PCD Practice Test 42 — 15 Questions

Question 1

A team deploys a microservices architecture on GKE with Istio service mesh. They want to enforce mutual TLS (mTLS) between services. After enabling Istio with the default configuration, some services report connection errors. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Some services do not have Istio sidecar injected, so strict mTLS fails.. Istio's default configuration enables 'STRICT' mTLS mode, which requires all services to have an Envoy sidecar proxy injected to handle TLS handshakes. If any service lacks the sidecar, it cannot participate in mTLS, causing connection errors when other services attempt to communicate with it using TLS. The error typically manifests as 'upstream connect error' or 'TLS handshake failure' in the sidecar logs.

Answer

The services need a ServiceEntry to communicate with each other.

Answer

The namespace is not labeled with istio-injection=enabled.

Answer

The services are using a different service mesh protocol.

Question 2

During an Oracle to PostgreSQL migration, a team uses the Ora2Pg tool. They notice that some PL/SQL code containing the 'DBMS_OUTPUT.PUT_LINE' procedure is not converted correctly. How should they handle this?

Accepted Answer

Replace DBMS_OUTPUT.PUT_LINE with RAISE NOTICE in PostgreSQL.. PostgreSQL does not have a direct equivalent; the typical approach is to use RAISE NOTICE for debugging output. Alternatively, the code can be replaced with logging to a table.

Answer

Replace with PostgreSQL's PRINT statement.

Answer

Use PostgreSQL's DBMS_OUTPUT extension from pgOracle.

Answer

Keep DBMS_OUTPUT.PUT_LINE as-is; PostgreSQL supports it.

Question 3

Which TWO are best practices for setting up alerting policies in Cloud Monitoring? (Choose two.)

Accepted Answer

Include documentation in the alert policy to guide responders. Option A is correct because embedding documentation (such as runbook links, troubleshooting steps, and escalation contacts) directly in the alert policy gives responders immediate context and remediation guidance when the alert fires, reducing mean time to resolution. Option C is correct because defining distinct notification channels (for example, email, SMS, Slack, or PagerDuty) mapped to different severity levels ensures that critical alerts reach on-call engineers immediately while lower-severity alerts go to less urgent channels, preventing alert fatigue. Option B is not a best practice because combining related conditions where appropriate reduces noise and simplifies management, so always splitting them is not recommended. Option D is wrong because notification channels are the mechanism by which alerts reach responders; avoiding them defeats the purpose of alerting. Option E is wrong because setting every alert to high severity causes alert fatigue and desensitizes responders, undermining the value of severity-based routing.

Answer

Create separate alerts for each condition rather than combining them

Answer

Avoid using notification channels to reduce noise

Answer

Set all alerts to high severity to ensure visibility

Question 4

An organization has multiple Google Cloud projects for different environments (dev, staging, prod). They want to create a single Cloud Monitoring dashboard that shows metrics from all projects. What is the correct approach?

Accepted Answer

Create a dashboard in a shared project and use metric scopes to include data from other projects. Metric scopes in Cloud Monitoring allow you to view metrics from multiple Google Cloud projects within a single dashboard. By creating a dashboard in a shared (host) project and adding other projects as monitored projects via metric scopes, you can aggregate metrics from dev, staging, and prod environments without duplicating dashboards or exporting data.

Answer

Use a custom metrics export to a central project via log sinks

Answer

Create a separate dashboard in each project and use dashboard sharing

Answer

Use the Monitoring API to aggregate metrics in a single chart

Question 5

A company is deploying a multi-region application on Cloud Run to serve global users. They want low latency and automatic failover. Which approach is best?

Accepted Answer

Deploy to multiple Cloud Run regions behind an external HTTP(S) Load Balancer with global backend.. Deploying Cloud Run services across multiple regions behind an external HTTP(S) Load Balancer with a global backend provides both low latency (via Google's global anycast IP and nearest-region routing) and automatic failover (the load balancer health checks automatically route traffic away from unhealthy backends). This architecture uses the load balancer's global external backend service to direct requests to the closest healthy Cloud Run service, ensuring high availability and performance for global users.

Answer

Deploy to multiple regions and use DNS round-robin.

Answer

Use Cloud Run for Anthos on-premises.

Answer

Deploy to a single region and use Cloud CDN.

