Service app-svc to app: my-app, version: blue, you can ensure that the Service only routes traffic to the Pods that have both labels app: my-app and version: blue. These Pods belong to the Deployment app-blue, which uses the previous version of the application. This way, you can mitigate the incident impact on users by switching back to the working version of the application. You can also enable the developers to troubleshoot the issue with the new version of the application in the Deployment app-green without affecting users.

To control data residency in Secret Manager, you must use a user-managed replication policy to specify that secrets reside in U.S. regions, satisfying healthcare compliance requirements (e.g., HIPAA, regional residency).

“To ensure that secrets are stored only in certain regions, use user-managed replication.”

— Secret Manager Replication Policies

“If an organization policy restricts the use of the global location, use a user-managed replication policy to comply with those restrictions.”

— Policy Restrictions on Global Resources

Using user-managed replication allows you to explicitly define U.S. regions while resolving the policy block.

Comprehensive and Detailed 150 to 200 words of Explanation From Google Cloud DevOps guides documents:

In incident management, the primary goal during the "Mitigation" phase is to restore service levels as quickly as possible, often referred to as "stopping the bleeding." Google Cloud’s SRE principles emphasize that during a high-priority incident, you should prioritize actions that have an immediate impact over long-term fixes or deep-dive forensics. While a rollback (Option C) is a standard procedure, the 15-minute CI/CD overhead is too slow when a critical payment service is failing. Using Cloud Profiler (Option A) is a diagnostic step that should be reserved for the post-mortem phase, not the heat of the outage.

Canceling the active Dataflow job (Option D) is the fastest way to alleviate the pressure on the shared Memorystore instance. Since the Dataflow pipeline is "non-critical" and "batch-based," stopping it has a low business impact compared to the payment service outage. Once the job is canceled, the write pressure on Redis drops instantly, reducing read latency and restoring the payment service to health. This aligns with the SRE practice of "shedding load" to protect critical system components. Once the immediate crisis is resolved, the team can then investigate the root cause and implement long-term fixes like rate limiting or resource isolation.