PCD Practice Test 34 — 15 Questions

Question 1

A retail company runs an e-commerce application on Compute Engine instances in a managed instance group (MIG). The application stores session data in a local SSD on each instance. During a rolling update, the company wants to ensure that active user sessions are not lost and that the application remains available. They also want to minimize downtime during the update. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Move session data to a centralized, highly available data store such as Cloud Firestore or Memorystore, and then perform a rolling update on the MIG.. The core issue is that session data is stored on local SSDs, which are ephemeral and tied to the instance. To ensure sessions are not lost during updates, the data must be moved to a centralized, highly available store. Cloud Firestore or Memorystore provide low-latency, durable storage for session state. Once sessions are externalized, a rolling update can be performed without affecting users, as new instances can retrieve session data from the central store. This approach ensures availability and minimizes downtime.

Answer

Create a new MIG with the updated instance template and gradually shift traffic using a load balancer.

Answer

Configure the MIG with a rolling update and set the maximum surge to 1 and maximum unavailable to 0.

Answer

Use a stateful MIG and configure the update policy to recreate instances while preserving the persistent disk.

Question 2

A company is designing a cloud-native application on Google Cloud that requires low-latency access to a global user base. The application serves static content and dynamic APIs. Which strategy best minimizes latency while maintaining high availability?

Accepted Answer

Use Cloud CDN to cache static content and deploy the API across multiple regions with global load balancing.. It combines Cloud CDN for caching static content at edge locations worldwide, reducing latency for static assets, and deploys the dynamic API across multiple regions with global load balancing (using Google Cloud's global external HTTP(S) load balancer) to route users to the nearest healthy backend, minimizing latency for dynamic requests while ensuring high availability through regional redundancy.

Answer

Deploy the application in a single region and use Cloud Interconnect for global access.

Answer

Use Cloud Armor to protect the application and rely on Google's backbone for low latency.

Answer

Store all content in Cloud Storage and serve directly from there.

Question 3

An analytics company runs a Cloud Run service that queries a Cloud SQL for PostgreSQL instance. During month-end reporting, many concurrent Cloud Run instances connect to Cloud SQL, and the database reports too many connections. The team wants to reduce connection pressure without changing the database engine or rewriting queries. What should they do?

Accepted Answer

Deploy a connection pooler such as PgBouncer on a Compute Engine instance or GKE, and have the Cloud Run service connect through it in transaction pooling mode.. The too many connections error occurs because each Cloud Run instance opens its own PostgreSQL connections and the count grows with scale. A connection pooler such as PgBouncer in transaction pooling mode multiplexes many client connections over a small pool of server connections, so the database sees far fewer backends. This preserves the PostgreSQL engine and requires no query rewrites.

Answer

Configure the Cloud Run service to use a Serverless VPC Access connector and connect directly to the Cloud SQL private IP.

Answer

Add the Cloud SQL Auth Proxy as a sidecar container in each Cloud Run instance and increase the Cloud SQL max_connections flag.

Answer

Increase the Cloud Run maximum instance count and set container concurrency to 1 so each instance handles one request at a time.

Question 4

A developer is writing unit tests for a Cloud Function that publishes a message to Pub/Sub. The function uses the Node.js Pub/Sub client library. The tests must run quickly and not depend on external services. Which approach should the developer take to test the function's logic?

Accepted Answer

Mock the Pub/Sub client library using a framework like sinon or jest.mock to simulate publish behavior.. To test a Cloud Function that publishes to Pub/Sub quickly and without external dependencies, the developer should mock the Pub/Sub client library. Mocking replaces actual network calls with controlled behavior, enabling fast unit tests that focus on the function's logic. This approach avoids the overhead of emulators or real cloud services and ensures tests are deterministic and isolated.

Answer

Use the Pub/Sub emulator and set the PUBSUB_EMULATOR_HOST environment variable before running tests.

Answer

Use the Cloud Functions Framework to invoke the function locally, which automatically intercepts Pub/Sub calls.

Answer

Create a test Pub/Sub topic and subscription in a dedicated Google Cloud project and publish messages to it during tests.

Question 5

Your team maintains a Cloud Run service that receives bursty traffic. You have deployed the service with `--min-instances=0` and `--max-instances=100`. During a sudden spike, users experience cold-start latency of several seconds. You want to reduce cold-start latency without changing the application code or over-provisioning. What should you do?

Accepted Answer

Set `--min-instances=1` so that at least one instance is always warm.. Cold starts occur when Cloud Run creates a new instance to handle a request after scaling to zero. Keeping at least one instance warm with a minimum instance setting ensures that requests are served by an already running container, removing the startup delay. Increasing maximum instances or adjusting concurrency does not prevent the first request from hitting a cold instance.

Answer

Deploy the service with `--cpu-boost` enabled.

Answer

Set `--concurrency=1` to ensure each instance handles only one request at a time.

Answer

Increase `--max-instances` to 200 to allow more concurrent instances.