Question 6

A financial services company uses Cloud Spanner for transactional data. They need to perform complex analytical queries that aggregate large volumes of data without affecting the performance of transaction processing. Which approach should they take?

Accepted Answer

Export data from Spanner to BigQuery periodically and run analytic queries there.. BigQuery is a serverless, highly scalable data warehouse designed for complex analytical queries on large datasets. By exporting Spanner transactional data to BigQuery, the company can run heavy aggregations without impacting Spanner's OLTP performance, as Spanner is optimized for high-throughput, low-latency transactions, not analytical workloads.

Answer

Use Spanner's read-only transactions to run analytic queries.

Answer

Enable Cloud Spanner's query optimizer for analytical workloads.

Answer

Create secondary indexes on the Spanner tables to speed up analytical queries.

Question 7

A team is designing a Firestore database for a global mobile game. They need to support offline play and sync data when the device is online. Which Firestore feature enables offline sync?

Accepted Answer

Offline persistence. Firestore provides persistent offline data access for mobile/web apps via built-in offline support in the client SDKs, enabling sync when connectivity returns.

Answer

Security Rules

Answer

Real-time listeners

Answer

Datastore mode

Question 8

A company uses Firestore in Native mode for a mobile app. They need to enforce security rules to allow users to read and write only their own data. Which TWO steps are required? (Select TWO.)

Accepted Answer

Write a security rule that checks if request.auth.uid == resource.data.user_id. Option A is correct because Firestore security rules must explicitly compare the authenticated user's UID to the document's owner field, e.g., allow read, write: if request.auth.uid == resource.data.user_id, which enforces per-user access at the database layer. Option D is correct because that rule can only work if each document actually stores the owner's UID in the user_id field, so the app must write request.auth.uid into user_id when creating documents. Option B is wrong because Firestore Native mode is the appropriate mode for mobile/web client SDKs and security rules; Datastore mode is for server-side workloads and does not use the same rules model. Option C is wrong because roles/datastore.user is an IAM role for server-side access to Datastore/Firestore, not a per-end-user mechanism for mobile clients. Option E is wrong because a composite index on user_id and timestamp only affects query performance and is not required to enforce ownership-based security rules.

Answer

Enable Datastore mode instead of Native mode

Answer

Assign the roles/datastore.user IAM role to each user

Answer

Create a composite index on user_id and timestamp

Question 9

You manage a global ecommerce platform using Cloud Spanner. You need to support a query that joins two tables on a foreign key relationship. The tables are parent and child in an interleaved table hierarchy. Which statement about performance is TRUE?

Accepted Answer

The join will be fast because interleaving stores child rows with the parent row in the same split. Cloud Spanner interleaved tables physically co-locate child rows with their parent row within the same split (and often the same tablet). This means a join on the interleaved foreign key can be executed with minimal cross-node communication, as the data needed for the join is stored together, resulting in very fast query performance.

Answer

Interleaved tables cannot be joined

Answer

The join will be slow because interleaving increases split overhead

Answer

The join is only fast if you use a global secondary index

Question 10

A company wants to query data across Cloud SQL (MySQL) and BigQuery using federated queries. They want to avoid data movement. Which TWO components must be set up?

Accepted Answer

External table in BigQuery. Option A (External table in BigQuery) is correct because BigQuery federated queries against Cloud SQL require creating an external table that points to the Cloud SQL MySQL instance via a connection, allowing BigQuery to read the data in place without copying it. Option D (BigQuery connection) is correct because a BigQuery connection (a Cloud SQL connection resource) is the mechanism that stores the credentials and network path BigQuery uses to reach the Cloud SQL instance; without it the external table cannot be created. Option B (Cloud SQL instance) is not a component to set up for this scenario since the question assumes the Cloud SQL (MySQL) data already exists and is being queried. Option C (Cloud Storage bucket) is unnecessary because federated queries read directly from Cloud SQL, not from files in GCS. Option E (Dataflow pipeline) is not required because federated queries avoid data movement and do not need an ETL pipeline.

Answer

Cloud SQL instance

Answer

Cloud Storage bucket

Answer

Dataflow pipeline

Question 11

An organization is migrating a 5 TB MySQL database from on-premises to Cloud SQL. The source uses MyISAM tables and the utf8 charset. The target must support full Unicode (emojis). The migration should have minimal downtime. What should the organization do?

