PCD Practice Test 22 — 15 Questions

Question 1

An organization uses Cloud SQL for MySQL and wants to set up a read replica in a different region to improve read latency for global users. What is the recommended way to configure network connectivity between the primary and replica?

Accepted Answer

Use Private Services Access. Option A is correct because cross-region Cloud SQL read replicas require Private Services Access to establish connectivity between the peered VPC and the Cloud SQL service. Option B is for VPN, option C is for dynamic routing, and option D is for high-bandwidth connectivity.

Answer

Use a Cloud Interconnect

Answer

Use Cloud VPN with dynamic routing

Answer

Use VPC peering between the regions

Question 2

Refer to the exhibit. A developer configured a Pub/Sub push subscription to a Cloud Run service. Messages are not being delivered to the Cloud Run service. The developer verified that the service is running and the IAM permissions are correct. What is the most likely issue?

Accepted Answer

The OIDC token audience does not match the Cloud Run service's URL. Option B is correct because the OIDC token audience must exactly match the URL of the Cloud Run service. In the exhibit, the audience is 'https://my-service.run.app/' which should be the same as the push endpoint, but if the Cloud Run service has a different URL (e.g., with a generated hash), the authentication will fail. Option A is possible but less likely because messages would still be delivered and then acknowledged if processing time is less than 10 seconds. Option C is incorrect because the endpoint is HTTPS. Option D is incorrect because the service account needs the token creator role, not publisher.

Answer

The service account does not have the pubsub.publisher role

Answer

The push endpoint URL is not a valid HTTPS endpoint

Answer

The ackDeadlineSeconds is too short for the Cloud Run service to process messages

Question 3

A company has a Cloud Function that processes events from Cloud Pub/Sub. The function uses HTTP client libraries to call external APIs. The team notices that the function sometimes times out during high traffic. Which THREE actions should they take to improve reliability? (Choose THREE.)

Accepted Answer

Use Cloud Tasks to queue the API call invocations and process them asynchronously from the function.. Option A (increase timeout) is correct to allow more processing time. Option D (implement retry with exponential backoff) is correct to handle transient API failures. Option E (use Cloud Tasks for internal queueing) is correct to decouple API calls from the function. Option B (increase memory) may help speed up, but not directly address timeout due to external dependencies. Option C (reduce concurrency) could reduce load but not timeout issue.

Answer

Increase the allocated memory to 2GB.

Answer

Reduce the maximum number of concurrent function instances.

Question 4

A company uses Cloud SQL for MySQL. They need to export data to Cloud Storage regularly. What is the recommended method?

Accepted Answer

Use Cloud SQL export feature to export to Cloud Storage.. Option A is correct because Cloud SQL provides a built-in export feature that writes directly to Cloud Storage. Option B is wrong because mysqldump from Compute Engine is manual and less secure. Option C is wrong because Cloud SQL does not support cron jobs. Option D is wrong because Dataflow is overkill for simple exports.

Answer

Use Dataflow to read from Cloud SQL and write to Cloud Storage.

Answer

Use a cron job on Cloud SQL instance to write to Cloud Storage.

Answer

Use mysqldump command from a Compute Engine instance.

Question 5

You want to deploy a containerized application on Google Cloud that requires no server management and automatically scales based on HTTP traffic. Which service should you use?

Accepted Answer

Cloud Run.. Option C is correct because Cloud Run is serverless, autoscaling, and HTTP-driven. Option A is wrong because Compute Engine requires server management. Option B is wrong because GKE requires cluster management. Option D is wrong because App Engine Flexible Environment still uses VMs.

Answer

Compute Engine.

Answer

Google Kubernetes Engine.

Answer

App Engine Flexible Environment.

Question 6

A company is migrating a monolithic application to microservices on Google Cloud. They have strict requirements for service-to-service communication: requests must be authenticated, authorized, and encrypted in transit. They also need to enforce fine-grained access control based on the requesting service identity. Which Google Cloud service should they use to achieve these goals?

