PCD Practice Exam 2 — 20 Questions

Question 1

A team is migrating a monolithic application to a microservices architecture on Google Kubernetes Engine (GKE). They want to ensure that failures in one microservice do not cascade to others. Which design pattern should they implement?

Accepted Answer

Implement a circuit breaker pattern that opens when failure thresholds are exceeded.. The circuit breaker pattern is the correct choice because it prevents cascading failures by monitoring inter-service calls and opening the circuit when failures exceed a threshold, allowing the system to fail fast and recover gracefully. In a GKE-based microservices architecture, this pattern is typically implemented using libraries like Resilience4j or Istio's circuit breaker, which can be configured to trip after a certain number of consecutive failures, thus protecting downstream services from being overwhelmed.

Answer

Implement retry logic with exponential backoff for all inter-service calls.

Answer

Use synchronous HTTP calls with timeouts to detect failures quickly.

Answer

Use bulkheads to separate thread pools for each service.

Question 2

A developer runs the command shown in the exhibit. They need to ensure that the application running on instance-3 can be restored quickly if it fails. What should they do?

Accepted Answer

Create a managed instance group using an instance template based on instance-3's boot disk.. Option C is correct because a managed instance group (MIG) with an instance template based on instance-3's boot disk provides automated health checking, auto-healing, and managed instance replacement. If instance-3 fails, the MIG automatically recreates it from the template, ensuring rapid restoration without manual intervention. This aligns with the goal of designing highly available and reliable applications on Google Cloud.

Answer

Add instance-3 to an unmanaged instance group.

Answer

Configure Cloud DNS with a health check pointing to instance-3.

Answer

Take a snapshot of instance-3's disk and use it to create a new instance manually.

Question 3

A company running a high-traffic e-commerce platform on Google Cloud experiences occasional data loss in their Cloud SQL database during failover events. The database is configured with a failover replica in a different zone. What is the most likely cause of the data loss?

Accepted Answer

The database is using asynchronous replication to the failover replica.. Cloud SQL uses synchronous replication for failover replicas by default, ensuring that transactions are committed on both the primary and the replica before acknowledging the write. If asynchronous replication is configured, the replica may lag behind the primary, and during a failover, any transactions not yet replicated are lost. This is the most likely cause of data loss during failover events.

Answer

Automated backups are not enabled.

Answer

The failover replica is configured as a read replica instead of a failover replica.

Answer

The database is not using regional persistent disks.

Question 4

A team is designing a globally distributed application on Google Cloud that requires strong consistency for writes but can tolerate eventual consistency for reads. The application expects millions of concurrent users. Which two strategies should they implement? (Choose two.)

Accepted Answer

Use Cloud Spanner for write operations requiring strong consistency.. Cloud Spanner provides strongly consistent writes globally through synchronous replication using the TrueTime API and Paxos-based consensus. This ensures that all write operations are immediately consistent across regions, meeting the requirement for strong consistency on writes.

Answer

Use Firestore in multi-region mode for all operations.

Answer

Deploy Cloud SQL with cross-region replication for read scalability.

Answer

Use Cloud Bigtable for reading data with strong consistency.

Question 5

A developer finds the JSON key shown in the exhibit in a Cloud Storage bucket that is publicly accessible. Which security best practice was violated?

Accepted Answer

The key was stored in a publicly accessible Cloud Storage bucket.. Option D is correct because storing a JSON key (a service account private key) in a publicly accessible Cloud Storage bucket directly violates the principle of least privilege and exposes sensitive credentials to unauthorized users. Any entity with read access to the bucket can retrieve the key and impersonate the service account, potentially gaining unauthorized access to Google Cloud resources.

Answer

The key is not rotated regularly.

Answer

The key was created as a user-managed key instead of a Google-managed key.

Answer

The key was not encrypted using Cloud KMS.

Question 6

A team is migrating a monolithic application to microservices on Google Kubernetes Engine (GKE). They want to ensure that if one microservice fails, it does not cascade to other services. Which design pattern should they implement?

Accepted Answer

Circuit Breaker pattern. The Circuit Breaker pattern is correct because it prevents cascading failures by monitoring for failures in a downstream microservice and, once a threshold is exceeded, immediately failing requests to that service without attempting the call. In GKE, this can be implemented using tools like Istio or Envoy sidecar proxies, which can be configured with circuit breaker settings to stop traffic to unhealthy pods, allowing the system to recover gracefully.

Answer

Event-driven architecture

Answer

Retry with exponential backoff

Answer

Bulkhead pattern

Question 7

A company is designing a cloud-native application on Google Cloud that requires low-latency access to a global user base. The application serves static content and dynamic APIs. Which strategy best minimizes latency while maintaining high availability?

