PCD Practice Test 36 — 15 Questions

Question 1

A company is designing a scalable web application on Google Cloud. They expect variable traffic and want to automatically scale resources based on load. Which two services can automatically scale? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Run. Cloud Run (B) is correct because it is a fully managed serverless platform that automatically scales containerized workloads up and down based on incoming request traffic, including scaling to zero when idle. Compute Engine managed instance groups (C) are correct because they support autoscaling policies (such as CPU utilization, load balancing serving capacity, or custom metrics) that automatically add or remove VM instances based on load. Compute Engine unmanaged instance groups (A) do not provide autoscaling, since they are just collections of dissimilar instances without a common instance template. Cloud Dataproc (D) is a managed Hadoop/Spark service for batch and data processing, not a web application autoscaling service. Cloud SQL (E) is a managed relational database that can scale storage or vertically resize, but it does not automatically scale application resources based on web traffic load.

Answer

Compute Engine unmanaged instance group

Answer

Cloud Dataproc

Answer

Cloud SQL

Question 2

Which THREE of the following are best practices for building secure applications on Google Cloud?

Accepted Answer

Use Secret Manager to manage sensitive configuration values.. Option A is correct because Secret Manager is Google Cloud's managed service for storing, versioning, and accessing sensitive configuration values such as API keys, passwords, and certificates, keeping them out of source code and environment variables while enforcing IAM-based access. Option D is correct because VPC Service Controls create a security perimeter around Google Cloud services and resources, which mitigates data exfiltration risks by restricting access from outside the perimeter and blocking unauthorized data movement. Option E is correct because storing source code in Cloud Source Repositories with IAM restrictions ensures that only authorized identities can read or modify code, protecting intellectual property and preventing tampering with the application supply chain. Option B is not a best practice because disabling authentication on a Cloud Run service exposes it publicly, allowing anyone to invoke it and potentially abuse resources or access data. Option C is not a best practice because using a single service account for all Cloud Functions violates least privilege; each function should have its own service account with only the permissions it needs.

Answer

Disable authentication on a test Cloud Run service for end-user testing.

Answer

Use a single service account for all Cloud Functions to simplify permissions.

Question 3

A company uses Cloud Load Balancing to distribute traffic to HTTP backends. They want to protect against application-layer DDoS attacks (e.g., HTTP flood). Which TWO services should they combine?

Accepted Answer

Cloud Armor. Cloud Armor (D) is correct because it provides Google Cloud's edge security service with WAF rules and rate-based ban rules that specifically mitigate application-layer (L7) DDoS attacks such as HTTP floods by filtering or throttling malicious requests before they reach the backends. Cloud CDN (E) is correct because caching content at Google's edge absorbs and offloads large volumes of repeated HTTP requests, reducing the load that reaches the origin and thereby blunting HTTP flood impact when combined with Cloud Armor's filtering. Cloud Firewall rules (A) operate at L3/L4 for VPC traffic and cannot inspect HTTP semantics to stop application-layer floods. Cloud NAT (B) only provides outbound address translation for private instances and offers no inbound attack protection. Cloud Endpoints (C) is an API management and authentication layer, not a DDoS mitigation or caching service.

Answer

Cloud Firewall rules

Answer

Cloud NAT

Answer

Cloud Endpoints

Question 4

An e-commerce company is migrating its on-premises MySQL database to Cloud SQL. They require synchronous replication to a standby instance in the same region for automatic failover with zero RPO. Which Cloud SQL configuration should they use?

Accepted Answer

Create a Cloud SQL for MySQL HA instance in the chosen region. Cloud SQL HA instances use synchronous replication to a standby in a different zone within the same region, providing automatic failover and 0 RPO.

Answer

Use Cloud Spanner instead, as it provides built-in HA across regions

Answer

Deploy two standalone Cloud SQL instances and configure MySQL native replication between them

Answer

Create a Cloud SQL for MySQL instance with a read replica in a different region

Question 5

A developer is debugging a Cloud Function that fails with a timeout. The function makes multiple synchronous external API calls. What is the best way to improve performance and avoid timeouts?

