Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. What does Managed Service for Prometheus replace?

   1. AYour applications' metrics endpoints
   2. BRunning and scaling Prometheus storage yourself: managed collectors scrape, Google stores the data, and you query with PromQL
   3. CCloud Logging
   4. Dkubectl top
   Show answer

   B. Apps still expose /metrics; collection rules are PodMonitoring resources; storage and global querying are managed.

   From lesson 11 · Observability: Cloud Logging, Cloud Monitoring & Managed Prometheus

2. Q2. The logging bill doubled. What is the usual first fix?

   1. ADelete the cluster
   2. BFind the noisiest sources and add exclusion filters (or lower verbosity), and route only what's needed to long-retention buckets
   3. CTurn off all logs
   4. DSwitch to zonal
   Show answer

   B. Ingestion volume drives cost. Exclusions and sinks control what is stored where; app log levels control what is produced.

   From lesson 11 · Observability: Cloud Logging, Cloud Monitoring & Managed Prometheus

3. Q3. Why alert on SLO burn rate rather than on every error?

   1. AIt's cheaper
   2. BIt pages when users are actually affected at a rate that threatens the objective, and ignores short harmless blips
   3. CErrors don't matter
   4. DCloud Monitoring can't alert on errors
   Show answer

   B. Burn-rate alerts (fast and slow windows) catch real incidents early with far fewer false pages.

   From lesson 11 · Observability: Cloud Logging, Cloud Monitoring & Managed Prometheus

4. Q4. What does application-layer secrets encryption add?

   1. ANothing, etcd is already encrypted
   2. BKubernetes Secrets are encrypted with a key you hold in Cloud KMS, on top of Google's default storage encryption, so you can rotate or revoke it
   3. CIt encrypts Pod traffic
   4. DIt hides Secrets from kubectl
   Show answer

   B. Envelope encryption with a customer-managed key gives you control and auditability of the key; anyone with RBAC read on Secrets can still read them.

   From lesson 12 · Security: nodes, secrets, policy and supply chain

5. Q5. What does Binary Authorization enforce?

   1. APassword strength
   2. BThat only images meeting a policy (for example signed by your CI after tests and scans) may be deployed
   3. CNetwork policy
   4. DNode upgrades
   Show answer

   B. It's an admission check against attestations, closing the gap between 'we scan images' and 'only scanned images run'.

   From lesson 12 · Security: nodes, secrets, policy and supply chain

6. Q6. When is GKE Sandbox (gVisor) worth using?

   1. AFor every Pod
   2. BFor untrusted or multi-tenant code, where an extra kernel boundary between the container and the node is worth some performance cost
   3. CFor databases
   4. DNever
   Show answer

   B. gVisor intercepts system calls in a user-space kernel. It reduces the impact of container escapes but adds overhead and has compatibility limits.

   From lesson 12 · Security: nodes, secrets, policy and supply chain

7. Q7. A peak sales period is coming. How do you stop GKE upgrading the cluster then, without leaving the release channel?

   1. ADelete the release channel
   2. BAdd a maintenance exclusion covering the period, with a scope such as no minor or node upgrades
   3. CTurn off the cluster
   4. DSwitch to a zonal cluster
   Show answer

   B. Exclusions block automatic upgrades for a period (scopes differ in what they block and how long they may last); windows say when upgrades may run otherwise.

   From lesson 13 · Upgrades: release channels, maintenance windows & node upgrade strategies

8. Q8. When is a blue-green node pool upgrade better than a surge upgrade?

   1. ANever
   2. BWhen you want a soak period and a fast rollback: the old nodes stay until the new ones prove healthy
   3. CFor dev clusters only
   4. DWhen you have no quota
   Show answer

   B. Blue-green needs capacity for a second set of nodes but allows rollback during the soak. Surge is cheaper and faster but has no built-in rollback.

   From lesson 13 · Upgrades: release channels, maintenance windows & node upgrade strategies

9. Q9. What can stop GKE from automatically upgrading a cluster to a new minor version?

   1. ANothing
   2. BDetected use of APIs removed in that version, maintenance exclusions, or the version not yet being the channel's target
   3. CHigh CPU
   4. DToo many namespaces
   Show answer

   B. GKE checks deprecated API usage and pauses automatic minor upgrades when workloads still call removed APIs; fix the callers using the deprecation insights.

   From lesson 13 · Upgrades: release channels, maintenance windows & node upgrade strategies

10. Q10. Why remove the default node pool and manage node pools as separate Terraform resources?

    1. AThe default pool is slower
    2. BNode pools can then be added, changed or replaced independently, without Terraform wanting to change or recreate the cluster
    3. CIt's required by GKE
    4. DTo save the cluster fee
    Show answer

    B. Many node pool settings are immutable; inline pools tie those changes to the cluster resource. Separate google_container_node_pool resources keep changes small and safe.

    From lesson 14 · Terraform, GitOps & fleets across cloud and on-prem

11. Q11. What should Terraform manage, and what GitOps?

    1. ATerraform everything
    2. BTerraform: Google Cloud resources (projects, network, cluster, node pools, IAM). GitOps: what runs inside the cluster (namespaces, RBAC, add-ons, apps)
    3. CGitOps everything
    4. DNeither
    Show answer

    B. Each tool reconciles what it's good at: Terraform has plans and state for cloud APIs; GitOps controllers continuously reconcile Kubernetes objects and fix drift.

    From lesson 14 · Terraform, GitOps & fleets across cloud and on-prem

12. Q12. What is a fleet?

    1. AA node pool
    2. BA group of clusters (GKE, on-prem, other clouds) registered together so features like Config Sync, policies, Connect gateway and multi-cluster networking apply across them
    3. CA VPC
    4. DA billing account
    Show answer

    B. Fleets are the unit for multi-cluster management in Google Cloud, including clusters that don't run on Google Cloud.

    From lesson 14 · Terraform, GitOps & fleets across cloud and on-prem

13. Q13. What does a regional GKE cluster protect against?

    1. ARegion outages
    2. BA zone outage: the control plane and (with spread node pools and workloads) the apps keep running in the other zones
    3. CBad deployments
    4. DDeleted namespaces
    Show answer

    B. Regional clusters cover zone failures. Region failures, bad changes and data loss need backups, GitOps rebuilds and a second region.

    From lesson 15 · Disaster recovery & reliability

14. Q14. What makes rebuilding a cluster in another region fast?

    1. ACopying the VMs
    2. BEverything defined as code: Terraform for the cluster and network, GitOps for its contents, and state restored from backups or replicated databases
    3. CA bigger node pool
    4. DManual runbooks only
    Show answer

    B. When the cluster is cattle, recovery is apply + sync + restore data; the slow part is usually data, so plan RPO there.

    From lesson 15 · Disaster recovery & reliability

15. Q15. Why run game days?

    1. AFor fun
    2. BA recovery plan that has never been executed hides gaps (missing permissions, quotas, DNS steps, stale backups) until the real incident
    3. CTo test the HPA
    4. DThey're required by GKE
    Show answer

    B. Rehearsals measure the real RTO and RPO and turn runbooks into something people trust.

    From lesson 15 · Disaster recovery & reliability