PCD Practice Test 40 — 15 Questions

Question 1

An application running on GKE is experiencing high latency. The team uses Cloud Trace to identify the bottleneck. They notice that a particular service spends most of its time waiting on a database query. How can they optimize performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Optimize the database query and add appropriate indexes. The bottleneck is identified as a database query causing high latency. Optimizing the query and adding appropriate indexes directly reduces the time spent waiting on the database, which is the root cause. Cloud Trace shows the service is waiting on the database, so improving database performance is the most effective solution.

Answer

Decrease the number of pods to reduce load

Answer

Use Cloud CDN to cache database results

Answer

Increase the number of replicas for the service

Question 2

Which THREE methods are valid ways to deploy a containerized application to Google Kubernetes Engine (GKE)?

Accepted Answer

Use Helm to install a chart.. Helm is a package manager for Kubernetes that simplifies deploying containerized applications by using pre-configured charts. A Helm chart packages all the necessary Kubernetes resource definitions (e.g., Deployments, Services) into a single deployable unit, and running `helm install` on a GKE cluster will deploy the application correctly.

Answer

Use gcloud container clusters create to deploy the application.

Answer

Upload the container image to Cloud Storage and use a trigger to deploy.

Question 3

A company is designing a multi-region Cloud Spanner deployment for a global user base. They want to ensure the lowest possible read latency for users in North America and Europe while maintaining strong consistency. Which THREE configuration choices should they make? (Choose 3)

Accepted Answer

Use interleaved tables to localize related data. A multi-region configuration with primary regions in North America and Europe provides leader placement for writes and read replicas for low-latency reads. Adding read-only replicas in each region reduces read latency. Placing read-write replicas in both regions ensures strong consistency locally.

Answer

Configure the application to use stale reads with 1-second bounded staleness

Answer

Use a single-region configuration and rely on Cloud CDN to cache read results

Question 4

A company runs a multi-service application on GKE and wants to create a Service Level Indicator (SLI) for request latency. They have set up Cloud Service Mesh (Anthos Service Mesh) with Istio. Which metric should they use for the SLI?

Accepted Answer

istio_request_duration_milliseconds_bucket metric from Cloud Monitoring.. `istio_request_duration_milliseconds_bucket` is a native Istio metric automatically exported by Cloud Service Mesh (Anthos Service Mesh) to Cloud Monitoring. It provides a histogram of request latencies, which is the standard data source for building a latency-based SLI (e.g., the proportion of requests under a threshold). This metric is pre-configured and requires no custom instrumentation, making it the most direct and reliable choice for an SLI in this environment.

Answer

Custom metric exported by the application using OpenTelemetry.

Answer

Cloud Trace latency distribution from traces.

Answer

Cloud HTTP Load Balancer latency metric.

Question 5

A developer uses this Cloud Build configuration to deploy to Cloud Run. The build succeeds but the deployment fails with an error that the service account lacks permission. What is the most likely missing permission?

Accepted Answer

roles/iam.serviceAccountUser on the Cloud Build service account.. The Cloud Build service account (typically the default compute engine service account or a user-specified service account) needs the `roles/iam.serviceAccountUser` role on the Cloud Run service account to impersonate it during deployment. Without this permission, Cloud Build cannot act as the Cloud Run service account to deploy the revision, even though the build itself succeeds. This is a common misconfiguration when deploying to Cloud Run from Cloud Build.

Answer

roles/iam.serviceAccountUser on the Compute Engine default service account.

Answer

roles/storage.objectViewer on the container registry.

Answer

roles/run.admin on the Cloud Run service.

Question 6

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, handling petabytes of data with consistent single-digit millisecond latency at high throughput. Its key-value and wide-column architecture, combined with native time-series optimization via row key design (e.g., inverted timestamps), makes it the ideal choice for IoT sensor data requiring millions of reads per second.

Answer

Cloud Spanner

Answer

Firestore

Answer

BigQuery

Question 7

Refer to the exhibit. A developer creates this cloudbuild.yaml for a Cloud Build pipeline. When they run the build, they get an error that the image push failed. What is the most likely cause?

Accepted Answer

The Artifact Registry repository 'my-repo' has not been created.. The error occurs because the cloudbuild.yaml references an Artifact Registry repository 'my-repo' that does not exist in the project. Cloud Build attempts to push the Docker image to the specified repository, and if the repository has not been created, the push fails with a permission or not-found error. The repository must be created before the build runs, as Cloud Build does not automatically create repositories.

Answer

The project ID 'my-project' does not exist.

Answer

The Dockerfile is missing in the repository.

Answer

Cloud Run service 'my-service' already exists and needs to be deleted.

Answer

The gcloud command requires the '--platform managed' flag.

Question 8

A company uses Cloud SQL for PostgreSQL and wants to run periodic analytical queries on the data without impacting the transactional workload. The data is updated frequently. Which integration approach is most suitable?

Accepted Answer

Create a read replica of the Cloud SQL instance and point analytical queries to the replica.. Cloud SQL read replicas provide a read-only copy of the database that is continuously updated, allowing analytical queries to be run without affecting the primary instance's performance. This is ideal for frequently updated data. Option A is incorrect because using Cloud Composer to schedule frequent ETL jobs (every minute) is unnecessarily complex and may not keep up with updates. Option B is incorrect because migrating to Cloud Spanner is a major change and not necessary for this use case; read replicas achieve the goal with less complexity. Option C is incorrect because exporting to Cloud Storage and loading into BigQuery is a batch process that introduces latency and is not suitable for frequently updated data.

Answer

Use Cloud Composer to schedule ETL jobs that copy data to BigQuery every minute.

Answer

Migrate the database to Cloud Spanner and use strong reads for analytics.

