PCD Practice Test 47 — 15 Questions

Question 1

A developer is building a Go service that will run on Cloud Run. The service must connect to a Cloud SQL for PostgreSQL instance using the Cloud SQL Auth Proxy. During local development, the developer wants to test the connection the same way it will work in production. Which approach should the developer use to start the Cloud SQL Auth Proxy and connect from the local Go application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the Cloud SQL Auth Proxy with the instance connection name and a service account key, then configure the application to connect to 127.0.0.1 on the proxy's local port.. The Cloud SQL Auth Proxy is the recommended way to connect to Cloud SQL from both local environments and Cloud Run. Running the proxy locally with the instance connection name and appropriate credentials creates a secure, authenticated tunnel that the application can use via localhost. This matches the production sidecar pattern, ensuring configuration parity and reducing deployment surprises.

Answer

Use the Cloud SQL Admin API from the local application to generate an ephemeral SSL certificate, then connect using the instance's private IP address.

Answer

Add the local machine's public IP address to the Cloud SQL instance's authorized networks and connect directly using the instance's public IP address.

Answer

Configure the local application to connect through a VPC peering connection to the default VPC network, and use the instance's private IP address.

Question 2

A developer is deploying a new Cloud Run service that must read secrets from Secret Manager at runtime without embedding them in the container image or environment variables. The service account attached to the Cloud Run service must have least-privilege access. Which combination of steps should the developer take?

Accepted Answer

Grant the runtime service account roles/secretmanager.secretAccessor on the specific secret, and mount the secret as a volume in the Cloud Run service configuration.. Mounting a Secret Manager secret as a volume in Cloud Run lets the container read the secret from the filesystem at runtime, so the value is never baked into the image or leaked through environment variables. Granting roles/secretmanager.secretAccessor on only the specific secret satisfies least privilege because the service account can read just that secret and nothing else in the project.

Answer

Store the secret in a Cloud Storage bucket, grant roles/storage.objectViewer to the runtime service account, and download the secret at container startup.

Answer

Embed the secret value directly in the container image as a build argument, and grant the runtime service account no additional roles.

Answer

Grant the runtime service account roles/secretmanager.admin at the project level, and reference the secret through the SECRET_MANAGER_SECRET environment variable.

Question 3

A financial services company runs a containerized trading dashboard on Google Kubernetes Engine (GKE) Standard. The dashboard reads from a Cloud SQL for PostgreSQL instance and must survive a zonal outage without manual intervention. The team wants to minimize cost while ensuring the database remains reachable if the primary zone fails. Which configuration should they implement?

Accepted Answer

Configure the Cloud SQL instance with high availability (HA) enabled, which provisions a standby replica in a different zone in the same region.. High availability on Cloud SQL automatically maintains a standby in a different zone and fails over without manual action. This is the standard, cost-effective way to survive a zonal failure for a single-region application. Read replicas and cross-region replicas serve different purposes, and PITR is for recovery, not availability.

Answer

Deploy the Cloud SQL instance with a cross-region replica and use a global load balancer to route database traffic.

Answer

Create a read replica in a different zone and configure the application to switch to it when the primary becomes unavailable.

Answer

Enable point-in-time recovery (PITR) on the Cloud SQL instance and restore the database to a new instance during an outage.

Question 4

A developer is preparing to deploy a new revision of a Cloud Run service. To ensure the new revision behaves correctly before shifting all traffic, the developer wants to run automated tests against the revision without affecting production users. Which two methods can achieve this? (Choose two.)

Accepted Answer

Deploy the new revision with the --tag=test flag, then send requests to the tagged URL.. To test a new Cloud Run revision without impacting production, the developer can deploy with --no-traffic, which creates the revision but sends no traffic to it, and then use the revision-specific URL. Alternatively, deploying with a tag (e.g., --tag=test) creates a tagged URL that can receive test requests independently. Both methods isolate the new revision from the default service URL used by production users.

Answer

Deploy the new revision with 50% traffic, run tests, then shift all traffic to the new revision.

Answer

Deploy the new revision with the --no-allow-unauthenticated flag, which creates a separate test endpoint.

Answer

Deploy the new revision with the --set-env-vars TEST_MODE=true flag, which automatically redirects test requests to the new revision.

Question 5

A team stores user-uploaded images in a Cloud Storage bucket. They want other Google Cloud services and external clients to access objects using short-lived, signed URLs without making the bucket public, and they want to avoid managing long-lived service account keys. Which approach should they use?

