PCD Practice Test 47 — 15 Questions

Question 1

A developer wants to automatically detect and capture application errors in a production environment on Google Cloud. Which two Google Cloud services should be enabled? (Choose two.)

Accepted Answer

Cloud Error Reporting. Cloud Error Reporting aggregates and displays application errors in real time, allowing developers to automatically detect and capture errors in production. Cloud Logging stores all application logs, which Error Reporting uses as a source to identify and analyze error events. Together, they provide a complete solution for error detection and capture without manual intervention.

Answer

Cloud Trace

Answer

Cloud Profiler

Answer

Cloud Debugger

Question 2

A developer deploys this Cloud Run service. During a load test, each incoming request starts a new container instance, even though concurrency is set to 80. What is the reason?

Accepted Answer

The container is not designed to handle multiple concurrent requests (single-threaded). Cloud Run's concurrency setting controls how many requests the runtime can send to a container instance, but the container itself must be capable of handling those requests concurrently. If the application is single-threaded or uses a blocking I/O model (e.g., a simple Flask or Express server without async workers), it can only process one request at a time. Cloud Run detects that the container is busy and starts a new instance for each incoming request, effectively ignoring the concurrency setting.

Answer

The memory limit is too low

Answer

The container is CPU-bound and cannot handle multiple requests concurrently

Answer

The CPU limit is too low

Answer

The concurrency setting of 80 is too high and Cloud Run ignores it

Question 3

A company is deploying a microservices architecture on GKE. They need to expose a set of related microservices under a single external IP address with path-based routing. Which Kubernetes resource should they use?

Accepted Answer

Ingress resource. An Ingress resource is the correct choice because it provides HTTP/HTTPS layer-7 routing to expose multiple services under a single external IP address, using path-based or host-based rules. This directly meets the requirement of exposing a set of related microservices with path-based routing on GKE, whereas a Service of type LoadBalancer would create a separate external IP per service.

Answer

Service of type NodePort

Answer

NetworkPolicy

Answer

Service of type LoadBalancer

Question 4

An application uses Cloud SQL and is experiencing slow query performance. The team wants to monitor query latency and identify slow queries. Which Google Cloud tool should they use?

Accepted Answer

Cloud SQL Insights. Cloud SQL Insights is the correct tool because it is specifically designed to provide detailed query performance diagnostics for Cloud SQL databases. It captures query latency, execution plans, and wait events, enabling teams to identify and troubleshoot slow queries directly within the Cloud SQL console without additional configuration.

Answer

Cloud Debugger

Answer

Cloud Monitoring

Answer

Cloud Trace

Question 5

A company is developing a microservices application on Google Cloud. Each service is deployed as a Docker container on Cloud Run. The development team wants to ensure that inter-service communication is encrypted and authenticated. What is the best approach?

Accepted Answer

Use Cloud Run's built-in IAM-based authentication and automatic TLS for internal requests.. Cloud Run automatically provisions TLS certificates for all incoming requests and supports IAM-based authentication for internal requests between services in the same Google Cloud project. This means inter-service communication is encrypted by default via HTTPS and can be authenticated by configuring the receiving service to require a valid IAM token from the caller, without any additional infrastructure or sidecar proxies.

Answer

Configure mutual TLS (mTLS) between services using Cloud Endpoints.

Answer

Deploy a sidecar proxy on each Cloud Run service to handle TLS termination.

Answer

Assign a service account to each service and use its private key to sign requests.

Question 6

A financial services company is architecting a multi-database solution. They need strong consistency across Cloud Spanner and Cloud SQL for a critical transaction flow. However, two-phase commit (2PC) across heterogeneous databases is not supported. Which pattern should they adopt to maintain data integrity?

Accepted Answer

Saga pattern with orchestration and compensating transactions. The Saga pattern with orchestration and compensating transactions is correct because it maintains data integrity across heterogeneous databases like Cloud Spanner and Cloud SQL without relying on distributed transactions (2PC). In this pattern, each local transaction commits independently, and if a subsequent transaction fails, a compensating transaction is executed to undo the previous committed changes, ensuring eventual consistency and business-level rollback.

