PCD Practice Test 36 — 15 Questions

Question 1

A company runs a microservices application on Cloud Run. One service, `order-processor`, is invoked asynchronously via a Cloud Tasks queue. The Cloud Tasks queue is configured with an HTTP target pointing to the `order-processor` service URL. The service requires authentication (no unauthenticated invocations). The service account used by Cloud Tasks to invoke the service is `cloud-tasks-system@project.iam.gserviceaccount.com`. After deploying a new revision of `order-processor` using Cloud Build and Cloud Deploy, the team notices that tasks are failing with a 403 status. The Cloud Run service logs show the requests are reaching the service but returning 403. The previous revision worked fine. What is the most likely cause?

Accepted Answer

The IAM policy binding granting the Cloud Tasks service account the Cloud Run Invoker role was removed during the deployment.. Option B is correct. When Cloud Run requires authentication, the invoker's service account must be granted the roles/run.invoker role on the Cloud Run service. Although the IAM policy is set on the service, deploying a new revision with Cloud Build and Cloud Deploy may use a different service account or the IAM bindings might be overwritten if the deployment pipeline includes IAM policy updates. In this scenario, the IAM binding for the Cloud Tasks service account was likely removed or not applied to the new revision, causing the 403 error. Option A is incorrect because the Cloud Tasks queue configuration does not change with revisions; the URL remains the same. Option C is incorrect because the OIDC token is configured on the queue and is independent of the revision. Option D is incorrect because a permission denied error inside the service would result in a 500 or 503, not 403, and the logs show requests are reaching the service.

Answer

The new revision has a bug causing a permission denied error when processing tasks.

Answer

The Cloud Tasks queue needs to be configured with an OIDC token and audience for the new revision.

Answer

The Cloud Tasks queue's HTTP target URL needs to be updated to point to the new revision's specific URL.

Question 2

A company runs a Java microservice on Google Kubernetes Engine (GKE) using a standard cluster with 3 nodes. They use Cloud Build to build the Docker image and push it to Artifact Registry, then apply a Kubernetes Deployment manifest that references the new image tag. The Deployment has a rolling update strategy with maxSurge=1 and maxUnavailable=0. After a recent deployment, the new pods crash with 'CrashLoopBackOff'. The old pods are still running successfully. The application logs show a connection refused error when trying to connect to a Cloud SQL instance. The Cloud SQL instance is in the same project and region. The GKE cluster nodes have the appropriate scopes to access Cloud SQL. The application uses a Cloud SQL proxy sidecar container to establish the connection. The previous deployment worked fine. What is the most likely cause of the failure?

Accepted Answer

The Cloud SQL proxy sidecar container is not included in the new Deployment revision.. The correct answer is B because the Cloud SQL proxy sidecar container is missing from the new Deployment revision. Since the application relies on the sidecar to establish a secure connection to Cloud SQL, its absence causes the connection refused error. The old pods continue to run because they still have the sidecar from the previous Deployment revision, while the new pods crash due to the missing proxy.

Answer

The GKE cluster nodes do not have the Cloud SQL Client role.

Answer

The Kubernetes Secret containing the service account key was not updated to include the new pod's service account.

Answer

The new image tag points to a broken build that has incorrect code for Cloud SQL connection.

Question 3

A company runs a web application on Google Kubernetes Engine (GKE) that uses Cloud SQL for its database. The application is deployed via Cloud Build and uses a custom container image stored in Artifact Registry. Recently, the development team noticed that new deployments are failing with a 'CrashLoopBackOff' error in the pod logs. The logs indicate that the application cannot connect to the Cloud SQL instance. The application uses the Cloud SQL Proxy sidecar container to connect. The Cloud SQL Proxy configuration has not changed recently. The GKE cluster is in region us-central1, and the Cloud SQL instance is in us-central1 as well. The team verified that the Cloud SQL instance is running and accepting connections from authorized networks. They also confirmed that the service account used by the pod has the 'Cloud SQL Client' role. The application has been running stable for months until a recent GKE cluster upgrade. The deployment YAML uses environment variables for database connection. The Cloud SQL Proxy is deployed as a sidecar container with command: '/cloud_sql_proxy -instances=<instance-connection-name>=tcp:5432'. The pod logs show the proxy attempting to connect but timing out. The network team confirms that there are no firewall rules blocking the connection. The Cloud SQL instance has an authorized network entry for the GKE cluster's nodes' IP range. What is the most likely cause of the connection failure?

