PCD Practice Test 46 — 15 Questions

Question 1

A developer is building a Node.js service deployed to Cloud Run. The service must read a secret from Secret Manager at runtime. During local development, the developer wants to run unit tests that verify the secret is fetched and used correctly without connecting to Google Cloud. Which approach should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Abstract the secret retrieval behind an interface and inject a mock implementation during unit tests.. Unit tests should not depend on external services or credentials. By hiding secret retrieval behind an interface and injecting a mock, the developer can verify that the application uses the secret correctly without needing network access or a real Secret Manager instance. This keeps tests fast, reliable, and runnable in any environment, including CI systems that lack Google Cloud credentials.

Answer

Use the gcloud CLI to fetch the secret and pipe it into the test process as an environment variable before running the tests.

Answer

Use the Secret Manager client library with the emulator by setting the SECRET_MANAGER_EMULATOR_HOST environment variable.

Answer

Configure the Secret Manager client library to use a local file-based cache and pre-populate it with the secret value.

Question 2

Your organization wants to deploy a new version of a service to Google Kubernetes Engine. The team must be able to roll back quickly if the new version is unhealthy, and they want the rollout to be gated so that no traffic shifts until a human approves. Which Google Cloud service should they use to orchestrate the release?

Accepted Answer

Google Cloud Deploy, because it provides delivery pipelines with approval gates and can target GKE clusters.. Google Cloud Deploy provides delivery pipelines that target GKE clusters and supports approval requirements before a rollout proceeds, which matches the need for a gated release. It also tracks rollout history, enabling quick rollback. Artifact Registry stores images, Cloud Build runs build steps, and Cloud Monitoring observes health, but none of those orchestrate an approval-gated release.

Answer

Cloud Monitoring, because it detects unhealthy revisions and can trigger a rollback automatically.

Answer

Cloud Build, because it runs the build steps and can push the image to the cluster.

Answer

Artifact Registry, because it stores the container images and controls which tags are deployable.

Question 3

A media company ingests telemetry from millions of devices into Pub/Sub. A Dataflow streaming pipeline enriches the messages and writes results to BigQuery. During peak hours the pipeline falls behind and the Pub/Sub subscription backlog grows continuously. The pipeline uses a fixed number of 20 workers. What should the team do to keep the backlog low while controlling cost?

Accepted Answer

Switch the pipeline to use Streaming Engine and enable autoscaling with a maximum number of workers.. A streaming pipeline that falls behind is capacity-constrained, and the most effective remedy is to let it scale with load. Streaming Engine separates execution from worker VMs so autoscaling responds quickly to backlog, and a maximum worker count places a ceiling on spend. This keeps the subscription backlog low during peaks while avoiding the cost of a permanently large static worker pool.

Answer

Increase the BigQuery write throughput by switching the sink to streaming inserts with a higher quota.

Answer

Increase the number of workers to a fixed value of 200 and leave the pipeline running at that size permanently.

Answer

Reduce the Pub/Sub message retention duration so old messages expire before they are processed.

Question 4

A team runs a stateful order-processing service on GKE that uses a Redis instance on Compute Engine for session state. The service must survive a zonal failure without losing session data. The Redis instance currently runs on a single VM in us-central1-a. What should the team do to meet the requirement with the least operational overhead?

Accepted Answer

Migrate the session state to Memorystore for Redis with a Standard Tier instance that has automatic failover to a replica in another zone.. Memorystore for Redis Standard Tier provides a primary and replica in different zones with automatic failover. The managed service handles replication and failover, so the application continues to read and write session data after a zonal failure. This meets the availability requirement with far less operational effort than self-managed replication.

Answer

Move the Redis instance to a larger machine type and enable live migration on the Compute Engine VM.

Answer

Create a managed instance group of Redis VMs across three zones and configure Redis replication manually.

Answer

Configure the application to write session data to both Redis and a Cloud Storage bucket for durability.

Question 5

You are deploying a containerized application to Cloud Run. The application requires a persistent connection to a Redis instance running on Compute Engine in the same project. You want to minimize latency and ensure that the connection does not go over the public internet. The Redis instance has only an internal IP address. Which configuration should you use?

Accepted Answer

Deploy the Cloud Run service with the --vpc-connector flag pointing to a Serverless VPC Access connector, and set egress to all-traffic.. To connect Cloud Run to an internal IP address in your VPC, you must use a Serverless VPC Access connector and set egress to all-traffic so that outbound traffic is routed through the VPC. This keeps the connection private and minimizes latency. The other options do not provide private connectivity to Redis.

Answer

Deploy the Cloud Run service with the --ingress internal flag to allow only internal traffic.

Answer

Deploy the Cloud Run service with a custom domain and configure Cloud DNS to resolve the Redis internal IP.

