PCD Practice Test 44 — 15 Questions

Question 1

A company needs a fully managed, globally distributed relational database that supports ACID transactions across regions. Which Google Cloud service should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is a fully managed, globally distributed relational database that supports ACID transactions and horizontal scaling across regions. It is designed for global consistency and high availability, making it the correct choice for this requirement.

Answer

Firestore

Answer

Cloud Bigtable

Answer

Cloud SQL

Question 2

A team uses Cloud Endpoints to manage their API. They want to monitor API latency for each API method. What is the recommended approach?

Accepted Answer

View the built-in Cloud Endpoints latency metrics in Cloud Monitoring.. Cloud Endpoints automatically exports per-method latency metrics to Cloud Monitoring, including request counts, error rates, and latency distributions. These built-in metrics are the recommended way to monitor API latency per method without writing any custom instrumentation. Viewing them in Cloud Monitoring gives immediate, low-effort visibility.

Answer

Parse Cloud Logging endpoint logs to calculate latency.

Answer

Use Cloud Trace to analyze samples and estimate latency.

Answer

Instrument the API code with a custom metric for each method.

Question 3

A company needs a managed Redis instance for caching and pub/sub messaging in their application. Which Google Cloud service should they use?

Accepted Answer

Memorystore for Redis. Memorystore for Redis is a managed Redis service that supports caching and pub/sub. Memorystore for Memcached only supports caching. Cloud SQL and Firestore are not caching services.

Answer

Firestore

Answer

Cloud SQL

Answer

Memorystore for Memcached

Question 4

You are deploying a containerized application to Cloud Run. The application must connect to a Cloud SQL for PostgreSQL instance. You want to use the built-in integration that provides secure connectivity without exposing the database to the public internet. What should you do?

Accepted Answer

Use the Cloud SQL Auth proxy by adding the `--add-cloudsql-instances` flag to the `gcloud run deploy` command and connect via the Unix socket.. Cloud Run has built-in support for the Cloud SQL Auth proxy. When you deploy with --add-cloudsql-instances, Cloud Run runs the proxy as a sidecar, creating a Unix socket. Your application connects via that socket, and authentication is handled by IAM. This method is secure, simple, and does not require public IPs or manual VPC setup.

Answer

Assign a public IP to the Cloud SQL instance and configure the Cloud Run service to connect using the instance's public IP address with SSL encryption.

Answer

Enable the Cloud SQL Admin API and add a volume mount for the Cloud SQL socket in the Cloud Run service configuration.

Answer

Configure the Cloud Run service to use a Serverless VPC Access connector and set the Cloud SQL connection to use a private IP.

Question 5

A startup is deploying a new web application on Compute Engine. They expect variable traffic and want to automatically adjust the number of VM instances based on demand while keeping costs low. They also want to ensure that the application remains available if a single VM fails. What should they do?

Accepted Answer

Create a managed instance group with autoscaling enabled and configure a health check to automatically replace unhealthy instances.. A managed instance group with autoscaling and health checks automatically adjusts capacity based on demand and replaces unhealthy instances, ensuring both scalability and high availability. This is the most cost-effective and resilient solution for variable traffic.

Answer

Create a managed instance group without autoscaling and set the size to a fixed number of instances that can handle peak load.

Answer

Create an unmanaged instance group and manually add or remove instances based on traffic patterns.

Answer

Create a single Compute Engine instance with a static external IP address and use a startup script to install the application.

Question 6

A company is designing a globally distributed application on Google Cloud. They need to ensure that user data is stored close to users for low latency and that the data is highly available across regions. The application requires strong consistency for writes. Which storage solution should they use?

Accepted Answer

Cloud Spanner with a multi-region configuration.. Cloud Spanner is the only Google Cloud database that provides strong consistency and global distribution with multi-region configurations. It ensures low-latency access for users worldwide while maintaining ACID transactions, making it the correct choice for this scenario.

