PCD Practice Test 46 — 15 Questions

Question 1

You are deploying a stateful application to GKE. The deployment fails with an error: 'pods failed to fit in any node due to insufficient CPU'. The cluster has 3 nodes with 4 vCPUs each. The deployment requests 2 vCPUs per pod with 5 replicas. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Other workloads or system components are consuming CPU resources.. The cluster has 3 nodes × 4 vCPUs = 12 vCPUs total capacity. The deployment requests 5 pods × 2 vCPUs = 10 vCPUs, which is within the total capacity. However, the error indicates that the pods cannot be scheduled due to insufficient CPU. This is most likely because other workloads (e.g., system components, DaemonSets, or other deployments) are consuming CPU on the nodes, reducing the available CPU below what is required. Option A is incorrect because the cluster autoscaler would only add nodes if there is insufficient total capacity, but here the capacity exists but is consumed. Option B is incorrect because missing resource limits would not cause CPU insufficiency; it would allow pods to consume more but not prevent scheduling. Option D is incorrect because the error explicitly mentions insufficient CPU, not taints or tolerations. Therefore, option C is the most likely cause.

Answer

The cluster autoscaler is not enabled.

Answer

The deployment does not specify resource limits.

Answer

The nodes have taints that prevent pod scheduling.

Question 2

You want to deploy a containerized application on Google Cloud that requires no server management and automatically scales based on HTTP traffic. Which service should you use?

Accepted Answer

Cloud Run.. (Cloud Run) is correct because Cloud Run is a serverless platform that automatically scales based on HTTP traffic and requires no server management. Option B (Compute Engine) is incorrect because it requires you to manage virtual machines. Option C (Google Kubernetes Engine) is incorrect because it requires cluster management. Option D (App Engine Flexible Environment) is incorrect because it still runs on VMs and requires more configuration than Cloud Run.

Answer

Compute Engine.

Answer

Google Kubernetes Engine.

Answer

App Engine Flexible Environment.

Question 3

A financial services company has a critical application that must survive a regional outage. They deployed on Compute Engine across multiple zones within a single region and now want to redirect traffic to a secondary region if the primary region becomes unavailable. Which load balancing solution should they use?

Accepted Answer

External HTTP(S) Load Balancer. The External HTTP(S) Load Balancer is the correct choice because it supports global load balancing across multiple regions, enabling traffic failover to a secondary region when the primary region becomes unavailable. It uses anycast IP addresses and is designed for HTTP/S traffic, making it suitable for a critical application that must survive a regional outage.

Answer

SSL Proxy Load Balancer

Answer

Proxy Network Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Network Load Balancer

Question 4

The developer runs the command above and sees both instances are unhealthy. The instances are running and serving traffic on port 80 when accessed directly. What is the most likely cause?

Accepted Answer

Firewall rules block the health check probe IP ranges. The most likely cause is that firewall rules are blocking the health check probe IP ranges. Google Cloud Platform (GCP) load balancers use specific, documented IP ranges for health check probes. If a firewall rule denies traffic from these ranges, the load balancer will mark the instances as unhealthy even though the instances are running and serving traffic on port 80 when accessed directly. This is a common misconfiguration because the health check probes originate from these special IP ranges, not from the load balancer's frontend IP.

Answer

The instances have been deleted

Answer

The instances are not running the specified health check port

Answer

The load balancer is misconfigured

Answer

The instances are out of memory and unable to respond

Question 5

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Accepted Answer

By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.. Cloud Storage automatically encrypts all data at rest using server-side encryption with Google-managed encryption keys by default, without any additional configuration. This ensures that data is protected before it is written to disk and remains encrypted throughout its lifecycle.

Answer

Using a signed URL revokes the underlying object's ACL.

Answer

Enabling uniform bucket-level access disables encryption at rest.

Answer

Bucket-level policies can restrict access to only compute instances with specific service accounts.

Question 6

A developer needs to deploy a Python application to App Engine flexible environment. The application requires a specific version of a system package (libssl-dev) that is not included in the default runtime image. How should the developer install this package?

Accepted Answer

Create a Dockerfile that uses the base runtime image and runs apt-get install.. The App Engine flexible environment runs your application in a Docker container based on a Google-provided runtime image. To install system packages like libssl-dev that are not included in the default image, you must customize the container by creating a Dockerfile that starts FROM the base runtime image and then runs apt-get install. This is the standard method for adding OS-level dependencies in the flexible environment.

Answer

Use a custom runtime that already includes the package.

Answer

Specify the package in the app.yaml file under the 'libraries' section.

Answer

Add the package name to the requirements.txt file.

Question 7

A team is building a microservices architecture on Google Cloud. They want services to communicate asynchronously to avoid tight coupling. They also need to guarantee at-least-once delivery of messages. Which two services should they use together? (Choose TWO.)

Accepted Answer

Cloud Tasks. To achieve asynchronous communication with at-least-once delivery, the team should use Cloud Tasks (option C) for reliable task execution with retries and Cloud Pub/Sub (option D) for asynchronous messaging with guaranteed at-least-once delivery. Cloud Run (HTTP) is synchronous, Cloud Endpoints is an API gateway, and Cloud Datastore is a database, so none of these meet the async and delivery requirements.

Answer

Cloud Run (HTTP)

Answer

Cloud Endpoints

Answer

Cloud Datastore

Question 8

Which THREE are valid ways to create custom metrics in Cloud Monitoring? (Select exactly 3.)

