PCD Practice Test 38 — 15 Questions

Question 1

A developer is deploying a Cloud Run service that needs to access a Cloud SQL instance. The service is deployed with the --no-allow-unauthenticated flag. What is the recommended way to grant the service access to the database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the Cloud SQL Client role to the Cloud Run service's runtime service account.. The recommended way to grant a Cloud Run service access to a Cloud SQL instance is to grant the Cloud SQL Client role (roles/cloudsql.client) to the Cloud Run service's runtime service account. This role provides the necessary permissions (cloudsql.instances.connect and cloudsql.instances.get) to establish a secure connection via the Cloud SQL Auth Proxy or the Cloud SQL connector library. Using the runtime service account follows the principle of least privilege and avoids managing long-lived credentials.

Answer

Create a service account key and store it in Secret Manager, then mount it as a volume.

Answer

Use the default Compute Engine service account and grant it the Cloud SQL Client role.

Answer

Enable the Cloud SQL Admin API and use Application Default Credentials from the Cloud Run service.

Question 2

A company uses Cloud Monitoring to set up an alerting policy for CPU utilization on Compute Engine instances. They want to be notified when average CPU usage exceeds 80% for 5 minutes. Which threshold type should they use?

Accepted Answer

Threshold. A Threshold alerting policy in Cloud Monitoring triggers when a metric's value crosses a defined static boundary. For this use case, setting a threshold of 80% with a duration of 5 minutes directly matches the requirement to alert when average CPU usage exceeds 80% for that period.

Answer

Forecast

Answer

Change rate

Answer

Metric absence

Question 3

Your application writes structured logs to Cloud Logging. You want to create a metric that counts log entries with a specific severity level, then alert when the count exceeds a threshold. What should you do?

Accepted Answer

Create a log-based metric using the Logs Explorer, then set up an alerting policy.. Log-based metrics in Cloud Logging allow you to define a counter metric based on log entries matching a filter (e.g., severity=ERROR). Once the metric is created, you can set up an alerting policy in Cloud Monitoring to trigger when the count exceeds a threshold. This approach is native, serverless, and requires no custom code or external exports.

Answer

Use Cloud Monitoring's custom metrics API to write the count.

Answer

Export logs to BigQuery and analyze there.

Answer

Use Cloud Logging's metrics dashboard.

Question 4

A developer runs the above command and cloudbuild.yaml. The build fails at the deploy step with a permission error. The developer has the Cloud Build Editor role on the project. What is the likely cause?

Accepted Answer

The Cloud Build service account lacks the Cloud Run Admin role.. The Cloud Build Editor role grants permissions to submit builds and execute build steps, but the actual execution of those steps (including the deploy step) runs under the Cloud Build service account. By default, this service account does not have the Cloud Run Admin role, which is required to deploy to Cloud Run. Without this role, the `gcloud run deploy` command fails with a permission error.

Answer

The Cloud Build Editor role does not have permission to submit builds.

Answer

The Docker image is not in a format compatible with Cloud Run.

Answer

The build step uses the 'gcloud' command without authentication.

Question 5

Which THREE components are essential for a complete application performance monitoring (APM) solution on Google Cloud?

Accepted Answer

Cloud Monitoring for metrics and alerting.. Cloud Monitoring (B) is essential because it collects and visualizes metrics such as latency, error rates, and resource utilization, and it drives alerting policies that notify operators when SLOs or thresholds are breached. Cloud Trace (C) is essential because it captures distributed traces of requests across services, revealing per-span latency and pinpointing bottlenecks in multi-service or microservices architectures. Cloud Logging (E) is essential because it aggregates application and infrastructure logs, supports log-based metrics, and enables querying and analysis of error details and events that metrics and traces alone cannot fully explain. Cloud Scheduler (A) is a cron-style job scheduling service and does not provide monitoring, tracing, or log analysis, so it is not a required APM component. Cloud CDN (D) is a content delivery and caching service that improves latency at the edge but does not deliver the observability data (metrics, traces, logs) that an APM solution requires.

Answer

Cloud Scheduler for job scheduling.

Answer

Cloud CDN for content caching.

