PCD Practice Test 10 — 10 Questions

Question 1

A developer needs to deploy a Python application to App Engine flexible environment. The application requires a specific version of a system package (libssl-dev) that is not included in the default runtime image. How should the developer install this package?

Accepted Answer

Create a Dockerfile that uses the base runtime image and runs apt-get install.. Option C is correct because the App Engine flexible environment runs your application in a Docker container based on a Google-provided runtime image. To install system packages like libssl-dev that are not included in the default image, you must customize the container by creating a Dockerfile that starts FROM the base runtime image and then runs apt-get install. This is the standard method for adding OS-level dependencies in the flexible environment.

Answer

Use a custom runtime that already includes the package.

Answer

Specify the package in the app.yaml file under the 'libraries' section.

Answer

Add the package name to the requirements.txt file.

Question 2

Refer to the exhibit. A Cloud Build config deploys a new image to GKE. After the build succeeds, the pods restart with the new image but the application configuration is unchanged. What is the most likely cause?

Accepted Answer

The ConfigMap is not updated with the new configuration values.. A is correct because a Cloud Build config that deploys a new image to GKE does not automatically update the ConfigMap. The pods restart with the new image, but the application configuration remains unchanged because the ConfigMap still holds the old values. To apply new configuration, the ConfigMap must be updated separately, and the pods must be restarted or redeployed to pick up the changes.

Answer

The deployment rollout strategy is set to Recreate, causing downtime.

Answer

The new image is not being pulled because of imagePullPolicy: IfNotPresent.

Answer

The GKE cluster does not have sufficient permissions to pull from Container Registry.

Question 3

A company is migrating a monolithic application to a microservices architecture on Google Cloud. They want to decouple services and ensure that a failure in one service does not impact others. Which pattern should they implement?

Accepted Answer

Implement circuit breaker pattern using a service mesh like Istio. The circuit breaker pattern, implemented via a service mesh like Istio, is the correct approach because it prevents cascading failures by monitoring service health and stopping requests to a failing service until it recovers. Istio's Envoy sidecar proxies enforce circuit breaking at the network layer, allowing the system to degrade gracefully without impacting other services.

Answer

Implement caching with Memorystore

Answer

Increase the number of instances of each service

Answer

Use synchronous HTTP calls with retries

Question 4

A developer is designing a serverless event-driven application that processes messages from Pub/Sub and writes results to BigQuery. The workload is unpredictable but must scale to zero when idle. Which compute option should they choose?

Accepted Answer

Cloud Functions with Pub/Sub trigger. Cloud Functions with a Pub/Sub trigger is the correct choice because it is purpose-built for event-driven, serverless workloads that scale to zero when idle. It automatically scales from zero to thousands of concurrent invocations based on the volume of Pub/Sub messages, and it natively integrates with Pub/Sub via a background function that is invoked for each message, making it ideal for unpredictable, bursty workloads that must process messages and write results to BigQuery.

Answer

Cloud Run with Pub/Sub push subscription

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine with Horizontal Pod Autoscaler

Question 5

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The development team has built a Docker image and pushed it to Artifact Registry. They want to automate the deployment process so that whenever a new image is pushed to the registry, the application is automatically updated in the GKE cluster. Which combination of services should they use to achieve this?

Accepted Answer

Set up a Cloud Build trigger that monitors the Artifact Registry and runs a build step to update the GKE deployment using kubectl.. Option B is correct because Cloud Build can be configured with a trigger that monitors Artifact Registry for new image pushes. When a new image is pushed, the trigger executes a build step that uses kubectl to update the GKE deployment, enabling continuous deployment without manual intervention.

Answer

Use Cloud Deploy to create a delivery pipeline that watches the Artifact Registry and promotes the image to GKE.

Answer

Schedule a Cloud Scheduler job that periodically checks for new images in Artifact Registry and updates the GKE deployment.

Answer

Configure a Cloud Run service that is automatically deployed when a new image is pushed to Artifact Registry.

