PCD Practice Exam 3 — 20 Questions

Question 1

A company is designing a microservices application. They want to ensure that if one service fails, it does not cascade to other services. Which pattern should they implement?

Accepted Answer

Circuit Breaker. The Circuit Breaker pattern is the correct choice because it prevents cascading failures by monitoring service calls and opening the circuit when failures exceed a threshold, allowing the system to fail fast and avoid resource exhaustion. This pattern directly addresses the requirement to isolate failures between microservices, ensuring that a failure in one service does not propagate to others.

Answer

Auto-scaling

Answer

Retry with exponential backoff

Answer

Load shedding

Question 2

Match each Cloud Storage class to its typical use case.

Accepted Answer

Standard: Frequently accessed data. Cloud Storage classes optimize cost based on access frequency. Standard is for hot data, Nearline for monthly, Coldline for quarterly, and Archive for yearly access. Common mistakes involve confusing the frequency thresholds.

Answer

Standard: Data accessed less than once a year

Answer

Nearline: Data accessed less than once a quarter

Question 3

Which THREE are best practices for building applications on GKE? (Choose three.)

Accepted Answer

Set resource requests and limits for CPU and memory. Option A is correct because setting CPU and memory requests lets the scheduler place pods on nodes with sufficient capacity, while limits prevent a single container from starving others and enable proper QoS classes and autoscaling decisions. Option C is correct because readiness probes ensure traffic only reaches containers that are ready to serve, and liveness probes let kubelet restart containers that are stuck or deadlocked, improving availability and reliability. Option E is correct because Google-managed SSL certificates integrate with GKE Ingress to automatically provision and renew TLS certificates for HTTPS, reducing operational overhead and avoiding expired-certificate outages. Option B is not a best practice because pinning pods to specific node instances via nodeSelector reduces scheduling flexibility and resilience, and performance consistency is better achieved with node affinity, taints/tolerations, or dedicated node pools. Option D is not a best practice because StatefulSets are intended for stateful workloads needing stable identities and persistent storage, while stateless applications should generally use Deployments for simpler scaling and rolling updates.

Answer

Use nodeSelector to pin pods to specific node instances for performance consistency

Answer

Use StatefulSets for all applications to preserve state across restarts

Question 4

A developer is writing a Cloud Function in Node.js that is triggered by HTTP. They want to test the function locally by sending an HTTP request. Which tool should they use?

Accepted Answer

The Functions Framework for Node.js.. The Functions Framework for Node.js allows developers to run HTTP-triggered Cloud Functions locally. It starts a local server that listens for HTTP requests and invokes the function, mimicking the production environment. This enables quick iteration and testing without deployment. Other options reference non-existent emulators or commands that require deployment, so they are not suitable for local testing.

Answer

The gcloud functions invoke command.

Answer

The Cloud Run emulator.

Answer

The Cloud Functions emulator.

Question 5

A developer is building a containerized application that will be deployed to Google Kubernetes Engine (GKE). They want to run unit tests for a Go package that interacts with the Kubernetes API. Which approach should they use to test the code without a running cluster?

Accepted Answer

Use the client-go library's fake clientset to simulate Kubernetes API interactions, and write tests that use the fake clientset to verify behavior.. The client-go library includes a fake clientset that implements the Kubernetes API interfaces. It allows you to simulate API operations, such as creating, updating, and deleting resources, without a real cluster. Tests can use the fake clientset to verify that the code interacts with the API correctly, including error handling. This approach is fast, reliable, and does not require external dependencies.

Answer

Use the kubectl proxy command to create a local proxy to a remote cluster, and point the tests to the proxy.

Answer

Start a local Kubernetes cluster using Minikube and run the tests against it, then tear it down after the tests complete.

Answer

Mock the HTTP calls to the Kubernetes API server using a library like httptest, and return predefined JSON responses.

Question 6

A company is developing a microservices application on Google Cloud. Each service is deployed as a Docker container on Cloud Run. The development team wants to ensure that inter-service communication is encrypted and authenticated. What is the best approach?