Question 6

Your application running on Google Kubernetes Engine (GKE) is experiencing intermittent latency spikes. You have enabled Cloud Monitoring and Cloud Logging. Which approach would be MOST effective to identify the root cause?

Accepted Answer

Use Cloud Trace to analyze distributed tracing data for slow requests.. Cloud Trace is the most effective tool for identifying intermittent latency spikes because it provides end-to-end distributed tracing, allowing you to pinpoint which specific service or request path is causing the delay. Unlike aggregate metrics or logs, Cloud Trace captures individual request spans and can reveal high-latency operations, such as slow database queries or external API calls, that occur only under certain conditions.

Answer

Increase the number of replicas or switch to a larger machine type.

Answer

Examine CPU and memory utilization metrics in Cloud Monitoring for the GKE cluster.

Answer

Review recent Cloud Logging entries for error messages.

Question 7

Which TWO actions are best practices for managing application performance monitoring in Google Cloud?

Accepted Answer

Set appropriate sampling rates for Cloud Trace to balance cost and insight.. Option A is correct because Cloud Trace sampling rates control how many requests are traced, letting you balance observability insight against ingestion/retention costs—setting an appropriate rate avoids tracing every request unnecessarily while still capturing representative latency data. Option D is correct because structured logging in JSON format lets Cloud Logging parse fields into indexed labels, enabling precise queries, filtering, and log-based metrics rather than relying on fragile text matching. Option B is not a best practice because debug-level logging in production generates excessive volume and cost and may expose sensitive data; debug logging should be scoped or temporary. Option C is wrong because logging all activity at INFO level creates high noise and cost without improving signal, so levels should be chosen deliberately. Option E is not recommended because alerting the entire development team causes alert fatigue; alerts should target on-call owners or specific responsible groups.

Answer

Enable debug logging in production to capture detailed errors.

Answer

Log all application activity at INFO level for complete visibility.

Answer

Configure alerts to send emails to the entire development team.

Question 8

Which TWO of the following are best practices when deploying applications on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across nodes.. Option C is correct because pod anti-affinity (e.g., requiredDuringSchedulingIgnoredDuringExecution or preferredDuringSchedulingIgnoredDuringExecution with topologyKey kubernetes.io/hostname) prevents multiple replicas of the same workload from landing on the same node, improving availability and fault tolerance across nodes and zones. Option D is correct because defining CPU/memory requests lets the GKE scheduler place pods on nodes with sufficient capacity, while limits cap resource usage and prevent noisy-neighbor problems and OOMKills or CPU throttling. Option A is not a best practice because sensitive data in environment variables can leak via process listings, logs, or pod specs; GKE recommends Secret Manager or Kubernetes Secrets mounted as volumes. Option B is wrong because liveness and readiness probes are essential even for stateless apps to detect failures and control traffic routing. Option E is wrong because using the default Compute Engine service account grants overly broad permissions; Workload Identity or a dedicated least-privilege service account should be used.

Answer

Store sensitive configuration data in environment variables.

Answer

Skip liveness and readiness probes for stateless applications.

Answer

Use the default Compute Engine service account for pods.

Question 9

A developer needs to deploy a Python application to App Engine flexible environment. The application requires a specific version of a system package (libssl-dev) that is not included in the default runtime image. How should the developer install this package?

Accepted Answer

Create a Dockerfile that uses the base runtime image and runs apt-get install.. The App Engine flexible environment runs your application in a Docker container based on a Google-provided runtime image. To install system packages like libssl-dev that are not included in the default image, you must customize the container by creating a Dockerfile that starts FROM the base runtime image and then runs apt-get install. This is the standard method for adding OS-level dependencies in the flexible environment.

Answer

Use a custom runtime that already includes the package.

Answer

Specify the package in the app.yaml file under the 'libraries' section.

Answer

Add the package name to the requirements.txt file.

Question 10

A development team is using Cloud Trace to analyze performance bottlenecks in a Node.js application deployed on GKE. They have enabled trace sampling at 10% and can see some traces, but many requests are not captured. They want to increase the sampling rate to 100% for a specific high-traffic endpoint while keeping the default sampling rate for other endpoints. How can they achieve this?

