PCD Practice Test 37 — 15 Questions

Question 1

A company wants to deploy a containerized application to Cloud Run. Which two approaches are supported? (Choose two.)

Accepted Answer

Use gcloud beta run deploy with --source flag to build and deploy from source. The `gcloud beta run deploy --source` flag allows Cloud Run to automatically build a container image from your source code using Cloud Build, then deploy it. This is a fully managed workflow that eliminates the need to manually build and push a container. Option E is correct because you can build a container locally, push it to Artifact Registry, and then deploy it to Cloud Run using `gcloud run deploy` with the `--image` flag, which is the standard deployment path for pre-built images.

Answer

Use Cloud Functions to package the container as a function

Answer

Upload a Dockerfile to Cloud Run console and let it build

Answer

Use Kubernetes Engine to deploy the container and then migrate to Cloud Run

Question 2

An application on Cloud Run needs to connect to a Cloud SQL instance securely with minimal latency. It also needs to access Cloud Storage buckets in the same region. Which networking configuration should they use?

Accepted Answer

Serverless VPC Access connector with Private Services Access for Cloud SQL. Serverless VPC Access connector enables Cloud Run to send requests to resources in a VPC network via internal IPs, while Private Services Access allocates an internal IP range for Cloud SQL, allowing direct, low-latency connectivity without traversing the public internet. This combination ensures secure, minimal-latency access to Cloud SQL and also allows Cloud Run to reach Cloud Storage buckets in the same region through the VPC connector's internal routing.

Answer

Cloud NAT for outbound traffic

Answer

Direct VPC peering with Cloud SQL

Answer

Use Cloud SQL Auth Proxy with public IP

Question 3

Which TWO actions are best practices for managing application performance monitoring in Google Cloud?

Accepted Answer

Set appropriate sampling rates for Cloud Trace to balance cost and insight.. Cloud Trace charges based on the number of spans ingested and retained. Setting an appropriate sampling rate (e.g., 1 in 10 requests for high-traffic services) reduces cost while still providing statistically significant latency data for performance analysis. This balances the need for actionable insights against budget constraints.

Answer

Enable debug logging in production to capture detailed errors.

Answer

Log all application activity at INFO level for complete visibility.

Answer

Configure alerts to send emails to the entire development team.

Question 4

Which TWO features are provided by Google Cloud Deploy? (Choose 2.)

Accepted Answer

Rollback to a previous deployment revision.. Google Cloud Deploy is a managed continuous delivery service that automates the rollout of applications to Google Kubernetes Engine (GKE) or GKE Enterprise clusters. It supports rollback to a previous deployment revision (A) by reverting the target cluster to the last known good state, and it provides automated canary analysis (C) by integrating with Cloud Monitoring to verify deployment health metrics before progressing traffic shifts.

Answer

Run containers without managing infrastructure.

Answer

Build container images from source code.

Answer

Manage Kubernetes clusters across multi-cloud environments.

Question 5

Which TWO statements about deploying applications on Google Kubernetes Engine (GKE) are correct?

Accepted Answer

HorizontalPodAutoscaler can use custom metrics from Cloud Monitoring.. HorizontalPodAutoscaler (HPA) in GKE can scale pods based on custom metrics from Cloud Monitoring (formerly Stackdriver). This is achieved by using the custom.metrics.k8s.io API, which allows HPA to query metrics like custom application latency or queue depth, not just default CPU/memory. This enables fine-grained, application-specific autoscaling.

Answer

Kubernetes Secrets are encrypted at rest by default.

Answer

A zonal GKE cluster automatically uses regional persistent disks for high availability.

Answer

To expose a Deployment externally, you must create an Ingress resource.

Question 6

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The deployment uses a Service of type LoadBalancer. After creating the Service, the external IP remains pending for several minutes. The team has verified that the cluster has sufficient node capacity and that the pod is running. What is the most likely cause?

Accepted Answer

The project's quota for external IP addresses has been exhausted.. When a Service of type LoadBalancer is created in GKE, it provisions an external IP address from the project's quota. If the quota for external IP addresses is exhausted, the IP assignment remains pending until additional quota is requested or released. The cluster having sufficient node capacity and the pod running confirms that the issue is not resource-related but rather a cloud-level quota limitation.

Answer

The Service is using an incorrect port mapping.

Answer

The pod's readiness probe is failing.

Answer

The cluster is using a regional cluster type.

Question 7

An application running on Compute Engine instances behind a Cloud Load Balancer experiences intermittent 502 errors. The health checks pass but sometimes requests time out. What is the most likely cause?

Accepted Answer

The connection draining timeout is too short.. A connection draining timeout that is too short can cause the load balancer to close connections prematurely while backend instances are still processing requests. This results in intermittent 502 errors and timeouts, even though health checks pass, as the instances are healthy but connections are being terminated before responses are sent.

Answer

The load balancer is misconfigured with wrong backend type.

Answer

The backend instances are running out of memory.

Answer

The SSL certificate has expired.

Question 8

A company is deploying a containerized application on Cloud Run that needs to connect to a Cloud SQL (MySQL) database. The database must not be accessible from the public internet. Which two steps should the company take to secure the connection?

Accepted Answer

Set Cloud SQL to have a private IP address only.. Setting Cloud SQL to have a private IP address only (Option D) ensures the database is accessible only within the VPC network, not from the public internet. This eliminates exposure to external threats and is a fundamental security best practice for private database access.

