PCD Practice Test 27 — 15 Questions

Question 1

A company is migrating a Redshift data warehouse to BigQuery. They need to stage the data in an intermediate storage before loading into BigQuery. What should they use?

Accepted Answer

Use Amazon S3 as intermediate staging, then copy to Cloud Storage.. BigQuery Data Transfer Service does not offer a Redshift connector; it supports sources such as Google Ads, Google Marketing Platform, YouTube, Amazon S3, and Teradata. To migrate a Redshift data warehouse to BigQuery, the standard approach is to unload the Redshift data to Amazon S3 as intermediate staging, then move it to Cloud Storage (for example with Storage Transfer Service) before loading into BigQuery. This matches the stem's requirement for intermediate storage.

Answer

Directly connect Redshift to BigQuery using VPN.

Answer

Use BigQuery Data Transfer Service for Redshift.

Answer

Use Google Cloud Interconnect for direct transfer.

Question 2

An engineer is using Database Migration Service for a continuous migration from on-premises MySQL to Cloud SQL. The source database is not directly reachable from DMS due to network restrictions. Which connectivity option should the engineer configure?

Accepted Answer

Use a public IP for the source database with SSL.. When the source database cannot be reached from DMS over private connectivity (no VPN, no VPC peering, no private interconnect), the recommended DMS connectivity method for an on-premises MySQL source behind network restrictions is a reverse SSH tunnel. The on-premises host initiates an outbound SSH connection to a tunnel VM in the destination VPC, allowing DMS to reach the source without exposing it to the public internet. Because the reverse SSH tunnel is not listed as an option, the best available choice is C: use a public IP for the source database with SSL. This is a valid but less secure fallback and requires whitelisting the DMS egress IPs and enforcing SSL/TLS on the MySQL source.

Answer

Deploy DMS on-premises as a virtual appliance.

Answer

Set up VPC peering between the on-premises network and the DMS VPC.

Answer

Configure Cloud SQL Auth Proxy on the source server.

Question 3

An organization is migrating from Oracle to Cloud SQL for PostgreSQL using Database Migration Service. They need to convert Oracle NUMBER(10,2) and VARCHAR2(100) columns to appropriate PostgreSQL types. What are the correct mappings?

Accepted Answer

NUMBER(10,2) → NUMERIC(10,2); VARCHAR2(100) → VARCHAR(100). Oracle NUMBER(10,2) maps directly to PostgreSQL NUMERIC(10,2) because both represent exact numeric values with 10 total digits and 2 decimal places, preserving precision and scale. Oracle VARCHAR2(100) maps to PostgreSQL VARCHAR(100) because both are variable-length character types with a 100-character limit, preserving the length constraint. These are the canonical, lossless mappings used by Database Migration Service schema conversion.

Answer

NUMBER(10,2) → DECIMAL(10,2); VARCHAR2(100) → TEXT

Answer

NUMBER(10,2) → INTEGER; VARCHAR2(100) → TEXT

Answer

NUMBER(10,2) → BIGINT; VARCHAR2(100) → CHAR(100)

Question 4

A company is using Datastream to continuously replicate data from an on-premises MySQL database to BigQuery. They notice that some schema changes (e.g., adding a column) on the source are not being propagated. Which TWO actions should they take to ensure schema changes are captured? (Choose two.)

Accepted Answer

Enable DDL event replication in the Datastream connection profile. Option A is correct because Datastream's MySQL source connection profile includes a setting to replicate DDL (data definition language) events; enabling DDL event replication is what allows schema changes such as adding a column to be captured and propagated to the destination BigQuery tables. Option C is correct because Datastream requires the MySQL binary log to capture full row images; setting binlog_row_image=FULL ensures that both before and after images of each row are logged, which is necessary for Datastream to correctly interpret and apply schema and data changes during replication. Option B is not correct because a backfill job only re-reads existing data from the source and does not make Datastream capture future DDL events. Option D is not correct because Dataflow is not the mechanism Datastream uses to detect or apply schema changes; Datastream handles schema evolution itself when DDL replication is enabled. Option E is not correct because binlog_format=STATEMENT logs SQL statements rather than row-level changes, and Datastream requires ROW-based binary logging (binlog_format=ROW) to replicate changes reliably.

Answer

Run a backfill job after each schema change

Answer

Use Dataflow to detect schema changes and apply them to BigQuery

Answer

Set binlog_format=STATEMENT on the MySQL source

Question 5

A company uses Cloud Spanner for a global database and needs to export a full backup to GCS for long-term archival and compliance. Which THREE statements are true about Cloud Spanner backups? (Choose 3 options.)

