PCD Practice Test 23 — 15 Questions

Question 1

A company uses a polyglot persistence architecture: Cloud SQL for transactions, Bigtable for real-time analytics, and BigQuery for reporting. They need to synchronize data from Cloud SQL to Bigtable in near real-time. Which combination of services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Datastream + Dataflow. Datastream can capture CDC from Cloud SQL (MySQL/PostgreSQL) and publish to Pub/Sub. Dataflow can then read from Pub/Sub and write to Bigtable. This provides near real-time sync.

Answer

Dataflow + Cloud SQL

Answer

Cloud Pub/Sub + Cloud Functions

Answer

Cloud Functions + BigQuery

Question 2

A team needs to replicate changes from an on-premises Oracle database to BigQuery in near real-time. They want to use Google's serverless CDC solution. Which service should they use?

Accepted Answer

Datastream. Datastream is Google Cloud's fully managed, serverless change data capture (CDC) and replication service that supports Oracle as a source and BigQuery as a destination. It captures changes from Oracle redo logs (via LogMiner or XStream) and streams them to BigQuery with low latency, without requiring you to manage any infrastructure. This directly matches the requirement for a serverless CDC solution for near real-time replication from on-premises Oracle to BigQuery.

Answer

Dataflow with JDBC connector

Answer

Database Migration Service

Answer

Cloud Functions with Oracle trigger

Question 3

A company is using Cloud SQL for PostgreSQL and wants to ensure that all connections to the database use SSL/TLS. They have set the `require_ssl` flag but still see some connections using non-SSL. What is the most likely reason?

Accepted Answer

Existing connections that were established before the flag was enabled are still active.. The `require_ssl` flag in Cloud SQL for PostgreSQL enforces SSL/TLS for new connections, but it does not terminate existing connections that were established before the flag was enabled. Those connections remain active and continue to operate without SSL until they are closed or the database is restarted.

Answer

The application is using a database driver that does not support SSL.

Answer

The flag only applies to connections using the Cloud SQL Auth Proxy.

Answer

The flag must be configured in the database server parameters, not the Cloud SQL admin panel.

Question 4

An engineer needs to create a cross-region read replica for a Cloud SQL for MySQL instance for disaster recovery. Which step is required?

Accepted Answer

Create the replica in a different region. Cross-region read replicas are supported in Cloud SQL for MySQL. The engineer can create a read replica in a different region from the primary instance. Read replicas are promoted for DR. HA configuration is regional only. External replicas are for on-premises. Binary logging must be enabled on the primary.

Answer

Create the replica in a different zone within the same region

Answer

Configure an external replica in the target region

Answer

Enable HA on the primary instance first

Question 5

A developer runs the command above. What is the effect of the --promote flag in this deployment?

Accepted Answer

It causes the new version (v2) to receive 100% of traffic after deployment.. The --promote flag in a Google Cloud App Engine deployment command (gcloud app deploy --promote) causes the newly deployed version (v2) to immediately receive 100% of traffic, effectively making it the default serving version. This is the standard behavior unless the --no-promote flag is explicitly used to keep traffic on the previous version.

Answer

It creates a new default service version with split traffic.

Answer

It promotes the previous version to receive traffic.

Answer

It enables automatic scaling for the new version.

Question 6

A team is migrating a MySQL database to Cloud SQL for MySQL. They want to test the migration with a dual-write strategy before cutting over to the new database. Which TWO steps should they take?

Accepted Answer

Configure the application to write to both the source and target databases simultaneously.. Option C is correct because a dual-write strategy requires the application to write to both the source MySQL database and the Cloud SQL for MySQL target at the same time, ensuring the new database receives all new data during the test. Option E is correct because after dual writes are running, the team must run comparison queries between the source and target to verify that the replicated or dual-written data is consistent and complete. Option A is wrong because deleting the source database after the first successful write would destroy the original data before cutover and validation are complete. Option B is wrong because directing all reads to Cloud SQL is a cutover or read-testing action, not part of a dual-write migration test, and it could expose users to an unvalidated target. Option D is wrong because Database Migration Service continuous replication is an alternative migration approach, not the dual-write strategy described in the scenario.

Answer

Delete the source database after the first successful write.

Answer

Direct all reads to Cloud SQL to validate performance.

Answer

Use Database Migration Service to set up continuous replication.

Question 7

A company has a multi-region deployment of their application on GKE. They need to monitor service-level indicators (SLIs) like availability and latency across regions. They want a single pane of glass to view SLO compliance. What should they use?

Accepted Answer

Cloud Monitoring SLO monitoring. Cloud Monitoring SLO monitoring is the correct choice because it provides a unified dashboard (single pane of glass) to define, track, and visualize service-level indicators (SLIs) such as availability and latency across multiple GKE regions. It allows you to set SLO targets, monitor compliance over time, and receive alerts when the error budget is depleted, all within a single monitoring view.

Answer

Cloud Logging with log-based metrics

Answer

Cloud Profiler cross-region profiles

Answer

Cloud Trace multi-region traces

Question 8

Which TWO are best practices for testing containerized applications on Google Cloud?

Accepted Answer

Use Cloud Build to build and test containers.. Option C is correct because Cloud Build is Google Cloud's managed CI/CD service that can execute container build and test steps (for example, running `docker build` followed by `docker run` test commands or `gcloud builds submit`) in a reproducible, ephemeral environment, which is a recommended practice for validating containerized applications before deployment. Option E is correct because Docker multi-stage builds let you define a dedicated test stage that runs the test suite inside the container image itself, so tests execute against the exact runtime environment and dependencies the application will use, while the final production image can exclude test artifacts and tooling. Option A is not a best practice because Kubernetes is an orchestration platform, not a testing framework, and restricting testing to Kubernetes alone ignores other valid approaches such as Cloud Build or local container test runs. Option B is not inherently a testing best practice because Distroless images reduce attack surface and image size but do not by themselves provide a testing methodology. Option D is not a best practice because using a different base image for testing than production reduces fidelity and can let environment-specific issues escape into production.

