PCD Practice Test 34 — 15 Questions

Question 1

A developer is deploying a Node.js application to App Engine flexible environment. They need to install custom dependencies and run startup scripts. Which two configuration elements should they define in the app.yaml? (Choose two.)

Accepted Answer

entrypoint. A is correct because the `entrypoint` element in app.yaml for App Engine flexible environment specifies the command to run your application, allowing you to execute custom startup scripts and install dependencies before the main process starts. This is essential for Node.js apps that require custom build steps or runtime initialization beyond the default `npm start`.

Answer

env_variables

Answer

manual_scaling

Answer

network

Question 2

A team is deploying a critical microservice on GKE. They want to minimize risk by gradually shifting traffic from old to new version. They use a Deployment with a single Service. What deployment strategy should they implement?

Accepted Answer

Create two Deployments (stable and canary) with different numbers of replicas and use the same Service label.. Option D is correct because it implements a canary deployment pattern on GKE: two separate Deployments (stable and canary) share the same Service label, allowing the Service to distribute traffic to both based on replica counts. This enables gradual traffic shifting by adjusting the number of canary replicas, minimizing risk while the new version is validated.

Answer

Use a rolling update with maxSurge=1 and maxUnavailable=0.

Answer

Use a single Deployment with a readinessProbe that fails for the new version until ready.

Answer

Create two separate Deployments and switch the Service selector to the new version after testing.

Question 3

A developer wants to deploy a containerized application to Google Kubernetes Engine (GKE) and ensure that new pods are automatically created if an existing pod fails. Which Kubernetes resource should be used?

Accepted Answer

Deployment. A Deployment is the correct Kubernetes resource for ensuring declarative updates and self-healing for stateless applications. It manages a ReplicaSet, which maintains the desired number of pod replicas; if a pod fails, the ReplicaSet controller automatically creates a replacement pod to match the desired state.

Answer

Job

Answer

DaemonSet

Answer

StatefulSet

Question 4

A company has a monolithic application that needs to be migrated to Cloud Run. The application currently writes logs to a local file. What is the best practice for handling logs in Cloud Run?

Accepted Answer

Write logs to stdout and stderr; Cloud Run automatically sends them to Cloud Logging.. Cloud Run is a serverless compute platform that automatically integrates with Cloud Logging. The best practice is to write logs to stdout and stderr because Cloud Run's runtime captures these streams and forwards them to Cloud Logging without any additional agents or sidecars. This approach aligns with the 12-factor app methodology and ensures logs are available for monitoring and troubleshooting.

Answer

Use a third-party logging agent installed in the container image.

Answer

Use a sidecar container to ship logs to Stackdriver.

Answer

Continue writing to a local file; Cloud Run will persist it.

Question 5

A developer is deploying an application on Compute Engine and needs to automatically apply security patches without downtime. The application runs behind a TCP load balancer. What is the best deployment strategy?

Accepted Answer

Use a rolling update on the instance group.. Option D is correct because a rolling update on a managed instance group allows the developer to update instances incrementally, applying security patches without downtime. The TCP load balancer automatically distributes traffic only to healthy instances, so as each instance is updated and passes health checks, traffic is seamlessly redirected away from instances being patched.

Answer

Use a canary deployment with a separate instance group.

Answer

Stop all instances, apply patches, then restart them.

Answer

Use a managed instance group with autohealing.

Question 6

A developer wants to automatically deploy a new version of an application to App Engine Standard every time code is pushed to the main branch of a Cloud Source Repositories repository. Which service should be used?

Accepted Answer

Cloud Build. Cloud Build is the correct service because it is a fully managed CI/CD platform that integrates natively with Cloud Source Repositories and App Engine Standard. You can configure a Cloud Build trigger to automatically build and deploy your application whenever code is pushed to the main branch, using a cloudbuild.yaml file that specifies the build steps and the `gcloud app deploy` command.

Answer

Cloud Run

Answer

Cloud Scheduler

Answer

Cloud Deploy

Question 7

A company has a multi-region deployment on GKE and needs to route traffic to the closest regional cluster based on user location. They want to minimize latency. Which approach should they use?

Accepted Answer

Use a global external HTTP(S) Load Balancer with backend services pointing to NEGs in each region.. A global external HTTP(S) Load Balancer uses Anycast IP addresses and is backed by backend services that reference Network Endpoint Groups (NEGs) in each regional GKE cluster. This allows the load balancer to direct traffic to the closest healthy backend based on the user's geographic location and the load balancer's proximity algorithm, minimizing latency without requiring DNS-based routing.

Answer

Create separate internal load balancers in each region and use Cloud DNS geo-routing.

