PCD Practice Test 23 — 15 Questions

Question 1

A developer is integrating a legacy on-premises application with Cloud Storage. The application generates files that must be uploaded to a bucket. The developer cannot install any additional software on the on-premises server. Which approach should the developer use?

Accepted Answer

Generate a signed URL and use an HTTP PUT request from the application.. Option C is correct because using a signed URL allows the application to upload files directly via HTTP without needing a Google Cloud SDK or library. Option A is wrong because the gcloud CLI may not be installed. Option B is wrong because Cloud Storage FUSE requires a FUSE driver installation. Option D is wrong because Cloud Functions is an additional service, not a direct upload method.

Answer

Use the gcloud CLI to copy files to the bucket.

Answer

Mount the bucket using Cloud Storage FUSE.

Answer

Deploy a Cloud Function that accepts file uploads and writes to the bucket.

Question 2

An application running on Compute Engine needs to publish messages to a Pub/Sub topic. The VPC does not have external internet access. What must be configured to allow the instance to publish?

Accepted Answer

Private Google Access. Option D is correct because Private Google Access enables instances without external IP addresses to call Google APIs and services (including Pub/Sub) using internal IPs. Option A is for NAT to internet, option B is for peering, and option C is for dynamic routing.

Answer

Cloud NAT

Answer

VPC Peering with Pub/Sub

Answer

Cloud Router with BGP

Question 3

A company has a Cloud Run service that ingests messages from a Cloud Pub/Sub subscription. The service uses automatic scaling based on CPU. Recently, the team noticed that when message volume spikes, the service scales up slowly, causing a backlog. What is the most effective solution to reduce the time to scale out?

Accepted Answer

Change the subscription type from pull to push and set the Cloud Run service as the push endpoint.. Option A is correct because Cloud Run can use direct Pub/Sub push subscriptions to trigger invocations, which reduces the polling interval and improves scaling responsiveness compared to pull subscriptions with CPU-based scaling. Option B is wrong because min-instances causes idle cost but does not improve scale-up speed when below min; it only ensures a base level. Option C is wrong because Cloud Tasks adds another queueing layer without solving the scaling delay. Option D is wrong because increasing max instances helps during high load but does not speed initial scaling.

Answer

Increase the max instances for the Cloud Run service to 100.

Answer

Use Cloud Tasks to buffer messages and configure a Cloud Scheduler job to pull from the queue.

Answer

Set a minimum number of instances on the Cloud Run service to 5.

Question 4

A company is using Cloud Build for CI/CD. They want to automatically trigger builds when code is pushed to a Cloud Source Repository and store the resulting Docker images in a secure, immutable artifact store. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud Source Repository. Cloud Source Repository hosts the code and can trigger Cloud Build. Artifact Registry is the recommended immutable artifact store for Docker images. Container Registry is deprecated. Cloud Storage and Cloud Functions are not directly involved.

Answer

Cloud Storage

Answer

Cloud Functions

Answer

Container Registry

Question 5

A company uses Cloud SQL for PostgreSQL and wants to run periodic analytical queries on the data without impacting the transactional workload. The data is updated frequently. Which integration approach is most suitable?

Accepted Answer

Create a read replica of the Cloud SQL instance and point analytical queries to the replica.. Option B is correct because Cloud SQL read replicas allow offloading read queries without affecting the primary instance's performance. Option A is wrong as export/import is batch and not real-time. Option C is wrong because Cloud Spanner is a different database. Option D is wrong because Cloud Composer is an orchestration tool, not a direct solution.

Answer

Use Cloud Composer to schedule ETL jobs that copy data to BigQuery every minute.

Answer

Migrate the database to Cloud Spanner and use strong reads for analytics.

Answer

Export the Cloud SQL data to Cloud Storage and then load into BigQuery for analysis.

Question 6

A development team is building a containerized application on Google Cloud. They want to implement a CI/CD pipeline that automatically builds and tests their application on every push to the main branch. Which TWO actions should they take to achieve this?