Accepted Answer

The Cloud SQL instance is configured with a private IP and the GKE cluster is VPC-native but the Cloud SQL Proxy is configured to connect via public IP.. Option D is correct because the Cloud SQL Proxy sidecar is configured to connect via public IP (using the instance connection name without the `-private-ip` flag), but the Cloud SQL instance is configured with a private IP. Since the GKE cluster is VPC-native, the pod can reach the private IP within the VPC, but the proxy is attempting a public IP connection, which fails because the instance's authorized networks only include the GKE nodes' IP range (public IPs of nodes), not the pod's private IP range. The recent GKE cluster upgrade may have changed the node's public IP or networking configuration, exacerbating the mismatch.

Answer

The Cloud SQL Proxy container is using an outdated version that is incompatible with the current Cloud SQL API.

Answer

The application is using a wrong database password in the connection string.

Answer

The pod's namespace does not have the Cloud SQL Proxy configuration correctly set up.

Question 4

A company has a legacy monolithic application running on Compute Engine that is being migrated to microservices on GKE. During the migration, they need to maintain performance monitoring across both environments. The legacy application uses Stackdriver Logging and Monitoring agents (now Ops Agent) and exports logs to Cloud Logging. The new microservices are instrumented with OpenTelemetry for traces and metrics. The team wants a unified view of performance across both environments, including distributed traces from the new services and log-based metrics from the legacy app. They also want to correlate logs and traces for troubleshooting. Which solution should they implement?

Accepted Answer

Use Cloud Monitoring dashboards and ingest OpenTelemetry metrics into Cloud Monitoring, while using Cloud Logging log-based metrics from legacy app.. Option C is correct because it provides a unified view by ingesting OpenTelemetry metrics into Cloud Monitoring and using Cloud Logging log-based metrics from the legacy app. Cloud Monitoring supports OpenTelemetry metrics via the OpenTelemetry Protocol (OTLP) and can correlate them with log-based metrics from the legacy app, enabling distributed tracing and log correlation in a single dashboard.

Answer

Keep monitoring separate and use separate dashboards for legacy and new.

Answer

Use a third-party APM tool that supports both environments.

Answer

Rewrite the legacy app to use OpenTelemetry.

Question 5

A team is developing a mobile backend API on Google Cloud. They are using Cloud Endpoints to manage API authentication and quotas. They want to monitor API performance including request count, latency, and error rates. They have enabled Cloud Endpoints logging but are not seeing detailed performance metrics in Cloud Monitoring. What should they do?

Accepted Answer

Enable Cloud Monitoring integration in Cloud Endpoints configuration.. Cloud Endpoints uses an Extensible Service Proxy (ESP) or Envoy proxy to intercept API calls and report metrics to Cloud Monitoring. By default, Endpoints logs requests but does not send detailed performance metrics (e.g., latency, request count, error rates) to Cloud Monitoring unless you explicitly enable the Cloud Monitoring integration in the Endpoints service configuration. Option B is correct because enabling this integration configures the proxy to emit those metrics directly to Cloud Monitoring.

Answer

Deploy a custom metrics exporter in the mobile app.

Answer

Install the Ops Agent on the API backend instances.

Answer

Use Cloud Logging to parse logs and create metric counters.

Question 6

Your company runs a multi-tier application on Compute Engine with a Cloud SQL backend. Recently, during peak hours, users report slow page loads. Cloud Monitoring shows high CPU on the app servers, but no memory pressure. Cloud Trace shows that the application spends most of its time waiting for database queries. The Cloud SQL instance is a high-memory machine type with 16 vCPUs and 64 GB RAM, but CPU utilization on the database is only 30%. There are no slow query alerts. What is the most likely cause and what should you do?

Accepted Answer

The database lacks indexes. Use Cloud SQL Query Insights to identify missing indexes.. The symptoms—high app server CPU, low database CPU, and queries consuming most of the application’s wait time—point to inefficient queries due to missing indexes. Cloud SQL Query Insights can identify these missing indexes by analyzing query execution plans and wait events. Adding appropriate indexes reduces query execution time, lowering app server CPU usage and resolving the slow page loads.

Answer

The application is performing unnecessary queries. Add caching with Memorystore.

Answer

The database connection pool is exhausted. Increase the maximum number of connections.

Answer

The Cloud SQL instance is under-provisioned. Upgrade to a larger machine type.

Question 7

A company runs a Java microservice on GKE that processes financial transactions. The service is critical and must meet a 99.9% availability SLO. They have set up Cloud Monitoring alerting policies based on request latency and error rate. Recently, the team noticed that the alerting policy for high latency fires too frequently with false positives, causing alert fatigue. They want to reduce false positives without compromising real issues. The latency metric is collected from the application's custom metric via Prometheus. Which approach should they take?

