PCD Practice Test 11 — 15 Questions

Question 1

A team is developing a microservice that needs to store user profile images in Cloud Storage. The service is deployed on Cloud Run and will be invoked by other services via HTTP. The images are uploaded by users and the service must validate that the file is an image (e.g., JPEG, PNG) before storing it. The team wants to minimize costs and operational overhead while ensuring that only valid images are stored. The current implementation uploads the file directly to Cloud Storage from the client, but the team wants to add validation in the service. Which approach should the team take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Have the client send the file to the Cloud Run service, validate the file on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library.. It keeps the validation logic within the Cloud Run service, which is already deployed and handling HTTP requests. The service can receive the file via HTTP, validate its MIME type and magic bytes on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library. This minimizes costs (no additional compute services) and operational overhead (single service to manage), while ensuring only valid images are stored.

Answer

Create a separate Cloud Function that receives the file, validates it, and uploads it to Cloud Storage. Invoke the Cloud Function from the client.

Answer

Validate the file on the client side before uploading directly to Cloud Storage, and rely on client-side validation.

Answer

Upload the file to Cloud Storage, then trigger a Cloud Function using Cloud Storage events to validate the file and delete it if invalid.

Question 2

A developer is writing unit tests for a Python Cloud Run service that uses Cloud Firestore. They want to avoid hitting the real Firestore during tests. What should they use?

Accepted Answer

Mock the Firestore client using a library like unittest.mock.. Unit tests should isolate the code under test from external dependencies. Using `unittest.mock` to mock the Firestore client allows the developer to simulate Firestore calls and return controlled responses without any network I/O, ensuring tests are fast, deterministic, and independent of the real Firestore service.

Answer

Use a real Firestore database but with a test project.

Answer

Disable network access during tests.

Answer

Use the Firestore emulator for unit tests.

Question 3

An organization runs a critical application on Compute Engine with a regional managed instance group. They want to achieve 99.99% availability. Which architecture should they use?

Accepted Answer

Regional MIG with instances in three zones. To achieve 99.99% availability, the architecture must tolerate both a zonal failure and a single instance failure. A regional managed instance group (MIG) with instances in three zones ensures that even if one zone becomes unavailable, the remaining two zones can still serve traffic, meeting the 99.99% uptime target. Three zones provide the necessary redundancy because a two-zone regional MIG can only survive a single zone failure but not a simultaneous instance failure in the remaining zone, whereas three zones allow for a rolling update or failure of one zone while still maintaining quorum.

Answer

Regional MIG with instances in two zones

Answer

Single zone MIG with multiple instances

Answer

Multi-region deployment with global load balancer

Question 4

A stateful service on GKE needs to persist data that must be accessible from any pod in the cluster, regardless of which node the pod runs on. Which volume type should they use?

Accepted Answer

PersistentVolumeClaim with RWX access mode. A PersistentVolumeClaim (PVC) with RWX (ReadWriteMany) access mode is correct because it allows multiple pods across different nodes to read and write to the same persistent volume simultaneously. This is essential for a stateful service where data must be accessible from any pod in the cluster, regardless of which node the pod runs on. RWX is typically backed by network filesystems like NFS or GKE Filestore, which provide shared access across nodes.

Answer

emptyDir

Answer

ConfigMap

Answer

hostPath

Question 5

A company is designing a scalable web application on Google Cloud. They expect variable traffic and want to automatically scale resources based on load. Which two services can automatically scale? (Choose two.)

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless compute platform that automatically scales your containerized applications based on incoming traffic, including scaling to zero when there is no traffic. This autoscaling is handled by the Knative serving layer, which adjusts the number of container instances based on request concurrency and CPU utilization.

Answer

Compute Engine unmanaged instance group

Answer

Cloud Dataproc

Answer

Cloud SQL

Question 6

A company is designing a microservices architecture on Google Kubernetes Engine (GKE). They want to ensure zero-downtime deployments. Which strategy should they use?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct strategy for achieving zero-downtime deployments on GKE because it runs two identical environments (blue and green) and switches traffic instantly via a Kubernetes Service or Ingress. This eliminates any period where the application is unavailable, as the old version remains live until the new version is fully ready and traffic is cut over. GKE's LoadBalancer or Ingress controller can route all traffic to the new environment with a single configuration update, ensuring no requests are dropped.

Answer

Recreate

Answer

Rolling update

Answer

Canary deployment

Question 7

A company uses Cloud Load Balancing to distribute traffic to HTTP backends. They want to protect against application-layer DDoS attacks (e.g., HTTP flood). Which TWO services should they combine?

Accepted Answer

Cloud Armor. Cloud Armor is correct because it provides Web Application Firewall (WAF) capabilities and DDoS protection at the application layer, allowing you to create security policies that filter HTTP/HTTPS traffic based on IP addresses, geo-locations, or custom rules (e.g., rate limiting) to mitigate HTTP flood attacks. Cloud CDN is correct because it caches content at edge locations, absorbing a significant portion of malicious traffic before it reaches the backend, reducing the load on origin servers and acting as a first line of defense against volumetric application-layer attacks.

Answer

Cloud Firewall rules

Answer

Cloud NAT

Answer

Cloud Endpoints

Question 8

An application on Cloud Run needs to handle traffic spikes. Which configuration setting should be adjusted?