Accepted Answer

Implement a custom sampler in the application code to sample the specific endpoint at 100%.. Cloud Trace allows you to implement a custom sampler in your application code to override the default sampling rate for specific endpoints. By using the OpenTelemetry SDK, you can create a sampler that checks the request path and returns a sampling decision of 1.0 (100%) for the high-traffic endpoint while delegating to the default sampler (e.g., 0.1) for all other requests. This gives you fine-grained control without affecting the global sampling configuration.

Answer

Use a separate trace exporter for the high-traffic endpoint.

Answer

Increase the quota for trace spans per request.

Answer

Set the global trace sampling rate to 100% in the application configuration.

Question 11

A developer needs to test a Cloud Function locally before deploying. Which tool should they use?

Accepted Answer

Functions Framework for your language.. The Functions Framework is the correct tool because it is an open-source library that allows you to run Cloud Functions locally on your machine, emulating the Cloud Functions runtime environment. This enables you to test your function's behavior, including HTTP triggers and event handling, without deploying to Google Cloud. Option D is correct because the Functions Framework is specifically designed for local development and testing of Cloud Functions.

Answer

Docker container with a custom entrypoint.

Answer

gcloud functions call command.

Answer

Cloud Code for VS Code or IntelliJ.

Question 12

Which Cloud Spanner configuration provides the highest availability and global read scalability?

Accepted Answer

Multi-region configuration. Cloud Spanner multi-region configurations replicate data across multiple geographic regions, providing the highest availability (survives regional failures) and global read scalability by serving reads from replicas closest to users. Regional configurations, even with multiple replicas, are confined to a single region and cannot match multi-region availability or global read performance. Multi-region is the only option that satisfies both requirements simultaneously.

Answer

Regional configuration with 1 read-write and 2 read-only replicas

Answer

Regional configuration with 3 read-write replicas

Answer

Single-zone configuration

Question 13

A financial services company is architecting a multi-database solution. They need strong consistency across Cloud Spanner and Cloud SQL for a critical transaction flow. However, two-phase commit (2PC) across heterogeneous databases is not supported. Which pattern should they adopt to maintain data integrity?

Accepted Answer

Saga pattern with orchestration and compensating transactions. The Saga pattern with orchestration and compensating transactions is correct because it maintains data integrity across heterogeneous databases like Cloud Spanner and Cloud SQL without relying on distributed transactions (2PC). In this pattern, each local transaction commits independently, and if a subsequent transaction fails, a compensating transaction is executed to undo the previous committed changes, ensuring eventual consistency and business-level rollback.

Answer

Use Cloud Spanner change streams to sync data to Cloud SQL

Answer

Eventual consistency with conflict resolution

Answer

Migrate all data to Cloud Spanner to avoid cross-database transactions

Question 14

A company is building a polyglot persistence architecture. They need to choose the correct Google Cloud databases for the following requirements: (1) ACID transactions for financial orders, (2) high-throughput time-series sensor data, and (3) real-time session cache. Which THREE databases should they choose? (Choose 3)

Accepted Answer

Memorystore. Cloud Spanner (B) is the right choice for ACID transactions on financial orders because it is a globally distributed, horizontally scalable relational database that provides strong consistency and full ACID transaction support with SQL semantics. Cloud Bigtable (D) is designed for high-throughput, low-latency time-series and sensor data workloads, as it is a wide-column NoSQL store that scales to millions of writes per second with HBase-compatible APIs. Memorystore (A) is correct for a real-time session cache because it is a fully managed Redis/Memcached service offering sub-millisecond latency for caching and session state. Cloud SQL (C) is not the best fit here since it is a traditional managed relational database that does not scale horizontally like Spanner for global ACID workloads, and Firestore (E) is a document database better suited for mobile/web app data than high-throughput time-series or low-latency caching.

Answer

Cloud SQL

Answer

Firestore

Question 15

A developer needs to view detailed performance profiles of a Java application running on Compute Engine to identify CPU hotspots. Which Google Cloud service should they use?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct service because it provides continuous, low-overhead CPU and heap profiling for Java applications running on Compute Engine. It uses statistical sampling to identify which methods consume the most CPU time, enabling developers to pinpoint hotspots without requiring code changes or redeployment.

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Cloud Logging