PCD Practice Exam 2 — 20 Questions

Question 1

A company wants to migrate an on-premises MySQL database to Cloud SQL with minimal downtime. Which two steps should they take? (Choose two.)

Accepted Answer

Use Database Migration Service to create a continuous replication job. Option A is correct because Database Migration Service (DMS) supports continuous replication from an on-premises MySQL source to Cloud SQL, keeping the target in sync so the cutover can happen with minimal downtime. Option D is correct because DMS continuous replication relies on the source MySQL binary log (binlog) to capture ongoing changes; binary logging must be enabled (with a suitable binlog_format such as ROW) for replication to work. Options B, C, and E are not required: the Cloud SQL Auth Proxy is used by clients to connect securely to Cloud SQL, not on the source database; a full backup/restore is part of the initial snapshot that DMS handles automatically, not a separate required step; and disabling foreign key checks on the source is neither necessary nor advisable for a migration.

Answer

Set up a Cloud SQL proxy on the source database

Answer

Take a full backup and restore it to Cloud SQL before replication

Answer

Disable foreign key checks on the source database

Question 2

An organization is migrating from Oracle to Cloud SQL for PostgreSQL. They need to convert Oracle packages (which use PL/SQL) into PostgreSQL equivalents. Which TWO approaches are correct for handling Oracle packages?

Accepted Answer

Rewrite PL/SQL code into PL/pgSQL syntax.. Option A is correct because Oracle packages contain PL/SQL code, and Cloud SQL for PostgreSQL executes procedural logic in PL/pgSQL, so the package bodies must be manually rewritten into PL/pgSQL syntax (including converting constructs like %TYPE, %ROWTYPE, and Oracle-specific built-ins). Option D is correct because PostgreSQL has no native package object; the standard migration pattern is to map each Oracle package to a dedicated PostgreSQL schema that groups the equivalent functions and procedures, preserving the package's namespace and encapsulation. Option B is wrong because pgAgent is only a job scheduler for PostgreSQL and does not translate or execute Oracle PL/SQL packages. Option C is wrong because PostgreSQL (and Cloud SQL for PostgreSQL) does not provide an Oracle compatibility mode that runs PL/SQL packages natively. Option E is wrong because the Orafce extension supplies Oracle-compatible functions and operators (e.g., NVL, DECODE, TO_DATE behaviors) but does not provide a PL/SQL package engine or convert package code.

Answer

Use pgAgent to schedule package execution.

Answer

Use Oracle compatibility mode in PostgreSQL.

Answer

Install the Orafce extension for Oracle compatibility.

Question 3

Refer to the exhibit. A developer configured a Pub/Sub push subscription to a Cloud Run service. Messages are not being delivered to the Cloud Run service. The developer verified that the service is running and the IAM permissions are correct. What is the most likely issue?

Accepted Answer

The OIDC token audience does not match the Cloud Run service's URL. For Pub/Sub push subscriptions to Cloud Run, the push endpoint must include an OIDC token whose audience matches the Cloud Run service's URL. If the audience does not match, Cloud Run rejects the request with a 401 or 403 error, and messages are not delivered. This is the most likely issue when the service is running and IAM permissions are correct.

Answer

The service account does not have the pubsub.publisher role

Answer

The push endpoint URL is not a valid HTTPS endpoint

Answer

The ackDeadlineSeconds is too short for the Cloud Run service to process messages

Question 4

A developer wants to store secrets (e.g., API keys) for use in Cloud Functions without exposing them in the source code. Which Google Cloud service should they use?

Accepted Answer

Use Secret Manager to store secrets and reference them via secret environment variables. Secret Manager is the dedicated Google Cloud service for storing sensitive data like API keys, passwords, and certificates. It provides built-in versioning, access control via IAM, and native integration with Cloud Functions through secret environment variables, ensuring secrets are never exposed in source code or configuration files.