Accepted Answer

Use Cloud Run's built-in IAM-based authentication and automatic TLS for internal requests.. Cloud Run automatically provisions TLS certificates for all incoming requests and supports IAM-based authentication for internal requests between services in the same Google Cloud project. This means inter-service communication is encrypted by default via HTTPS and can be authenticated by configuring the receiving service to require a valid IAM token from the caller, without any additional infrastructure or sidecar proxies.

Answer

Configure mutual TLS (mTLS) between services using Cloud Endpoints.

Answer

Deploy a sidecar proxy on each Cloud Run service to handle TLS termination.

Answer

Assign a service account to each service and use its private key to sign requests.

Question 7

You are managing a microservices application deployed on Google Kubernetes Engine (GKE) that uses Cloud Monitoring and Cloud Logging. Recently, users have reported intermittent slow response times, especially during peak hours. You have enabled the Ops Agent on GKE nodes and configured custom metrics for your services. The application consists of a frontend service, a backend API service, and a database service. The frontend calls the backend, which in turn queries the database. You notice that when the response time spikes, the frontend service's CPU utilization remains low, but the backend service's CPU utilization increases. The database service shows normal latency and no errors. You have examined the logs and found no application errors. The GKE cluster has three node pools: one for each service, with autoscaling enabled. The backend service is configured with a HorizontalPodAutoscaler (HPA) based on CPU utilization, but the HPA does not seem to scale up quickly enough during traffic spikes. You want to identify the root cause of the performance degradation. Which course of action should you take first?

Accepted Answer

Analyze the backend service's request latency distribution using Cloud Monitoring metrics to identify whether the issue is due to increased request volume or slow request processing.. The intermittent slow response times during peak hours, combined with low frontend CPU but high backend CPU and normal database latency, strongly suggest the backend service is struggling to process requests quickly under load. Analyzing the backend's request latency distribution using Cloud Monitoring metrics (e.g., 99th percentile latency) will reveal whether the issue stems from increased request volume (which would show a shift in latency distribution) or from individual requests taking longer to process (e.g., due to inefficient code or resource contention). This diagnostic step directly addresses the symptom without making assumptions about scaling or network issues.

Answer

Check the network latency between the frontend and backend services using Cloud Monitoring's network metrics.

Answer

Configure the backend service's HPA to use custom metrics based on request latency instead of CPU utilization.

Answer

Increase the minimum number of replicas for the backend service to handle peak traffic.

Question 8

Match each Kubernetes resource to its function.

Accepted Answer

Pod: The smallest and simplest Kubernetes object. It represents a single instance of a running process in your cluster.. These are fundamental Kubernetes objects for running containerized applications.

Answer

ConfigMap: Stores sensitive data such as passwords, OAuth tokens, and ssh keys.

Answer

Secret: Manages external access to the services in a cluster, typically HTTP.

Answer

Ingress: Allows you to decouple configuration artifacts from image content to keep containerized applications portable.

Question 9

A company uses Cloud Bigtable for AdTech clickstream data. They notice that some tables have many deleted rows and the storage cost is increasing. What should they configure to automatically remove deleted data and reduce storage?

Accepted Answer

Configure a garbage collection policy based on time or number of versions. Cloud Bigtable automatically compacts data in the background, but deleted rows are not immediately removed; they remain as tombstones until a garbage collection policy is applied. By configuring a garbage collection policy based on time or number of versions, you instruct Bigtable to permanently delete expired data and reclaim storage space, reducing costs.

Answer

Set up cluster replication to a secondary cluster

Answer

Enable compaction on the table

Answer

Use IAM conditions to restrict write access

Question 10

A Cloud Spanner instance is configured with 1000 processing units. The workload has unpredictable traffic spikes. To ensure consistent performance, the team wants to automatically adjust capacity based on a high-priority CPU target of 60%. What should they configure?

