PCD Practice Test 35 — 15 Questions

Question 1

An application publishes order events to a Pub/Sub topic. A downstream Cloud Run service must process each event exactly once in business terms, but the team sees duplicate orders during retries. They already use a subscription with a 10-minute ack deadline and a dead-letter topic. Which change best prevents duplicate processing while keeping the pipeline resilient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Switch the subscription to exactly-once delivery and make the Cloud Run handler idempotent using the message ID stored in Firestore.. Exactly-once delivery reduces, but does not fully remove, redelivery during failures, so the durable idempotency check is what actually guarantees each order is written once. Storing the message ID in Firestore gives the handler a reliable record to consult before committing work, which makes retries safe.

Answer

Enable message ordering on the subscription and use the ordering key to serialize processing per customer.

Answer

Create a separate subscription per Cloud Run instance and rely on Pub/Sub to route each message to only one subscription.

Answer

Increase the ack deadline to 60 minutes and reduce the Cloud Run maximum concurrency to 1 so only one message is handled at a time.

Question 2

A company runs a real-time bidding service on Compute Engine. They need to publish bid events to a Pub/Sub topic from an application running on a VM. The security team mandates that no long-lived service account keys be stored on the VM. What should the developer do to authenticate the application to Pub/Sub?

Accepted Answer

Assign a service account with the Pub/Sub Publisher role to the VM instance and let the application use Application Default Credentials (ADC).. The most secure and operationally sound approach is to attach a service account to the Compute Engine VM and use Application Default Credentials. The application then retrieves short-lived tokens from the metadata server without any key files. This eliminates key management overhead and aligns with Google's recommendation to avoid long-lived service account keys whenever possible.

Answer

Create a service account key and store it in Cloud Key Management Service (Cloud KMS), then have the application decrypt and use it at runtime.

Answer

Configure the application to use the end-user's OAuth 2.0 refresh token to obtain access tokens for Pub/Sub.

Answer

Generate a JWT signed with the VM's SSH host key and exchange it for a Google Cloud access token.

Question 3

A developer is building a Cloud Function that processes messages from a Pub/Sub topic. The function must acknowledge messages only after successful processing, and failed messages should be retried. The developer wants to minimize code complexity. What should they do?

Accepted Answer

Use a background function triggered by Pub/Sub and rely on the function's automatic acknowledgment when it returns successfully.. Cloud Functions with a Pub/Sub trigger automatically handle message acknowledgment and retries. When the function completes successfully, the message is acknowledged; if it fails, the message is retried according to the subscription's settings. This built-in integration reduces code and ensures reliable processing, making it the simplest and most effective solution.

Answer

Deploy the function with the --retry flag and implement explicit acknowledgment using the Pub/Sub client library.

Answer

Create a pull subscription and have the function poll for messages, then acknowledge them after processing.

Answer

Use an HTTP-triggered function and manually acknowledge messages by calling the Pub/Sub API after processing.

Question 4

A financial services company runs a batch processing job on Google Cloud that reads data from BigQuery and writes results to Cloud Storage. The job must run only during a specific maintenance window and must be able to restart from where it left off if interrupted. The developer needs to implement checkpointing. Which Google Cloud service should the developer use to store the checkpoint state?

Accepted Answer

Cloud Storage. Cloud Storage is the ideal service for storing checkpoint files because it is durable, scalable, and simple to use. Batch jobs can write their progress to a Cloud Storage object and read it back when restarting. This pattern is widely used and integrates well with tools like Apache Beam and Dataflow.

Answer

Cloud Pub/Sub

Answer

Cloud Firestore in Datastore mode

Answer

Cloud SQL

Question 5

A company runs a critical application on Compute Engine instances managed by a managed instance group (MIG). They need to ensure that the application can access a Cloud Storage bucket without exposing credentials on the instances. The instances must also be able to call the Cloud Storage API with the least privilege necessary. What should they do?

Accepted Answer

Assign a service account with the Storage Object Viewer role to the instance template, and grant the service account access to the bucket.. The correct approach is to assign a service account to the instance template so that all instances in the managed instance group inherit it. This service account can be granted the Storage Object Viewer role, which allows read-only access to the bucket's objects. This method avoids storing credentials on instances and follows the principle of least privilege. The other options either involve insecure key management, excessive permissions, or unnecessary complexity.

Answer

Use the default Compute Engine service account and grant it the Storage Admin role to ensure the instances can access the bucket.

Answer

Configure the instances to use Application Default Credentials by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a shared credentials file on a persistent disk.

Answer

Create a service account with the Storage Object Viewer role, download its key as a JSON file, and store it on each instance.