Accepted Answer

Cloud Service Mesh (Anthos Service Mesh). Option C is correct because Cloud Service Mesh (Anthos Service Mesh) provides mutual TLS, fine-grained authorization policies, and service identity. Option A is for API management, option B is for DDoS protection, and option D is for serverless ingress control.

Answer

Cloud Run with ingress control

Answer

Cloud Armor with IAM

Answer

Cloud Endpoints with API keys

Question 7

A company wants to send events from a custom application to Cloud Pub/Sub, then process them with a Cloud Run service. The application runs on Compute Engine. What is the simplest way for the application to authenticate to Pub/Sub?

Accepted Answer

Attach a service account to the Compute Engine instance with necessary Pub/Sub roles.. Option B is correct because using a service account attached to the Compute Engine instance allows automatic authentication via the instance metadata server, which is the simplest and most secure approach. Option A is wrong because storing a JSON key in the application code is not best practice. Option C is wrong because an API key does not provide identity-based access control for Pub/Sub. Option D is wrong because while Cloud Endpoints is an option, it adds unnecessary complexity.

Answer

Use an API key for the Pub/Sub API.

Answer

Embed a service account JSON key in the application code.

Answer

Set up Cloud Endpoints to proxy the Pub/Sub requests.

Question 8

You are designing a multi-region disaster recovery strategy for a Cloud Spanner database. The application requires read-your-writes consistency globally after failover. Which configuration should you choose?

Accepted Answer

Multi-region placement with one read-write region and two read-only replicas.. Option D is correct because a multi-region placement with one read-write region and two read-only replicas provides strong consistency and failover capability. Option A is wrong because single region does not provide disaster recovery. Option B is wrong because Enterprise edition with leader optimization is a feature, not a configuration. Option C is wrong because two read-write regions would introduce write conflicts.

Answer

Multi-region placement with two read-write regions and a witness.

Answer

Enterprise edition with multi-region configuration and default leader optimization.

Answer

Single region with multiple zones.

Question 9

A company uses Cloud Build to build Docker images and push to Artifact Registry. They want to trigger builds automatically when code is pushed to a Cloud Source Repository branch. They also need to ensure that only builds from the repository's main branch are allowed to push to the production Artifact Registry repository. What is the best way to implement this?

Accepted Answer

Use Cloud Build triggers with branch filter and use IAM conditions on the Artifact Registry to restrict push based on the Cloud Build service account. Option A is correct because creating a Cloud Build trigger with a branch filter for the main branch and using a dedicated service account for that trigger with appropriate permissions on the production repository ensures only main branch builds can push to production. Option B does not restrict access per branch, option C is unnecessarily complex, and option D uses multiple service accounts but is less straightforward.

Answer

Use Cloud Source Repository webhooks and a Cloud Function to call Cloud Build

Answer

Use Cloud Build triggers and configure separate service accounts for each branch

Answer

Use Cloud Build triggers with substitution variables and separate build configurations

Question 10

A team wants to use Cloud Scheduler to trigger a Cloud Function that calls an external API every hour. The Cloud Function requires an API key for the external service. How should the team securely provide the API key to the function?

Accepted Answer

Store the API key in Secret Manager and access it via the Secret Manager API in the function code.. Option D is correct because Secret Manager is designed for storing secrets like API keys and integrates easily with Cloud Functions. Option A is wrong because hardcoding in code is insecure. Option B is wrong because environment variables are visible in the function configuration. Option C is wrong while encrypted, it's not a standard practice and harder to manage than Secret Manager.

Answer

Pass the API key as an environment variable in the function's runtime environment.

Answer

Hardcode the API key in the Cloud Function source code.

Answer

Store the key in Cloud Storage with customer-supplied encryption key (CSEK).

Question 11

A company is deploying a containerized application on Cloud Run that requires access to a Cloud SQL PostgreSQL instance. The application needs to connect to the database using private IP to minimize latency and avoid public internet exposure. The Cloud Run service and Cloud SQL instance are in the same region and project. The database user and password are stored in Secret Manager. Which two steps should the developer take to enable the connection? (Choose TWO.)