Accepted Answer

Use the Cloud Monitoring API to write time series directly.. The Cloud Monitoring API allows you to write time series data directly via the `projects.timeSeries.create` method, which is a primary mechanism for ingesting custom metrics. This enables you to programmatically send metric data from any source, bypassing the need for an agent.

Answer

Use the Cloud Billing pricing calculator to estimate metric costs.

Answer

Deploy Ops Agent with default configuration.

Question 9

A team uses Cloud Build to build a Go application and deploy it to Cloud Run. The build triggers from a GitHub repository. The team wants to ensure that only commits to the 'main' branch trigger a production deployment, while other branches trigger a build but not a deployment. How should they configure this?

Accepted Answer

Use a single Cloud Build trigger with a substitution variable for the branch name, and include a conditional step that runs deployment only when the variable equals 'main'.. Cloud Build provides the predefined substitution variable $BRANCH_NAME, which automatically receives the branch name from the trigger event. By using a conditional step in cloudbuild.yaml that checks if $BRANCH_NAME equals 'main', you can run the deployment step only for main branch commits, while still building on all branches. This approach keeps a single trigger and avoids unnecessary duplication or external filtering.

Answer

Configure the GitHub repository to only send push events from the main branch to Cloud Build.

Answer

Use a conditional step in cloudbuild.yaml that checks the $_BRANCH variable and skips deployment if not main.

Answer

Create two separate Cloud Build triggers: one for main branch with deployment step, and one for all branches without deployment step.

Question 10

A team uses GitHub for source control. They want to automatically trigger Cloud Build builds on pull request creation. Which two actions are required? (Choose two.)

Accepted Answer

Install the Cloud Build GitHub app in the repository. Installing the Cloud Build GitHub app and creating a trigger with the 'pull_request' event are the two necessary steps. Other options are either not needed or incorrect.

Answer

Configure a webhook in GitHub to send push events to Cloud Build

Answer

Use Cloud Source Repositories as a mirror of GitHub

Answer

In the Cloud Build trigger, set the event to 'push' and branch filter to 'pull-request/*'

Question 11

A company is migrating an on-premises PostgreSQL database to Cloud SQL for PostgreSQL using Database Migration Service (DMS). They need to minimize downtime and keep the on-premises database available for reads during migration. The migration plan includes a full dump followed by continuous change data capture (CDC). Which method should they use to validate the migrated data before cutting over?

Accepted Answer

Promote the Cloud SQL replica to a standalone instance for testing; if the data is correct, stop the on-premises database and update the application connection string.. Promoting the Cloud SQL read replica to a standalone instance allows you to validate the migrated data in isolation without affecting the ongoing CDC replication. This method minimizes downtime by keeping the on-premises database available for reads and only cutting over after verification, which aligns with the requirement for a low-downtime migration using Database Migration Service.

Answer

Run the migration job a second time in parallel and compare the data manually.

Answer

Stop the Database Migration Service job and promote the source Cloud SQL instance.

Answer

Modify the promoted replica's database flags to match the source and then run a consistency check.

Question 12

Which TWO best practices should be followed when deploying a containerized application to Cloud Run for production?

Accepted Answer

Use a minimal base image with only necessary dependencies.. Using a minimal base image (e.g., distroless or Alpine-based) reduces the attack surface, decreases image size, and speeds up cold starts. Cloud Run pulls the container image for each new instance, so a smaller image directly reduces startup latency and improves scaling responsiveness. This aligns with Google's best practices for production deployments on Cloud Run.

Answer

Set min-instances to 0 to save costs when idle.

Answer

Set max-instances to unlimited to handle traffic spikes.

Answer

Always use the latest public image from Docker Hub for dependencies.

Question 13

An engineer is designing a disaster recovery plan for a production AlloyDB cluster. The primary cluster is in us-central1. They need a cross-region replica that can be promoted to primary in the event of a regional failure. The replica should also be able to handle read traffic in the secondary region. Which THREE steps should they take? (Choose 3.)

Accepted Answer

Promote the secondary cluster to primary during a disaster.. AlloyDB cross-region replication is achieved by creating a secondary cluster in another region with an external read pool. The secondary cluster can be promoted for failover. Instance-level read pool does not exist; read pools are cluster-level. AlloyDB Omni is for on-premises, not cross-region replication.

Answer

Configure an instance-level read pool in the secondary cluster.

Answer

Enable AlloyDB Omni on the secondary cluster.

Question 14

Which TWO of the following are best practices when deploying applications on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across nodes.. Pod anti-affinity ensures pods are scheduled across different nodes, improving fault tolerance and high availability. This is a best practice for stateless applications to avoid a single point of failure during node failures. Option D is correct because defining resource requests and limits allows the Kubernetes scheduler to make informed placement decisions and prevents resource starvation, ensuring predictable application performance.

Answer

Store sensitive configuration data in environment variables.

Answer

Skip liveness and readiness probes for stateless applications.

Answer

Use the default Compute Engine service account for pods.

Question 15

A team is using Cloud Source Repositories and wants to enforce code reviews before merging. What tool should they use?

Accepted Answer

Cloud Source Repositories with branch protection rules that require pull request reviews and passing status checks.. Cloud Source Repositories (CSR) integrates with Cloud Build and Git. To enforce mandatory code reviews before merging, you configure branch protection rules on the CSR repository. These rules require pull request reviews and passing status checks (e.g., from Cloud Build), preventing direct pushes to protected branches. This is the native Git-based mechanism for enforcing review workflows.

Answer

Cloud Source Repositories pull requests without restrictions.

Answer

Cloud Deploy with manual approval.

Answer

Cloud Build triggers with approval gates.