Answer

Enable automatic IAM database authentication for Cloud SQL.

Answer

Create a Cloud NAT gateway for outbound traffic from Cloud Run.

Answer

Use Cloud SQL Auth proxy within the Cloud Run container.

Question 9

A developer is building a Cloud Pub/Sub-based event-driven system. They need to ensure that messages are processed at least once, and they want to handle processing failures. What should they do?

Accepted Answer

Use push subscriptions with a dead-letter topic. Using push subscriptions with a dead-letter topic ensures at-least-once delivery and provides a mechanism to handle processing failures. When a push subscription fails to deliver a message (e.g., due to a downstream error), Pub/Sub automatically retries delivery. After exhausting the maximum delivery attempts (default 5), the message is forwarded to a dead-letter topic, where it can be analyzed or reprocessed without losing the message. This guarantees that every message is either processed successfully or stored for manual intervention, satisfying the at-least-once requirement.

Answer

Use pull subscriptions with auto-acknowledgment

Answer

Configure max delivery attempts on the subscription

Answer

Use Cloud Tasks instead of Pub/Sub

Question 10

A team is deploying a critical microservice on GKE. They want to minimize risk by gradually shifting traffic from old to new version. They use a Deployment with a single Service. What deployment strategy should they implement?

Accepted Answer

Create two Deployments (stable and canary) with different numbers of replicas and use the same Service label.. It implements a canary deployment pattern on GKE: two separate Deployments (stable and canary) share the same Service label, allowing the Service to distribute traffic to both based on replica counts. This enables gradual traffic shifting by adjusting the number of canary replicas, minimizing risk while the new version is validated.

Answer

Use a rolling update with maxSurge=1 and maxUnavailable=0.

Answer

Use a single Deployment with a readinessProbe that fails for the new version until ready.

Answer

Create two separate Deployments and switch the Service selector to the new version after testing.

Question 11

A company is deploying a microservices architecture on Google Cloud using Cloud Run. They need to ensure that services can communicate securely with each other and with other Google Cloud services, such as Cloud Storage and Secret Manager. Which three steps should they take? (Choose three.)

Accepted Answer

Use Cloud Run's direct VPC egress to access resources in a VPC network.. To securely communicate with other Google Cloud services like Cloud Storage and Secret Manager, Cloud Run services can use direct VPC egress to route traffic through your VPC. Additionally, to access resources in a VPC, you can use a VPC connector. Using service accounts with least privilege ensures secure access control. These three steps together provide secure communication.

Answer

Enable Cloud Service Mesh for sidecar proxy injection.

Answer

Configure Cloud Run services to use internal load balancing.

Question 12

You are designing a multi-region disaster recovery strategy for a Cloud Spanner database. The application requires read-your-writes consistency globally after failover. Which configuration should you choose?

Accepted Answer

Multi-region placement with one read-write region and two read-only replicas.. A multi-region placement with one read-write region and two read-only replicas provides strong consistency and failover capability while maintaining read-your-writes consistency globally. Option A is incorrect because two read-write regions with a witness can lead to write conflicts and does not guarantee read-your-writes consistency after failover without additional configuration. Option B is incorrect because enterprise edition with default leader optimization is a performance feature, not a disaster recovery configuration. Option C is incorrect because a single region with multiple zones does not provide multi-region disaster recovery; it only provides zone-level redundancy within one region.

Answer

Multi-region placement with two read-write regions and a witness.

Answer

Enterprise edition with multi-region configuration and default leader optimization.

Answer

Single region with multiple zones.

Question 13

You need to design a system that handles both high-frequency OLTP transactions and real-time analytical queries on the same dataset with low latency. Which Google Cloud database should you choose?

Accepted Answer

AlloyDB. AlloyDB is PostgreSQL-compatible and includes a columnar engine for fast analytical queries on transactional data, enabling HTAP workloads. Cloud SQL does not have a columnar engine, BigQuery is for analytics only, and Spanner is OLTP-focused.

Answer

BigQuery

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Question 14

An application uses Cloud SQL MySQL for OLTP and wants to run analytics queries without impacting performance. Which TWO approaches can achieve this? (Select 2)

Accepted Answer

Use BigQuery federated queries to query Cloud SQL directly. BigQuery federated queries allow you to query Cloud SQL MySQL in real time using BigQuery's SQL engine, without moving data. This enables analytics on live OLTP data while offloading the query processing to BigQuery, thus avoiding performance impact on the Cloud SQL instance. Option C is correct because a Cloud SQL read replica is a separate read-only copy of the primary instance; running analytics queries on the replica prevents resource contention with OLTP write operations.

Answer

Use Cloud Spanner for OLTP instead

Answer

Use BigQuery Omni

Answer

Enable Cloud SQL automatic storage increase

Question 15

Which TWO statements about Cloud Trace are correct?

Accepted Answer

Trace can be integrated with Cloud Monitoring for alerting. Cloud Trace can be integrated with Cloud Monitoring to create alerting policies based on trace data, such as latency thresholds or error rates. This integration allows you to set up notifications when specific trace conditions are met, enabling proactive performance monitoring.

Answer

Trace collects latency data from all requests by default

Answer

Trace automatically creates dashboards for visualization

Answer

Trace supports auto-scaling based on latency