PCD Practice Test 22 — 15 Questions

Question 1

Refer to the exhibit. A developer creates this cloudbuild.yaml for a Cloud Build pipeline. When they run the build, they get an error that the image push failed. What is the most likely cause?

Accepted Answer

The Artifact Registry repository 'my-repo' has not been created.. The error occurs because the cloudbuild.yaml references an Artifact Registry repository 'my-repo' that does not exist in the project. Cloud Build attempts to push the Docker image to the specified repository, and if the repository has not been created, the push fails with a permission or not-found error. The repository must be created before the build runs, as Cloud Build does not automatically create repositories.

Answer

The project ID 'my-project' does not exist.

Answer

The Dockerfile is missing in the repository.

Answer

Cloud Run service 'my-service' already exists and needs to be deleted.

Answer

The gcloud command requires the '--platform managed' flag.

Question 2

A developer needs to store configuration parameters for a Cloud Run service, such as database connection strings and API keys. The values must be encrypted at rest and in transit. Which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing configuration parameters like database connection strings and API keys, as it provides encryption at rest and in transit, along with fine-grained access control. Cloud SQL is a relational database service, not designed for secret storage. Cloud Storage is for object storage, not secrets. Firestore is a NoSQL database and not intended for secret management.

Answer

Cloud SQL

Answer

Cloud Storage

Answer

Firestore

Question 3

You are developing a Cloud Function that needs to read data from a Cloud Storage bucket. The function runs under a specific service account. You want to follow the principle of least privilege. What should you do?

Accepted Answer

Grant the service account the roles/storage.objectViewer role on the bucket.. The storage.objectViewer role grants read-only access to objects. Assigning it on the specific bucket ensures the service account can only read objects in that bucket, which is the minimal permission required. This follows the principle of least privilege and reduces the blast radius if the function is compromised.

Answer

Grant the service account the roles/storage.objectCreator role on the bucket.

Answer

Grant the service account the roles/editor role on the project.

Answer

Grant the service account the roles/storage.admin role on the project.

Question 4

A developer is deploying an application on Compute Engine and needs to automatically apply security patches without downtime. The application runs behind a TCP load balancer. What is the best deployment strategy?

Accepted Answer

Use a rolling update on the instance group.. A rolling update on a managed instance group allows the developer to update instances incrementally, applying security patches without downtime. The TCP load balancer automatically distributes traffic only to healthy instances, so as each instance is updated and passes health checks, traffic is seamlessly redirected away from instances being patched.

Answer

Use a canary deployment with a separate instance group.

Answer

Stop all instances, apply patches, then restart them.

Answer

Use a managed instance group with autohealing.

Question 5

Which THREE steps are required to set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub? (Choose THREE.)

Accepted Answer

Enable the Cloud Build, Cloud Run, and Artifact Registry APIs.. Option A is correct because the pipeline depends on the Cloud Build, Cloud Run, and Artifact Registry services, so their APIs must be enabled in the project before builds, image storage, and deployments can occur. Option B is correct because Cloud Build executes under its own service account, which needs the Cloud Run Developer (roles/run.developer) role (plus actAs on the runtime service account) to deploy the built image to Cloud Run. Option C is correct because Cloud Build requires a build configuration, and placing a cloudbuild.yaml at the repository root defines the build, push, and deploy steps that Cloud Build executes for the GitHub-triggered pipeline. Option D is not required because Container Registry is the legacy registry; the modern pipeline pushes to Artifact Registry, and the push step is defined inside cloudbuild.yaml rather than being a separate setup step. Option E is not required because Cloud Build connects directly to GitHub repositories via the Cloud Build GitHub App or triggers, so mirroring to Cloud Source Repositories is unnecessary.

Answer

Push the container image to Container Registry.

Answer

Mirror the GitHub repository to Cloud Source Repositories.

Question 6

A developer needs to connect a Cloud Run application to a Cloud SQL for MySQL database securely without managing IP allowlists or SSL certificates. Which method should they use?