Answer

Export the Cloud SQL data to Cloud Storage and then load into BigQuery for analysis.

Question 9

During a Cloud Build run, a developer sees the error: "Step #0: error: failed to fetch metadata: connection refused". The build is trying to access a private Docker registry in a different project. What is the most likely cause?

Accepted Answer

The build environment cannot reach the registry due to network restrictions. The error 'connection refused' indicates a network connectivity issue, not an authentication or authorization problem. The most likely cause is that the build environment (Cloud Build) cannot reach the private Docker registry in the other project due to network restrictions such as VPC Service Controls, firewall rules, or the registry being in a different VPC network. Authentication errors would typically show 'denied' or 'unauthorized'. Therefore, option B is correct.

Answer

The registry does not exist

Answer

The build service account lacks IAM permissions to the registry

Answer

The build is using a public pool with no access to internal networks

Question 10

A company uses Cloud SQL for MySQL to store customer data. They have enabled automatic backups and a read replica for reporting. The application experiences timeouts during peak hours because the primary instance cannot handle the write load. The team needs to improve write performance without losing the ability to read from replicas. What should they do?

Accepted Answer

Increase the number of vCPUs on the primary instance.. Increasing the number of vCPUs on the primary Cloud SQL for MySQL instance directly improves its processing capacity to handle higher write throughput. This addresses the root cause of timeouts during peak hours without disrupting the existing read replica architecture, which continues to serve reporting queries. Cloud SQL allows vertical scaling of the primary instance by adjusting machine type, and this change does not affect the ability to read from replicas.

Answer

Increase the size of the read replica to handle writes.

Answer

Promote the read replica to a standalone instance and redirect writes.

Answer

Use Cloud Spanner instead of Cloud SQL for better write scalability.

Question 11

A team is using Cloud Build to build a Go application. They want to cache Go module dependencies across builds to speed up builds. Which configuration should they add to cloudbuild.yaml?

Accepted Answer

Set up a bucket for caching and use substitutions. Cloud Build volumes share data across steps within a single build, but they do not persist across separate builds. To cache Go module dependencies across builds, you must use an external storage service such as Cloud Storage. A common pattern is to set up a Cloud Storage bucket for caching and use substitution variables in cloudbuild.yaml to reference the bucket. Steps can be added to download the cache before building and upload after building, using tools like gsutil.

Answer

Use a custom builder that pre-installs dependencies

Answer

Use a Kaniko cache with a remote repository

Answer

Use Cloud Build's built-in caching feature by specifying a volume

Question 12

Which THREE components are essential for a complete application performance monitoring (APM) solution on Google Cloud?

Accepted Answer

Cloud Monitoring for metrics and alerting.. Cloud Monitoring is essential for an APM solution because it provides metrics, dashboards, and alerting policies to track application health and performance. It integrates with other services like Cloud Trace and Cloud Logging to offer a unified observability platform, enabling proactive detection of issues such as latency spikes or error rate increases.

Answer

Cloud Scheduler for job scheduling.

Answer

Cloud CDN for content caching.

Question 13

Which TWO security best practices should be implemented when using Cloud Build to deploy applications? (Choose 2.)

Accepted Answer

Use Cloud KMS to encrypt sensitive environment variables.. Cloud Build does not automatically encrypt environment variables stored in build config files or the console. Using Cloud KMS allows you to encrypt sensitive data like API keys or passwords, then decrypt them at build time via the `gcloud kms decrypt` step, ensuring secrets are never stored in plaintext.

Answer

Add SSH keys to Cloud Build for private Git repos.

Answer

Use container image tags instead of digests in build configs.

Answer

Store secrets in Cloud Build's default substitution variables.

Question 14

Which TWO Google Cloud services are suitable for deploying serverless applications that scale automatically based on demand?

Accepted Answer

Cloud Functions.. Cloud Functions (option C) is a serverless execution environment that automatically scales instances from zero to thousands in response to event triggers, such as HTTP requests or Cloud Pub/Sub messages, without requiring any infrastructure management. Cloud Run (option E) is a managed compute platform that runs stateless containers in a fully serverless manner, scaling each revision automatically based on incoming request concurrency (up to 80 concurrent requests per container instance by default). Both services abstract away underlying servers and scale to zero when idle, making them ideal for serverless applications.

Answer

Cloud Storage.

Answer

Google Kubernetes Engine.

Answer

Compute Engine with managed instance groups.

Question 15

A company runs a Java microservice on Google Kubernetes Engine (GKE) using a standard cluster with 3 nodes. They use Cloud Build to build the Docker image and push it to Artifact Registry, then apply a Kubernetes Deployment manifest that references the new image tag. The Deployment has a rolling update strategy with maxSurge=1 and maxUnavailable=0. After a recent deployment, the new pods crash with 'CrashLoopBackOff'. The old pods are still running successfully. The application logs show a connection refused error when trying to connect to a Cloud SQL instance. The Cloud SQL instance is in the same project and region. The GKE cluster nodes have the appropriate scopes to access Cloud SQL. The application uses a Cloud SQL proxy sidecar container to establish the connection. The previous deployment worked fine. What is the most likely cause of the failure?

Accepted Answer

The Cloud SQL proxy sidecar container is not included in the new Deployment revision.. The Cloud SQL proxy sidecar container is missing from the new Deployment revision. Since the application relies on the sidecar to establish a secure connection to Cloud SQL, its absence causes the connection refused error. The old pods continue to run because they still have the sidecar from the previous Deployment revision, while the new pods crash due to the missing proxy.

Answer

The GKE cluster nodes do not have the Cloud SQL Client role.

Answer

The Kubernetes Secret containing the service account key was not updated to include the new pod's service account.

Answer

The new image tag points to a broken build that has incorrect code for Cloud SQL connection.