PCD Practice Test 49 — 15 Questions

Question 1

A developer is deploying a Cloud Function (2nd gen) that is triggered by an Eventarc event from Cloud Storage. The function is written in Python and uses the functions-framework to handle events. During local testing with the Functions Framework, the developer wants to simulate a Cloud Storage event. Which method should they use to invoke the function locally?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Send a POST request to the local Functions Framework endpoint with a JSON body that mimics the Cloud Storage event payload.. The Functions Framework for Python exposes an HTTP endpoint that can receive events. For CloudEvent functions, you can send a POST request with a CloudEvent-formatted JSON body. This mimics the event that Eventarc would deliver. The developer can craft a payload representing a Cloud Storage object finalize event and send it using curl or a similar tool. This approach tests the function's event handling logic locally without deploying.

Answer

Publish a message to a local Pub/Sub emulator and configure the function to subscribe to it.

Answer

Use the Cloud Storage emulator to trigger the function by uploading a file to a local bucket.

Answer

Use the gcloud functions call command with the --data flag to send a test event to the local function.

Question 2

You are deploying a Java application to Google Kubernetes Engine (GKE) using a Deployment. The application requires a configuration file that contains sensitive credentials. You want to store the credentials securely in Google Cloud and make them available to the application as a file system mount. You also want to ensure that the credentials are automatically updated in the running pods when they are rotated. Which approach should you use?

Accepted Answer

Use the Secret Manager CSI driver to mount the secret as a volume in the pod.. The Secret Manager CSI driver is designed to mount secrets from Secret Manager as volumes in GKE pods and supports automatic rotation. It provides a secure way to store credentials in Google Cloud and have them updated in running pods without redeployment. Other options either lack automatic rotation or are not secure for sensitive data.

Answer

Use the Cloud SQL Auth Proxy sidecar to inject the credentials as environment variables.

Answer

Create a Kubernetes Secret with the credentials and mount it as a volume in the pod spec.

Answer

Store the credentials in a ConfigMap and mount it as a volume.

Question 3

A developer is building a Node.js service that will run on Cloud Run. The application reads configuration from environment variables at startup. To test the container locally exactly as it will run in production, including the same environment variables and port, which command should the developer use after building the image with `docker build -t my-service .`?

Accepted Answer

docker run --rm -p 8080:8080 -e PORT=8080 -e NODE_ENV=production my-service. Cloud Run injects a PORT environment variable (default 8080) and expects the container to listen on that port. To test locally as in production, the developer must run the container with the same PORT value and map that port to the host. Setting NODE_ENV to production further aligns the local run with production behavior. Using docker run with the appropriate -e flags achieves this.

Answer

docker-compose up --build

Answer

gcloud run deploy my-service --source . --port 8080 --set-env-vars NODE_ENV=production

Answer

docker run --rm -p 3000:3000 -e PORT=3000 my-service

Question 4

A financial services company runs a portfolio management application on GKE Autopilot. The application must remain available even if an entire zone in a region goes offline. The team wants to minimize manual intervention and ensure that pods are automatically rescheduled when a zone fails. Which configuration should they implement?

Accepted Answer

Create a regional GKE cluster with a node pool spanning multiple zones and use topology spread constraints to distribute pods evenly across zones.. A regional GKE cluster with a multi-zone node pool and topology spread constraints ensures that pods are evenly distributed across zones. If one zone fails, the remaining pods continue to serve traffic, and Kubernetes automatically reschedules pods onto healthy nodes. This design provides high availability without manual intervention.

Answer

Deploy the application on a single-zone GKE cluster with high-availability control plane and use a Horizontal Pod Autoscaler to scale replicas during zone outages.

Answer

Configure a node pool with nodes spread across multiple zones and set pod anti-affinity rules to avoid scheduling multiple replicas on the same node.

Answer

Use a managed instance group of Compute Engine instances with an autoscaler and deploy the application directly on VMs, then configure a global load balancer.

Question 5

You manage a Cloud Run service that receives bursty traffic. You want to minimize cold starts while keeping costs predictable. The service has a container startup time of about 8 seconds. You need to ensure that at least two instances are always running and ready to serve requests. What should you do?

Accepted Answer

Set the minimum instance count to 2 using `gcloud run deploy --min-instances=2`.. To ensure a minimum number of instances are always running, you must set the minimum instance count. Cloud Run's min-instances parameter keeps the specified number of instances warm, avoiding cold starts. Other options either limit scaling, control concurrency, or use external triggers that do not provide the same guarantee.