Answer

Configure an external TCP/UDP Network Load Balancer in each region and use Cloud DNS geo-routing.

Answer

Deploy a single regional cluster and use Cloud CDN to cache content globally.

Question 8

Which TWO strategies can be used to reduce cold start latency in Cloud Run? (Choose 2)

Accepted Answer

Set a minimum number of instances (min-instances) to keep instances warm.. Option C is correct because setting a minimum number of instances (min-instances) ensures that a specified number of container instances are always running and ready to serve requests, eliminating the cold start latency that occurs when an instance must be started from scratch. This pre-warming strategy directly reduces the time users wait for the first request to be processed.

Answer

Increase the maximum number of concurrent requests per instance.

Answer

Deploy the Cloud Run service in a region closer to the users.

Answer

Use a VPC connector to access resources in a VPC network.

Question 9

A developer runs the command above and receives the error. The developer has just been granted the 'roles/cloudbuild.builds.editor' role on the project. What is the most likely reason for the permission error?

Accepted Answer

The Cloud Build API is not enabled for the project.. The error occurs because the Cloud Build API has not been enabled for the project. Even with the 'roles/cloudbuild.builds.editor' IAM role, the Cloud Build service itself must be explicitly enabled via the Google Cloud Console or using the `gcloud services enable cloudbuild.googleapis.com` command. Without enabling the API, any attempt to run a build will fail with a permission error, as the service is not available to process the request.

Answer

The project ID 'my-project' does not exist or the developer typed it incorrectly.

Answer

The container registry (gcr.io) is incorrect; should use us.gcr.io.

Answer

The developer is using the wrong region; Cloud Build must be enabled per region.

Question 10

You are a site reliability engineer for a fintech company that runs a latency-sensitive trading application on Google Kubernetes Engine (GKE). The application is instrumented with OpenTelemetry and exports traces and metrics to Cloud Monitoring and Cloud Logging. Recently, the team observed a gradual increase in p99 latency from 50ms to 500ms over the past week, and error rates have spiked to 5% from a baseline of 0.1%. You review the Cloud Monitoring dashboards and notice that the 'container/cpu/utilization' metric shows normal usage, but the 'container/memory/bytes_used' metric shows a steady climb, reaching 90% of the memory limit on several pods. The application logs contain many 'OutOfMemoryError' exceptions and 'GC overhead limit exceeded' messages. You also see that the HPA (Horizontal Pod Autoscaler) has not triggered any scale-up events because the 'custom/googleapis.com|container/cpu/utilization' metric is below the target utilization threshold. The cluster autoscaler is enabled and has sufficient node pool capacity. What is the most likely root cause and the best immediate action to resolve the issue?

Accepted Answer

Add a custom metric for memory utilization to the HPA and configure the target to scale when memory exceeds 70%.. The gradual memory increase and OutOfMemoryError exceptions indicate that the application is memory-bound, not CPU-bound. Since the HPA is configured to scale only on CPU utilization, it never triggers scale-up despite memory pressure. Adding a custom memory utilization metric to the HPA (option D) directly addresses the root cause by scaling pods when memory exceeds 70%, preventing OOM errors and reducing latency.

Answer

Enable the Vertical Pod Autoscaler (VPA) in update mode to automatically adjust memory requests.

Answer

Switch the HPA to use the default 'container/cpu/utilization' metric instead of the custom metric.

Answer

Increase the memory request and limit for the pods to allow more memory usage.

Question 11

A financial services company runs a transaction processing microservice on Google Kubernetes Engine (GKE). The service uses Cloud Spanner as its database. After migrating from Cloud SQL to Spanner to improve scalability, the team notices that a small percentage of transactions fail with an 'ABORTED' error due to deadlock detection. The application currently performs no retries, and the failures cause customer-facing errors. The team also observes that under peak load, transaction latencies are around 500ms, which is acceptable but they want to ensure the system remains reliable. They need to implement a solution that minimizes failures while maintaining acceptable performance. Which course of action should they take?

Accepted Answer

Implement retry logic with exponential backoff and random jitter for aborted transactions.. In Cloud Spanner, 'ABORTED' errors due to deadlock detection are a normal part of the optimistic concurrency control mechanism. The correct solution is to implement retry logic with exponential backoff and random jitter, as recommended by Google's own documentation. This approach transparently handles transient deadlocks without requiring infrastructure changes or sacrificing consistency, and it maintains acceptable latency by spacing out retries.

Answer

Increase the number of Spanner nodes to reduce the probability of deadlocks.

Answer

Reduce the size of each transaction by splitting them into smaller ones.