Question 6

A financial analytics company runs a Java application on Compute Engine that must write events to a Cloud Pub/Sub topic. The security team mandates that no long-lived service account keys be stored on the VM. The VM's service account has the `roles/pubsub.publisher` IAM role. A developer writes code using the Google Cloud client library for Java. Which authentication approach should the application use?

Accepted Answer

Rely on Application Default Credentials (ADC), which automatically uses the Compute Engine metadata server to obtain tokens for the attached service account.. Application Default Credentials is the idiomatic way for Google Cloud client libraries to discover credentials. On Compute Engine, ADC queries the metadata server, which vends short-lived OAuth2 tokens for the attached service account. This avoids distributing service account keys entirely, aligning with the security team's requirement and with Google's recommended practice of using attached service accounts for workloads on Google Cloud infrastructure.

Answer

Embed the service account's private key directly in the application source code and instantiate a credential object with it.

Answer

Download a JSON key for the VM's service account, store it in a file on the persistent disk, and set GOOGLE_APPLICATION_CREDENTIALS to its path.

Answer

Configure the application to use the Cloud Pub/Sub REST API with an API key passed in the request query string.

Question 7

A developer is building a Cloud Function that needs to read data from a Cloud Storage bucket. The developer wants to follow the principle of least privilege. What should they do to grant the function access to the bucket?

Accepted Answer

Assign the Storage Object Viewer role to the Cloud Function's service account at the bucket level.. To follow least privilege, the Cloud Function's service account should be granted only the permissions required to perform its task. For reading objects from a specific Cloud Storage bucket, the Storage Object Viewer role at the bucket level is the minimal necessary permission. This avoids granting broad project-level access and ensures that the function can only read objects from that bucket. Using a dedicated service account also improves auditability and reduces the blast radius if the function is compromised.

Answer

Use the default App Engine service account and grant it the Editor role at the project level.

Answer

Assign the Storage Admin role to the Cloud Function's service account at the project level.

Answer

Generate a service account key and embed it in the function's code to authenticate as a user with access to the bucket.

Question 8

A media company stores user-uploaded video files in a Cloud Storage bucket. They want to automatically transcode each uploaded video and store the output in a second bucket. They need a fully managed, event-driven solution with minimal operational overhead. Which Google Cloud service should they use to trigger the transcoding workflow when a new object is finalized?

Accepted Answer

Cloud Storage Pub/Sub notifications on the source bucket, delivered to a Pub/Sub topic.. Cloud Storage integrates with Pub/Sub by publishing notifications when objects are created, updated, or deleted. Subscribing a serverless compute service to the OBJECT_FINALIZE event creates a push-based pipeline that reacts immediately to uploads. This is the recommended pattern for event-driven media processing because it decouples storage from compute, requires no polling, and scales automatically with upload volume.

Answer

Cloud Storage Object Lifecycle Management rules that move objects to a transcoding bucket when they are uploaded.

Answer

A Cloud Storage transfer job created with Storage Transfer Service that copies new objects to a Compute Engine instance for processing.

Answer

A Cloud Scheduler job that lists the bucket every minute and compares results to a database of processed files.

Question 9

A team has a Cloud Run service that writes to a Cloud SQL for PostgreSQL instance. They want to connect the service to Cloud SQL without exposing the database to the public internet and without managing a Cloud SQL Auth Proxy sidecar manually. What should they do?

Accepted Answer

Configure the Cloud Run service to use the Cloud SQL connections feature, specifying the instance connection name, and grant the service account the Cloud SQL Client role.. Cloud Run's built-in Cloud SQL connections feature automatically runs the Cloud SQL Auth Proxy, connects over a Unix socket, and uses IAM for authentication. Specifying the instance connection name and granting the Cloud SQL Client role satisfies the need for private, secure connectivity without manual proxy management. The other options either expose the database publicly, require manual sidecar management, or add unnecessary networking complexity.

Answer

Assign a public IP to the Cloud SQL instance, create a firewall rule to allow the Cloud Run service's egress IP range, and connect using the instance's public IP address.

Answer

Deploy a Cloud SQL Auth Proxy as a sidecar container in the Cloud Run service and connect to the proxy over localhost.

Answer

Use a Serverless VPC Access connector to connect the Cloud Run service to the Cloud SQL instance's private IP address, and configure the database to allow connections from the connector's IP range.

Question 10

A developer is writing unit tests for a Cloud Function that processes Cloud Storage events. The function's code depends on the Cloud Storage client library to read object metadata. To keep tests fast and isolated, the developer wants to avoid making real API calls to Cloud Storage. Which approach should the developer use?

