Google Professional Cloud Developer 1-10

In an Apigee Quota policy, setting the Synchronous attribute to false processes the count update asynchronously, so each request can return a response without waiting for the counter update to complete.
The question prioritizes API response speed over guaranteeing “exactly 1,000 times,” and asynchronous counting delivers high performance while tolerating a small margin of error.
Resetting the quota when a reservation is completed or after 24 hours can also be configured within the policy.
Approaches that use BigQuery or Firestore offer high counting accuracy but incur a read/write on every request, which is a disadvantage for speed.
The in-memory approach cannot share the counter across multiple instances and lacks reliability.
Apigee Quota policy (official documentation)

Cloud Run is a fully managed serverless platform that automatically scales with request volume and can scale in to zero while there is no traffic.
It flexibly handles unpredictable traffic and sudden spikes while charging only for what you use, so it avoids over-provisioning and best fits the cost-optimization requirement.
Compute Engine (both managed and unmanaged) scales at the VM level, cannot shrink to zero, and takes time to start up, making it unsuitable.
GKE cluster autoscaling takes time to add nodes and is prone to over-provisioning, so it is inferior for this requirement.
What is Cloud Run (official documentation)

When investigating a VM that fails to start, Google’s recommended approach is to inspect the serial console (serial port output).
Even when startup fails, the serial port output records messages from the boot process, so you can directly identify the cause of the startup failure.
Serial port output can also be forwarded to Cloud Logging to be stored and reviewed.
Mounting the disk locally (A) involves considerable effort and may make it hard to obtain boot-stage logs.
Rebuilding locally (B) or re-requesting a build (C) does not lead to investigating the cause itself.
Troubleshooting using the serial console (official documentation)

For delivering static content, using a Cloud Storage bucket as the backend significantly reduces management overhead compared with operating VMs.
The optimal combination is a multi-region Cloud Storage bucket for high availability, an external HTTP(S) load balancer for global access, and Cloud CDN for low-latency delivery.
A regional bucket (C) is limited to a single region and is inferior in terms of availability.
The instance group approaches (A and B) require replicating and managing VMs, which conflicts with the requirement to minimize management overhead.
Setting up Cloud CDN with a Cloud Storage bucket (official documentation)

The Functions Framework is an official library provided by Google for running and testing Cloud Function code in a local environment.
Because you can invoke the function locally using tools such as curl to validate it, you can greatly speed up the development cycle without waiting for a deployment, and this is Google’s recommended best practice.
Testing in production (D) is high risk and not recommended.
Rewriting to an HTTP trigger (B) or integrating with audit logs (A) cannot reproduce the original trigger condition and adds unnecessary complexity.
Functions Framework (official documentation)

To make infrastructure creation and modification version-controlled and auditable, you need a configuration that manages Infrastructure as Code (IaC) with Git.
The configuration that stores source code and infrastructure definitions in Git, deploys with Cloud Build and Terraform, and deploys to the serverless Cloud Function (A) satisfies all requirements.
gcloud commands (D) cannot provide declarative version control and violate the auditability requirement.
Jenkins (B) is not Google-managed and requires self-management.
Deploying to Compute Engine (C) does not satisfy the serverless requirement.
Best practices for Terraform (official documentation)

To achieve separation of duties, it is important to divide key management and key usage into separate permissions and separate projects.
Placing Cloud KMS in a dedicated project (A) and not assigning an owner to that project (B) is Google’s recommended configuration, as it eliminates the existence of a privileged user who could manage and use the keys single-handedly.
Having an organization-level administrator control only the IAM policy preserves the separation.
Co-locating with the key-using project (C) or granting the KMS admin role to the using-side owner (D) violates the separation principle.
Cloud KMS separation of duties (official documentation)

A service mesh (Istio / now the Google-managed Cloud Service Mesh) injects sidecar proxies to achieve automatic encryption via mutual TLS (mTLS) without changing application code.
Simply enabling proxy injection and mTLS encrypts all in-cluster traffic with minimal changes and maintains Google support.
Network Policies (A) control traffic but do not encrypt it.
Defining a trusted range within the app (C) or manually embedding Let’s Encrypt certificates (D) involves large changes to the application and conflicts with the requirement.
Cloud Service Mesh mTLS (official documentation)

The standard command to copy local files to Cloud Storage is gsutil cp.
The syntax gsutil cp [LOCAL_OBJECT] gs://[BUCKET_NAME]/ uploads directly from on-premises to Cloud Storage, and this is the correct command.
gcloud cp and gcloud dataproc cp do not exist as object-copy commands.
hadoop fs cp is intended for operations within HDFS and is not suitable for an initial upload from local.
Note that the newer gcloud storage cp is now also available, but among these options gsutil cp is the correct answer.
gsutil cp command (official documentation)

GKE has a “cluster notifications” feature that delivers events such as upgrade information and security bulletins affecting a specific cluster to a Pub/Sub topic.
Configuring cluster notifications to be sent to a Pub/Sub topic lets you receive events relevant to the target cluster in real time and automatically.
BigQuery scheduled queries (B) and querying the GKE API (C) require active polling.
An RSS subscription (D) covers release notes for all of GKE and is not suitable for event notifications specific to your own cluster.
Cluster notifications (official documentation)