Question 6

A company is deploying a microservices application on Google Kubernetes Engine (GKE) and needs to ensure that services can discover each other without hardcoding IP addresses. Which approach should they use?

Accepted Answer

Use Cloud DNS with Kubernetes Services of type ClusterIP. Option C is correct because Kubernetes Services of type ClusterIP provide a stable virtual IP and DNS name (via Cloud DNS) that resolves to the service's ClusterIP, enabling pods to discover each other without hardcoding IP addresses. GKE integrates with Cloud DNS to automatically register service DNS names in the format ..svc.cluster.local, allowing microservices to communicate reliably even if pods are rescheduled or IPs change.

Answer

Use environment variables injected into each pod

Answer

Use a ConfigMap to store service endpoints

Answer

Use Cloud Load Balancing to route traffic between services

Question 7

A company is running a critical application on Google Kubernetes Engine (GKE) that stores state in a Cloud SQL PostgreSQL instance. The application's latency-sensitive frontend needs to read data from Cloud SQL with minimal latency. The team wants to reduce read latency and offload read traffic from the primary database. What should they do?

Accepted Answer

Create a read replica of the Cloud SQL instance and direct read traffic to the replica.. Option C is correct because creating a read replica of the Cloud SQL PostgreSQL instance allows read-heavy, latency-sensitive traffic to be offloaded from the primary database. The replica handles SELECT queries independently, reducing load on the primary and lowering read latency for the frontend, as replicas are typically in the same region and can serve data with minimal additional delay.

Answer

Migrate the database to Cloud Spanner for better read scalability.

Answer

Use Memorystore for Redis as a cache layer between the application and Cloud SQL.

Answer

Use Cloud CDN to cache database responses.

Question 8

Refer to the exhibit. A developer is deploying a container to Cloud Run and receives the error shown. What is the most likely cause?

Accepted Answer

The container is trying to listen on a privileged port (e.g., 80) instead of the expected port 8080.. Cloud Run requires containers to listen on the port specified by the PORT environment variable, which defaults to 8080. The error indicates the container is trying to bind to port 80, a privileged port, which is not allowed by the Cloud Run runtime sandbox. This mismatch causes the container to fail health checks and deployment.

Answer

The container's health check is failing because the startup command is incorrect.

Answer

The PORT environment variable is not set correctly in the Cloud Run service configuration.

Answer

The container image does not exist in the specified registry.

Question 9

A company is deploying a microservices application on Google Cloud. They want to securely store and access secrets (e.g., API keys, database passwords) across multiple services. They need to minimize operational overhead and ensure secrets are automatically rotated. Which TWO approaches should they use?

Accepted Answer

Use Secret Manager with a Cloud Function that automatically rotates secrets on a schedule.. Secret Manager is Google Cloud's native service for storing and managing secrets with built-in support for automatic rotation. By enabling automatic rotation on a secret, you eliminate the need for custom infrastructure like Cloud Functions to handle the rotation logic, thereby minimizing operational overhead. Option A is correct because it uses Secret Manager with a Cloud Function for rotation, which is a valid approach, but Option C is more aligned with the requirement to minimize overhead since automatic rotation is a native feature.

Answer

Store secrets in Cloud Storage buckets encrypted with Cloud KMS (CMEK).

Answer

Store secrets in a Cloud SQL database and use Cloud Scheduler to rotate them.

Answer

Store secrets in Cloud Firestore and use Firestore triggers to rotate them.

Question 10

Which TWO of the following are best practices when deploying applications on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across nodes.. Option C is correct because pod anti-affinity ensures pods are scheduled across different nodes, improving fault tolerance and high availability. This is a best practice for stateless applications to avoid a single point of failure during node failures. Option D is correct because defining resource requests and limits allows the Kubernetes scheduler to make informed placement decisions and prevents resource starvation, ensuring predictable application performance.

Answer

Store sensitive configuration data in environment variables.

Answer

Skip liveness and readiness probes for stateless applications.

Answer

Use the default Compute Engine service account for pods.