Accepted Answer

Mock the Cloud Storage client library methods that the function calls, returning predefined responses.. For unit tests that need to avoid external dependencies, mocking the Cloud Storage client library is the correct approach. It provides control over responses and keeps tests fast and isolated. Since Google Cloud does not offer a Cloud Storage emulator, mocking is the recommended practice for testing code that interacts with Cloud Storage.

Answer

Set the STORAGE_EMULATOR_HOST environment variable to point to a local mock server.

Answer

Use the Cloud Storage emulator provided by the Google Cloud SDK to simulate Cloud Storage locally.

Answer

Create a test Cloud Storage bucket and use a service account with limited permissions to run the tests.

Question 11

A company is migrating a MySQL database to Cloud SQL for MySQL. They want to use Flyway for versioned schema migrations in CI/CD. Which TWO commands are part of a typical Flyway migration workflow?

Accepted Answer

flyway migrate. Option C, flyway migrate, is correct because it is the core command that applies all pending versioned migrations to the target MySQL database, bringing the schema up to the latest version in the CI/CD pipeline. Option D, flyway validate, is correct because it verifies that the applied migrations match the available migration files and checks checksums, ensuring the schema history is consistent before or after deploying to Cloud SQL. Option A, flyway undo, is not part of a typical forward-only migration workflow and requires a paid Teams/Enterprise edition with undo scripts. Option B, flyway clean, drops all objects in the schema and is destructive, so it is not a standard step in a production CI/CD migration. Option E, flyway repair, is only used to fix the schema history table after failed migrations or checksum mismatches, not as a routine workflow command.

Answer

flyway undo

Answer

flyway clean

Answer

flyway repair

Question 12

You are configuring a Cloud SQL for PostgreSQL instance for high availability. The instance must have automatic failover in under 60 seconds and avoid any data loss. Which configuration meets these requirements?

Accepted Answer

Create a regional HA configuration with synchronous replication. Regional HA configures a primary and a standby in different zones within the same region, using synchronous replication to ensure no data loss and failover in under 60 seconds.

Answer

Use Cloud Spanner instead

Answer

Create a zonal HA configuration with asynchronous replication

Answer

Add a cross-region read replica and promote it on failure

Question 13

A financial services company requires a globally distributed database with strong consistency and sub-10 millisecond write latency across three continents. They anticipate 50 TB of transactional data. Which Google Cloud database should they deploy?

Accepted Answer

Cloud Spanner multi-region configuration. Cloud Spanner is the only Google Cloud database that provides global strong consistency, horizontal scaling, and low-latency reads and writes across regions. Multi-region configurations span continents and meet the requirements.

Answer

Firestore in multi-region mode

Answer

Cloud Bigtable with multi-cluster replication

Answer

Cloud SQL with cross-region replicas

Question 14

A Cloud Bigtable instance is experiencing high latency for reads of recent data. The row keys start with a timestamp. What is the MOST likely cause?

Accepted Answer

Row key design leading to hotspotting. When row keys begin with a timestamp, all writes for the current time period land on the same tablet, creating a hotspot that concentrates read and write load on a single node. This causes high latency for recent data reads because that node is saturated while other nodes sit idle. The fix is to prepend a high-cardinality field (e.g., a hash or reverse timestamp) to distribute the load.

Answer

Too many column families

Answer

Garbage collection policy too aggressive

Answer

Insufficient number of nodes

Question 15

Which THREE are valid ways to create custom metrics in Cloud Monitoring? (Select exactly 3.)

Accepted Answer

Use the Cloud Monitoring API to write time series directly.. Option B is correct because the Cloud Monitoring API (specifically the timeSeries.create method) allows you to write custom metric data points directly to Cloud Monitoring, making it a valid programmatic way to create user-defined metrics. Option C is correct because the Cloud Monitoring agent (and its successor, the Ops Agent) supports custom metric collection through its configuration file, where you define custom metric endpoints and types that the agent then reports to Cloud Monitoring. Option D is correct because log-based metrics in Cloud Logging let you define a metric from log content (via filters), and these user-defined log-based metrics are surfaced in Cloud Monitoring as custom metrics. Option A is not a metric-creation method at all; the Cloud Billing pricing calculator only estimates costs and does not write or define metrics. Option E is incorrect because deploying the Ops Agent with its default configuration only collects built-in system metrics (such as CPU, memory, and disk) and does not create custom metrics unless you explicitly configure custom metric definitions.

Answer

Use the Cloud Billing pricing calculator to estimate metric costs.

Answer

Deploy Ops Agent with default configuration.