Answer

Change the transaction isolation level to READ UNCOMMITTED to avoid deadlocks.

Question 12

A retail company processes customer orders through a pipeline. New orders are written to a Cloud Storage bucket as JSON files. A Cloud Function (currently triggered directly by Cloud Storage finalize events) parses the order and sends it to a third-party fulfillment service via an HTTP POST. As order volume grows, the team observes that the Cloud Function often times out (60s default) because the fulfillment service is slow. The team wants to decouple the processing to improve reliability. The order must be attempted at least once, and if the fulfillment service fails, retries should be exponential with a maximum of 5 attempts. Which solution should the team implement?

Accepted Answer

Use Cloud Tasks to create a queue that targets the Cloud Function. Configure the queue with exponential backoff and max retries of 5. Set the Cloud Function trigger to be HTTP instead of Cloud Storage.. Option B is correct because Cloud Tasks provides the exact retry semantics required (exponential backoff, max attempts) and decouples the HTTP call from the Cloud Function. Option A is flawed because increasing timeout does not provide retries and 540s is still not infinite. Option C introduces polling, which is inefficient and not real-time. Option D uses Pub/Sub push, but Pub/Sub's retry is not as configurable and lacks max attempts without a dead letter queue; Cloud Tasks is the appropriate service for HTTP-targeted retry logic.

Answer

Keep the Cloud Storage trigger, but increase the Cloud Function timeout to 540 seconds and add retry logic in the function code.

Answer

Use Pub/Sub notifications from Cloud Storage to a Pub/Sub topic, with a subscription that pushes to the Cloud Function. Enable dead letter topics for failed deliveries.

Answer

Replace the Cloud Function with a Cloud Run job that polls Cloud Storage for new files and sends orders to the fulfillment service. Use Cloud Scheduler to run the job every 5 minutes.

Question 13

You deployed a new version of your application that uses Cloud Pub/Sub for asynchronous messaging. After deployment, you notice that messages are accumulating in the subscription backlog. You suspect the subscriber is too slow. Which tool should you use to diagnose?

Accepted Answer

Cloud Monitoring to check subscriber's processing latency and throughput.. Cloud Monitoring is the correct tool because it provides metrics such as subscriber processing latency, throughput, and backlog size for Pub/Sub subscriptions. By examining these metrics, you can quantify how slow the subscriber is and identify whether the issue is due to high latency or insufficient throughput, directly addressing the suspicion of a slow subscriber.

Answer

Cloud Trace to trace message processing.

Answer

Cloud Logging to view subscriber logs.

Answer

Cloud Profiler to profile subscriber code.

Question 14

A development team is using Cloud Trace to analyze performance bottlenecks in a Node.js application deployed on GKE. They have enabled trace sampling at 10% and can see some traces, but many requests are not captured. They want to increase the sampling rate to 100% for a specific high-traffic endpoint while keeping the default sampling rate for other endpoints. How can they achieve this?

Accepted Answer

Implement a custom sampler in the application code to sample the specific endpoint at 100%.. Option C is correct because Cloud Trace allows you to implement a custom sampler in your application code to override the default sampling rate for specific endpoints. By using the OpenTelemetry SDK, you can create a sampler that checks the request path and returns a sampling decision of 1.0 (100%) for the high-traffic endpoint while delegating to the default sampler (e.g., 0.1) for all other requests. This gives you fine-grained control without affecting the global sampling configuration.

Answer

Use a separate trace exporter for the high-traffic endpoint.

Answer

Increase the quota for trace spans per request.

Answer

Set the global trace sampling rate to 100% in the application configuration.

Question 15

A company uses Cloud Build to build and deploy a microservice. The build step that runs tests fails with a permission denied error when trying to access a private GitHub repository. The build configuration uses a default Cloud Build service account. The team has already added the GitHub repository as a trigger and provided credentials during trigger creation. However, the build step still fails. What is the most likely cause and solution?

Accepted Answer

Create a new service account with access to the secret containing the GitHub SSH key and use it in the build configuration.. Cloud Build uses the Cloud Build service account by default for executing build steps. To access private GitHub repositories, the build step must authenticate using the SSH key or access token stored in Secret Manager, and the Cloud Build service account needs permissions to read the secret. The error suggests the build step does not have the necessary authentication. Using a custom service account with required permissions and retrieving the secret in the build step is the correct approach. The trigger credentials are only for triggering the build, not for build steps.

Answer

Use Cloud Build's '--no-cache' flag to force a fresh clone.

Answer

Add a build step to run 'git config' to set user credentials.

Answer

Grant the Cloud Build service account the role 'Cloud Build Service Agent'.