Accepted Answer

Use the IAM SignBlob API with the Cloud Run service account to generate V4 signed URLs, so no downloaded key is needed.. Signing with the IAM SignBlob API lets the workload use its own service account identity to create V4 signed URLs, so access can be scoped and time-limited without any downloadable key. The bucket stays private and no long-lived credential is introduced.

Answer

Set the bucket's default object ACL to public-read and rely on the URL's expiration parameter.

Answer

Create a service account key, download the JSON file, and embed it in the application to sign URLs.

Answer

Grant allUsers the Storage Object Viewer role on the bucket and share direct object URLs.

Question 6

You are deploying a new version of a service to Cloud Run. You want to perform a canary deployment to gradually shift traffic to the new revision. Which two actions should you perform? (Choose two.)

Accepted Answer

Deploy the new revision with the `--no-traffic` flag to prevent it from receiving any traffic initially.. A canary deployment in Cloud Run involves deploying the new revision without traffic using --no-traffic, then gradually shifting traffic with gcloud run services update-traffic. This allows you to test the new revision and roll back if issues arise. The other options either do not apply to Cloud Run's native traffic management or are not part of the canary process.

Answer

Use `gcloud run deploy` with the `--tag` flag to assign a unique tag to the new revision for testing.

Answer

Configure a load balancer to distribute traffic between the old and new revisions based on weights.

Answer

Set the `--concurrency` parameter to control the number of concurrent requests per revision.

Question 7

A developer needs to deploy a new revision of a Cloud Run service but wants to send only 10 percent of traffic to the new revision while keeping the previous revision serving the rest. The deployment should not disrupt existing sessions. What should the developer do?

Accepted Answer

Deploy the new revision with --no-traffic, then use gcloud run services update-traffic to assign 10 percent to the new revision.. Deploying with --no-traffic creates the revision without routing live traffic, and then update-traffic sets a percentage split so the new revision receives a controlled share. The previous revision keeps serving the majority, which supports a canary rollout and avoids disrupting existing sessions. This uses Cloud Run's native traffic management rather than external routing.

Answer

Create a second Cloud Run service with the new image, and use Cloud DNS weighted routing to send 10 percent of requests to it.

Answer

Deploy the new revision with the --tag flag, and configure the load balancer to route 10 percent of requests to the tagged URL.

Answer

Deploy the new revision normally, then delete the previous revision so all traffic shifts to the new one.

Question 8

A developer is building a Cloud Function that processes files uploaded to a Cloud Storage bucket. The function must be triggered only when new files are created, not when existing files are modified or deleted. Which event type should the developer configure for the Cloud Storage trigger?

Accepted Answer

google.storage.object.finalize. The google.storage.object.finalize event is the correct trigger for new file creation in Cloud Storage. It fires when a new object is successfully written to the bucket. Other events like metadataUpdate, delete, and archive correspond to different lifecycle actions and would not meet the requirement of processing only new files.

Answer

google.storage.object.archive

Answer

google.storage.object.delete

Answer

google.storage.object.metadataUpdate

Question 9

A developer is deploying a new version of a service to Cloud Run. The service uses a custom domain and must maintain 100% availability during the rollout. The developer wants to gradually shift traffic to the new revision while monitoring for errors. Which approach should they use?

Accepted Answer

Deploy the new revision with `--no-traffic`, then use `gcloud run services update-traffic` to gradually shift traffic to the new revision.. Cloud Run supports gradual traffic migration by deploying a new revision with no traffic and then using the `update-traffic` command to incrementally shift percentages. This allows the developer to monitor the new revision's health and performance, and to roll back by shifting traffic back if needed. It maintains availability because traffic is only shifted as confidence grows, and no downtime occurs during the process.

Answer

Deploy the new revision with `--traffic` set to 100% and rely on Cloud Run's automatic rollback on errors.

Answer

Deploy the new revision with `--traffic` set to 0% and use Cloud Monitoring to manually switch traffic when ready.

Answer

Use a blue/green deployment by creating a second Cloud Run service and switching the custom domain's DNS record.

Question 10

A media company ingests millions of small event records per minute into Cloud Bigtable from a Dataflow pipeline. The pipeline uses row keys formatted as the event timestamp in reverse order followed by the device ID, and writes are evenly distributed. After several weeks, scans for a specific device ID become very slow, and single-row reads by timestamp are fast. They need to query by device ID efficiently while keeping write throughput high. What should they change?

Accepted Answer

Change the row key to device ID followed by the reverse timestamp, and enable a column family with a single version.. Bigtable stores rows sorted lexicographically by row key, and range scans are efficient only when the queried attribute is the leading part of the key. Placing the device ID first makes each device's events contiguous, so device queries become narrow range scans, and appending the reverse timestamp keeps recent events first. High-cardinality device IDs still distribute writes evenly across tablets, preserving ingest throughput.

