PCD Practice Test 36 — 15 Questions

Question 1

A company uses Cloud SQL for PostgreSQL with a cross-region replica for disaster recovery. They need to perform a regional failover with minimal data loss. What configuration is required?

Accepted Answer

Promote the cross-region replica to a primary instance. Cloud SQL cross-region replicas use asynchronous replication, so some data loss is possible. To minimize loss, ensure that the replication lag is low and that automated backups are taken frequently. However, the key is to promote the replica to a standalone instance, which will stop replication and make it writable.

Answer

Use Database Migration Service instead

Answer

Take a manual backup of the primary and restore to the replica

Answer

Enable synchronous replication

Question 2

A company has a multi-region deployment on GKE and needs to route traffic to the closest regional cluster based on user location. They want to minimize latency. Which approach should they use?

Accepted Answer

Use a global external HTTP(S) Load Balancer with backend services pointing to NEGs in each region.. A global external HTTP(S) Load Balancer uses Anycast IP addresses and is backed by backend services that reference Network Endpoint Groups (NEGs) in each regional GKE cluster. This allows the load balancer to direct traffic to the closest healthy backend based on the user's geographic location and the load balancer's proximity algorithm, minimizing latency without requiring DNS-based routing.

Answer

Create separate internal load balancers in each region and use Cloud DNS geo-routing.

Answer

Configure an external TCP/UDP Network Load Balancer in each region and use Cloud DNS geo-routing.

Answer

Deploy a single regional cluster and use Cloud CDN to cache content globally.

Question 3

A security engineer applied the IAM policy above to a Cloud Storage bucket. The service account "my-sa" is used by an application that needs to read and write files to the bucket. The application reports that it cannot write files. What is the issue?

Accepted Answer

The "roles/storage.objectCreator" role only allows creating new objects, but not overwriting existing ones.. The 'roles/storage.objectCreator' role grants permission to create new objects in a Cloud Storage bucket, but it does not allow overwriting existing objects. To overwrite objects, the 'roles/storage.objectAdmin' or 'roles/storage.legacyObjectOwner' role is required, which includes the storage.objects.update permission. Since the application needs to both read and write (including overwrite) files, the objectCreator role is insufficient.

Answer

The policy is missing the "roles/storage.objectAdmin" role.

Answer

The service account lacks permission to list bucket contents.

Answer

The policy has duplicate bindings that cause a conflict.

Question 4

You are designing a CI/CD pipeline using Cloud Build. Which three features can be used to secure the pipeline and enforce compliance? (Choose three.)

Accepted Answer

Configuring Cloud Build to only run builds from approved source repositories via VPC-SC.. Options B, C, and E are correct. B is correct because VPC Service Controls (VPC-SC) can restrict Cloud Build to only run builds from approved source repositories, enforcing compliance. C is correct because Cloud Build provides a built-in approval mechanism (manual approval gates) that adds a review step before a build proceeds. E is correct because using Cloud Build worker pools with private IP and within a service perimeter enhances security by isolating build execution. A is incorrect: inline substitution variables are not secure for secrets; use Secret Manager instead. D is incorrect: vulnerability scanning for container images is a feature of Artifact Analysis, not Cloud Build itself.

Answer

Using Cloud Build's inline substitution variables to inject secrets.

Answer

Integrating with Cloud Build's vulnerability scanning for container images.

Question 5

A company is using Cloud Build for CI/CD. They want to automatically trigger builds when code is pushed to a Cloud Source Repository and store the resulting Docker images in a secure, immutable artifact store. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud Source Repository. Cloud Source Repository hosts the code and can trigger Cloud Build. Artifact Registry is the recommended immutable artifact store for Docker images. Container Registry is deprecated. Cloud Storage and Cloud Functions are not directly involved.

Answer

Cloud Storage

Answer

Cloud Functions

Answer

Container Registry

Question 6

An engineer is using Firestore Security Rules for a mobile app. They want to ensure that a user can only read their own documents, where each document has a field 'userId' matching the user's authenticated UID. Which rule is correct?

Accepted Answer

service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read: if resource.data.userId == request.auth.uid; } } }. Firestore Security Rules use the `request.auth.uid` variable to get the authenticated user's UID and `resource.data.userId` to access the document field. The correct condition checks that the document's 'userId' equals the requester's UID. `request.resource` refers to incoming data, not existing data.

Answer

service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read: if request.auth.uid == get(/databases/$(database)/documents/$(document)).data.userId; } } }

Answer

service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read: if request.auth.uid == request.resource.data.userId; } } }

Answer

service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read: if request.auth.uid == resource.data['user-id']; } } }

Question 7

Which THREE of the following are valid reasons to use Cloud Deploy instead of manually applying kubectl commands in a CI/CD pipeline?

Accepted Answer

Cloud Deploy maintains a deployment history for auditing.. Cloud Deploy automatically maintains a detailed deployment history, including the state of each rollout, approvals, and metadata. This history is stored in the Cloud Deploy API and can be queried for auditing, compliance, and troubleshooting purposes, which is not natively provided by manual kubectl commands in a CI/CD pipeline.

Answer

Cloud Deploy automatically containerizes applications.

Answer

Cloud Deploy enforces IAM roles on Kubernetes clusters.

Question 8

A Cloud Spanner instance is experiencing high read latency. The instance has a single regional configuration. Monitoring shows high-priority CPU utilization is above 90%. What should the engineer do to reduce latency?

Accepted Answer

Increase the number of processing units. High-priority CPU utilization above 90% indicates that the instance's compute resources are saturated, causing queuing and increased read latency. Increasing the number of processing units (or nodes) adds more CPU capacity, allowing the instance to handle more concurrent reads and reducing latency. This directly addresses the root cause of resource contention.