Accepted Answer

Set min and max instances. Cloud Run automatically scales the number of container instances based on incoming traffic. By setting min and max instances, you control the scaling range: a minimum ensures a baseline of warm instances to absorb sudden spikes, while a maximum caps costs and prevents resource exhaustion. This is the primary lever for handling traffic spikes in a serverless environment.

Answer

Enable HTTP/2

Answer

Increase CPU allocation

Answer

Increase memory

Question 9

Match each Cloud Storage class to its typical use case.

Accepted Answer

Standard: Frequently accessed data. Cloud Storage classes optimize cost based on access frequency. Standard is for hot data, Nearline for monthly, Coldline for quarterly, and Archive for yearly access. Common mistakes involve confusing the frequency thresholds.

Answer

Standard: Data accessed less than once a year

Answer

Nearline: Data accessed less than once a quarter

Question 10

A team is designing a globally distributed application on Google Cloud that requires strong consistency for writes but can tolerate eventual consistency for reads. The application expects millions of concurrent users. Which two strategies should they implement? (Choose two.)

Accepted Answer

Use Cloud Spanner for write operations requiring strong consistency.. Cloud Spanner provides strongly consistent writes globally through synchronous replication using the TrueTime API and Paxos-based consensus. This ensures that all write operations are immediately consistent across regions, meeting the requirement for strong consistency on writes.

Answer

Use Firestore in multi-region mode for all operations.

Answer

Deploy Cloud SQL with cross-region replication for read scalability.

Answer

Use Cloud Bigtable for reading data with strong consistency.

Question 11

A company wants to run a batch job every hour that processes files from Cloud Storage. The job takes about 10 minutes. Which serverless option should they use?

Accepted Answer

Cloud Functions with Cloud Scheduler. Cloud Functions triggered by Cloud Scheduler is ideal for periodic, short-lived batch jobs that process files. Cloud Run Jobs is also suitable but less event-driven. Compute Engine requires manual setup. App Engine Cron Service is possible but more complex.

Answer

Cloud Run jobs

Answer

Compute Engine with cron

Answer

App Engine Cron Service with Cloud Tasks

Question 12

Refer to the exhibit. A developer is configuring Cloud Build to build a Docker image from a Cloud Source Repository. The build fails with a permission error. What is the most likely reason?

Accepted Answer

The service account is missing the roles/source.reader role to access the repository. The build fails with a permission error because the Cloud Build service account does not have the `roles/source.reader` role on the Cloud Source Repository. Without this role, the service account cannot read the source code from the repository, which is required to trigger the build. The error is not about building permissions but about accessing the source.

Answer

The service account lacks the roles/cloudbuild.builds.builder role

Answer

The Cloud Source Repository does not have the build trigger enabled

Answer

The build config file is missing the 'source' field

Question 13

A gaming company uses Cloud Spanner for their global leaderboard. They want to reduce the number of stale reads and improve read performance while maintaining strong consistency for writes. Which TWO strategies should they implement? (Choose two)

Accepted Answer

Create secondary indexes on frequently queried columns. Secondary indexes in Cloud Spanner allow queries to access data directly from the index without scanning the entire base table, significantly improving read performance for frequently queried columns. Option E is correct because stale reads with a maximum staleness bound reduce contention and latency by allowing reads to return data that is slightly behind the current timestamp, which improves read throughput while still maintaining strong consistency for writes.

Answer

Use interleaved tables to store child rows with parent rows

Answer

Increase the number of read replicas in each region

Answer

Use strong reads for all queries

Question 14

Refer to the exhibit. A developer uses the above cloudbuild.yaml for a Cloud Run service. The trigger is set to run on pushes to the main branch. After a push, the build succeeds but the deployment fails with a permission error. What is the most likely issue?

Accepted Answer

The Cloud Build service account lacks permission to deploy to Cloud Run. The Cloud Build service account (typically the default compute engine service account or a user-specified service account) does not have the required IAM roles (e.g., roles/run.admin or roles/run.invoker) to deploy to Cloud Run. Even though the build step succeeds, the deployment step fails because the service account lacks the `run.services.create` or `run.services.update` permission for the target Cloud Run service.

Answer

The region 'us-central1' is incorrect

Answer

The container image tag ${SHORT_SHA} is invalid

Answer

The Cloud Run service name 'my-service' is misspelled

Question 15

A company deploys a stateful application using StatefulSets on GKE. They need to store persistent data on regional persistent disks for high availability. However, during zonal failures, pods are not rescheduled quickly. What is the best approach to improve recovery time?

Accepted Answer

Configure podDisruptionBudget and use persistent disk with regional replication.. Configuring a podDisruptionBudget ensures that a minimum number of Pods remain available during voluntary disruptions, while using regional persistent disks (which replicate data across zones) allows the StatefulSet controller to quickly reschedule Pods in another zone without waiting for the failed zone's disk to become available. This combination minimizes downtime during zonal failures by maintaining quorum and ensuring data is already accessible in the surviving zone.

Answer

Increase the number of replicas in the StatefulSet.

Answer

Use a headless service with external persistent storage like Filestore.

Answer

Use a Deployment instead of StatefulSet.