Accepted Answer

Set up Cloud Spanner autoscaling with min=500, max=2000 processing units and high-priority CPU target=0.6.. Cloud Spanner autoscaling lets you define a minimum and maximum processing-unit range plus a high-priority CPU utilization target, and the service automatically scales capacity within that range to keep CPU near the target. Setting min=500, max=2000 with a 0.6 high-priority CPU target directly matches the requirement for automatic, performance-driven capacity adjustment during unpredictable spikes.

Answer

Configure compute capacity with a fixed number of nodes.

Answer

Enable Bigtable autoscaling for the Spanner instance.

Answer

Manually adjust nodes when CPU exceeds 60%.

Question 11

An organization is migrating a 2 TB Oracle database to Cloud SQL for PostgreSQL. They need to minimize downtime and have a limited maintenance window of 30 minutes. Which migration strategy should they use?

Accepted Answer

Use DMS with continuous migration (CDC) and promote the replica for cutover.. To migrate a 2 TB Oracle database to Cloud SQL for PostgreSQL with minimal downtime and a 30-minute maintenance window, the best strategy is Database Migration Service (DMS) with continuous migration using change data capture (CDC). DMS performs an initial full load and then continuously replicates ongoing changes, so the cutover can be a quick promotion of the replica, keeping downtime within the window.

Answer

Export the database as a SQL dump and import into Cloud SQL.

Answer

Use BigQuery Data Transfer Service to migrate the data.

Answer

Use a one-time migration job with DMS.

Question 12

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Accepted Answer

By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.. Option A is correct because Cloud Storage always encrypts data at rest by default using Google-managed encryption keys (AES-256), requiring no configuration from the customer. Option D is correct because CMEK (Customer-Managed Encryption Keys), backed by Cloud KMS, lets the company generate, rotate, and control the keys protecting its objects, satisfying stricter key-ownership requirements. Option B is wrong because a signed URL only grants time-limited access to an object; it does not revoke or modify the object's ACLs. Option C is wrong because uniform bucket-level access changes how permissions are managed (IAM at the bucket level) and has no effect on encryption at rest, which remains enabled. Option E is wrong because bucket-level IAM policies grant access to principals (users, groups, service accounts) and cannot be scoped to compute instances with specific service accounts.

Answer

Using a signed URL revokes the underlying object's ACL.

Answer

Enabling uniform bucket-level access disables encryption at rest.

Answer

Bucket-level policies can restrict access to only compute instances with specific service accounts.

Question 13

Based on the Cloud Trace exhibit, which service is the primary contributor to the overall request latency?

Accepted Answer

The auth service. The Cloud Trace exhibit shows that the auth service accounts for the largest segment of the overall request latency, as indicated by the longest span duration in the trace waterfall. In Google Cloud Trace, each span represents a service's contribution to the total latency, and the service with the highest cumulative span time is the primary contributor. Since the auth service span is the longest, it is the correct answer.

Answer

The productcatalog service

Answer

The frontend service itself

Answer

The recommendations service

Question 14

A company needs a globally distributed relational database that provides strong ACID transactions across regions and a 99.999% availability SLA. Which Google Cloud database service meets these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that provides a globally distributed, horizontally scalable, relational database with strong ACID transactions and a 99.999% availability SLA. It uses TrueTime and Paxos to synchronize clocks and achieve external consistency across regions. Cloud SQL and AlloyDB are regional and do not offer the same global scale or SLA.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

AlloyDB

Question 15

A mobile application developer needs a serverless NoSQL database that supports offline data synchronization across devices and real-time updates. Which Google Cloud database service should they use?

Accepted Answer

Firestore. Firestore is a serverless, NoSQL document database that provides built-in offline data synchronization across devices and real-time updates via snapshot listeners. It automatically handles conflict resolution and data replication, making it ideal for mobile applications that need to work offline and sync when connectivity is restored.

Answer

Cloud Bigtable

Answer

Cloud SQL

Answer

Cloud Spanner

Question 16

An engineer is designing a disaster recovery plan for a production AlloyDB cluster. The primary cluster is in us-central1. They need a cross-region replica that can be promoted to primary in the event of a regional failure. The replica should also be able to handle read traffic in the secondary region. Which THREE steps should they take? (Choose 3.)