Answer

Deploy the Cloud Run service with the --add-cloudsql-instances flag to connect to Redis.

Question 6

A team is connecting a Cloud Run service to a Cloud SQL for PostgreSQL instance using the Cloud SQL Auth Proxy via a Unix socket. They want to follow Google-recommended practices for connectivity and identity. Which two actions should they take? (Choose two.)

Accepted Answer

Pass the instance connection name to the Cloud Run service and connect through the /cloudsql/<INSTANCE_CONNECTION_NAME> socket path.. The Cloud SQL Auth Proxy authenticates using the attached service account, so granting only the Cloud SQL Client role satisfies least privilege. The proxy listens on a Unix socket derived from the instance connection name, so passing that name and connecting through the /cloudsql path is the recommended Cloud Run pattern.

Answer

Grant the service account the Cloud SQL Editor role to ensure all required operations are permitted.

Answer

Store the database password in the container image so the application can authenticate without extra configuration.

Answer

Enable a public IP on the Cloud SQL instance and open the Cloud Run egress range in the instance's authorized networks.

Question 7

A media company runs a video transcoding pipeline where each incoming upload must be processed exactly once, and the order of processing for a given video's segments matters. They are using Pub/Sub and want to guarantee that messages for the same video are delivered in order and processed sequentially. Which Pub/Sub feature should they enable to meet this requirement?

Accepted Answer

Message ordering using ordering keys. The need is to guarantee that messages for the same video are processed in order. Pub/Sub's message ordering feature, enabled by setting an ordering key, ensures that all messages with the same key are delivered in publish order. This directly meets the scenario's requirement without requiring custom sequencing logic in the application.

Answer

Push subscriptions with flow control

Answer

Exactly-once delivery with a dead-letter topic

Answer

Message retention duration set to 7 days

Question 8

A global logistics company runs a microservices application on Google Kubernetes Engine (GKE) across multiple regions. They use a multi-region Cloud Spanner instance for their database. They want to ensure that the application remains available even if an entire region fails, and they want to minimize data replication lag. Which design should they implement?

Accepted Answer

Deploy GKE clusters in multiple regions and configure the application to connect to the nearest Cloud Spanner replica using a multi-region instance configuration.. Cloud Spanner multi-region instances provide automatic replication and failover across regions with strong consistency. Deploying GKE clusters in multiple regions and connecting to the nearest Spanner replica ensures low latency and high availability. This design allows the application to survive a region failure without manual intervention.

Answer

Deploy GKE clusters in multiple regions and use a Cloud SQL for PostgreSQL instance with cross-region replicas, manually promoting the replica during a regional failure.

Answer

Deploy GKE clusters in multiple regions and use a Cloud Spanner multi-region instance, but configure the application to write to a single region to avoid conflicts.

Answer

Use a single GKE cluster in one region and a Cloud Spanner regional instance with a read replica in another region.

Question 9

A development team wants its Compute Engine application to read objects from a Cloud Storage bucket without embedding credentials in code or on disk. The VM runs under a custom service account. Which approach should the team use?

Accepted Answer

Use the Cloud Storage client library with Application Default Credentials, relying on the VM's attached service account.. Application Default Credentials on Compute Engine queries the metadata server for tokens tied to the VM's attached service account, so the application authenticates without any key material. Access is controlled by IAM roles on that service account, and tokens rotate automatically. This satisfies the no-credentials-in-code-or-on-disk requirement and is the recommended pattern for Google Cloud compute workloads.

Answer

Hard-code a signed URL generation routine using a user-managed HMAC key stored in the application configuration file.

Answer

Store the service account key in instance metadata and read it from the metadata server at runtime.

Answer

Generate a service account key, store it in Secret Manager, and fetch it at startup using the Secret Manager API.

Question 10

A retail company runs an order-processing service on Cloud Run (fully managed) in the us-central1 region. During flash sales, request latency spikes and some requests return HTTP 503 errors because all container instances are busy. The team wants the service to absorb sudden traffic bursts without manual intervention, while keeping cold-start latency low and controlling cost. Which combination of Cloud Run settings should they configure?

Accepted Answer

Set a minimum instance count greater than zero and increase the maximum instance count, relying on concurrency and CPU allocation settings to handle bursts.. The service fails because concurrent requests exceed available container instances. Raising the maximum instance count allows horizontal scale-out, and a non-zero minimum instance count keeps warm instances ready so bursts do not trigger cold starts. Together they address both the 503 errors and latency. Platform changes or timeout and concurrency tweaks do not add the capacity needed for sudden traffic spikes.

Answer

Increase the Cloud Run request timeout to 60 minutes and lower the concurrency setting to 1 so each request gets a dedicated instance.

Answer

Enable Cloud CDN in front of the Cloud Run service and configure a global external HTTP(S) load balancer with Cloud Armor rate limiting.