Answer

Use Cloud Spanner change streams to sync data to Cloud SQL

Answer

Eventual consistency with conflict resolution

Answer

Migrate all data to Cloud Spanner to avoid cross-database transactions

Question 7

Match each Cloud SQL database engine to its description.

Accepted Answer

Cloud SQL for MySQL: Fully managed relational database based on MySQL community edition.. Cloud SQL offers managed relational databases; AlloyDB and Spanner are for higher scale.

Answer

Cloud SQL for MySQL: A globally distributed relational database with strong consistency.

Answer

Cloud SQL for PostgreSQL: A fully managed relational database compatible with PostgreSQL and designed for high-scale analytical workloads.

Question 8

You are a cloud architect at a financial services company. The company is deploying a new application on Google Kubernetes Engine (GKE) that processes sensitive financial transactions. The application must be highly available across two regions (us-central1 and europe-west1) and must fail over automatically if one region becomes unavailable. The application uses Cloud Spanner as its primary database. Additionally, the application needs to send audit logs to a centralized Cloud Storage bucket for compliance. The current design uses GKE clusters in each region with a global HTTP(S) load balancer. However, during a recent test, when the us-central1 cluster was deliberately taken down, the load balancer continued to send traffic to that region, causing errors. You need to troubleshoot and fix the issue. What is the most likely cause and the best solution?

Accepted Answer

The load balancer backend lacks a health check that marks the backend as unhealthy when the cluster is down. Solution: Configure a health check on the backend service that points to a readiness endpoint on the GKE cluster.. The issue is that the global HTTP(S) load balancer continues to send traffic to the us-central1 region because its backend service lacks a health check that can detect when the GKE cluster is down. By configuring a health check on the backend service that probes a readiness endpoint (e.g., /healthz) on the GKE cluster, the load balancer will automatically stop routing traffic to the unhealthy region and fail over to the healthy region. This ensures high availability across the two regions as required.

Answer

The load balancer is configured with only one backend service. Solution: Create a separate backend service for each region.

Answer

The Cloud Spanner instance is not configured with multi-region replication, causing write failures. Solution: Configure Cloud Spanner as a multi-region instance.

Answer

The GKE clusters are not configured as network endpoint groups (NEGs). Solution: Create NEGs for each cluster and use them as backends.

Question 9

An organization needs to secure Cloud SQL for MySQL instances. Which two measures should they implement to restrict network access? (Choose TWO.)

Accepted Answer

Enable SSL enforcement (require_ssl flag). Using Private IP restricts access to the VPC network, and enabling the 'require_ssl' flag ensures encrypted connections. IAM authentication controls user access but does not restrict network access. Public IP with authorized networks allows network access from authorized IP addresses but is still public. VPC Service Controls can restrict access, but the option is not listed; Private IP is the correct VPC-centric method.

Answer

Use IAM database authentication

Answer

Assign a public IP and configure authorized networks

Answer

Disable automatic storage increase

Question 10

An application running on Compute Engine generates structured logs. The operations team needs to parse a specific field from the logs and create a metric that counts occurrences of a particular value. They want the metric to be available for alerting with minimal delay. What should they do?

Accepted Answer

Create a log-based metric in Cloud Logging. Log-based metrics in Cloud Logging are designed to extract specific fields from structured logs and count occurrences of particular values with near-real-time latency, making them ideal for alerting with minimal delay. They are natively integrated with Cloud Monitoring, so the metric is automatically available for alerting policies without additional infrastructure or data movement.

Answer

Export logs to BigQuery and use scheduled queries

Answer

Write a Cloud Function to process logs from Pub/Sub

Answer

Use the Cloud Monitoring agent to collect logs

Question 11

A company is using Cloud Bigtable for a time-series workload. They want to monitor performance and identify hot spots. Which TWO Google Cloud tools or features should they use? (Choose 2.)