Accepted Answer

Use Cloud Tasks to offload the API calls asynchronously.. Cloud Tasks is the best choice because it allows you to offload synchronous external API calls to be executed asynchronously, decoupling the Cloud Function from the slow external services. This prevents the function from timing out while waiting for responses, and Cloud Tasks handles retries and scheduling automatically, improving overall reliability and performance.

Answer

Increase the timeout of the Cloud Function to the maximum of 9 minutes.

Answer

Use Firestore transactions to batch API calls.

Answer

Use Pub/Sub to trigger another function for each API call.

Question 6

A company uses Cloud Logging to centralize logs from multiple projects. They want to create a log-based metric for tracking 404 errors. However, the metric shows zero data even though 404 errors are occurring. What is the most likely reason?

Accepted Answer

The logs are being excluded by an exclusion filter before the metric is applied. Log-based metrics are computed from logs that have passed through all exclusion filters. If an exclusion filter is configured to discard logs matching certain criteria (e.g., all HTTP 4xx responses), those logs are never evaluated by the metric filter, causing the metric to show zero data even though 404 errors are occurring. Exclusion filters are applied before log-based metric evaluation in Cloud Logging.

Answer

The metric filter uses the wrong resource type

Answer

The metric is sampled and not all logs are considered

Answer

The logs are not being exported to Cloud Logging

Question 7

A mobile app needs to synchronize user data across devices with offline support. The data is structured as documents with hierarchical relationships. Which Google Cloud database is best suited for this use case?

Accepted Answer

Firestore. Firestore is a NoSQL document database designed for mobile and web apps, with built-in offline support and real-time synchronization across devices. Its document model with collections and subcollections naturally represents hierarchical relationships, and client SDKs cache data locally so the app keeps working offline and syncs when connectivity returns.

Answer

Cloud Bigtable

Answer

Cloud SQL

Answer

Memorystore

Question 8

A company is migrating a Cassandra-based time-series application to Google Cloud. They need to maintain single-digit millisecond write latency at petabyte scale. Which Google Cloud database is the BEST replacement?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is Google Cloud's fully managed, petabyte-scale NoSQL wide-column store, purpose-built for low-latency (single-digit millisecond) read/write workloads at massive scale, and it is the direct managed successor to Apache HBase/Cassandra-style time-series use cases. It uses a sparse, sorted map data model ideal for time-series keys and supports high-throughput ingestion. This makes it the best fit for the stated latency and scale requirements.

Answer

Cloud Spanner

Answer

Firestore

Answer

BigQuery

Question 9

Which Google Cloud database service provides a fully managed, in-memory caching solution compatible with the Redis protocol?

Accepted Answer

Memorystore for Redis. Memorystore for Redis is Google Cloud's fully managed, in-memory data store service that is wire-compatible with the Redis protocol (RESP). It handles provisioning, replication, failover, patching, and monitoring, letting applications use standard Redis clients without managing infrastructure. This directly matches the question's requirement for a managed, Redis-compatible in-memory cache.

Answer

Firestore

Answer

Bigtable

Answer

Cloud SQL

Question 10

A startup is building an application that requires strong consistency and horizontal scalability across multiple regions. They need a fully managed relational database that supports both SQL queries and ACID transactions. Which database service should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is Google Cloud's fully managed, horizontally scalable relational database that provides strong external consistency (linearizability) globally and supports ANSI SQL with ACID transactions. It is the only option that combines relational semantics, horizontal scale across regions, and strong consistency in a fully managed service. This makes it the correct fit for the startup's stated requirements.

Answer

Cloud SQL

Answer

Firestore

Answer

Bigtable

Question 11

You are deploying a stateful application to GKE. The deployment fails with an error: 'pods failed to fit in any node due to insufficient CPU'. The cluster has 3 nodes with 4 vCPUs each. The deployment requests 2 vCPUs per pod with 5 replicas. What is the most likely issue?