Accepted Answer

Increase the alert duration to require sustained latency over a longer period.. Option D is correct because increasing the alert duration requires the high latency to be sustained over a longer period, which filters out transient spikes that cause false positives. This approach preserves the ability to detect genuine, prolonged performance degradation that could impact the 99.9% availability SLO, without raising the threshold and risking missed real issues.

Answer

Change the metric to use median instead of average.

Answer

Increase the alert threshold to a higher latency value.

Answer

Disable the alert and rely on manual checks.

Question 8

A startup has deployed a Python web application on Compute Engine. They have installed the Cloud Monitoring agent and can see basic system metrics like CPU and disk usage. However, they want to track custom application metrics, such as number of active users and request latency, to monitor performance. They have added OpenCensus code to export metrics but notice that custom metrics are not appearing in Cloud Monitoring. The application runs under a custom service account with the 'Monitoring Metric Writer' role assigned. What is the most likely cause?

Accepted Answer

The OpenCensus exporter is not configured to send to the Cloud Monitoring endpoint.. Option A is correct because OpenCensus requires explicit configuration to export metrics to a specific backend. Even though the service account has the 'Monitoring Metric Writer' role, the OpenCensus exporter must be configured with the correct Cloud Monitoring endpoint (e.g., 'monitoring.googleapis.com') and project ID. Without this configuration, the metrics are collected by OpenCensus but never sent to Cloud Monitoring.

Answer

The Cloud Monitoring agent needs to be restarted after adding OpenCensus.

Answer

The service account has not been granted the 'Monitoring Viewer' role.

Answer

The application is not exporting metrics to the correct Cloud Monitoring project.

Question 9

A company serves static content (images, CSS) through a Cloud Load Balancer with Cloud CDN enabled. They release a new version of the website with updated image assets. After deployment, users still see old images, even though the new image files are served from the backend. The team has already invalidated the cache for the directory containing the images using the Cloud CDN invalidation feature with a specific path. However, the old images persist. What is the most effective additional step to ensure users see the new images?

Accepted Answer

Use a wildcard in the Cloud CDN invalidation path (e.g., /images/*).. Option B is correct because Cloud CDN cache invalidation requires exact path matching unless a wildcard is used. The team invalidated a specific path but likely missed the exact paths of the cached image files. Using a wildcard like `/images/*` ensures all objects under the `/images/` directory are invalidated, forcing the CDN to fetch the updated images from the backend.

Answer

Set the cache TTL for the image directory to 0 seconds.

Answer

Change the load balancer cache mode to 'FORCE_CACHE_ALL'.

Answer

Configure cache key parameters to ignore query strings.

Question 10

A developer deployed a Cloud Function that is triggered by a Pub/Sub topic. The function processes messages and writes results to a BigQuery table. The developer notices that some messages are not being processed; they are visible in the Pub/Sub subscription but the function logs show no invocation for those messages. The function's code is correct and handles errors gracefully. What is the most likely cause and fix?

Accepted Answer

Enable retry on failure for the Pub/Sub subscription.. Option D is correct because the Pub/Sub subscription has a default 'ack deadline' and if the Cloud Function does not acknowledge the message within that time (or if the function fails to process it and the subscription is not configured to retry), the message may be redelivered but eventually dropped. Enabling retry on failure ensures that messages that cause the function to fail (even if the code handles errors gracefully, the function might still return an error status) are retried until successfully processed.

Answer

Increase the function timeout to 540 seconds.

Answer

Check that the Pub/Sub subscription push endpoint is set to the Cloud Function URL.

Answer

Increase the function memory to 2GB.

Question 11

A team deploys a containerized web application on Cloud Run. The deployment fails with error 'Container failed to start. Failed to start and then listen on the port defined by the PORT environment variable.' The container image runs fine locally on port 8080. The team has not set any environment variables in the Cloud Run service configuration. What is the most likely issue and solution?

Accepted Answer

Set the PORT environment variable to 8080 in the Cloud Run service configuration.. Cloud Run expects the container to listen on the port specified by the PORT environment variable, which defaults to 8080. Since the team did not set any environment variables, Cloud Run assigns PORT=8080 automatically. The container runs fine locally on port 8080, but the error indicates it is not listening on the port defined by PORT. The most likely issue is that the container is hardcoded to listen on port 8080 but does not respect the PORT environment variable, or the application is binding to a different interface (e.g., localhost) that Cloud Run cannot reach. Setting the PORT environment variable explicitly to 8080 in the Cloud Run service configuration ensures the container listens on the expected port.