Accepted Answer

Use Cloud CDN to cache static content and deploy the API across multiple regions with global load balancing.. Option B is correct because it combines Cloud CDN for caching static content at edge locations worldwide, reducing latency for static assets, and deploys the dynamic API across multiple regions with global load balancing (using Google Cloud's global external HTTP(S) load balancer) to route users to the nearest healthy backend, minimizing latency for dynamic requests while ensuring high availability through regional redundancy.

Answer

Deploy the application in a single region and use Cloud Interconnect for global access.

Answer

Use Cloud Armor to protect the application and rely on Google's backbone for low latency.

Answer

Store all content in Cloud Storage and serve directly from there.

Question 8

An application running on Cloud Run experiences cold starts causing latency spikes. What is the most cost-effective solution to reduce cold starts?

Accepted Answer

Set a minimum number of instances. Setting a minimum number of instances ensures that Cloud Run always keeps at least one instance warm (idle) to serve incoming requests instantly, eliminating cold start latency. This is the most cost-effective solution because you only pay for the minimum instances when they are idle (at a reduced rate), whereas other options increase per-request cost or do not address the root cause of cold starts.

Answer

Increase the container's CPU allocation

Answer

Enable HTTP keep-alive connections

Answer

Use a larger container memory size

Question 9

A company is building a real-time analytics application on Google Cloud that ingests data from thousands of IoT devices. The data must be processed with sub-second latency and stored in a time-series database for querying. Which combination of services provides the best scalability and availability?

Accepted Answer

Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable. Cloud Bigtable is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, offering sub-10ms latency for time-series data. Combined with Cloud Pub/Sub for ingesting high-throughput IoT data and Cloud Dataflow for stream processing, this combination provides the best scalability and availability for real-time analytics with sub-second latency requirements.

Answer

Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore

Answer

Cloud Pub/Sub, Cloud Functions, Cloud SQL

Answer

Cloud Pub/Sub, Cloud Dataflow, Cloud Storage

Question 10

A company runs a stateful application on Compute Engine instances with local SSDs. They need to perform maintenance that requires stopping the instances. What is the best approach to ensure data durability and minimal downtime?

Accepted Answer

Migrate data to persistent disks and configure the application to use persistent disks. Local SSDs provide ephemeral storage that is tied to the lifecycle of the Compute Engine instance. When an instance is stopped or terminated, data on local SSDs is permanently lost. To ensure data durability during maintenance that requires stopping the instance, the application must use persistent disks, which are durable network-attached storage that persists independently of the instance. Option D is correct because migrating the application to persistent disks ensures data survives the stop and allows the instance to be restarted with the same data, minimizing downtime.

Answer

Create a snapshot of the local SSD before stopping the instance

Answer

Use instance groups with autohealing to automatically recreate instances

Answer

Enable live migration on the instance

Question 11

A company is designing a highly available application on Google Cloud using multiple regions. Which TWO strategies should they implement to achieve this?

Accepted Answer

Use a global load balancer to distribute traffic across regions.. Option B is correct because a global load balancer (e.g., Google Cloud External HTTPS Load Balancer) can distribute traffic across multiple regions, providing cross-region failover and low-latency routing. This is a fundamental pattern for multi-region high availability, as it allows traffic to be directed to healthy backends in any region, even if an entire region fails.

Answer

Use zonal persistent disks for stateful data.

Answer

Deploy a single instance group in one region for simplicity.

Answer

Store all data in a single Cloud Storage bucket.

Question 12

You are troubleshooting a web application deployed on Compute Engine instances behind a target pool. Users report intermittent timeouts when accessing the application via the forwarding rule's IP address. Based on the exhibit, what is the most likely cause of the issue?

Accepted Answer

The target pool lacks health checks, causing traffic to be sent to unhealthy instances.. The target pool in a legacy HTTP(S) load balancer does not automatically perform health checks unless they are explicitly configured. Without health checks, the load balancer continues to send traffic to all instances in the pool, including those that are unhealthy or unresponsive. This causes intermittent timeouts when users hit an unhealthy instance, as the forwarding rule distributes connections across the entire pool without verifying instance health.

Answer

The forwarding rule is missing a backend service.

Answer

The port range is set to 80-80, which restricts traffic to port 80 only.

Answer

The forwarding rule should use a backend service instead of a target pool for HTTP traffic.

Question 13

A company is migrating a monolithic Java application to microservices on Google Kubernetes Engine (GKE). The application uses a shared MySQL database. The team wants to adopt a testing strategy that validates service interactions without deploying to a full cluster. Which testing approach is most appropriate?

Accepted Answer

Consumer-driven contract testing with tools like Spring Cloud Contract.. Consumer-driven contract testing (CDC) with tools like Spring Cloud Contract validates the interactions between microservices by defining and verifying API contracts (e.g., request/response formats, headers, status codes) without requiring a full GKE cluster. This approach is ideal for a migration from a monolithic Java application because it ensures that each service adheres to its expected behavior when communicating over HTTP or messaging, catching integration issues early in the development cycle. It does not require deploying to a cluster, making it faster and more lightweight than end-to-end testing.

