PCD Practice Test 48 — 15 Questions

Question 1

A startup runs a stateless containerized API on Cloud Run. Traffic is unpredictable and can spike from zero to thousands of requests per second within seconds. The team wants the service to scale out rapidly while keeping cold starts low. Which Cloud Run configuration should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the minimum number of instances to a value greater than zero and configure CPU to be always allocated.. Cloud Run scales to zero by default, which introduces cold starts when traffic resumes. Setting a minimum instance count above zero keeps a pool of warm instances ready, and allocating CPU always ensures those instances remain responsive. Together they provide fast response during sudden traffic spikes while the platform scales out additional instances as needed.

Answer

Enable CPU throttling outside of request processing and set the minimum instances to zero.

Answer

Set the maximum number of instances to a high value and rely on the default CPU allocation.

Answer

Deploy the service with a concurrency setting of one request per instance.

Question 2

A company uses Cloud Build to build and deploy a containerized application to Google Kubernetes Engine (GKE). They want to ensure that the build process can push images to Artifact Registry and deploy to GKE without storing long-lived credentials. What should they do?

Accepted Answer

Configure the Cloud Build trigger to use a user-specified service account that has the Artifact Registry Writer and Kubernetes Engine Developer roles.. The secure and recommended approach is to configure Cloud Build to use a user-specified service account that has the necessary IAM roles: Artifact Registry Writer to push images and Kubernetes Engine Developer to deploy to GKE. This leverages short-lived credentials managed by Google Cloud, eliminating the need for long-lived keys. It also adheres to least privilege by granting only the required roles. This method integrates seamlessly with Cloud Build triggers and is the standard practice for CI/CD on Google Cloud.

Answer

Embed the credentials in the Docker image and use them during deployment to GKE.

Answer

Create a service account key and store it in Cloud Key Management Service (KMS), then reference it in the Cloud Build configuration.

Answer

Use the default Cloud Build service account and grant it the Editor role at the project level.

Question 3

A healthcare company is building a patient portal on Google Cloud. The application must be highly available and able to scale automatically. They expect unpredictable traffic patterns. The application uses a stateless frontend and a Cloud SQL for PostgreSQL database. They want to minimize operational overhead. What should they do?

Accepted Answer

Deploy the frontend on Cloud Run, and configure Cloud SQL with a regional instance and automatic storage increase.. Cloud Run is a fully managed platform that automatically scales stateless containers, eliminating infrastructure management. A regional Cloud SQL instance provides high availability with automatic failover, and automatic storage increase prevents storage issues. This pairing meets the requirements for high availability, automatic scaling, and minimal operational overhead.

Answer

Deploy the frontend on a regional managed instance group with autoscaling, and use Cloud SQL with a single zone instance.

Answer

Deploy the frontend on GKE Autopilot, and use Cloud SQL with a read replica in another region.

Answer

Deploy the frontend on Compute Engine instances in a zonal MIG, and use Cloud SQL with a regional instance.

Question 4

A developer is writing a Cloud Function in Node.js that is triggered by a Cloud Storage finalize event. The function needs to read the uploaded file and write a transformed version to another bucket. The developer wants to minimize latency and cost. Which approach should the developer take to access the file?

Accepted Answer

Use the Cloud Storage client library to download the file to a temporary directory, process it, and upload the result to the destination bucket.. Cloud Functions provides a writable /tmp directory. The developer should download the file from Cloud Storage to /tmp using the client library, process it, and upload the result. This approach is simple, reliable, and works within the constraints of the Cloud Functions environment.

Answer

Mount the source bucket as a file system in the Cloud Function using Cloud Storage FUSE, then read and write files directly.

Answer

Configure the function to receive the file content in the event payload and process it without additional API calls.

Answer

Use the Cloud Storage API to stream the file directly from the source bucket to the destination bucket, applying transformations on the fly.

Question 5

Your team runs a Cloud Run service that must access a Cloud SQL for PostgreSQL instance. Security policy prohibits public IPs and requires IAM-based authentication. You have created the Cloud SQL instance with a private IP and enabled the Cloud SQL Admin API. You need to configure the Cloud Run service to connect. What should you do?

Accepted Answer

In the Cloud Run service configuration, add a Cloud SQL connection to the instance and use the Unix socket path /cloudsql/INSTANCE_CONNECTION_NAME in the connection string.. Cloud Run's built-in Cloud SQL integration automatically provisions the Cloud SQL Auth Proxy and exposes a Unix socket. By adding the connection in the service configuration and using the socket path, the application benefits from IAM-based authentication and private connectivity without managing proxies or VPNs. This meets the security policy and is the standard method.

Answer

Configure the Cloud Run service to use a Serverless VPC Access connector and connect directly to the Cloud SQL private IP on port 5432.

Answer

Create a Cloud VPN tunnel between the Cloud Run service and the Cloud SQL instance, then connect using the instance's private IP.