Accepted Answer

Backups can be created on demand or via a scheduled policy. Option A is correct because Cloud Spanner supports both on-demand backups and scheduled backup policies (backup schedules) that automatically create backups at defined intervals, which fits the need for a full backup for archival and compliance. Option D is correct because when a Cloud Spanner backup is exported to Cloud Storage, the data is written in Avro format, which is the format used for Spanner export/import operations. Option E is correct because a Cloud Spanner backup can be restored to a different Spanner instance, not only the original instance, which is important for disaster recovery and migration scenarios. Option B is not correct because Cloud Spanner backups are full backups; incremental backups are not a supported backup type. Option C is not correct because backups are not automatically replicated across regions; backup storage location is chosen when the backup is created and replication is not automatic across regions.

Answer

Incremental backups are supported to reduce storage costs

Answer

Backups are automatically replicated across regions

Question 6

A company is using Cloud SQL for MySQL with automated backups enabled. They need to ensure they can recover to any point in time within the last 7 days. The database experiences high write throughput. Which TWO settings should they configure?

Accepted Answer

Set the automated backup retention to 7 days.. Option B is correct because Cloud SQL point-in-time recovery (PITR) requires that automated backups be retained for the entire recovery window; setting the automated backup retention to 7 days ensures backups covering the last 7 days are available to serve as the base for PITR. Option E is correct because PITR replays the binary log (binlog) on top of a backup, so binary logging must be enabled and its retention (via the binary log expiration period, e.g., binlog_expire_logs_seconds or expire_logs_days) must cover at least the 7-day window; otherwise binlog entries needed to replay writes would be purged. Option A is wrong because disabling binary logging makes PITR impossible, even though it would save storage. Option C is wrong because HA provides failover for availability, not historical point-in-time recovery, and does not extend the recovery window. Option D is wrong because a 1-day binlog expiration would purge logs needed to recover to points between days 1 and 7, breaking the 7-day PITR requirement.

Answer

Disable binary logging to reduce storage costs.

Answer

Enable high availability (HA) configuration.

Answer

Set the binary log expiration period to 1 day to save disk space.

Question 7

You need to monitor the CPU usage of a Compute Engine instance and trigger an alert when it exceeds 80% for 5 minutes. Which Google Cloud service should you use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it provides metrics, dashboards, and alerting policies for Compute Engine instances. You can create a metric-based alert condition that triggers when the CPU utilization metric exceeds 80% for a duration of 5 minutes, using the MQL or policy builder.

Answer

Cloud Debugger

Answer

Cloud Logging

Answer

Error Reporting

Question 8

A developer wants to deploy a Compute Engine instance using Terraform. They want to run a startup script to install software. How should they provide the script?

Accepted Answer

Use the metadata block with key 'startup-script' and the script content as value.. Terraform's `google_compute_instance` resource supports a `metadata` block where you can set the key `startup-script` with the script content as the value. When the Compute Engine instance boots, the `google-guest-agent` reads this metadata key and executes the script as the root user, which is the standard method for running startup scripts on Linux instances without additional configuration.

Answer

Use a cloud-init configuration file passed via user-data metadata.

Answer

Use the user-data metadata key with the script content.

Answer

Use the gcloud compute instances create command with --metadata-from-file flag.

Question 9

A company is migrating an on-premises PostgreSQL database to Cloud SQL. They need to ensure minimal downtime and continuous replication during the migration. Which approach should they use?

Accepted Answer

Use Database Migration Service with continuous replication.. Database Migration Service (DMS) with continuous replication is designed for minimal downtime migrations. It performs an initial full dump and then continuously replicates ongoing changes from the source to the destination, allowing cutover with minimal downtime. This is the recommended approach for migrating on-premises PostgreSQL to Cloud SQL.

Answer

Use a cross-region replica from an existing Cloud SQL instance.

Answer

Export the database using pg_dump and import into Cloud SQL.

Answer

Create a Cloud SQL read replica of the on-premises database.

Question 10

After updating the image to v2, users report that the frontend application returns errors because it cannot reach the backend service. The backend service is running on GKE with the name 'backend-service' in the same namespace. What is the most likely cause?

Accepted Answer

The application expects the backend URL from an environment variable named BACKEND_SERVICE_URL, but the deployment sets BACKEND_URL.. The most likely cause is that the frontend application expects the backend URL from an environment variable named `BACKEND_SERVICE_URL`, but the deployment sets `BACKEND_URL`. This mismatch means the frontend cannot resolve the backend endpoint, leading to connection errors. In Kubernetes, environment variables are commonly used to pass service discovery information, and a naming mismatch directly breaks the application's ability to reach the backend.

Answer

The selector labels do not match the pods.

Answer

The backend service is not listening on port 8080.