Question 6

You are deploying a new version of a Java web application to App Engine standard environment. The previous version is still serving 100% of traffic. You want to test the new version with a small subset of users before shifting all traffic. Which approach should you take?

Accepted Answer

Deploy the new version with `gcloud app deploy --no-promote`, then use the version-specific URL to test, and finally migrate traffic using `gcloud app services set-traffic`.. Deploying with --no-promote creates a new version without routing traffic to it, allowing you to test via the version-specific URL. After validation, you can shift traffic gradually using gcloud app services set-traffic, which supports splitting by IP or cookie. This provides a safe rollout and rollback capability.

Answer

Use `gcloud app deploy --promote` to deploy the new version and automatically split traffic 50/50 between old and new versions.

Answer

Create a new App Engine service for the test version, deploy there, and use a load balancer to route a percentage of traffic to the new service.

Answer

Deploy the new version normally, then immediately use `gcloud app versions stop` on the old version to force all traffic to the new version.

Question 7

A developer is building a container image for a Java application that will run on Cloud Run. The application must read configuration from environment variables at runtime. The developer wants to ensure the image builds correctly and the application starts as expected. Which action should the developer take to test the container locally before deploying to Cloud Run?

Accepted Answer

Run the container locally with Docker, passing the required environment variables using the -e flag, and send requests to the exposed port.. To test a container locally before deploying to Cloud Run, the developer should run it with Docker and pass environment variables using the -e flag. This mimics how Cloud Run injects environment variables at runtime and allows the developer to verify that the application starts and responds correctly. It is a fast, local, and effective way to catch configuration issues early.

Answer

Use the Cloud Run emulator provided by the Google Cloud SDK to run the container locally.

Answer

Build the container image and inspect its layers to verify that environment variables are set correctly.

Answer

Deploy the container to Cloud Run with a minimal configuration and then check the logs for errors.

Question 8

A developer is writing unit tests for a Cloud Function that uses the Cloud Vision API to analyze images. The tests should run quickly and not require network access. Which approach should the developer use?

Accepted Answer

Mock the Cloud Vision client library's method that performs image analysis to return a predefined response.. Mocking the Cloud Vision client method is the correct approach for unit testing because it avoids network calls and allows the test to control the response. This makes the test fast, reliable, and independent of external factors. The developer can verify that the function correctly processes the response and handles errors. This technique is widely used for testing code that interacts with external APIs, as it isolates the unit under test.

Answer

Use a real image and call the Cloud Vision API during tests, but use a test project with limited quotas.

Answer

Use the google-cloud-vision library's built-in test mode by setting the VISION_TEST_MODE environment variable to true.

Answer

Use the Cloud Vision API emulator by setting the CLOUD_VISION_EMULATOR_HOST environment variable.

Question 9

A developer is using Cloud Build to run unit tests for a Python application. The tests require a connection to a Cloud SQL for MySQL instance. The developer wants to keep the build secure and avoid exposing the database to the public internet. Which approach should the developer use to allow Cloud Build to connect to Cloud SQL?

Accepted Answer

Use the Cloud SQL Auth Proxy as a build step to connect to the instance over a secure tunnel.. To connect Cloud Build to Cloud SQL securely, the developer should use the Cloud SQL Auth Proxy as a build step. It provides authenticated, encrypted connectivity without exposing the database to the public internet. Other methods like authorized networks or Serverless VPC Access are either insecure or not applicable to Cloud Build.

Answer

Export the Cloud SQL instance's SSL certificates and configure the application to use them for a direct connection.

Answer

Set up a Serverless VPC Access connector and configure Cloud Build to use it for egress to the Cloud SQL private IP.

Answer

Configure the Cloud SQL instance to allow connections from the Cloud Build IP range by adding it to authorized networks.

Question 10

You are deploying a containerized application to Cloud Run. The application requires a database connection string that must be kept secret. You want to avoid hardcoding the secret in the container image and ensure that the secret is rotated regularly without redeploying the service. What should you do?

Accepted Answer

Use Secret Manager to store the secret and reference it as an environment variable in the Cloud Run service configuration.. Secret Manager is the recommended service for storing and managing secrets on Google Cloud. Cloud Run can reference a secret from Secret Manager as an environment variable or as a mounted volume. When the secret is rotated, new Cloud Run instances automatically retrieve the latest version, so you don't need to redeploy. This approach keeps secrets out of the image and source code, and provides centralized management and auditing.

Answer

Store the secret in an environment variable in the Cloud Run service YAML file and commit it to a private Git repository.

Answer

Store the secret in a Cloud Storage bucket and mount it as a volume in the Cloud Run service.

Answer

Pass the secret as a build-time argument in the Dockerfile and build the image with the secret embedded.

Question 11

A developer uses Cloud Build to build a container image. The build should only run when a commit is pushed to the main branch of a connected GitHub repository. Where should the developer configure this trigger condition?