Accepted Answer

Promote the secondary cluster to primary during a disaster.. Option D is correct because AlloyDB cross-region replication is established by creating a secondary cluster in a different region (us-west1) that continuously replicates from the primary cluster in us-central1, which is exactly the foundation of this DR design. Option E is correct because a secondary cluster does not serve reads by default; adding a read pool (read-only instances) to the secondary cluster enables it to handle read traffic in the secondary region as required. Option A is correct because promoting the secondary cluster to primary is the designed failover mechanism that makes it writable and lets it take over production duties during a regional failure. Option B is incorrect because read pools are cluster-level resources, not instance-level, so an 'instance-level read pool' is not a valid AlloyDB construct. Option C is incorrect because AlloyDB Omni is a downloadable, containerized edition for running AlloyDB outside Google Cloud, and it is irrelevant to configuring cross-region replication for a managed AlloyDB cluster.

Answer

Configure an instance-level read pool in the secondary cluster.

Answer

Enable AlloyDB Omni on the secondary cluster.

Question 17

A developer needs to store session state for a user in a cloud-native application. Which storage solution is most appropriate?

Accepted Answer

Memorystore. Memorystore (Redis) is the most appropriate solution for storing session state in a cloud-native application because it provides an in-memory data store with sub-millisecond latency, which is critical for fast session reads and writes. Session state is ephemeral, key-value data that requires high throughput and low latency, and Memorystore supports features like TTL (time-to-live) for automatic session expiration and persistence options for durability. This aligns with the cloud-native principle of stateless application tiers offloading state to a managed caching layer.

Answer

Cloud SQL

Answer

Cloud Storage

Answer

Bigtable

Question 18

Drag and drop the steps to set up a Cloud Build trigger for continuous deployment in the correct order.

Accepted Answer

1. Connect your repository (e.g., GitHub, Cloud Source Repositories). 2. Create a new trigger in Cloud Build. 3. Configure the trigger event (e.g., push to a specific branch). 4. Specify the build configuration file (e.g., cloudbuild.yaml).. A Cloud Build trigger is set up by connecting a repository and configuring the conditions for automatic builds.

Answer

1. Create a new trigger in Cloud Build. 2. Connect your repository. 3. Configure the trigger event. 4. Specify the build configuration file.

Answer

1. Configure the trigger event. 2. Connect your repository. 3. Create a new trigger in Cloud Build. 4. Specify the build configuration file.

Answer

1. Specify the build configuration file. 2. Connect your repository. 3. Create a new trigger in Cloud Build. 4. Configure the trigger event.

Question 19

You are deploying a Cassandra database on GKE. Which resource type should you use to ensure stable network identities and persistent storage per pod?

Accepted Answer

StatefulSet with volumeClaimTemplates. StatefulSet is the correct resource because it provides stable, unique network identities (via headless Service and ordinal pod names) and persistent storage per pod through volumeClaimTemplates, which dynamically create PersistentVolumeClaims for each replica. This is essential for Cassandra, which requires stable node identities and dedicated storage to maintain cluster state and data consistency.

Answer

Job with persistent disk

Answer

Deployment with persistent volume claims

Answer

DaemonSet with hostPath volumes

Question 20

A company is designing a cloud-native application on Google Kubernetes Engine. They want to ensure high availability and scalability for their microservices. Which two best practices should they follow?

Accepted Answer

Use horizontal pod autoscaling based on custom metrics.. Horizontal Pod Autoscaling (HPA) based on custom metrics allows the application to automatically scale the number of pod replicas in response to application-specific signals (e.g., requests per second, queue depth) rather than just CPU/memory. This ensures that each microservice can handle varying load efficiently, maintaining high availability and scalability without over-provisioning.

Answer

Use a single cluster per region.

Answer

Use a single replica for each service to reduce cost.

Answer

Use stateful sets for all services.