Accepted Answer

Convert MyISAM to InnoDB, change charset to utf8mb4, then use DMS continuous migration.. Cloud SQL requires InnoDB tables (MyISAM is not supported) and utf8mb4 charset for full Unicode support including emojis. By first converting the tables and charset on-premises, then using Database Migration Service (DMS) continuous migration, you achieve minimal downtime through ongoing replication.

Answer

Export the database using mysqldump and import into Cloud SQL; change charset after import.

Answer

Use DMS continuous migration directly; DMS automatically converts MyISAM to InnoDB and changes charset.

Answer

Use DMS one-time migration, convert MyISAM to InnoDB during migration.

Question 12

A team wants to monitor CPU utilization on their Compute Engine instances. They need an alert that sends a notification when the average CPU utilization across all instances in a project exceeds 80% for more than 5 minutes. Which alerting configuration should they use?

Accepted Answer

Create an alert policy with a metric threshold condition for compute.googleapis.com/instance/cpu/utilization, aggregated across all instances with alignment period 1 min and duration 5 min. Cloud Monitoring alert policies allow you to define a metric threshold condition using the `compute.googleapis.com/instance/cpu/utilization` metric, aggregate it across all instances in the project, and set an alignment period of 1 minute with a duration of 5 minutes. This configuration ensures the alert fires only when the average CPU utilization exceeds 80% for a sustained period of 5 minutes, meeting the exact requirement.

Answer

Use Cloud Scheduler to periodically check CPU and trigger notification

Answer

Create a log-based alert using metrics from Cloud Logging

Answer

Use an uptime check to monitor CPU utilization

Question 13

A company needs to migrate an on-premises PostgreSQL database to Cloud SQL for PostgreSQL with near-zero downtime. Which TWO features of Database Migration Service (DMS) should they use?

Accepted Answer

Connection profiles. Option B (Connection profiles) is correct because Database Migration Service requires you to define source and destination connection profiles that store the connectivity details (host, port, credentials) for the on-premises PostgreSQL source and the Cloud SQL for PostgreSQL destination, which is a prerequisite for setting up any migration job. Option C (Continuous migration with CDC) is correct because DMS uses change data capture (via PostgreSQL logical replication/decoding) to continuously replicate ongoing changes from the source to Cloud SQL after the initial full dump, allowing cutover with near-zero downtime. Option A (Dataflow templates) is incorrect because Dataflow is a separate Apache Beam-based data processing service used for streaming/batch pipelines, not the mechanism DMS uses for PostgreSQL migrations. Option D (Full dump only) is incorrect because a one-time full dump captures only a point-in-time snapshot and would require downtime to stop writes and re-sync, so it cannot achieve near-zero downtime. Option E (One-time migration) is incorrect because a one-time migration job performs only the initial load without continuous replication, again failing the near-zero downtime requirement.

Answer

Dataflow templates

Answer

Full dump only

Answer

One-time migration

Question 14

A company wants to migrate an on-premises PostgreSQL 9.6 database to Cloud SQL for PostgreSQL with minimal downtime. Which service should they use?

Accepted Answer

Database Migration Service. Google Cloud Database Migration Service (DMS) is designed to migrate databases to Cloud SQL with minimal downtime, supporting homogeneous migrations like PostgreSQL to Cloud SQL for PostgreSQL. It handles continuous replication and cutover, making it the correct choice for a low-downtime migration.

Answer

Cloud Dataflow

Answer

BigQuery Data Transfer Service

Answer

Cloud SQL Auth Proxy

Question 15

During a code review, a developer notices that the application's Cloud Storage client library is using the default credentials of the Compute Engine instance. What is a more secure alternative for a production environment?

Accepted Answer

Create a dedicated service account with minimal permissions and attach it to the instance. Creating a dedicated service account with minimal permissions and attaching it to the Compute Engine instance follows the principle of least privilege. This avoids using the overly permissive default Compute Engine service account, which often has broad access to many Google Cloud services. By scoping the service account to only the required Cloud Storage permissions (e.g., roles/storage.objectViewer), you reduce the attack surface and adhere to production security best practices.

Answer

Store user credentials in a configuration file

Answer

Use an API key for Cloud Storage

Answer

Generate an access token and embed it in the code