Answer

Store secrets in a Cloud Storage bucket with encrypted objects and load them at runtime

Answer

Use Firestore to store secrets in a secure document and access it via the Firestore SDK

Answer

Use Cloud Key Management Service (Cloud KMS) to create and manage secrets

Question 5

A DevOps team is troubleshooting high latency in a Cloud Bigtable instance. They notice that the row keys are lexicographically sorted timestamps. Which TWO actions will MOST improve performance? (Select 2 answers)

Accepted Answer

Use salt (hash prefix) in the row key. Option D is correct because Bigtable stores rows in lexicographic order and distributes them across tablets by key range; timestamp-only keys cause all new writes to land on the last tablet, creating a hotspot, so adding a salt (hash prefix) spreads writes across many tablets and improves throughput/latency. Option E is correct because prepending a high-cardinality field such as user ID before the timestamp also distributes writes across the key space while still allowing efficient prefix scans per user, eliminating the sequential-write hotspot. Option A is not correct because adding nodes increases capacity but cannot fix a hot tablet caused by a monotonically increasing key, since a single tablet cannot be split to parallelize that hotspot. Option B is not correct because more column families do not change row-key distribution and can even add overhead. Option C is not correct because compression reduces storage and some I/O, but it does not address the write hotspot from lexicographically sorted timestamp keys.

Answer

Add more Bigtable nodes

Answer

Increase the number of column families

Answer

Enable compression on column families

Question 6

A company is running a global application on Cloud Spanner. They notice high write latency on a specific table because a frequently updated row is being accessed by many clients simultaneously. Which design pattern should they implement to distribute writes across multiple nodes and reduce contention?

Accepted Answer

Add a hash suffix to the primary key of the hot row to split it into multiple rows.. Adding a hash suffix to the primary key of the hot row splits the single heavily contended row into multiple logical rows, each with a different primary key. This distributes the write load across multiple Cloud Spanner splits and nodes, reducing lock contention and write latency. Cloud Spanner uses a distributed, synchronous replication architecture where a single row is managed by a single split; splitting the hot row into multiple rows allows parallel writes to different splits.

Answer

Increase the number of nodes in the Cloud Spanner instance.

Answer

Use interleaved tables to co-locate related data.

Answer

Migrate the table to Cloud Bigtable which handles hotspots better.

Question 7

A company is migrating a MySQL 5.7 database to Cloud SQL for MySQL 8.0. They use MyISAM tables and utf8 charset. What changes must they make during migration?

Accepted Answer

Convert MyISAM tables to InnoDB and change charset from utf8 to utf8mb4.. Cloud SQL for MySQL 8.0 does not support the MyISAM storage engine, so tables must be converted to InnoDB. Additionally, MySQL 8.0 defaults to utf8mb4 and deprecates the legacy utf8 (which is actually utf8mb3, limited to 3 bytes), so the charset must be migrated to utf8mb4 to support full Unicode including emoji and supplementary characters. Both changes are mandatory.

Answer

Convert MyISAM to InnoDB only; utf8 is fine in MySQL 8.0.

Answer

No changes needed; Cloud SQL automatically converts MyISAM to InnoDB and utf8 to utf8mb4.

Answer

Change charset to utf8mb4 only; MyISAM is supported in Cloud SQL.

Question 8

A company is migrating an on-premises MySQL 5.7 database to Cloud SQL for MySQL 8.0. The database includes MyISAM tables. What is the required action for these tables?

Accepted Answer

Convert MyISAM tables to InnoDB. Cloud SQL for MySQL 8.0 does not support the MyISAM storage engine; it only supports InnoDB. Therefore, before migrating, MyISAM tables must be converted to InnoDB. This conversion is required for compatibility and to leverage Cloud SQL's features such as automated backups, replication, and point-in-time recovery.

Answer

Use a MySQL 5.7 compatible Cloud SQL instance

Answer

Keep MyISAM tables as is

Answer

Migrate to Cloud Spanner instead

Question 9

Drag and drop the steps to configure a Cloud CDN with a Cloud Load Balancer in the correct order.

Accepted Answer

Create a Cloud Storage bucket, then create an external HTTP(S) load balancer with the bucket as a backend, then enable Cloud CDN on the backend bucket, then update DNS records to point to the load balancer's IP.. Cloud CDN is enabled on a backend bucket of a load balancer, then DNS is configured.

Answer

Create a Cloud Storage bucket, then enable Cloud CDN on the bucket, then create an external HTTP(S) load balancer with the bucket as a backend, then update DNS records.

Answer

Create an external HTTP(S) load balancer, then create a Cloud Storage bucket, then enable Cloud CDN on the bucket, then update DNS records.

Answer

Enable Cloud CDN on a bucket, then create an external HTTP(S) load balancer, then add the bucket as a backend, then update DNS records.

Question 10

Which three are valid ways to authenticate a service account when using the Google Cloud client libraries? (Choose three.)

