PCD Practice Test 39 — 15 Questions

Question 1

A developer wants to store application logs from Compute Engine instances in a centralized logging system. Which service should they use?

Accepted Answer

Cloud Logging. Cloud Logging. Cloud Logging is the centralized logging service in Google Cloud that collects and stores logs from various sources, including Compute Engine instances. Cloud Monitoring (A) is for monitoring metrics and alerting, not logs. Cloud Trace (B) is a distributed tracing tool for latency analysis. Cloud Debugger (C) inspects application state at runtime, not for log storage.

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Cloud Debugger

Question 2

A developer sets environment variables for a Cloud Function as shown. What is the security concern?

Accepted Answer

The password is exposed in plain text and should be stored in Secret Manager.. Storing a password in plain text in an environment variable exposes it to anyone with access to the function's configuration. Cloud Secret Manager should be used to store secrets securely. Option A is incorrect because the variable name FOO, while short, is syntactically valid and does not pose a security risk. Option B is incorrect because build variables are for build-time settings, not runtime secrets, and the security concern is about exposure, not where the variable is set. Option C is incorrect because encryption at rest is not applicable; environment variables are not encrypted by default, but the main issue is visibility, not encryption.

Answer

The variable name FOO is too short and does not follow naming conventions.

Answer

The variable DB_PASS should be set as a build variable instead.

Answer

There is no encryption applied to environment variables.

Question 3

A team deploys a containerized application on Cloud Run and notices increased latency during traffic spikes due to cold starts. Which configuration change would best address this?

Accepted Answer

Set min_instances to a value greater than 0. Setting min_instances to a value greater than 0 keeps a baseline of warm instances ready to handle traffic, reducing cold starts. Option B is wrong because setting concurrency to 1 limits throughput, which can worsen scaling behavior and does not address cold starts. Option C is wrong because enabling CPU always allocated does not create new instances; it only prevents CPU throttling on existing instances. Option D is wrong because increasing max_instances only raises the upper limit of instances but does not prevent cold starts; it can help with scale but not with initial latency.

Answer

Set concurrency to 1

Answer

Enable CPU always allocated

Answer

Increase max_instances

Question 4

A startup wants to deploy a Python web application with low traffic and minimal operational overhead. They need to automatically scale down to zero when not in use. Which compute option should they choose?

Accepted Answer

App Engine Standard Environment.. Both App Engine Standard Environment and Cloud Run satisfy the requirements of low traffic, minimal operational overhead, and scaling to zero. App Engine Standard can scale to zero when no requests are incoming and supports Python, making it a valid choice. Cloud Run also scales to zero automatically and is fully managed, but for a simple Python web app, App Engine Standard offers even less configuration. Therefore, both options are correct.

Answer

Compute Engine with managed instance group and autoscaling.

Answer

Google Kubernetes Engine with cluster autoscaling.

Question 5

A company has a hybrid cloud setup with on-premises applications that need to send messages to a Pub/Sub topic. The on-premises network is connected via Cloud VPN. What is the recommended way to publish messages?

Accepted Answer

Use VPC Service Controls and Private Google Access. To allow on-premises access to Pub/Sub via Cloud VPN, you need to enable Private Google Access to allow traffic from on-premises to Google APIs via private IP, and VPC Service Controls to restrict data exfiltration. Option A is incorrect: Cloud NAT is for outbound internet access from private instances, not for on-premises to Google API access. Option B is incorrect: exposing Pub/Sub publicly with OAuth would not use the VPN and would be less secure. Option D is incorrect: Cloud Router establishes BGP sessions for dynamic routing, but does not directly provide access to Pub/Sub.

Answer

Use a Cloud NAT instance to route traffic

Answer

Expose Pub/Sub publicly and use authentication via OAuth2 tokens

Answer

Use Cloud Router to establish BGP sessions for direct connectivity

Question 6

Refer to the exhibit. The user developer@example.com tries to create a firewall rule and receives a permission denied error. What is the most likely reason?

Accepted Answer

All of the above. All of the above. In Google Cloud, creating a firewall rule requires the `compute.securityAdmin` role (which includes `compute.firewalls.create` permission) or the `compute.networkAdmin` role (which also includes `compute.firewalls.create` permission). If the user lacks any of these roles or the specific permission, they will receive a permission denied error. While options A, B, and C are individually true statements, the question asks for the 'most likely reason,' and since all three are valid, the single correct answer is D. This tests the understanding that multiple permission deficiencies can cause the same error.

Answer

The user lacks compute.networkAdmin role

Answer

The user lacks compute.securityAdmin role

Answer

The user is missing compute.firewalls.create permission

Question 7

A company wants to send events from a custom application to Cloud Pub/Sub, then process them with a Cloud Run service. The application runs on Compute Engine. What is the simplest way for the application to authenticate to Pub/Sub?

Accepted Answer

Attach a service account to the Compute Engine instance with necessary Pub/Sub roles.. Attaching a service account to the Compute Engine instance allows the application to automatically obtain credentials via the instance metadata server, which is the simplest and most secure method. Option A is wrong because API keys are not used for authentication to Pub/Sub; they lack identity-based access control. Option B is wrong because embedding a service account JSON key in the code is insecure and not best practice. Option C is wrong because Cloud Endpoints adds unnecessary complexity for this use case and is not the simplest approach.

Answer

Use an API key for the Pub/Sub API.

Answer

Embed a service account JSON key in the application code.

Answer

Set up Cloud Endpoints to proxy the Pub/Sub requests.

Question 8

A developer is building a microservices application on Cloud Run. One service needs to make authenticated HTTP requests to another Cloud Run service in the same project. What is the best practice for authentication?

