PCD Practice Test 29 — 15 Questions

Question 1

You are building a data pipeline using Cloud Dataflow (Apache Beam). The pipeline reads from Pub/Sub, performs aggregations, and writes to BigQuery. Occasionally, you see duplicates in the BigQuery output, even though the pipeline uses .withInsertId() in the BigQuery write transform. What could be causing these duplicates?

Accepted Answer

The pipeline is using at-least-once mode and bundles are being retried, but the insertId is not being reused across retry attempts. Option C is correct because Cloud Dataflow (Apache Beam) operates in at-least-once mode by default, meaning bundles may be retried during processing. When a bundle is retried, the insertId set via .withInsertId() must be reused across retry attempts to enable BigQuery's deduplication. If the insertId is not reused (e.g., because it's generated per attempt or not properly propagated), BigQuery treats each write as a separate row, resulting in duplicates.

Answer

You are not using the exactly-once sink option for BigQuery

Answer

You have set .withOutputParallelization() to false

Answer

You need to enable Dataflow's built-in deduplication using the .withIdAttribute() in Pub/Sub read

Question 2

Which THREE are valid approaches for automating testing in a Cloud Build CI pipeline?

Accepted Answer

Use Cloud Build triggers to run tests on every push to a branch.. Option B is correct because Cloud Build triggers can be configured to automatically start a build (including test steps) on specific events, such as a push to a branch. This enables continuous integration by validating every code change as soon as it is committed, without manual intervention.

Answer

Use Cloud Build to ship test results to Cloud Monitoring.

Answer

Use Cloud Build to run tests only after manual approval.

Question 3

A developer wants to store secrets (e.g., API keys) for use in Cloud Functions without exposing them in the source code. Which Google Cloud service should they use?

Accepted Answer

Use Secret Manager to store secrets and reference them via secret environment variables. Secret Manager is the dedicated Google Cloud service for storing sensitive data like API keys, passwords, and certificates. It provides built-in versioning, access control via IAM, and native integration with Cloud Functions through secret environment variables, ensuring secrets are never exposed in source code or configuration files.

Answer

Store secrets in a Cloud Storage bucket with encrypted objects and load them at runtime

Answer

Use Firestore to store secrets in a secure document and access it via the Firestore SDK

Answer

Use Cloud Key Management Service (Cloud KMS) to create and manage secrets

Question 4

A developer is writing unit tests for a Python Cloud Run service that uses Cloud Firestore. They want to avoid hitting the real Firestore during tests. What should they use?

Accepted Answer

Mock the Firestore client using a library like unittest.mock.. Option B is correct because unit tests should isolate the code under test from external dependencies. Using `unittest.mock` to mock the Firestore client allows the developer to simulate Firestore calls and return controlled responses without any network I/O, ensuring tests are fast, deterministic, and independent of the real Firestore service.

Answer

Use a real Firestore database but with a test project.

Answer

Disable network access during tests.

Answer

Use the Firestore emulator for unit tests.

Question 5

A company deploys a microservice on Google Kubernetes Engine (GKE) with a Cloud Deploy delivery pipeline. The application uses a custom container image stored in Artifact Registry. After a successful deployment to a staging cluster, the production deployment fails with 'ImagePullErr: image not found'. The staging and production clusters are in different projects. What is the most likely cause?

Accepted Answer

The production cluster's node pool has not been granted access to pull images from Artifact Registry in the staging project.. Option C is correct because the production cluster's node pool, which runs in a different project, does not have the necessary permissions to pull the custom container image from Artifact Registry in the staging project. By default, GKE node pools use the Compute Engine default service account, which only has access to images in the same project. To pull images across projects, the node pool's service account must be granted the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in the staging project.

Answer

The Cloud Deploy service account lacks permission to create pods in the production cluster.

Answer

Cloud Deploy is not configured to use Artifact Registry and still references Container Registry.

Answer

The container image tag used in production is different from the staging tag.

Question 6

Which TWO are best practices for testing containerized applications on Google Cloud?

Accepted Answer

Use Cloud Build to build and test containers.. Cloud Build is a managed CI/CD platform that can build container images from source code and execute tests as part of the build pipeline. It integrates natively with Google Cloud services like Container Registry and Artifact Registry, and supports custom build steps, making it an ideal tool for building and testing containerized applications in a consistent, automated environment.

Answer

Use Kubernetes for testing only.

Answer

Use Distroless images for testing.

Answer

Use a different base image for testing than production.

Question 7

A team is implementing a CI/CD pipeline for a Cloud Function using Cloud Build. Which three steps should they include in their cloudbuild.yaml? (Choose 3)

Accepted Answer

Static code analysis. Static code analysis (A) is correct because it helps identify code quality issues, security vulnerabilities, and adherence to coding standards early in the pipeline, which is a best practice for Cloud Functions. Running unit tests (C) is essential to validate function logic before deployment. Deploying the function (B) is the final step that pushes the validated code to Cloud Functions, making it a required step in the CI/CD pipeline.

Answer

Build a container image

Answer

Manual approval step

Question 8

Which THREE of the following are valid reasons to use Cloud Deploy instead of manually applying kubectl commands in a CI/CD pipeline?

Accepted Answer

Cloud Deploy maintains a deployment history for auditing.. Option B is correct because Cloud Deploy automatically maintains a detailed deployment history, including the state of each rollout, approvals, and metadata. This history is stored in the Cloud Deploy API and can be queried for auditing, compliance, and troubleshooting purposes, which is not natively provided by manual kubectl commands in a CI/CD pipeline.

Answer

Cloud Deploy automatically containerizes applications.

Answer

Cloud Deploy enforces IAM roles on Kubernetes clusters.