Accepted Answer

Deploy the Cloud SQL Auth Proxy as a sidecar container in Cloud Run.. The Cloud SQL Auth Proxy is the recommended way to connect to Cloud SQL securely without managing IP allowlists or SSL certificates. When deployed as a sidecar container in Cloud Run, it provides encrypted, IAM-authenticated connectivity to the Cloud SQL instance over a secure tunnel. This eliminates the need for authorized networks and manual certificate management, exactly matching the developer's requirements.

Answer

Create a Compute Engine instance with a VPN to Cloud SQL and connect from Cloud Run via VPC peering.

Answer

Use the public IP of the Cloud SQL instance and add the Cloud Run service's IP range to the authorized networks.

Answer

Enable the 'require_ssl' flag and distribute the server certificate to the Cloud Run service.

Question 7

A company is deploying a microservices application on Google Cloud. They need a database for each service: one for user profiles (relational, high availability), one for product catalog (NoSQL, low latency), and one for session caching. Which THREE services should they use? (Select 3 answers)

Accepted Answer

Firestore. Cloud SQL (E) is the right choice for the user profiles database because it provides a fully managed relational database (MySQL, PostgreSQL, or SQL Server) with high availability configurations such as regional HA with automatic failover. Firestore (A) fits the product catalog requirement since it is a fully managed, serverless NoSQL document database that delivers low-latency reads and real-time synchronization at scale. Memorystore (D) is designed for session caching, offering a fully managed Redis or Memcached in-memory data store with sub-millisecond latency. Cloud Spanner (B) is not appropriate here because, while it is relational and highly available, it is a globally distributed, horizontally scalable database intended for large-scale transactional workloads, making it overkill and more expensive for per-service user profiles. Bigtable (C) does not belong because it is a wide-column NoSQL database optimized for massive analytical and time-series workloads, not for low-latency product catalog serving or session caching.

Answer

Cloud Spanner

Answer

Bigtable

Question 8

A company uses Cloud Bigtable for time-series data. They want to enable disaster recovery with the ability to fail over to another region in minutes. What feature should they enable?

Accepted Answer

Enable Bigtable replication across regions.. Cloud Bigtable replication lets you configure a single instance with multiple clusters in different regions, with data replicated asynchronously and automatic failover for reads and writes. Because replication is continuous and built into the service, failing over to another region takes minutes (often seconds) by redirecting the application's client to the secondary cluster, meeting the disaster recovery requirement.

Answer

Export tables to Cloud Storage and import into another Bigtable instance.

Answer

Configure Bigtable backups and restore in another region.

Answer

Use BigQuery federated queries to access Bigtable data from another region.

Question 9

An e-commerce company uses Cloud SQL for MySQL for transactional data and BigQuery for analytics. They need to replicate order data from Cloud SQL to BigQuery in near real-time with minimal latency. Which Google Cloud service should they use?

Accepted Answer

Datastream. Datastream is a serverless CDC replication service that can stream changes from MySQL (including Cloud SQL) to BigQuery, GCS, or Pub/Sub with low latency. Dataflow requires building pipelines, DMS is for database migrations (not ongoing sync), and Pub/Sub alone doesn't load into BigQuery.

Answer

Cloud Dataflow

Answer

Cloud Pub/Sub

Answer

Database Migration Service (DMS)

Question 10

An organization uses Cloud Build to deploy multiple microservices to GKE. They want to ensure that the deployment process can be audited and that each deployment can be rolled back to a previous version. What is the recommended approach?

Accepted Answer

Use Cloud Deploy to manage deployments with rollback capabilities and audit logs.. Cloud Deploy is the recommended service for managing progressive deliveries and rollbacks on GKE, as it provides built-in rollback capabilities, audit logging, and delivery pipeline management. Unlike raw Kubernetes Deployment history, Cloud Deploy integrates with Cloud Build and offers a controlled, auditable deployment process with the ability to roll back to any previous release revision.

Answer

Use Kubernetes Deployment history to rollback by specifying a revision.

Answer

Store each manifest version in Artifact Registry and manually apply kubectl.

Answer

Use Cloud Build to redeploy a previous image tag when rollback is needed.

