PCD Practice Test 21 — 15 Questions

Question 1

You are deploying a stateful application on GKE that requires persistent storage with high IOPS. You need to ensure that each pod can failover to a different node and still access the same data. Which volume type should you use?

Accepted Answer

PersistentVolumeClaim with ReadWriteMany.. Option D is correct because ReadWriteMany allows multiple nodes to access the same volume simultaneously. Option A is wrong because EmptyDir is ephemeral. Option B is wrong because ConfigMap is for configuration. Option C is wrong because ReadWriteOnce only allows one node at a time.

Answer

ConfigMap.

Answer

EmptyDir.

Answer

PersistentVolumeClaim with ReadWriteOnce.

Question 2

Which two statements are true about Cloud Load Balancing? (Choose two.)

Accepted Answer

Global external HTTP(S) load balancer can distribute traffic across multiple regions.. Options A and B are correct. A is correct because global external HTTP(S) load balancers can distribute traffic across multiple regions. B is correct because internal TCP/UDP load balancers operate within a VPC. C is wrong because SSL proxy load balancers only support TCP with SSL. D is wrong because network load balancers support both TCP and UDP. E is wrong because not all load balancers support IPv6.

Answer

All load balancers support IPv6 client traffic.

Answer

SSL proxy load balancer supports non-HTTP traffic.

Answer

Network load balancer can only balance TCP traffic.

Question 3

Which three are valid ways to authenticate a service account when using the Google Cloud client libraries? (Choose three.)

Accepted Answer

Attaching a service account to a Compute Engine instance and letting the metadata server provide credentials.. Options A, B, and C are correct. These are the standard methods for Application Default Credentials (ADC). Option D is wrong because API keys are not used for service account authentication. Option E is wrong because OAuth 2.0 client IDs are for user authentication.

Answer

Using OAuth 2.0 client IDs for web applications.

Answer

Using an API key in the client library initialization.

Question 4

You are designing a CI/CD pipeline using Cloud Build. Which three features can be used to secure the pipeline and enforce compliance? (Choose three.)

Accepted Answer

Configuring Cloud Build to only run builds from approved source repositories via VPC-SC.. Options A, B, and C are correct. A is correct because Cloud Build supports manual approval gates. B is correct because private pools and service perimeters enhance security. C is correct because VPC Service Controls can restrict builds to approved repositories. D is wrong because substitution variables are not secure for secrets. E is wrong because vulnerability scanning is a separate Artifact Analysis feature.

Answer

Using Cloud Build's inline substitution variables to inject secrets.

Answer

Integrating with Cloud Build's vulnerability scanning for container images.

Question 5

A developer ran the following command: `gcloud compute instances list --filter='labels.env=prod'`. The command returned no instances even though there are instances with label env=prod. What is the most likely reason?

Accepted Answer

The filter syntax is incorrect; should use `labels.env:prod`.. Option B is correct because the correct filter syntax for labels uses a colon (:) instead of an equals sign. The proper filter is `labels.env:prod`. Option A is wrong because if the project were different, a different error would appear. Option C is wrong because permission errors produce a different message. Option D is wrong because stopped instances are still listed.

Answer

Instances are in a different project.

Answer

The user lacks compute.instances.list permission.

Answer

The instances are stopped.

Question 6

A company has a hybrid cloud setup with on-premises applications that need to send messages to a Pub/Sub topic. The on-premises network is connected via Cloud VPN. What is the recommended way to publish messages?

Accepted Answer

Use VPC Service Controls and Private Google Access. Option A is correct because to allow on-premises access to Pub/Sub via VPN, you need to enable Private Google Access and use VPC Service Controls for security. Option B is for dynamic routing, not for accessing Pub/Sub. Option C is for dynamic routing, not for Pub/Sub access. Option D is for outbound internet access, not for private access to Google APIs.

Answer

Use a Cloud NAT instance to route traffic

Answer

Expose Pub/Sub publicly and use authentication via OAuth2 tokens

Answer

Use Cloud Router to establish BGP sessions for direct connectivity

Question 7

A team is designing a data pipeline that uses Cloud Storage for input files, Cloud Functions to process each file, and writes results to BigQuery. The pipeline must guarantee exactly-once processing of each file, even if the function fails and retries. Which approach should the team take?

Accepted Answer

Use Cloud Pub/Sub to store file notification events and use Dataflow for processing with exactly-once guarantees. Option B is correct because using Cloud Pub/Sub to store file notification events and Dataflow for processing provides exactly-once guarantees. Option A may lead to duplicates because Cloud Storage triggers are at-least-once. Option C with Cloud Tasks can deduplicate tasks but processing may still be at-least-once if not idempotent. Option D with Cloud Workflows does not inherently provide exactly-once.

Answer

Use Cloud Storage triggers with event filters and configure the function to delete the file after successful processing

Answer

Use Cloud Tasks to queue file processing tasks and configure retries with deduplication

Answer

Use Cloud Workflows to orchestrate the pipeline and use idempotent writes to BigQuery

Question 8

A company is building a data processing pipeline that needs to ingest events from multiple sources, process them in order, and handle failures with retry. They also need to schedule periodic tasks. Which THREE services should they use? (Choose 3)

Accepted Answer

Cloud Scheduler. Cloud Pub/Sub for ingesting events with ordering, Cloud Tasks for retry handling, and Cloud Scheduler for scheduling periodic tasks. Cloud Workflows is for orchestration, Cloud Logging is for logs.