Accepted Answer

Configure a Cloud Build trigger to run on push events to the main branch.. Option A is correct because Cloud Build triggers can be configured to automatically start a build whenever a push event occurs on a specific branch, such as main. This is the standard way to initiate a CI/CD pipeline in response to code changes in Google Cloud.

Answer

Enable Cloud Run for Anthos to automatically deploy after build.

Answer

Use Cloud Scheduler to trigger a Cloud Build trigger every 5 minutes.

Answer

Create a Cloud Source Repository and use Cloud Functions to build on push.

Question 7

Refer to the exhibit. The Cloud Run service is experiencing high tail latency under moderate load. Which change would most effectively reduce latency?

Accepted Answer

Reduce containerConcurrency to 10.. High tail latency under moderate load often indicates that requests are queuing behind each other due to excessive concurrency. Reducing `containerConcurrency` to 10 limits the number of simultaneous requests each container instance handles, which reduces queueing delay and improves per-request response time. This is the most effective change because it directly controls the request multiplexing level, preventing a single instance from being overwhelmed.

Answer

Increase CPU limit to 2.

Answer

Increase containerConcurrency to 250.

Answer

Increase timeoutSeconds to 600.

Question 8

A company is deploying a containerized application on Cloud Run that needs to connect to a Cloud SQL (MySQL) database. The database must not be accessible from the public internet. Which two steps should the company take to secure the connection?

Accepted Answer

Set Cloud SQL to have a private IP address only.. Setting Cloud SQL to have a private IP address only (Option D) ensures the database is accessible only within the VPC network, not from the public internet. This eliminates exposure to external threats and is a fundamental security best practice for private database access.

Answer

Enable automatic IAM database authentication for Cloud SQL.

Answer

Create a Cloud NAT gateway for outbound traffic from Cloud Run.

Answer

Use Cloud SQL Auth proxy within the Cloud Run container.

Question 9

A company deploys a containerized application to Cloud Run using Cloud Build. They want to implement a rolling update strategy with zero downtime. Which two actions should they take? (Choose two.)

Accepted Answer

Gradually shift traffic to the new revision using the gcloud run services update-traffic command.. Option A is correct because the `gcloud run services update-traffic` command allows you to gradually shift traffic from the current revision to a new revision, enabling a rolling update with zero downtime. This command supports percentage-based traffic splitting, which ensures that the new revision is incrementally exposed to users while the old revision remains active, thus maintaining service availability throughout the deployment.

Answer

Create a new Cloud Run service for the new revision.

Answer

Set the min-instances attribute to 1 to keep at least one instance running.

Answer

Use the gcloud run deploy command with the --concurrency flag.

Question 10

Refer to the exhibit. A Cloud Build pipeline that deploys a Cloud Run service fails with the above error. The Cloud Build service account has the roles/run.admin role at the project level. What is the most likely cause?

Accepted Answer

The Cloud Run API is not enabled in the project.. Option C is correct because the error message indicates that Cloud Run is not available, which typically occurs when the Cloud Run API has not been enabled in the project. Without the API enabled, any attempt to deploy a Cloud Run service via Cloud Build will fail, regardless of the service account's IAM roles. Enabling the API is a prerequisite for using Cloud Run resources.

Answer

The service account used by Cloud Build does not have the Cloud Run Invoker role.

Answer

The Cloud Run service was deleted manually before the pipeline ran.

Answer

The region specified in the deploy step does not have Cloud Run enabled.

Question 11

A company uses Cloud Monitoring with custom metrics. They have a custom metric called 'requests_total' with labels 'endpoint', 'status_code'. They want to create an alert that fires if the error rate (status_code >=500) for any endpoint exceeds 5% over a 5-minute window. Which MQL query should they use?

Accepted Answer

fetch custom::requests_total | { filter status_code >= 500 ; group_by [endpoint], sum() } / { group_by [endpoint], sum() } | condition gt 0.05. Option A is correct because it first filters for error responses (status_code >= 500), then groups by endpoint and sums the error count, and divides that by the total count per endpoint (also grouped and summed). This computes the error rate per endpoint, and the condition fires when that rate exceeds 0.05 (5%) over the 5-minute window. The use of two separate group_by operations within a join (the `{ ... } / { ... }` syntax) is the correct MQL pattern for calculating a ratio per label.