Answer

Change the instance configuration to a multi-region setup

Answer

Reduce the number of indexes

Answer

Decrease the number of nodes to reduce contention

Question 9

An organization is migrating from Oracle to Cloud SQL for PostgreSQL using Database Migration Service. The source Oracle database has many stored procedures with PL/SQL. Which tool should be used to automate the conversion of these stored procedures to PL/pgSQL?

Accepted Answer

Ora2Pg. Ora2Pg is an open-source tool that converts Oracle schemas and PL/SQL code to PostgreSQL-compatible format, including stored procedures and functions.

Answer

Cloud SQL Auth Proxy

Answer

BigQuery Data Transfer Service

Answer

Database Migration Service with built-in schema converter

Question 10

A team deploys a containerized web application on Cloud Run. The deployment fails with error 'Container failed to start. Failed to start and then listen on the port defined by the PORT environment variable.' The container image runs fine locally on port 8080. The team has not set any environment variables in the Cloud Run service configuration. What is the most likely issue and solution?

Accepted Answer

Set the PORT environment variable to 8080 in the Cloud Run service configuration.. Cloud Run expects the container to listen on the port specified by the PORT environment variable, which defaults to 8080. Since the team did not set any environment variables, Cloud Run assigns PORT=8080 automatically. The container runs fine locally on port 8080, but the error indicates it is not listening on the port defined by PORT. The most likely issue is that the container is hardcoded to listen on port 8080 but does not respect the PORT environment variable, or the application is binding to a different interface (e.g., localhost) that Cloud Run cannot reach. Setting the PORT environment variable explicitly to 8080 in the Cloud Run service configuration ensures the container listens on the expected port.

Answer

Configure a health check for the container.

Answer

Increase the container concurrency setting.

Answer

Set min instances to 1 to keep the container warm.

Question 11

During a migration from MySQL to Cloud SQL, an engineer notices that the source database uses MyISAM tables with full-text indexes. What must be done to successfully migrate these tables to Cloud SQL (which uses InnoDB by default)?

Accepted Answer

Convert the tables to InnoDB and recreate full-text indexes.. Cloud SQL for MySQL uses InnoDB as its default storage engine and does not support MyISAM. Therefore, MyISAM tables with full-text indexes must be converted to InnoDB, and the full-text indexes must be recreated because InnoDB supports full-text indexes natively. Option D correctly identifies this required conversion and index recreation process.

Answer

Migrate the tables to Cloud Storage and use external tables.

Answer

Use the MEMORY storage engine instead.

Answer

Create the tables as MyISAM in Cloud SQL.

Question 12

A company is migrating a 5 TB Oracle database to AlloyDB for PostgreSQL. They need to validate the migration with a test replica without impacting the source. After testing, they plan to promote the replica to become the primary. Which migration strategy should they use?

Accepted Answer

Use Database Migration Service to create a continuous migration job with a full dump and CDC, then test the replica and promote it. Database Migration Service (DMS) with a continuous migration job using a full dump and Change Data Capture (CDC) is the correct choice because it allows you to create a fully synchronized test replica of the 5 TB Oracle database in AlloyDB for PostgreSQL without impacting the source. After validating the replica, you can promote it to become the primary with minimal downtime, as CDC ensures near-real-time consistency.

Answer

Use Ora2Pg to migrate the schema, then perform a manual bulk data export/import

Answer

Use Datastream to replicate to AlloyDB, then promote the target

Answer

Use Cloud Data Fusion to create an ETL pipeline from Oracle to AlloyDB

Question 13

A developer runs the command above and receives the error. The developer has just been granted the 'roles/cloudbuild.builds.editor' role on the project. What is the most likely reason for the permission error?

Accepted Answer

The Cloud Build API is not enabled for the project.. The error occurs because the Cloud Build API has not been enabled for the project. Even with the 'roles/cloudbuild.builds.editor' IAM role, the Cloud Build service itself must be explicitly enabled via the Google Cloud Console or using the `gcloud services enable cloudbuild.googleapis.com` command. Without enabling the API, any attempt to run a build will fail with a permission error, as the service is not available to process the request.

Answer

The project ID 'my-project' does not exist or the developer typed it incorrectly.

Answer

The container registry (gcr.io) is incorrect; should use us.gcr.io.

Answer

The developer is using the wrong region; Cloud Build must be enabled per region.

Question 14

Refer to the exhibit. You are reviewing a Cloud Monitoring MQL query. What is the purpose of this query?

Accepted Answer

It filters for instances with CPU utilization > 90% and then computes the 5-minute average.. The MQL query uses the `filter` clause to first select only time series where `cpu.utilization` exceeds 90%, and then applies the `avg` aggregation over a 5-minute window. This order of operations ensures that the average is computed only on the filtered data points, not on all instances.

Answer

It displays the raw CPU utilization data points that exceed 90%.

Answer

It shows the 5-minute average CPU utilization for all instances, then filters out those with average > 90%.

Answer

It computes the 5-minute average of CPU utilization and then selects instances where any data point exceeded 90%.

Question 15

A company is designing a global inventory system using Cloud Spanner. They need to ensure data consistency across regions while minimizing latency for read-heavy workloads. Which two strategies should they consider? (Choose two.)

Accepted Answer

Use a multi-region configuration with read-write and read replicas. Multi-region configurations with read replicas provide strong consistency for writes and allow stale reads from read replicas for low-latency reads. Using global secondary indexes improves query performance. Interleaved tables help locality but not cross-region.

Answer

Use Cloud SQL for reads and Spanner for writes

Answer

Create interleaved tables for all relationships

Answer

Configure regional configuration with asynchronous replication