Accepted Answer

Key Visualiser. Key Visualizer is a Cloud Bigtable-specific tool that provides a heatmap of tablet server load, row key access patterns, and traffic distribution. It directly identifies hot spots by showing which row ranges are receiving disproportionate read/write activity, enabling targeted schema optimization.

Answer

Cloud Trace

Answer

Cloud Profiler

Answer

Cloud Logging

Question 12

A company is migrating an on-premises PostgreSQL database to Cloud SQL for PostgreSQL using Database Migration Service (DMS). They need to minimize downtime during the cutover. What should they do to achieve a zero-downtime cutover?

Accepted Answer

Create a continuous migration job, let it replicate changes, then promote the Cloud SQL replica to primary.. Database Migration Service (DMS) supports continuous migration jobs that use PostgreSQL logical replication to keep the Cloud SQL replica synchronized with the on-premises source. When you are ready to cut over, you promote the Cloud SQL replica to a standalone primary, which applies any remaining changes and makes the database available with minimal downtime — typically only seconds for the final replication lag to clear.

Answer

Set up VPC peering between on-premises and Cloud SQL, then use pg_dump and pg_restore.

Answer

Use Cloud SQL Auth Proxy to connect and manually copy data using a script.

Answer

Create a one-time migration job and stop the source database during the migration.

Question 13

An e-commerce platform uses Cloud Spanner for its inventory system. They notice that the processing units utilization is consistently above 90% during peak hours, causing increased read latency. They want to automatically scale capacity based on load. What should they configure?

Accepted Answer

Enable auto-scaling by setting min and max processing units with a high-priority CPU target. Cloud Spanner supports auto-scaling by configuring min and max processing units and a high-priority CPU target utilization. When utilization exceeds the target, Spanner automatically adds processing units up to the max. This is the correct approach.

Answer

Switch from processing units to nodes for better performance

Answer

Manually increase the number of nodes

Answer

Reduce the number of processing units to lower cost

Question 14

A company is using Cloud SQL for PostgreSQL and wants to ensure that all connections to the database use SSL/TLS. They have set the `require_ssl` flag but still see some connections using non-SSL. What is the most likely reason?

Accepted Answer

Existing connections that were established before the flag was enabled are still active.. The `require_ssl` flag only affects new connections; existing connections may continue without SSL until they are re-established. Restarting the instance forces all connections to reconnect with SSL. The flag does not require clients to connect via Auth Proxy. Old clients may not support SSL but the flag would block them, not allow non-SSL.

Answer

The application is using a database driver that does not support SSL.

Answer

The flag only applies to connections using the Cloud SQL Auth Proxy.

Answer

The flag must be configured in the database server parameters, not the Cloud SQL admin panel.

Question 15

Your team manages a serverless application deployed on Cloud Run. The application processes image uploads and stores metadata in Firestore. You have set up a Cloud Monitoring alert based on the 'request_count' metric for the Cloud Run service. The alert triggers when the request count exceeds 1000 requests per minute. Recently, the alert has been firing frequently, but the team notices that the application is performing well and there are no errors. The team is concerned about alert fatigue. You review the metric and notice that the request count metric is based on all HTTP requests, including health checks from the Cloud Run system. The health check requests account for about 30% of the total requests. What should you do to reduce unnecessary alerts while still monitoring real user traffic?

Accepted Answer

Create a new log-based metric that filters out health check requests, and use that in the alert. Creating a new log-based metric that filters out health check requests allows you to monitor only real user traffic. Cloud Run's system health checks (e.g., from the Cloud Run infrastructure) are included in the default 'request_count' metric, inflating the count. By using a log-based metric with a filter that excludes these health check requests, you can set an accurate alert threshold based on actual user demand, reducing alert fatigue without losing visibility into real issues.

Answer

Increase the alert threshold to 1500 requests per minute

Answer

Disable health checks on the Cloud Run service

Answer

Configure the existing metric to exclude health check logs