Accepted Answer

Use the `gcloud builds triggers create github` command with the `--branch-pattern` flag set to `^main$`.. The requirement is to trigger a Cloud Build only for pushes to the main branch. Cloud Build triggers support branch filtering through the `--branch-pattern` flag, which takes a regular expression. `^main$` matches exactly the main branch. The other options either misplace the filter (in the build config), use an overly complex workaround, or filter on tags instead of branches, so they do not satisfy the scenario.

Answer

Use the `gcloud builds triggers create github` command with the `--tag-pattern` flag set to `main`.

Answer

Add a `branches` section to the `cloudbuild.yaml` file and list `main` under it.

Answer

Create a Pub/Sub topic that receives GitHub webhooks and filter messages for the main branch.

Question 12

A retail company runs a Python web application on Compute Engine. The application needs to read messages from a Pub/Sub subscription, enrich them using a Cloud SQL for PostgreSQL database, and write results to a Cloud Storage bucket. The security team mandates that no service account keys be downloaded to the VM. The application must authenticate to all three services. Which approach should the developer implement?

Accepted Answer

Create a user-managed service account, grant it the required IAM roles, and attach it to the Compute Engine instance. Use the Application Default Credentials (ADC) libraries in the application code.. The correct approach is to attach a user-managed service account to the Compute Engine instance and use Application Default Credentials. This eliminates the need to download or manage keys, as the metadata server provides short-lived tokens. Granting the service account only the necessary IAM roles adheres to least privilege while enabling access to Pub/Sub, Cloud SQL, and Cloud Storage.

Answer

Create a service account and configure the application to use the service account's OAuth 2.0 client ID and secret to obtain access tokens for each API call.

Answer

Use the Compute Engine default service account and grant it the Editor role at the project level to ensure it has permissions for all three services.

Answer

Create a service account and generate a JSON key. Store the key in Cloud Storage, then have the application download it at startup and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Question 13

A developer is deploying a new version of a microservice to Cloud Run. The service uses a custom domain and must be accessible only from a specific VPC network. The developer configures a Serverless VPC Access connector and sets ingress to 'internal and cloud load balancing'. After deployment, external users report that the service is unreachable. What is the most likely cause?

Accepted Answer

The ingress setting 'internal and cloud load balancing' blocks all traffic from outside the VPC and Google Cloud load balancing, so external users cannot reach the service.. The ingress setting 'internal and cloud load balancing' restricts access to traffic originating from the VPC network or from Cloud Load Balancing. This means direct external traffic from the internet is blocked. If the goal is to allow external users while still restricting to a specific VPC, the developer would need to use a different approach, such as an external load balancer with Cloud Armor or VPC firewall rules. The setting as configured correctly blocks external access, which explains the reported unreachability.

Answer

The Serverless VPC Access connector is not in the same region as the Cloud Run service.

Answer

The custom domain mapping was not configured with a Google-managed SSL certificate, so HTTPS requests are rejected.

Answer

Cloud Run requires the use of a global external HTTP(S) load balancer to expose services with custom domains, and the developer did not configure one.

Question 14

A company runs a containerized web application on Cloud Run. The application must read configuration values and secrets from environment variables at runtime. The security team requires that secrets are never stored in the container image or in plaintext in the deployment YAML. Which approach should the developer use to securely provide these secrets to the Cloud Run service?

Accepted Answer

Store the secrets in Secret Manager and reference them in the Cloud Run service configuration using the secret's resource name and version.. Cloud Run integrates with Secret Manager to securely inject secrets as environment variables or mounted volumes. By referencing the secret's resource name and version in the service configuration, the secret is fetched at runtime and never exposed in the image or YAML. This satisfies the security team's requirements for secure secret handling.

Answer

Store the secrets as environment variables directly in the Cloud Run service YAML file and apply it with gcloud run services replace.

Answer

Build the secrets into the container image as environment variables using a Dockerfile ENV instruction.

Answer

Store the secrets in a Cloud Storage bucket and have the application download them at startup using the Cloud Storage API.

Question 15

A developer is preparing to deploy a containerized application to Cloud Run and needs the container to start successfully. The application listens on a port and must be reachable by the Cloud Run front end. Which two requirements must the container satisfy? (Choose two.)

Accepted Answer

The container must listen on the port specified by the PORT environment variable, which Cloud Run injects.. A Cloud Run container must listen on the port provided by the PORT environment variable and bind to all interfaces so the platform's front end can reach it. Honoring PORT keeps the app portable across revisions and platform-assigned values, while binding to 0.0.0.0 ensures the listener is reachable from outside the container namespace, which is required for health checks and traffic routing.

Answer

The container must listen on port 8080 exclusively, because Cloud Run only routes traffic to that fixed port.

Answer

The container must expose the port in the Dockerfile with the EXPOSE instruction so Cloud Run can detect it.

Answer

The container must run as root so Cloud Run can attach the network namespace and route traffic.