Question 9

A developer is writing integration tests for a Cloud Function that uses Cloud Firestore. The tests must run in a local environment without incurring costs or affecting production data. What should the developer use?

Accepted Answer

Use the Firestore emulator running locally.. Option C is correct because the Firestore emulator, part of the Firebase Local Emulator Suite, allows integration tests to run entirely on the local machine without network calls to GCP. This avoids incurring costs and prevents any impact on production data, as all operations are performed against an in-memory Firestore instance that mimics the real service's behavior.

Answer

Create a separate GCP project for testing and use its Firestore.

Answer

Mock the Firestore client library calls.

Answer

Run tests against the production Firestore instance with a test prefix.

Question 10

An organization uses Cloud Build to deploy multiple microservices to GKE. They want to ensure that the deployment process can be audited and that each deployment can be rolled back to a previous version. What is the recommended approach?

Accepted Answer

Use Cloud Deploy to manage deployments with rollback capabilities and audit logs.. Cloud Deploy is the recommended service for managing progressive deliveries and rollbacks on GKE, as it provides built-in rollback capabilities, audit logging, and delivery pipeline management. Unlike raw Kubernetes Deployment history, Cloud Deploy integrates with Cloud Build and offers a controlled, auditable deployment process with the ability to roll back to any previous release revision.

Answer

Use Kubernetes Deployment history to rollback by specifying a revision.

Answer

Store each manifest version in Artifact Registry and manually apply kubectl.

Answer

Use Cloud Build to redeploy a previous image tag when rollback is needed.

Question 11

A Cloud SQL for PostgreSQL instance is experiencing high query latency. The database has a high number of read replicas and is used for reporting. The team has identified that index scans are not being used effectively. Which THREE actions should they take to improve query performance?

Accepted Answer

Analyze table statistics using VACUUM ANALYZE.. Option A is correct because `VACUUM ANALYZE` updates table statistics that the PostgreSQL query planner relies on to choose efficient index scans. Stale statistics can cause the planner to underestimate the selectivity of index conditions, leading to sequential scans instead of index scans, which increases latency. Regular analysis ensures the planner has accurate data distribution information to optimize query execution plans.

Answer

Enable automatic storage increase.

Answer

Create additional read replicas.

Question 12

A development team is implementing a CI/CD pipeline using Cloud Build. They need to ensure that sensitive data, such as API keys, are never exposed in build logs. What is the best practice?

Accepted Answer

Use Cloud Build's encrypted variables or Secret Manager to pass secrets at build time.. Option A is correct because Cloud Build's encrypted variables and Secret Manager are designed to securely inject sensitive data like API keys at build time without exposing them in logs. Encrypted variables are stored in Cloud KMS and decrypted only during the build, while Secret Manager provides versioned secrets with fine-grained access control. This ensures secrets never appear in plaintext in the build configuration or output logs.

Answer

Store the API keys in a separate file in the source repository and reference it in the build.

Answer

Use custom substitutions with default values and rely on Cloud Build's encryption.

Answer

Store the API keys as plain text in cloudbuild.yaml and restrict access to the file.

Question 13

A team uses Cloud Build to build a Go application and deploy it to Cloud Run. The build triggers from a GitHub repository. The team wants to ensure that only commits to the 'main' branch trigger a production deployment, while other branches trigger a build but not a deployment. How should they configure this?

Accepted Answer

Use a single Cloud Build trigger with a substitution variable for the branch name, and include a conditional step that runs deployment only when the variable equals 'main'.. Option C is correct because Cloud Build supports substitution variables like $_BRANCH, which automatically receive the branch name from the trigger event. By using a conditional step in cloudbuild.yaml that checks if $_BRANCH equals 'main', you can run the deployment step only for main branch commits, while still building on all branches. This approach keeps a single trigger and avoids unnecessary duplication or external filtering.

Answer

Configure the GitHub repository to only send push events from the main branch to Cloud Build.

Answer

Use a conditional step in cloudbuild.yaml that checks the $_BRANCH variable and skips deployment if not main.

Answer

Create two separate Cloud Build triggers: one for main branch with deployment step, and one for all branches without deployment step.

Question 14

Which TWO of the following are valid strategies for testing Cloud Functions locally before deployment?

Accepted Answer

Use the Cloud Functions emulator provided by gcloud beta emulators.. Option C is correct because the `gcloud beta emulators` command includes a Cloud Functions emulator that allows you to run your functions locally in a simulated environment, enabling testing without deploying to the cloud. Option D is correct because the Functions Framework is an open-source library that starts a local HTTP server (typically on port 8080) and serves your function, matching the Cloud Functions runtime environment exactly.

Answer

Write unit tests that mock the HTTP request and response objects.

Answer

Use the Cloud Console to invoke the function with test events.

Answer

Deploy the function to a staging Cloud Functions project and test via HTTP invocations.

Question 15

A team created the instance template above and used it in a managed instance group. However, instances fail to serve web traffic. What is the most likely cause?

Accepted Answer

The startup script does not configure a firewall rule to allow HTTP traffic.. The instance template likely includes a startup script that installs and starts Nginx, but does not configure a firewall rule (e.g., via `gcloud compute firewall-rules create` or `iptables`) to allow inbound HTTP traffic on port 80. By default, GCP VPC firewall rules deny all ingress traffic unless explicitly allowed, so even if Nginx is running, external requests will be blocked. This is the most common reason why a managed instance group fails to serve web traffic despite the application being installed.

Answer

The image family debian-11 does not have the necessary packages.

Answer

The machine type e2-medium is too small for Nginx.

Answer

The instance template is missing a service account.