Answer

Use Kubernetes for testing only.

Answer

Use Distroless images for testing.

Answer

Use a different base image for testing than production.

Question 9

A financial services company needs to query data across Cloud SQL (PostgreSQL) and BigQuery without moving data. They want to use federated queries from BigQuery to access Cloud SQL tables. What must be created in BigQuery to enable this?

Accepted Answer

A Cloud SQL instance connection. BigQuery federated queries to Cloud SQL require a BigQuery connection (Cloud SQL instance connection) to be created first. This connection stores the credentials and instance details. Then, you use the EXTERNAL_QUERY function in a query to access Cloud SQL tables. An external table is not used for federated queries; it is for querying external data sources like Cloud Storage.

Answer

A BigQuery view

Answer

An external table

Answer

A BigQuery dataset

Question 10

A company uses Cloud Functions to process events from Pub/Sub. They notice that occasionally the same message is processed more than once. What can they do to ensure idempotent processing?

Accepted Answer

Make the function idempotent using a deduplication field. Making the function idempotent using a deduplication field ensures that even if the same Pub/Sub message is delivered more than once (Pub/Sub offers at-least-once delivery), the function processes it only once. By checking a unique message ID or a custom deduplication key before processing, the function can skip or safely reapply the operation, preventing duplicate side effects.

Answer

Configure retry policies to only retry once

Answer

Use Cloud Tasks instead

Answer

Use Cloud Scheduler

Answer

Increase the acknowledgement deadline for the subscription

Question 11

A developer wants to containerize a Node.js application and deploy it to Cloud Run. They need to ensure the container is as small as possible. What should they do?

Accepted Answer

Use a multi-stage Dockerfile with a distroless base image.. A multi-stage Dockerfile allows you to separate the build environment from the runtime environment. By using a distroless base image (e.g., gcr.io/distroless/nodejs), you include only the application and its runtime dependencies, omitting package managers, shells, and other OS utilities. This results in a significantly smaller container image, which reduces attack surface and improves deployment speed on Cloud Run.

Answer

Use a full Ubuntu base image with all dependencies.

Answer

Use a node:latest image and remove unnecessary files.

Answer

Use a simple FROM scratch image.

Question 12

A developer wants to deploy a Cloud Function that connects to a Cloud SQL database. What is the simplest way to securely inject database credentials?

Accepted Answer

Use Secret Manager to store and access the database password.. Secret Manager provides a secure, centralized service for storing sensitive data like database passwords, and the Cloud Function can access the secret at runtime via the Secret Manager API or by mounting it as a volume. This avoids hardcoding credentials in code or environment variables, which can be exposed in logs or source control. It is the simplest and most secure approach recommended by Google Cloud for injecting database credentials into Cloud Functions.

Answer

Store credentials in the Cloud Function code as environment variables.

Answer

Use Cloud Key Management Service to encrypt credentials and pass them via HTTP headers.

Answer

Embed credentials in the database connection string in the source code.

Question 13

You need to deploy a critical update to a production service on GKE with zero downtime. Which deployment strategy should you use?

Accepted Answer

Blue/green deployment using a Kubernetes Service and label selector. Blue/green deployment creates two identical environments (blue and green) and switches traffic atomically by updating the Kubernetes Service's label selector to point to the new version. This ensures zero downtime because the old version remains fully serving until the new version is verified, and traffic cutover is instantaneous with no overlapping broken requests.

Answer

Recreate strategy

Answer

Canary deployment with 10% traffic

Answer

Rolling update with maxSurge=25%, maxUnavailable=25%

Question 14

A team uses Cloud Build to automatically deploy a Cloud Function on push to a repository. The build fails intermittently with 'PERMISSION_DENIED' when executing gcloud functions deploy. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the necessary IAM permissions on the Cloud Functions API.. The intermittent 'PERMISSION_DENIED' error when Cloud Build runs `gcloud functions deploy` indicates that the Cloud Build service account does not have the required IAM roles (e.g., Cloud Functions Developer or Cloud Functions Admin) on the Cloud Functions API. Cloud Build uses its default compute engine service account (or a user-specified service account) to execute build steps; if this account lacks the `cloudfunctions.functions.create` or `cloudfunctions.functions.update` permission, the deployment will fail, and the intermittent nature may be due to eventual consistency or race conditions in IAM propagation.

Answer

The region specified in the build configuration does not match the function's region.

Answer

The build configuration file has a syntax error.

Answer

The Cloud Source Repository does not have the correct triggers.

Question 15

A company uses Cloud SQL for PostgreSQL with HA configuration. During a regional outage, the standby fails over to the primary. What is the expected recovery point objective (RPO) and recovery time objective (RTO)?

Accepted Answer

RPO = 0, RTO < 60 seconds. Cloud SQL for PostgreSQL HA uses a regional persistent disk with synchronous replication to a standby in a different zone. Because replication is synchronous, no committed transaction is lost during failover, giving an RPO of 0. The failover itself is automated and typically completes in under 60 seconds, so the RTO is less than one minute.

Answer

RPO = 5 minutes, RTO = 10 minutes

Answer

RPO = 0, RTO = 5 minutes

Answer

RPO = 1 minute, RTO = 5 minutes