Answer

Deploy the service to a GKE Autopilot cluster and configure a HorizontalPodAutoscaler based on CPU utilization.

Question 11

A startup runs a stateless REST API on a managed instance group of Compute Engine VMs behind an external Application Load Balancer. The API is deployed in a single region with three zones, but during a regional outage the service was completely unavailable. The startup wants the API to remain available even if an entire region fails, with minimal changes to the application code. What should they do?

Accepted Answer

Deploy the managed instance group in a second region and add a global external Application Load Balancer with backend services in both regions.. Regional resilience requires capacity in more than one region plus a traffic distribution mechanism that can react to a regional failure. A global external Application Load Balancer fronts backend services in multiple regions behind one anycast IP and automatically steers users to healthy backends. Because the API is stateless, deploying the same managed instance group template in a second region completes the design with no application changes.

Answer

Add more zones to the existing regional managed instance group and increase the minimum number of instances per zone.

Answer

Enable autoscaling on the existing managed instance group and raise the maximum instance count to absorb the outage.

Answer

Create a Cloud DNS failover routing policy with health checks that points to a static IP in a second region.

Question 12

A company is developing a mobile app that uses Firebase Authentication. They want to allow users to sign in with their Google accounts and also store user profile data in a Firestore database. The app must ensure that only authenticated users can read and write their own profile data. What should they do?

Accepted Answer

Use Firebase Authentication to sign in users with Google, and configure Firestore security rules to allow read/write only if request.auth.uid matches the document ID.. The correct approach is to use Firebase Authentication for Google Sign-In and Firestore security rules that check if the authenticated user's UID matches the document ID. This ensures that each user can only access their own profile data. The other options either use inappropriate storage, add unnecessary complexity, or fail to enforce per-user access control.

Answer

Use Firebase Authentication to sign in users with Google, and use Cloud Functions to validate the user's ID token before allowing access to Firestore.

Answer

Use Firebase Authentication to sign in users with Google, and store the user profile data in Cloud Storage with a bucket policy that allows only authenticated users.

Answer

Use Firebase Authentication to sign in users with Google, and configure Firestore security rules to allow read/write to all authenticated users.

Question 13

You need to deploy a containerized application to Cloud Run. The application requires an environment variable `DB_HOST` to be set at runtime. You want to avoid hardcoding the value in the container image. Which method should you use?

Accepted Answer

Pass the environment variable using the `--set-env-vars` flag during deployment.. Cloud Run allows environment variables to be set at deploy time using `--set-env-vars` (or `--update-env-vars`). This injects the value into the container at runtime without modifying the image. Dockerfile ENV and source substitution hardcode the value, and Secret Manager volumes are overkill for a non-sensitive hostname.

Answer

Use Cloud Build to substitute the value into the application source code before building the image.

Answer

Set the environment variable in the Dockerfile using the ENV instruction.

Answer

Mount a Secret Manager secret as a volume and read the value from a file.

Question 14

A developer is writing unit tests for a Cloud Function written in Go that uses the Cloud Firestore client. The tests must run quickly and not require network access. Which strategy should the developer use to simulate Firestore interactions?

Accepted Answer

Define an interface for the Firestore operations used by the function and provide a fake implementation for tests.. In Go, the idiomatic way to unit test code that uses external services is to define interfaces for the operations and provide fakes. This allows the tests to run quickly without network access and to simulate various scenarios, such as successful reads, errors, and edge cases. The fake can be a simple struct that implements the interface and returns predefined values. This approach also improves the design by making the code more modular and testable.

Answer

Use the httptest package to intercept HTTP calls made by the Firestore client and return canned responses.

Answer

Use the Firestore client library's built-in mock mode by calling firestore.NewClient with the WithMock option.

Answer

Use the Firestore emulator by setting the FIRESTORE_EMULATOR_HOST environment variable and starting the emulator with gcloud beta emulators firestore start.

Question 15

You are deploying a Python application to App Engine standard environment. The application needs to read a configuration file that contains environment-specific values, such as database hostnames, which differ between staging and production. You want to avoid hardcoding these values in the source code and ensure they are available as environment variables at runtime. Which approach should you use?

Accepted Answer

Define the variables in the app.yaml file under the env_variables section.. App Engine standard supports environment variables defined in app.yaml under env_variables. This is the simplest and most direct way to provide configuration values that vary by environment without hardcoding them in source code. Other options either do not result in environment variables or are unnecessarily complex for non-sensitive configuration.

Answer

Use the Google Cloud Secret Manager to store the values and access them via the Secret Manager API at runtime.

Answer

Store the configuration in a JSON file within the application directory and read it at startup.

Answer

Set the variables in the Cloud Build trigger's substitution variables and pass them to the app.yaml during deployment.