Answer

Cloud Workflows

Answer

Cloud Logging

Question 9

Refer to the exhibit. A developer runs the command and sees that the Cloud Run service is publicly accessible. The security team requires that only authenticated requests from a specific service account in the same project are allowed. What should the developer do to modify the IAM policy?

Accepted Answer

Update the IAM policy to remove the allUsers member from the roles/run.invoker binding. Option B is correct because removing the allUsers member from the invoker role revokes public access. The service account already has the viewer role, but needs invoker to actually invoke the service. Option A changes ingress, which is not necessary. Option C removes the viewer role, which is not needed. Option D adds a binding but does not remove allUsers.

Answer

Add a new binding with the service account as the only member of roles/run.invoker

Answer

Change the service's ingress settings to "Internal and Cloud Load Balancing"

Answer

Remove the roles/run.viewer binding and add the service account to roles/run.invoker

Question 10

A company wants to trigger a Cloud Run job every time a new file is uploaded to a Cloud Storage bucket. Which integration should be used?

Accepted Answer

Use Eventarc to create a trigger that routes Cloud Storage events to the Cloud Run job.. Option C is correct because Eventarc can route Cloud Storage events (like object finalize) to Cloud Run jobs via CloudEvents. Option A is wrong because Cloud Scheduler is time-based, not event-based. Option B is wrong because Cloud Functions can be triggered by storage events, but the question asks for Cloud Run job. Option D is wrong because Pub/Sub alone cannot directly trigger a Cloud Run job without a subscription or push endpoint.

Answer

Use Cloud Pub/Sub notifications from the bucket and create a push subscription to the Cloud Run job.

Answer

Use Cloud Scheduler to poll the bucket and invoke the Cloud Run job every minute.

Answer

Use Cloud Functions to listen for storage events and then call the Cloud Run job via HTTP.

Question 11

A security audit reveals that a service account has been granted excessive permissions. The exhibit shows the IAM policy for a project. Which statement best describes the security issue?

Accepted Answer

The service account has more permissions than necessary because objectAdmin includes all objectViewer permissions.. Option C is correct because the objectAdmin role includes all permissions of objectViewer, making the viewer role redundant and indicating over-permissioning. Option A is wrong because there is no conflict. Option B is wrong because the policy is syntactically correct. Option D is wrong because storage.admin would be even more permissive.

Answer

The policy is missing an explicit deny for public access.

Answer

The service account should have roles/storage.admin instead.

Answer

The service account has both admin and viewer roles, causing a conflict.

Question 12

A developer wants to store application logs from Compute Engine instances in a centralized logging system. Which service should they use?

Accepted Answer

Cloud Logging. Option A is correct because Cloud Logging is the centralized logging service for Google Cloud. Option B is for monitoring metrics, option C is for tracing, and option D is for debugging.

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Cloud Debugger

Question 13

Refer to the exhibit. A team is deploying a Cloud Function that needs to connect to a Cloud SQL instance in a VPC. They have set up a VPC connector. After deployment, the function fails to connect to the database. What is the most likely cause?

Accepted Answer

The VPC connector is in a different region than the function. Option A is correct because the VPC connector must be in the same region as the Cloud Function. If they are in different regions, the function cannot use the connector. Option B is less likely because Cloud SQL private IP uses VPC peering, not firewall rules. Option C is possible but usually the default service account has the necessary permissions. Option D is a possible typo but less likely given the exhibit shows 'DB_HOST'.

Answer

The function's service account does not have permissions to use the VPC connector

Answer

The environment variable DB_HOST is misspelled

Answer

The database firewall rules do not allow traffic from the VPC connector's subnet

Question 14

A company is integrating a legacy application with Google Cloud using Cloud VPN. The application must be accessed from multiple remote offices over the internet. Which TWO technologies should the company use to ensure secure and reliable connectivity? (Choose TWO.)

Accepted Answer

Cloud Interconnect. Option A (Cloud VPN) is correct for site-to-site VPN connectivity. Option C (Cloud Interconnect) is correct for dedicated, reliable connectivity. Option B (Direct Peering) is not recommended for multi-office since it's for on-prem to Google, not hub-spoke. Option D (Cloud NAT) is for outbound internet. Option E (Private Google Access) is for on-prem to Google APIs.

Answer

Private Google Access

Answer

Cloud NAT

Answer

Direct Peering

Question 15

A developer sets environment variables for a Cloud Function as shown. What is the security concern?

Accepted Answer

The password is exposed in plain text and should be stored in Secret Manager.. Option B is correct because the password is exposed in plain text in environment variables. Option A is wrong because the variable name is acceptable. Option C is wrong because build variables are for build time, not runtime. Option D is wrong because encryption at rest is not the issue; the problem is visibility.

Answer

The variable name FOO is too short and does not follow naming conventions.

Answer

The variable DB_PASS should be set as a build variable instead.

Answer

There is no encryption applied to environment variables.