Accepted Answer

Attaching a service account to a Compute Engine instance and letting the metadata server provide credentials.. Options A, B, and D are correct. These are standard methods for Application Default Credentials (ADC). Attaching a service account to a Compute Engine instance allows the metadata server to provide credentials (A). Setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a service account key file is another valid method (B). Using the gcloud CLI default application credentials is also a valid approach (D). Option C is incorrect because OAuth 2.0 client IDs for web applications are used for user authentication, not service account authentication. Option E is incorrect because API keys are not used for service account authentication; they are used for simple API access without a service account.

Answer

Using OAuth 2.0 client IDs for web applications.

Answer

Using an API key in the client library initialization.

Question 11

You are deploying a Node.js application on Cloud Run. The container image is stored in Artifact Registry. After deploying with gcloud run deploy, the revision fails with 'Container failed to start. Failed to start and then listen on the port defined by the PORT environment variable.' The application listens on port 8080 by default. The Dockerfile uses EXPOSE 8080. The Cloud Run service is configured with container port 8080. You have verified that the container starts locally using docker run -p 8080:8080. What is the most likely cause of the startup failure?

Accepted Answer

The application is hardcoded to listen on port 8080 but the Cloud Run environment variable PORT may override it to a different value.. Cloud Run injects a PORT environment variable that the container must listen on; the application is hardcoded to 8080, so if Cloud Run sets PORT to a different value (e.g., 8081), the app listens on the wrong port and fails the health check. The error message explicitly references the PORT environment variable, indicating the app ignored it. Since the container works locally with port 8080, the issue is the mismatch between the hardcoded port and the dynamically assigned PORT.

Answer

The application is trying to bind to a privileged port.

Answer

The Cloud Run service is configured with container port 443 by default.

Answer

The container does not have a proper HEALTHCHECK instruction.

Question 12

A team is deploying a microservice on Cloud Run that requires environment variables with sensitive information, such as database passwords. What is the recommended way to provide these secrets?

Accepted Answer

Use Secret Manager to store the secrets and refer to them in the Cloud Run service.. Secret Manager is Google Cloud's dedicated service for securely storing and managing sensitive data like API keys and database passwords. Cloud Run natively integrates with Secret Manager, allowing you to reference secret versions by name in your service configuration without exposing the secret value in plaintext. This approach ensures secrets are encrypted at rest and in transit, and access can be tightly controlled via IAM permissions.

Answer

Inject them directly in the Cloud Run YAML configuration.

Answer

Embed them in the container image as environment variables.

Answer

Store them in a Cloud Storage bucket and mount as a volume.

Question 13

Which THREE are valid approaches for automating testing in a Cloud Build CI pipeline?

Accepted Answer

Use Cloud Build triggers to run tests on every push to a branch.. Option B is correct because Cloud Build triggers (e.g., a push trigger on a branch) can automatically start a build that executes test steps whenever code is pushed, which is a standard CI testing approach. Option D is correct because Cloud Build supports multiple steps in a build config, and steps run in parallel by default unless you declare waitFor dependencies, so tests can be distributed across parallel steps for faster feedback. Option E is correct because a build step can use a custom builder image (referenced via the 'name' field in cloudbuild.yaml) that contains your test framework and commands, allowing arbitrary test execution inside the pipeline. Option A is not a valid testing approach because Cloud Monitoring is for metrics, dashboards, and alerting, not for shipping or executing test results as part of CI. Option C is not a valid Cloud Build testing approach because Cloud Build does not natively gate steps on manual approval; approvals are handled by external systems or release pipelines, not as a built-in Cloud Build test mechanism.

Answer

Use Cloud Build to ship test results to Cloud Monitoring.

Answer

Use Cloud Build to run tests only after manual approval.

Question 14

A company wants to run hybrid transactional/analytical processing (HTAP) workloads on a PostgreSQL-compatible database with built-in columnar engine for faster analytical queries. Which Google Cloud database should they choose?

Accepted Answer

AlloyDB. AlloyDB is a PostgreSQL-compatible database service with a built-in columnar engine that accelerates analytical queries by storing data in columns rather than rows, enabling HTAP workloads without needing to move data between separate transactional and analytical systems. Its architecture decouples compute from storage and uses a columnar cache to deliver up to 100x faster analytical queries than standard PostgreSQL, making it the correct choice for HTAP on Google Cloud.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Answer

BigQuery

Question 15

A developer wants to automatically detect and capture application errors in a production environment on Google Cloud. Which two Google Cloud services should be enabled? (Choose two.)