Answer

Firestore in Datastore mode with multi-region replication.

Answer

Cloud SQL with cross-region read replicas.

Answer

Cloud Bigtable with a multi-cluster configuration.

Question 7

A developer is building a Cloud Function that processes files uploaded to a Cloud Storage bucket. The function must be triggered only when new files are created in the bucket and must not trigger on file deletions or metadata updates. The developer needs to configure the trigger. What should they do?

Accepted Answer

Create a Cloud Function with a Cloud Storage trigger and set the event type to google.storage.object.finalize.. The google.storage.object.finalize event is specifically designed to trigger when a new object is created or overwritten in a Cloud Storage bucket. This aligns with the requirement to process only new files. Other event types handle deletions or metadata updates, which are not needed here.

Answer

Create a Cloud Function with a Cloud Storage trigger and set the event type to google.storage.object.delete.

Answer

Create a Cloud Function with a Cloud Storage trigger and set the event type to google.storage.object.metadataUpdate.

Answer

Create a Cloud Function with an HTTP trigger and configure a Cloud Storage notification to send a webhook to the function's URL on object creation.

Question 8

A developer is using Cloud Build to run unit tests for a Python application. The build step uses the python:3.9 image and runs pip install -r requirements.txt followed by pytest. The build fails with an error that some tests cannot find the required dependencies. The build logs show that pip install completed successfully. What is the most likely cause?

Accepted Answer

The pytest command is not using the same Python interpreter that pip installed packages into.. The most likely cause is that pip and pytest are using different Python interpreters. This can happen if the image has multiple Python installations or if the PATH is altered. When pip installs packages into one interpreter's site-packages, another interpreter cannot import them. Ensuring both commands invoke the same Python executable fixes the problem.

Answer

The Cloud Build step does not persist the installed dependencies between steps, but the tests are run in the same step.

Answer

The tests are run in a different working directory than where pip installed the dependencies.

Answer

The cloudbuild.yaml file does not specify a volume to mount the dependencies directory.

Question 9

You are deploying a microservices application to Google Kubernetes Engine (GKE). The application consists of several services that need to communicate with each other. You want to enforce mutual TLS (mTLS) between services and gain fine-grained traffic control without modifying application code. Which GKE feature should you use?

Accepted Answer

Anthos Service Mesh. Anthos Service Mesh provides a uniform way to secure, connect, and monitor microservices. It automatically enables mTLS between services, encrypting traffic and authenticating both ends. It also offers advanced traffic management features like canary deployments, retries, and circuit breaking. These are achieved via sidecar proxies, without modifying application code, making it ideal for the scenario.

Answer

Cloud VPN

Answer

GKE Ingress

Answer

Network policies

Question 10

A company runs a microservices application on GKE. They want to ensure that if the Redis cache used by one service becomes unavailable, the service degrades gracefully and continues to serve requests with reduced functionality. Which pattern should they implement?

Accepted Answer

Fallback pattern by implementing logic in the service to use a local cache or default values when Redis is unavailable.. To degrade gracefully when Redis is unavailable, the service should implement a fallback mechanism, such as using a local cache or returning default data. This ensures continued operation with reduced functionality, rather than complete failure.

Answer

Circuit breaker pattern using Istio to detect failures and redirect traffic to a fallback service.

Answer

Bulkhead pattern to isolate the Redis connection pool and prevent resource exhaustion.

Answer

Retry pattern with exponential backoff to handle transient Redis failures.

Question 11

A startup is building a new mobile backend using Cloud Run. They expect unpredictable traffic and want to minimize costs while ensuring the service scales automatically. What should they do?

Accepted Answer

Deploy the service to Cloud Run with the default settings, which automatically scale based on incoming requests.. Cloud Run is a serverless platform that automatically scales based on request load and scales to zero when idle, making it cost-effective for unpredictable traffic. Default settings handle scaling without additional configuration, so the startup can focus on development.