Accepted Answer

Use IAM roles on the target service and call it with the appropriate identity token from the metadata server. Cloud Run service-to-service authentication is best done using an identity token from the metadata server and setting IAM on the target service. Option A is not recommended as API keys are for external clients. Option B uses the default compute service account, which may have broader permissions than needed and is not the best practice for service-to-service auth. Option C uses OAuth2 client credentials, which are for external applications, not for internal service-to-service calls.

Answer

Use API keys

Answer

Use Cloud Run's built-in service-to-service authentication with the default compute service account

Answer

Use OAuth2 client credentials

Question 9

A developer needs to store configuration parameters for a Cloud Run service, such as database connection strings and API keys. The values must be encrypted at rest and in transit. Which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing configuration parameters like database connection strings and API keys, as it provides encryption at rest and in transit, along with fine-grained access control. Cloud SQL is a relational database service, not designed for secret storage. Cloud Storage is for object storage, not secrets. Firestore is a NoSQL database and not intended for secret management.

Answer

Cloud SQL

Answer

Cloud Storage

Answer

Firestore

Question 10

Which THREE are valid approaches for automating testing in a Cloud Build CI pipeline?

Accepted Answer

Use Cloud Build triggers to run tests on every push to a branch.. Cloud Build triggers can be configured to automatically start a build (including test steps) on specific events, such as a push to a branch. This enables continuous integration by validating every code change as soon as it is committed, without manual intervention.

Answer

Use Cloud Build to ship test results to Cloud Monitoring.

Answer

Use Cloud Build to run tests only after manual approval.

Question 11

Refer to the exhibit. A developer runs the command and sees that the Cloud Run service is publicly accessible. The security team requires that only authenticated requests from a specific service account in the same project are allowed. What should the developer do to modify the IAM policy?

Accepted Answer

Update the IAM policy to remove the allUsers member from the roles/run.invoker binding. Modifying the IAM policy to remove the allUsers member from the roles/run.invoker binding revokes public access, ensuring only authenticated requests are allowed. The service account can then be granted the roles/run.invoker role if it does not already have it. Option A adds the service account as an invoker but does not remove the allUsers member, so the service remains publicly accessible. Option C changes ingress settings, which controls network-level access, not IAM authentication; it does not address the requirement for authenticated requests. Option D removes the viewer role and adds the service account to invoker, but it fails to remove the allUsers member, leaving public access intact.

Answer

Add a new binding with the service account as the only member of roles/run.invoker

Answer

Change the service's ingress settings to "Internal and Cloud Load Balancing"

Answer

Remove the roles/run.viewer binding and add the service account to roles/run.invoker

Question 12

A team wants to deploy infrastructure as code on Google Cloud. They need a declarative language that supports modularity and state management. Which tool should they choose?

Accepted Answer

Terraform.. Terraform is the correct choice because it is a declarative infrastructure-as-code tool that supports modularity through reusable modules and state management via state files (local or remote backends like Cloud Storage). It allows teams to define Google Cloud resources in HashiCorp Configuration Language (HCL) and track resource changes over time, enabling safe, incremental updates.

Answer

Cloud Deployment Manager.

Answer

Cloud Shell.

Answer

gcloud commands.

Question 13

A team uses Google Kubernetes Engine (GKE) with Node Auto-Provisioning. They want to optimize cost while maintaining high availability across zones. Which two strategies should they implement? (Select exactly 2.)

Accepted Answer

Use cluster autoscaler with appropriate min and max node counts. Node Auto-Provisioning (NAP) in GKE works in conjunction with the cluster autoscaler to automatically create and delete node pools based on workload demands. By setting appropriate minimum and maximum node counts, you ensure the cluster can scale down to zero when idle (saving cost) and scale up to handle peak load, while avoiding runaway scaling that could increase costs unexpectedly.

Answer

Use preemptible VMs for all node pools

Answer

Disable cluster autoscaler to prevent scaling

Answer

Use sole-tenant nodes for high availability

Question 14

A company uses Cloud Build to build Docker images and push to Artifact Registry. They want to trigger builds automatically when code is pushed to a Cloud Source Repository branch. They also need to ensure that only builds from the repository's main branch are allowed to push to the production Artifact Registry repository. What is the best way to implement this?

Accepted Answer

Use Cloud Build triggers with branch filter and use IAM conditions on the Artifact Registry to restrict push based on the Cloud Build service account. Cloud Build triggers with a branch filter can be set to only trigger on the main branch, and IAM conditions on the Artifact Registry can restrict push access based on the Cloud Build service account, ensuring only builds from the main branch can push to the production repository. Option A is overly complex and unnecessary. Option B does not enforce branch-level restrictions. Option D is less direct and harder to manage.

Answer

Use Cloud Source Repository webhooks and a Cloud Function to call Cloud Build

Answer

Use Cloud Build triggers and configure separate service accounts for each branch

Answer

Use Cloud Build triggers with substitution variables and separate build configurations

Question 15

A developer wants to store secrets (e.g., API keys) for use in Cloud Functions without exposing them in the source code. Which Google Cloud service should they use?

Accepted Answer

Use Secret Manager to store secrets and reference them via secret environment variables. Secret Manager is the dedicated Google Cloud service for storing sensitive data like API keys, passwords, and certificates. It provides built-in versioning, access control via IAM, and native integration with Cloud Functions through secret environment variables, ensuring secrets are never exposed in source code or configuration files.

Answer

Store secrets in a Cloud Storage bucket with encrypted objects and load them at runtime

Answer

Use Firestore to store secrets in a secure document and access it via the Firestore SDK

Answer

Use Cloud Key Management Service (Cloud KMS) to create and manage secrets