Answer

The termination grace period is too short causing connection drops.

Question 11

Your team runs a Node.js API on Cloud Run that must write to a Cloud Storage bucket in the same project. The service currently uses a downloaded service account key stored in a Secret Manager secret and mounted as a volume. You need to remove the static key entirely while keeping least-privilege access and avoiding any credential files on disk. What should you do?

Accepted Answer

Create a dedicated service account with the roles/storage.objectCreator role, assign it as the Cloud Run service's runtime identity, and delete the secret and key.. Attaching a dedicated runtime service account to the Cloud Run revision lets the container obtain short-lived tokens from the metadata server, so no key file is needed. Scoping that identity to roles/storage.objectCreator enforces least privilege for bucket writes. Removing the Secret Manager secret and downloaded key completes the keyless migration and removes the risk of credential exfiltration from the container filesystem.

Answer

Keep the mounted key but rotate it every 24 hours using a Cloud Scheduler job that calls the IAM API to create a new key version.

Answer

Enable the Cloud Storage API and use the default Compute Engine service account by setting the GOOGLE_APPLICATION_CREDENTIALS variable to the metadata server path.

Answer

Store the key in an environment variable instead of a mounted volume, and restrict access to the Cloud Run service with Cloud IAM.

Question 12

You are a Cloud Developer working for an e-commerce company. The company uses Cloud Build to build and deploy a Python application to App Engine standard environment. The application uses Cloud SQL for its database. The team recently updated the application code and added a new dependency. The build succeeds, but the deployment fails with 'Error Response: [9] Application startup error!' You check the logs and see 'ImportError: No module named requests'. The team uses a requirements.txt file. However, the requirements.txt file has been configured correctly in the past. The team also uses a custom runtime config in app.yaml with a 'entrypoint' field. They did not change any configuration files. What is the most likely cause of this error?

Accepted Answer

The custom entrypoint in app.yaml bypasses the automatic installation of dependencies.. The error 'ImportError: No module named requests' indicates the new dependency was not installed. In App Engine standard, when a custom `entrypoint` is specified in app.yaml, App Engine does not automatically install dependencies from requirements.txt; the entrypoint overrides the default build/start behavior that would normally run pip install. Since the team added a new dependency and uses a custom entrypoint, the dependency is not installed. The runtime is not the cause because no configuration files were changed and requirements.txt was previously working.

Answer

The app.yaml file incorrectly specifies 'runtime: python27' but the code uses Python 3, and python27 does not automatically install dependencies from requirements.txt.

Answer

The app.yaml file specifies 'runtime: python39' which is not supported by App Engine standard.

Answer

The requirements.txt file is missing from the deployment directory.

Question 13

An organization deploys a critical application on GKE with multiple namespaces. They want to enforce that only certain images from approved Artifact Registry repositories can be deployed in the production namespace. Which GKE feature should they use?

Accepted Answer

Binary Authorization. Binary Authorization is the correct GKE feature because it enforces deployment-time policy controls that require container images to be signed by trusted authorities and originate from approved Artifact Registry repositories. By configuring an admission webhook with Binary Authorization, the organization can create an attestation policy that blocks any pod in the production namespace from running unless its image has a valid cryptographic signature from a trusted signer and the image path matches an allowed Artifact Registry host.

Answer

Network Policies

Answer

Workload Identity

Answer

Pod Security Policies (deprecated)

Question 14

A team wants to monitor the availability of an external API by pinging it every minute from multiple locations around the world. Which Cloud Monitoring feature should they use?

Accepted Answer

Uptime checks. Uptime checks are the correct Cloud Monitoring feature because they are specifically designed to verify the availability of external services by sending HTTP, HTTPS, or TCP requests from multiple locations around the world. This matches the requirement to ping an external API every minute from multiple global locations, providing detailed latency and status data without custom scripting.

Answer

Synthetic monitoring

Answer

Custom metrics from a cron job

Answer

Log-based metrics

Question 15

A database team is planning to migrate a 500 GB MySQL database to Cloud SQL. They require minimal downtime. Which Database Migration Service job type should they use?

Accepted Answer

Continuous migration job. A continuous migration job in Database Migration Service (DMS) is designed for minimal downtime by performing an initial full dump and then continuously replicating ongoing changes from the source to the destination until cutover. This is ideal for a 500 GB MySQL database requiring minimal downtime. One-time migration would require downtime during the migration. Cloud SQL replication from external primary is for replicating from an external master to a Cloud SQL replica, but it's not a DMS job type and may not handle the full migration workflow. Bulk export/import would cause significant downtime.

Answer

One-time migration job

Answer

Cloud SQL replication from external primary

Answer

Bulk export and import