Accepted Answer

Cloud Error Reporting. Cloud Error Reporting aggregates and displays application errors in real time, allowing developers to automatically detect and capture errors in production. Cloud Logging stores all application logs, which Error Reporting uses as a source to identify and analyze error events. Together, they provide a complete solution for error detection and capture without manual intervention.

Answer

Cloud Trace

Answer

Cloud Profiler

Answer

Cloud Debugger

Question 16

A developer notices that a Cloud Function is timing out after 60 seconds. The function makes an external API call that occasionally takes longer than the timeout. What is the best practice to handle this?

Accepted Answer

Increase the timeout for the specific Cloud Function to a higher value. Cloud Functions have a configurable timeout per function (up to 540 seconds for HTTP functions). Increasing the timeout for the specific function that makes the slow external API call directly addresses the timeout issue without affecting other functions or introducing unnecessary retry overhead. This is the most targeted and efficient solution.

Answer

Implement retry logic without changing the timeout

Answer

Increase the timeout for all Cloud Functions in the project

Answer

Decrease the timeout to fail fast and implement retry logic

Question 17

A company is migrating a monolithic Java application to microservices on Google Kubernetes Engine (GKE). The application uses a shared MySQL database. The team wants to adopt a testing strategy that validates service interactions without deploying to a full cluster. Which testing approach is most appropriate?

Accepted Answer

Consumer-driven contract testing with tools like Spring Cloud Contract.. Consumer-driven contract testing (CDC) with tools like Spring Cloud Contract validates the interactions between microservices by defining and verifying API contracts (e.g., request/response formats, headers, status codes) without requiring a full GKE cluster. This approach is ideal for a migration from a monolithic Java application because it ensures that each service adheres to its expected behavior when communicating over HTTP or messaging, catching integration issues early in the development cycle. It does not require deploying to a cluster, making it faster and more lightweight than end-to-end testing.

Answer

Load testing to simulate production traffic.

Answer

Unit testing with mocked dependencies.

Answer

End-to-end testing in a staging environment.

Question 18

A company is using Cloud Run for a stateless API. They want to ensure that the service can handle sudden traffic spikes. Which two features should they configure?

Accepted Answer

Enable container concurrency.. Enabling container concurrency allows a single Cloud Run container instance to handle multiple requests simultaneously, up to the configured concurrency limit (default 80, max 1000). This improves throughput and resource utilization during traffic spikes without requiring additional instances. Option D is correct because setting max instances to a high value ensures the service can scale out to handle sudden load by creating more container instances, up to the configured maximum, preventing cold starts and request queuing.

Answer

Use Cloud Load Balancing.

Answer

Enable CPU always on allocation.

Answer

Set min instances to zero to save cost.

Question 19

You want to identify performance bottlenecks in your application's code, such as functions consuming excessive CPU. Which Google Cloud tool should you use?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and memory usage data from your application's functions and methods, presenting a flame graph or call graph that pinpoints which code paths consume the most resources. This allows you to identify performance bottlenecks like functions consuming excessive CPU without adding significant overhead to your production environment.

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Cloud Logging

Question 20

A company is migrating a 500 GB MySQL database to Cloud SQL for MySQL 8.0. They want to test the migration with minimal risk before the final cutover. Which TWO testing approaches should they use?

Accepted Answer

Set up shadow writes to dual-write to both source and target databases.. Option A is correct because shadow writes (dual-writing to both the source and the Cloud SQL target) let the team validate write-path compatibility, replication fidelity, and application behavior against MySQL 8.0 in production-like conditions without exposing users to the new database, which directly supports low-risk testing before cutover. Option C is correct because running comparison queries on a snapshot of data from both databases verifies data consistency and correctness (row counts, checksums, key business queries) after a test migration, catching transformation or replication discrepancies before the final cutover. Option B is not appropriate because synthetic-data load testing alone does not validate real data fidelity or application compatibility with the actual 500 GB dataset. Option D is not a testing approach for validating the migration; migrating only the schema with Database Migration Service tests connectivity and DDL compatibility but not data movement or application behavior. Option E is a prudent risk-management step, but a rollback plan is not a migration testing approach and does not itself validate the migration.

Answer

Perform load testing using synthetic data only.

Answer

Use Database Migration Service to migrate only the schema first.

Answer

Create a rollback plan before starting migration.