Answer

fetch custom::requests_total | filter status_code < 500 | ratio | condition gt 0.05

Answer

fetch custom::requests_total | group_by [endpoint], sum() | filter status_code >= 500 | ratio | condition gt 0.05

Answer

fetch custom::requests_total | filter status_code >= 500 | ratio | condition gt 0.05

Question 12

An operations team has set up a Cloud Monitoring alerting policy that fires when the 99th percentile latency of a service exceeds 200ms for 1 minute. They notice that the alert fires frequently during normal traffic patterns. What is the most likely issue with the alert configuration?

Accepted Answer

The alerting policy uses a rolling window that is too short for the metric's natural variation.. The alert fires frequently during normal traffic because the 1-minute rolling window is too short to smooth out natural latency spikes. A short window captures transient variations as if they were sustained, causing false positives. Lengthening the window (e.g., to 5 minutes) would reduce noise and better reflect true performance trends.

Answer

The metric's alignment period is set to align by rate instead of mean.

Answer

The service is actually experiencing high latency, and the threshold should be lowered.

Answer

The alerting policy is using a forecast threshold instead of a metric threshold.

Question 13

A team is using Cloud Monitoring to set up an alerting policy for a Compute Engine instance that runs a web server. The team wants to be notified if the instance's CPU utilization exceeds 80% for 5 minutes. Which threshold type should they use?

Accepted Answer

Metric threshold. Option B is correct because a metric threshold alerting policy directly monitors a numeric metric (e.g., CPU utilization) and triggers when the value exceeds a defined threshold (80%) for a specified duration (5 minutes). This is the standard approach for simple threshold-based alerts on a single metric in Cloud Monitoring.

Answer

Ratio threshold

Answer

MQL (Monitoring Query Language)

Answer

Forecast threshold

Question 14

An application deployed on Google Kubernetes Engine is experiencing intermittent latency spikes. The team has enabled Cloud Trace and sees that a specific gRPC call to a backend service occasionally takes >500ms. However, the backend service's logs show no errors. What is the most likely cause that the team should investigate further?

Accepted Answer

The gRPC client is not using connection pooling, causing frequent TLS handshakes.. Option B is correct because gRPC relies on HTTP/2, which multiplexes multiple requests over a single persistent connection. If the client does not reuse connections, each new request triggers a new TLS handshake, which can add significant latency (often 100-500ms) due to certificate exchange and cryptographic operations. This intermittent behavior occurs when the client creates a new channel per request rather than reusing a connection pool, leading to sporadic high-latency calls without backend errors.

Answer

The Cloud Trace sampling rate is too low, causing statistical noise.

Answer

The backend service is under-provisioned and experiencing resource contention only during peak traffic.

Answer

The network latency between the client and backend is high due to a misconfigured VPC firewall.

Question 15

A company has a Cloud Run service that uses Cloud SQL. They notice that the number of database connections is increasing over time, causing connection pool exhaustion. They have enabled Cloud Monitoring and see a custom metric for active DB connections. To proactively alert when the connection count exceeds 80% of the maximum pool size (which is 100), which alerting approach is most efficient?

Accepted Answer

Create a ratio alert using an MQL query that divides the active connections by the max connections and alerts when > 0.8.. Option D is correct because it creates a ratio alert using MQL to divide the active connections by the maximum pool size (100), triggering when the ratio exceeds 0.8 (80%). This directly measures the utilization of the connection pool, which is the most efficient way to alert on impending exhaustion. It avoids hardcoding a static threshold that would break if the pool size changes, and it uses the custom metric already being monitored.

Answer

Create a metric threshold alert on the custom metric with condition > 80.

Answer

Create a forecast alert to predict when connections will exceed 80.

Answer

Create an alert on the Cloud SQL system metric for 'cloudsql.googleapis.com/database/connections/num_failed_reserved'.