Answer

Keep the existing row key and add a secondary index in a separate Bigtable table keyed by device ID.

Answer

Change the row key to a salted hash of the device ID followed by the reverse timestamp.

Answer

Keep the existing row key and switch reads to a Cloud Bigtable SQL query that filters on the device ID column.

Question 11

A developer is writing unit tests for a Cloud Run service that reads an environment variable named API_KEY at startup and calls an external payment API. The developer wants tests to run quickly and reliably without making real network calls to the payment API. The service code is in Python and uses the requests library. What should the developer do?

Accepted Answer

Use the unittest.mock library to patch the requests.get method and set the API_KEY environment variable in the test setup.. Unit tests for Cloud Run services should run quickly and deterministically. Mocking the external HTTP client with unittest.mock and injecting required environment variables in test setup achieves this. Deploying to the cloud or calling real APIs introduces latency, cost, and flakiness. Using Google Cloud Client Libraries does not apply to third-party APIs.

Answer

Deploy the service to Cloud Run with a test API key and run the tests against the deployed URL.

Answer

Set the API_KEY environment variable in a .env file and use the python-dotenv library to load it during tests, while allowing real calls to the payment API.

Answer

Use the Google Cloud Client Libraries for Python to mock the payment API by enabling the Cloud Mock API.

Question 12

You are deploying a web application to App Engine standard environment. You need to ensure that the application can scale automatically based on incoming traffic and that it uses the latest runtime version. You also want to minimize costs when there is no traffic. Which scaling configuration should you use?

Accepted Answer

Automatic scaling with a minimum number of instances set to 0 and a maximum number of instances set to 10.. Automatic scaling with a minimum instances set to 0 allows the application to scale down to zero when there is no traffic, eliminating costs during idle periods. The maximum instances limit controls scaling during traffic spikes. This configuration provides automatic scaling based on demand and cost efficiency, making it ideal for the scenario.

Answer

Automatic scaling with a minimum number of instances set to 1 and a maximum number of instances set to 10.

Answer

Basic scaling with a maximum number of instances set to 5.

Answer

Manual scaling with a fixed number of instances set to 3.

Question 13

A company runs a microservices application on Google Kubernetes Engine (GKE). They want to ensure that if a single node fails, the application's Pods are rescheduled and the service remains available. The application uses a Deployment with multiple replicas. Which GKE feature should they configure to ensure Pods are spread across nodes and zones?

Accepted Answer

Configure topology spread constraints for the Deployment.. Topology spread constraints are designed to distribute Pods across failure domains such as nodes and zones. By defining constraints with appropriate topology keys and whenUnsatisfiable policies, the scheduler ensures that replicas are spread out, so a single node or zone failure affects only a subset of Pods. This is the GKE-native way to achieve even distribution.

Answer

Use node affinity rules to schedule Pods on specific nodes.

Answer

Configure a PodDisruptionBudget for the Deployment.

Answer

Enable the Horizontal Pod Autoscaler for the Deployment.

Question 14

A developer is writing unit tests for a Cloud Function that uses the Cloud Firestore client library. The tests need to run locally and in Cloud Build without connecting to the real Firestore database. The developer wants to avoid network calls and ensure tests are deterministic. Which approach should they use?

Accepted Answer

Use the Firestore emulator and set the FIRESTORE_EMULATOR_HOST environment variable before initializing the client.. The Firestore emulator is the official local emulator that mimics Firestore behavior without network access. By setting the FIRESTORE_EMULATOR_HOST environment variable, the client library connects to the emulator. This is ideal for unit and integration tests that need to run locally and in CI/CD pipelines like Cloud Build, ensuring deterministic and isolated test runs.

Answer

Enable the Firestore offline persistence mode and rely on local caching for all reads and writes during tests.

Answer

Mock the Firestore client library using a framework like Sinon or Mockito to return predefined responses.

Answer

Create a separate Firestore database in a test project and use service account credentials to connect during tests.

Question 15

You are deploying a new version of an App Engine standard service. You want to direct a small percentage of live traffic to the new version to test it before a full rollout. Which App Engine feature should you use?

Accepted Answer

Traffic splitting. Traffic splitting in App Engine lets you route a specified percentage of requests to different versions. This is ideal for canary deployments, where you want to test a new version with a subset of users before committing to a full rollout. Other features like warmup requests or instance classes do not control traffic distribution.

Answer

Automatic scaling

Answer

Warmup requests

Answer

Instance classes