Accepted Answer

Grant the Cloud Run service account the Cloud SQL Client role.. Option C is correct because Cloud Run requires a VPC connector to access resources on a VPC network, and Private Services Access must be configured to allow Cloud Run to reach the Cloud SQL private IP. Option D is correct because the Cloud Run service account needs the Cloud SQL Client role to authenticate with Cloud SQL. Option A is incorrect because enabling the Cloud SQL Admin API is a prerequisite but not a direct step for the connection itself; it is often already enabled. Option B is incorrect because the Cloud SQL Auth proxy is not needed when using private IP. Option E is incorrect because the CLOUD_SQL_CONNECTION_NAME environment variable is used with the Cloud SQL Auth proxy, not with private IP.

Answer

Set the CLOUD_SQL_CONNECTION_NAME environment variable in the Cloud Run service.

Answer

Enable the Cloud SQL Admin API.

Answer

Deploy the Cloud SQL Auth proxy as a sidecar container in Cloud Run.

Question 12

A developer is building a microservices application on Cloud Run. One service needs to make authenticated HTTP requests to another Cloud Run service in the same project. What is the best practice for authentication?

Accepted Answer

Use IAM roles on the target service and call it with the appropriate identity token from the metadata server. Option D is correct because Cloud Run service-to-service authentication is best done using an identity token from the metadata server and setting IAM on the target service. Option A is not recommended as API keys are for external clients. Option B uses OAuth2 client credentials which are for external applications. Option C uses the default compute service account which may have broader permissions than needed.

Answer

Use API keys

Answer

Use Cloud Run's built-in service-to-service authentication with the default compute service account

Answer

Use OAuth2 client credentials

Question 13

A developer is building a serverless application that processes user-uploaded images. The images are stored in Cloud Storage, and each upload should trigger a Cloud Function that performs image analysis and stores the result in Firestore. Which TWO Google Cloud services are essential for this integration? (Choose 2)

Accepted Answer

Cloud Pub/Sub. Cloud Storage is the source of events (uploaded images). Cloud Pub/Sub is used to deliver notifications from Cloud Storage to the Cloud Function. Cloud Tasks, Cloud Scheduler, and Eventarc are not required for this pattern.

Answer

Cloud Tasks

Answer

Eventarc

Answer

Cloud Scheduler

Question 14

A developer is integrating an App Engine standard environment app with Cloud Storage. The app needs to read objects from a bucket that is in a different project. The developer has granted the App Engine service account the Storage Object Viewer role on the bucket. However, the app still gets a 403 error when trying to read objects. What is the most likely cause?

Accepted Answer

The service account is from the app's project, not the bucket's project, and the bucket's IAM policy may not include the service account.. Option A is correct because cross-project access requires the service account to be granted access at the bucket level in the source project, but the App Engine service account is in the same project as the app; the bucket is in another project, so the role must be assigned in the bucket's project. The error might persist if the bucket's IAM policy doesn't include the service account. Option B is wrong as no need for service account key. Option C is wrong because VPC-SC could block, but that would be a different error. Option D is wrong because public access disabled is fine for explicit IAM.

Answer

The service account needs to be downloaded as a JSON key and added to the app configuration.

Answer

The bucket has uniform bucket-level access disabled, so ACLs may override IAM permissions.

Answer

The bucket is in a VPC Service Controls perimeter that blocks access from the App Engine service account.

Question 15

A developer needs to store configuration parameters for a Cloud Run service, such as database connection strings and API keys. The values must be encrypted at rest and in transit. Which service should be used?

Accepted Answer

Secret Manager. Option B is correct because Secret Manager is designed for storing secrets with encryption at rest and in transit. Option A is for object storage, option C is a database, and option D is a relational database.

Answer

Cloud SQL

Answer

Cloud Storage

Answer

Firestore