Question 11

A developer is designing a serverless event-driven application that processes messages from Pub/Sub and writes results to BigQuery. The workload is unpredictable but must scale to zero when idle. Which compute option should they choose?

Accepted Answer

Cloud Functions with Pub/Sub trigger. Cloud Functions with a Pub/Sub trigger is the correct choice because it is purpose-built for event-driven, serverless workloads that scale to zero when idle. It automatically scales from zero to thousands of concurrent invocations based on the volume of Pub/Sub messages, and it natively integrates with Pub/Sub via a background function that is invoked for each message, making it ideal for unpredictable, bursty workloads that must process messages and write results to BigQuery.

Answer

Cloud Run with Pub/Sub push subscription

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine with Horizontal Pod Autoscaler

Question 12

A company needs to run a PostgreSQL-compatible database with 4x faster OLTP performance than standard PostgreSQL, and also wants to run analytical queries on the same data without extracting to a separate system. Which Google Cloud database should they choose?

Accepted Answer

AlloyDB. AlloyDB is a PostgreSQL-compatible database that delivers up to 4x faster OLTP performance than standard PostgreSQL through a combination of a columnar engine, adaptive indexing, and a disaggregated storage architecture. It also supports running analytical queries on the same data without extraction, using its built-in columnar engine for fast analytics on transactional data.

Answer

Cloud Spanner

Answer

Cloud SQL for PostgreSQL

Answer

BigQuery

Question 13

During a live migration from MySQL to Cloud SQL using DMS, the migration job enters a 'failed' state after the full dump. The error log indicates 'Binlog position out of bounds'. What is the most likely cause?

Accepted Answer

The source MySQL binary log retention period is too short.. The 'Binlog position out of bounds' error in Database Migration Service (DMS) means the replication task tried to resume from a binary log coordinate that no longer exists on the source. This happens when the source MySQL server has already purged the binlog files that DMS needs, typically because the binlog retention period (expire_logs_days or binlog_expire_logs_seconds) is shorter than the time between the full load and the start of CDC. Extending retention on the source resolves the issue.

Answer

The Cloud SQL instance is not using InnoDB engine.

Answer

The DMS job is configured for one-time migration instead of continuous.

Answer

The source database has GTID mode disabled.

Question 14

A company wants to use BigQuery Omni to query data stored in Amazon S3. They have set up a BigQuery Omni connection. Which querying method should they use?

Accepted Answer

Create an external table referencing the S3 data. BigQuery Omni uses external tables stored in S3 (or Azure Blob). You create an external table that points to the S3 location, then query it with standard SQL.

Answer

Use Cloud Storage Transfer Service

Answer

Use the BigQuery Data Transfer Service to copy data

Answer

Use the bq load command to load data into BigQuery

Question 15

A company has a Cloud SQL for MySQL instance in the us-central1 region. They want to improve read performance for a report generation tool that runs in us-west1, and also provide disaster recovery in case the primary fails. Which TWO actions should they take?

Accepted Answer

Configure the report generation tool to connect to the cross-region replica.. Option B is correct because creating a cross-region read replica in us-west1 places a copy of the data close to the report generation tool, reducing network latency and offloading read traffic from the primary, which directly improves read performance for that tool. Option A is correct because the report generation tool must actually be pointed at that cross-region replica (via its own connection name/IP) so its read queries are served locally in us-west1 rather than hitting the primary in us-central1; the replica only helps if the tool connects to it. Together these two actions also support disaster recovery, since a cross-region replica can be promoted to a standalone primary if the us-central1 instance fails. Option C is not correct here because HA creates a standby in a second zone within the same region (us-central1), which does not serve reads and does not help a tool running in us-west1. Option D is not correct because scaling up the primary's machine type increases its capacity but does not reduce cross-region latency or provide cross-region DR. Option E is not correct because a read replica in us-central1 stays in the same region as the primary and therefore does not improve performance for the us-west1-based tool or provide cross-region disaster recovery.

Answer

Enable high availability (HA) on the primary instance.

Answer

Change the primary instance to a larger machine type.

Answer

Add a read replica in us-central1.