Answer

Mount Cloud SQL Auth Proxy as a sidecar container in the Cloud Run service and configure the application to connect to localhost:5432.

Question 6

You are deploying a Python application to App Engine flexible environment. The application requires a custom runtime with specific system packages. You need to ensure that the deployment includes these packages. What should you do?

Accepted Answer

Create a custom runtime by providing a Dockerfile that installs the necessary system packages and sets up the application.. App Engine flexible environment allows custom runtimes through a Dockerfile. By writing a Dockerfile, you can install any system packages using the package manager of the base image. The Dockerfile is used to build the container image during deployment. This approach provides the flexibility needed for custom system dependencies while still leveraging App Engine's managed infrastructure.

Answer

Use the standard Python runtime and include a `requirements.txt` file to install the packages.

Answer

Include a `app.yaml` file with a `system_packages` section listing the required packages.

Answer

Use the `gcloud app deploy` command with the `--install-packages` flag to specify the system packages to install.

Question 7

A developer is writing unit tests for a Cloud Function written in Node.js that publishes a message to Pub/Sub. They want to test the function logic without actually publishing to Pub/Sub. Which approach should they take?

Accepted Answer

Inject a mock Pub/Sub client into the function and assert that the publish method is called with the expected arguments.. For unit testing a Cloud Function that publishes to Pub/Sub, mocking the Pub/Sub client is the best practice. It allows the test to verify that the function calls the publish method with the correct parameters without actually sending messages to Pub/Sub. This keeps tests fast, isolated, and reliable, and avoids dependencies on external services or emulators.

Answer

Use the Pub/Sub emulator and set the PUBSUB_EMULATOR_HOST environment variable.

Answer

Use the Pub/Sub REST API with a service account key to publish a test message.

Answer

Deploy the function to a test project and trigger it with a test message, then check Pub/Sub logs.

Question 8

A company is building a microservices application on Cloud Run. They want to ensure that if a downstream service becomes unavailable, the upstream service does not overwhelm it with retries. Which pattern should they implement to handle transient failures gracefully and prevent cascading failures?

Accepted Answer

Circuit breaker pattern. The circuit breaker pattern monitors for failures and, when a threshold is reached, opens the circuit to stop further requests to the failing service. This gives the downstream service time to recover and prevents the upstream service from wasting resources on doomed requests. It is the standard pattern for preventing cascading failures in microservices.

Answer

Retry with exponential backoff

Answer

Timeout and bulkhead pattern

Answer

Load balancing with round-robin

Question 9

A financial services company runs a Python service on Cloud Run that writes transaction records to Cloud Spanner. During a regional outage in us-central1, the service in us-east1 continues to serve reads but writes fail with 'Session not found' errors after about 10 minutes. The Spanner instance is configured as a regional instance in us-central1. What should the company do to make writes survive a regional outage with minimal application changes?

Accepted Answer

Recreate the Spanner instance as a multi-region instance with a configuration that includes us-central1 and us-east1, and update the application to use the new instance ID.. Cloud Spanner regional instances keep all replicas and the leader in one region, so a regional outage stops writes. A multi-region instance replicates across regions and automatically elects a new leader in a surviving region, providing write availability with no application-level failover logic. Changing the instance configuration and updating the connection string is the only application change required.

Answer

Add a read replica in us-east1 and configure the application to write to the replica when the primary is unavailable.

Answer

Configure the Cloud Run service to retry failed writes using exponential backoff and a longer session timeout.

Answer

Increase the Spanner instance's node count and enable automatic scaling to handle the failover traffic.

Question 10

A developer is writing a Cloud Run service that receives Pub/Sub push messages. The service must verify that incoming requests genuinely originate from Pub/Sub before processing the message. The developer wants to implement this verification in code. Which approach should they use?

Accepted Answer

Validate the OIDC JWT in the Authorization header against Google's public keys, checking the email claim equals the service account used by the Pub/Sub subscription.. Pub/Sub push subscriptions configured with authentication send an OIDC JWT in the Authorization header. Verifying the signature against Google's public keys and checking that the email claim matches the service account bound to the subscription is the supported way to confirm authenticity. This prevents unauthorized clients from injecting messages into the service.

Answer

Compare the source IP address of the request against the published list of Google Cloud Pub/Sub egress ranges.

Answer

Check that the request contains a custom header X-Goog-PubSub-Secret with a value configured in the subscription.

Answer

Verify the message payload signature using the HMAC key associated with the Pub/Sub topic.

Question 11

A financial services firm runs a Java service on GKE Standard. The service holds in-memory session state and must survive a zonal failure without losing sessions. The team wants the application to remain available if a single zone becomes unavailable. Which design should they implement?