Answer

Deploy the service to Compute Engine instances behind a load balancer and use an autoscaler based on CPU usage.

Answer

Deploy the service to Cloud Functions with a maximum instance limit set to 100 to control costs.

Answer

Deploy the service to a GKE cluster with a Horizontal Pod Autoscaler configured to scale based on CPU utilization.

Question 12

A financial services company runs a payment API on Cloud Run that calls a third-party provider. The provider enforces a strict rate limit and returns HTTP 429 when exceeded. During peak hours, the API retries immediately on 429 responses, causing a retry storm and cascading failures. The team wants to protect the provider and keep the API responsive. What should they do?

Accepted Answer

Implement exponential backoff with jitter on 429 responses and add a circuit breaker that opens after repeated failures.. Backoff with jitter desynchronizes retries so the provider is not hammered simultaneously, and a circuit breaker sheds load when failures persist, allowing recovery. This directly addresses the retry storm and cascading failure. Simply adding capacity or shortening timeouts does not reduce pressure on the rate-limited dependency.

Answer

Increase the Cloud Run maximum instance count so more requests can be handled concurrently and the provider limit is less likely to be hit.

Answer

Configure a Cloud Run timeout shorter than the provider's response time so failed calls are terminated before they can be retried.

Answer

Move the third-party calls to a Cloud Tasks queue that delivers each request exactly once with no retry configuration.

Question 13

A team runs a fault-tolerant web application on a regional managed instance group of Compute Engine VMs behind an external Application Load Balancer. They need to ensure that if an entire zone becomes unavailable, traffic continues to be served with minimal disruption and no manual intervention. Which configuration should they implement?

Accepted Answer

Configure the managed instance group to spread instances across multiple zones within the region and set the load balancer's health check to use a short interval.. A regional managed instance group spreads instances across multiple zones, so a zone outage only affects a fraction of capacity. The load balancer health check ensures traffic is routed only to healthy instances. This design provides automatic zone-level failover without manual intervention, which is exactly what the scenario requires. Cross-region failover is overkill for a single-zone failure.

Answer

Create a second managed instance group in a different region and use a global load balancer with failover based on a health check.

Answer

Use a single-zone managed instance group and enable autoscaling to add instances when a zone fails.

Answer

Deploy a standalone VM in each zone and manually add them to the load balancer backend service.

Question 14

A company has a Cloud Run service that must read and write objects in a Cloud Storage bucket. The security team wants to avoid granting project-wide permissions and wants to ensure the service can only access that specific bucket. What should the developer do?

Accepted Answer

Grant the Cloud Run service account the Storage Object Admin role on the specific bucket using a bucket-level IAM policy.. To restrict access to a specific bucket, grant the Storage Object Admin role at the bucket level. This provides read and write permissions only for that bucket, avoiding project-wide access. The other options either grant excessive project-wide permissions, provide only read access, or use an unsuitable mechanism like signed URLs. Bucket-level IAM is the correct way to scope permissions precisely.

Answer

Create a signed URL for the bucket and embed it in the Cloud Run service's environment variables.

Answer

Grant the Cloud Run service account the Storage Object Viewer role at the project level.

Answer

Grant the Cloud Run service account the Storage Admin role at the project level.

Question 15

You are deploying a new version of a service to App Engine standard environment. The new version uses a different runtime and requires a new set of environment variables. You want to deploy the new version without sending any traffic to it initially, and then gradually migrate traffic. Which command should you use?

Accepted Answer

gcloud app deploy --no-promote. The `--no-promote` flag deploys a new version without routing traffic to it. You can then test the version and gradually shift traffic using `gcloud app services set-traffic`. The `--promote` flag sends all traffic immediately, `--stop-previous-version` only stops old versions, and `--migrate` is not a valid flag.

Answer

gcloud app deploy --version=v2 --migrate

Answer

gcloud app deploy --promote

Answer

gcloud app deploy --stop-previous-version