Answer

Configure a health check for the container.

Answer

Increase the container concurrency setting.

Answer

Set min instances to 1 to keep the container warm.

Question 12

A team uses Cloud Tasks to process orders asynchronously. Each order is enqueued after payment verification. Processing involves calling an external shipping API that occasionally returns 503 (Service Unavailable). The Cloud Tasks queue is configured with default retry parameters: max retries = 100, max retry duration = 1 hour. The team notices that some orders are never processed; they remain in the queue until the max retry duration expires and then are discarded. What is the most likely cause and solution?

Accepted Answer

Increase the max retry duration to 24 hours.. The default Cloud Tasks retry parameters include a max retry duration of 1 hour. If an order repeatedly fails due to 503 errors from the external shipping API, the task will be retried up to 100 times within that hour. However, if the API remains unavailable for longer than the max retry duration, the task will be discarded even if the retry count hasn't been exhausted. Increasing the max retry duration to 24 hours gives the external API more time to recover, ensuring that orders are not prematurely discarded.

Answer

Set a custom retry deadline of 2 hours.

Answer

Use exponential backoff in the task handler instead of relying on Cloud Tasks.

Answer

Check the task queue rate limits and increase max dispatches per second.

Question 13

A company is designing a real-time leaderboard for a mobile gaming application. The leaderboard must support millions of concurrent users updating their scores and querying rankings with low latency (under 100ms). Scores change frequently and require strong consistency for reads. The development team is evaluating Cloud SQL and Cloud Spanner. They estimate they need to handle 100,000 writes per second. Which database should they choose and why?

Accepted Answer

Cloud Spanner because it provides horizontal scaling, strong consistency, and high write throughput.. Cloud Spanner is the correct choice because it provides horizontal scaling with strong consistency and can handle 100,000 writes per second while maintaining ACID transactions and low-latency reads. Unlike Cloud SQL, Spanner scales horizontally across nodes without sacrificing consistency, making it ideal for a real-time leaderboard with millions of concurrent users.

Answer

Cloud Firestore because it offers real-time synchronization and is serverless.

Answer

Cloud Bigtable because it's optimized for high write throughput and time-series data.

Answer

Cloud SQL with read replicas because it's cost-effective and supports ACID transactions.

Question 14

A multinational corporation runs a web application on Google Kubernetes Engine (GKE) with multiple microservices. They use Cloud Service Mesh (Anthos) for observability and security. The application uses gRPC for inter-service communication. Recently, they have observed increased latency and occasional timeouts between services in different regional clusters connected via Cloud VPN. The team wants to diagnose the issue and improve reliability. They suspect network round-trip time (RTT) is causing the latency, but they are not sure if the problem is at the application or network layer. Which tool should they use to pinpoint the exact cause?

Accepted Answer

Use Cloud Trace to analyze distributed traces and identify bottlenecks in request paths.. Cloud Trace is the correct tool because it provides end-to-end distributed tracing, which can capture the exact latency contribution of each gRPC call across microservices and regional clusters. By analyzing trace spans, the team can determine whether the increased latency is due to network round-trip time (RTT) between clusters or due to application-level processing delays within a service.

Answer

Use Cloud Monitoring to view gRPC latency distributions and break down by service and method.

Answer

Use VPC Flow Logs to examine network throughput and packet loss.

Answer

Use Cloud Logging to search for error logs in the application containers.

Question 15

A development team is deploying a new application on Cloud Run. They anticipate unpredictable traffic patterns and want to minimize cold start latency. They also need to ensure that the application can handle sudden spikes without request drops. Which configuration should they use?

Accepted Answer

Set min-instances to a non-zero value to keep some instances warm, and enable CPU always-on.. Setting min-instances to a non-zero value ensures that Cloud Run always keeps at least that many instances warm, eliminating cold starts for baseline traffic. Enabling CPU always-on prevents the instance's CPU from being throttled to zero when idle, allowing the instance to handle incoming requests immediately without a cold start penalty. This combination minimizes latency for unpredictable traffic and ensures capacity to absorb sudden spikes without dropping requests.

Answer

Use App Engine Standard Environment with automatic scaling.

Answer

Set min-instances to 0 and max-instances to a high number to allow scaling from zero.

Answer

Use Cloud Functions instead of Cloud Run for better cold start performance.