Accepted Answer

Deploy the service as a Deployment spread across zones, and externalize session state to a highly available store such as Memorystore for Redis with a replica in another zone.. Surviving a zonal failure requires both compute redundancy across zones and session data that does not live only in a pod's memory. A multi-zone Deployment keeps serving replicas available, while a replicated Memorystore for Redis instance stores sessions outside the pods, so a client can be routed to a surviving replica and still find its session. Together these provide continuity without relying on any single zone.

Answer

Deploy the service as a DaemonSet so that one pod runs on every node in the cluster, ensuring coverage across all zones.

Answer

Deploy the service as a StatefulSet with a PersistentVolumeClaim per replica, and pin each replica to a specific zone using node affinities.

Answer

Deploy the service as a Deployment with a single replica and configure a PodDisruptionBudget to prevent eviction during maintenance.

Question 12

A developer is building a Cloud Run service that publishes messages to Pub/Sub. The developer wants to write unit tests that verify the service publishes the correct message when a specific endpoint is called. The tests must not depend on network access. Which two actions should the developer take? (Choose two.)

Accepted Answer

Use the unittest.mock library to patch the publish method of the Pub/Sub client and assert that it was called with the expected message.. To test the publishing logic without network access, the developer can either abstract the publishing behind an interface and inject a mock, or patch the publish method directly with unittest.mock. Both approaches allow the test to verify that the correct message is published while keeping the test fast and isolated. The choice between them depends on the code structure; if the code uses an interface, injecting a mock is natural, while patching is convenient when the code directly uses the client library.

Answer

Use the Pub/Sub emulator by setting the PUBSUB_EMULATOR_HOST environment variable and starting the emulator before running tests.

Answer

Use the google-cloud-pubsub client library's built-in test mode by setting the PUBSUB_TEST_MODE environment variable to true.

Answer

Create a test topic in Pub/Sub and configure the service to publish to that topic during tests.

Question 13

A media company runs a video transcoding pipeline on Google Kubernetes Engine. The pipeline uses a Deployment with pods that pull jobs from a Pub/Sub subscription and write output to Cloud Storage. During a node upgrade, several pods are terminated mid-transcode, and jobs are lost. The team wants terminated pods to finish their current job before shutdown, up to a bounded time. What should they do?

Accepted Answer

Set the pod's terminationGracePeriodSeconds to a value larger than the longest transcode and handle SIGTERM in the application to stop fetching new messages, finish the current job, acknowledge the message, then exit.. Graceful termination on Kubernetes depends on the application reacting to SIGTERM and on the pod having enough time to finish. Handling SIGTERM lets the worker stop fetching new messages and complete the current transcode, while a terminationGracePeriodSeconds longer than the longest job gives it room to acknowledge and exit. Together these prevent job loss during node upgrades.

Answer

Configure the Deployment with a PodDisruptionBudget of maxUnavailable: 0 and rely on it to prevent pod termination during node upgrades.

Answer

Add a preStop lifecycle hook that sleeps for the maximum transcode duration and increase the terminationGracePeriodSeconds on the pod spec to match.

Answer

Change the workload from a Deployment to a DaemonSet so that one pod runs per node and is not evicted during upgrades.

Question 14

Your team maintains a Java service on App Engine standard. A new library requires a native binary that the standard runtime does not include, and you must keep using app.yaml for configuration. You need the smallest deployment change that lets the native binary run. What should you do?

Accepted Answer

Deploy the service to App Engine flexible environment with a custom runtime and a Dockerfile that installs the native binary.. The native binary needs an environment where you control the OS packages and can install shared libraries. App Engine flexible environment with a custom runtime provides that control through a Dockerfile while preserving app.yaml-based configuration. The other approaches assume the standard sandbox can host arbitrary native code, which it cannot, so they fail to satisfy the dependency.

Answer

Add the native binary as a static file in the app directory and reference it from app.yaml using the handlers section.

Answer

Package the native binary inside a JAR and load it at runtime using System.loadLibrary from a Java servlet.

Answer

Switch the service to the Java 17 standard runtime and add the binary to the CLASSPATH environment variable in app.yaml.

Question 15

A company is developing a mobile app backend using Firebase Authentication. They want to allow users to sign in with their existing Google accounts and also with email/password. The backend is hosted on Cloud Run and must verify the Firebase ID token on each API request. Which approach should the developer use to validate the token?

Accepted Answer

Use the Firebase Admin SDK to call verifyIdToken() with the ID token from the Authorization header.. The Firebase Admin SDK provides a robust verifyIdToken() method that validates the token's signature, issuer, audience, and expiration. It is the recommended way to authenticate requests to a backend. Other options either skip signature verification, use an inappropriate API, or introduce unnecessary complexity without security benefits.

Answer

Decode the JWT payload and check the email domain against an allowlist.

Answer

Send the ID token to the Firebase Authentication REST API endpoint /v1/accounts:lookup to validate it.

Answer

Store the ID token in Cloud Secret Manager and retrieve it for each request to compare against the incoming token.