Accepted Answer

Other workloads or system components are consuming CPU resources.. The cluster has 3 nodes with 4 vCPUs each, totaling 12 vCPUs. The deployment requests 2 vCPUs per pod with 5 replicas, totaling 10 vCPUs. While 10 vCPUs is less than 12, Kubernetes reserves some CPU for system components (kubelet, kube-proxy, etc.) and other workloads may already be running. The error 'insufficient CPU' indicates that no single node has enough allocatable CPU to fit a pod, likely because other workloads or system components are consuming CPU, leaving less than 2 vCPUs available on each node. Thus, the most likely issue is that other workloads or system components are consuming CPU resources.

Answer

The cluster autoscaler is not enabled.

Answer

The deployment does not specify resource limits.

Answer

The nodes have taints that prevent pod scheduling.

Question 12

A company's Cloud Bigtable instance is experiencing high latency and increased error rates for write requests. The Key Visualiser shows that a single row key prefix receives the majority of writes, creating a hotspot. What is the BEST long-term solution to distribute writes more evenly?

Accepted Answer

Redesign the row key by salting with a hash or a more distributed prefix. Bigtable distributes data across nodes by row-key range, so a single hot prefix concentrates all writes on one tablet and one node, causing the observed latency and errors. Salting the row key with a hash or a more distributed prefix spreads writes across many tablets and nodes, which is the only durable fix. Adding nodes or changing storage type does not address the root cause because the hotspot remains bound to one key range.

Answer

Add more nodes to the Bigtable cluster

Answer

Switch from SSD to HDD storage

Answer

Create a secondary Bigtable cluster in another region

Question 13

Your company runs a production App Engine standard environment service (module 'frontend', version 'v2') that handles e-commerce checkout requests. You have set up an alerting policy on a custom metric 'request_latency' that fires when latency exceeds 500ms for 1 minute. Recently, customers have complained about slow checkout times, but no alert has fired. You examine the exhibit: the log entry shows a latency of 0.452s (452ms) for a request to '/api/checkout'. The custom metric is defined from OpenTelemetry instrumentation. What is the most likely reason the alert did not fire?

Accepted Answer

The alert threshold is 500ms, and the exhibited request latency is 452ms, which is below the threshold. Individual requests may be below the threshold, so the alert does not fire.. The alerting policy is configured to fire when the custom metric 'request_latency' exceeds 500ms for 1 minute. The exhibited log entry shows a latency of 452ms, which is below the 500ms threshold. The alert condition is based on a metric threshold, not individual log entries, and since the metric value remains below the threshold, the alert does not trigger.

Answer

The alert condition uses a threshold on a metric that is not being written because the OpenTelemetry exporter is not configured for the 'frontend' module.

Answer

The log entry does not contain the required custom metric data because the httpRequest field is not parsed by Cloud Monitoring.

Answer

The custom metric is only emitted for version 'v1', and the current version is 'v2', so no metric data is available for the alert.

Question 14

Refer to the exhibit. A company configured an HPA for their deployment. They notice that the HPA is not scaling based on the 'packets-per-second' metric. What is the most likely reason?

Accepted Answer

The metric is not available in the cluster.. Kubernetes Horizontal Pod Autoscaler can only scale on metrics that are actually exposed to the cluster's metrics pipeline — either the resource metrics API (CPU/memory) or a custom/external metrics adapter. If 'packets-per-second' is not registered by any adapter, the HPA cannot retrieve a value and will not scale, regardless of how the metric is named or referenced. The most likely reason is therefore that the metric simply is not available in the cluster.

Answer

The metric name 'packets-per-second' is incorrect.

Answer

The target type should be 'Value' instead of 'AverageValue'.

Answer

The HPA is using the wrong scaleTargetRef.

Question 15

You are designing a global e-commerce application with a product catalog that must be strongly consistent across continents and have 99.999% availability. Transactions must span multiple items and maintain ACID guarantees. Which Google Cloud database should you choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is Google Cloud's globally distributed, horizontally scalable relational database that provides strong external consistency (linearizability) across regions along with ACID transactions and multi-region replication. It is the only option that simultaneously satisfies global strong consistency, multi-item ACID transactions, and a 99.999% availability SLA in multi-region configurations. These properties map directly to the e-commerce catalog requirements.

Answer

Cloud Bigtable

Answer

Cloud SQL for PostgreSQL

Answer

Firestore Native mode