Answer

Load testing to simulate production traffic.

Answer

Unit testing with mocked dependencies.

Answer

End-to-end testing in a staging environment.

Question 14

Refer to the exhibit. A developer deployed a Cloud Run service as shown. Authenticated requests from another service in the same project using a service account receive 403 Forbidden. What is the most likely cause?

Accepted Answer

The service account used to authenticate is not granted the roles/run.invoker role on the Cloud Run service. Option C is correct because the Cloud Run service requires the IAM role `roles/run.invoker` on the service itself for any principal (including a service account) to invoke it. Since the service was deployed with `--no-allow-unauthenticated`, only explicitly granted principals can invoke it. The service account used for authentication lacks this role, causing the 403 Forbidden response.

Answer

The Cloud Run service requires the 'allAuthenticatedUsers' member to be added

Answer

The --no-allow-unauthenticated flag blocks all requests including authenticated ones

Answer

The container image was built without proper authentication headers

Question 15

Which TWO statements about building container images for Google Cloud Run are correct? (Choose TWO.)

Accepted Answer

The container must respond to health checks on the same port as the main application.. Option B is correct because Cloud Run requires the container to respond to health checks (e.g., HTTP GET /health) on the same port as the main application. Cloud Run uses the same port for both user requests and health check probes; if the health check fails, the container is restarted. This ensures the container is always ready to serve traffic.

Answer

The container must use HTTP/1.1; HTTP/2 is not supported.

Answer

The container must listen on port 8080 by default.

Answer

The container must run as root user.

Question 16

Which THREE steps are required to set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub? (Choose THREE.)

Accepted Answer

Enable the Cloud Build, Cloud Run, and Artifact Registry APIs.. Options A, B, and D are required. Option C is optional; Cloud Build can connect to GitHub without a mirror. Option E is wrong because Artifact Registry is used, not Container Registry (deprecated).

Answer

Push the container image to Container Registry.

Answer

Mirror the GitHub repository to Cloud Source Repositories.

Question 17

A developer is building a CI/CD pipeline for a microservices application. The pipeline should build a container image, run unit tests, and deploy to Google Kubernetes Engine (GKE) only if all tests pass. Which Google Cloud service is best suited for orchestrating this pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct choice because it is a fully managed CI/CD platform that natively supports building container images, running unit tests, and deploying to GKE. It can be configured with a cloudbuild.yaml file to define steps for building, testing, and deploying, and it only proceeds to the deploy step if all prior steps (including tests) succeed. This makes it the best fit for orchestrating the entire pipeline in a single, integrated service.

Answer

Compute Engine

Answer

Cloud Run

Answer

Cloud Functions

Question 18

A developer needs to build a CI/CD pipeline that automatically tests and deploys a Node.js application to Cloud Run whenever a pull request is merged to the main branch. Which Google Cloud service should be used to trigger the pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct service because it is Google Cloud's fully managed CI/CD platform that can automatically trigger pipeline executions in response to repository events, such as a pull request merge to the main branch. By configuring a Cloud Build trigger with a source repository (e.g., Cloud Source Repositories, GitHub, or Bitbucket), the developer can define build steps to test the Node.js application and deploy it to Cloud Run using the `gcloud run deploy` command or a dedicated builder. This makes Cloud Build the native and most direct choice for building, testing, and deploying to Cloud Run in a single automated pipeline.

Answer

Cloud Functions

Answer

Cloud Deploy

Answer

App Engine

Question 19

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Accepted Answer

Automate the teardown of test resources after test completion. Option A is correct because end-to-end testing of a Cloud Run service that interacts with Firestore and Pub/Sub must include automated teardown of test resources (e.g., Pub/Sub topics, subscriptions, Firestore documents) to prevent resource leaks and avoid incurring ongoing costs. Without teardown, leftover resources can cause quota exhaustion and interfere with subsequent test runs, making automation essential for reliable CI/CD pipelines.

Answer

Use the Cloud Run emulator to run the service locally

Answer

Use the Firestore emulator to simulate Firestore operations

Question 20

During a code review, a developer notices that the application's Cloud Storage client library is using the default credentials of the Compute Engine instance. What is a more secure alternative for a production environment?

Accepted Answer

Create a dedicated service account with minimal permissions and attach it to the instance. Option A is correct because creating a dedicated service account with minimal permissions and attaching it to the Compute Engine instance follows the principle of least privilege. This avoids using the overly permissive default Compute Engine service account, which often has broad access to many Google Cloud services. By scoping the service account to only the required Cloud Storage permissions (e.g., roles/storage.objectViewer), you reduce the attack surface and adhere to production security best practices.

Answer

Store user credentials in a configuration file

Answer

Use an API key for Cloud Storage

Answer

Generate an access token and embed it in the code