Answer

Configure a Cloud Run service with a concurrency setting of 2 and deploy.

Answer

Use a Cloud Scheduler job to send a request to the service every minute.

Answer

Set the maximum instance count to 2 and enable CPU always allocated.

Question 6

A retail company runs an application on Google Kubernetes Engine (GKE) that reads from a Cloud SQL for PostgreSQL instance. The security team requires that database traffic never traverse the public internet and that the database have no public IP. The GKE cluster is VPC-native and runs in the same VPC as the Cloud SQL instance. Which connection method should the application use?

Accepted Answer

Connect using the Cloud SQL Auth Proxy sidecar, which authenticates with IAM and connects over the instance's private IP.. Private IP connectivity keeps database traffic on Google's internal network. The Cloud SQL Auth Proxy adds IAM-based authentication and encryption without managing SSL certificates manually. Running it as a sidecar in the GKE pod means the application connects to localhost, and the proxy securely tunnels to the instance's private IP. This combination satisfies both the no-public-IP and no-public-internet constraints while providing strong identity controls.

Answer

Connect directly to the instance's public IP and rely on Cloud SQL's built-in SSL enforcement for encryption.

Answer

Configure the application to use the Cloud SQL Connector for Java, which establishes a direct TCP connection using the instance's public IP and IAM database authentication.

Answer

Use a Cloud VPN tunnel from the GKE cluster to a remote network that forwards traffic to the Cloud SQL public endpoint.

Question 7

A developer is deploying a new version of a service to Cloud Run. They want to gradually shift traffic to the new revision while monitoring for errors. They also want to be able to roll back quickly if issues arise. What should they do?

Accepted Answer

Deploy the new revision with no traffic, then use gradual traffic migration to shift a percentage of traffic to the new revision.. Cloud Run allows you to deploy a new revision without sending it traffic. You can then gradually shift traffic to the new revision using the traffic migration feature. This enables canary deployments where you can monitor the new revision's performance and error rates. If issues arise, you can quickly shift traffic back to the previous revision. This approach minimizes risk and downtime, and is the recommended way to perform gradual rollouts on Cloud Run.

Answer

Create a new Cloud Run service for the new version and use a load balancer to split traffic between the two services.

Answer

Deploy the new revision and immediately send all traffic to it, then monitor and roll back if errors occur.

Answer

Use Cloud Build to deploy the new revision and configure a Pub/Sub trigger to automatically roll back on errors.

Question 8

A developer is building a Cloud Run service that reads messages from a Pub/Sub subscription. During local testing with the Pub/Sub emulator, the service must connect to the emulator instead of the production Pub/Sub service. The developer wants to avoid code changes between local and production environments. What should the developer do to configure the Pub/Sub client library to use the emulator?

Accepted Answer

Set the PUBSUB_EMULATOR_HOST environment variable to the emulator's host and port before starting the application.. The Pub/Sub emulator is designed to be used by setting the PUBSUB_EMULATOR_HOST environment variable, which the client libraries read automatically. This enables seamless switching between local and production environments without code modifications. Other methods either require code changes or misconfigure authentication, failing to meet the requirement.

Answer

Create a service account key for the emulator and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to it.

Answer

Configure the Pub/Sub client with a custom endpoint by passing the emulator's address to the PublisherClient and SubscriberClient constructors.

Answer

Modify the application code to conditionally create the Pub/Sub client with a different project ID when running locally.

Question 9

A developer is deploying a Go application to App Engine standard environment. The application needs to read a configuration value that varies by environment (e.g., `dev`, `staging`, `prod`). The developer wants to avoid hardcoding the value in source code. Which approach is recommended?

Accepted Answer

Define the value in `app.yaml` under `env_variables` and access it via `os.Getenv` in the Go code.. The recommended way to provide environment-specific configuration to an App Engine standard app without hardcoding is to use the `env_variables` section in `app.yaml`. These variables are set during deployment and accessible via standard environment variable APIs. This decouples configuration from code and supports different values per environment by maintaining separate `app.yaml` files or using deployment pipelines.

Answer

Hardcode the value in a Go constant and use build tags to select the correct one.

Answer

Use the App Engine Admin API to fetch the value from the application's settings at runtime.

Answer

Store the value in a local `config.json` file and parse it at runtime.

Question 10

A developer is building a Go application that will be deployed to App Engine standard environment. They want to run the application locally with the same runtime behavior as production, including access to Cloud Firestore and Pub/Sub emulators. Which approach should they use?

Accepted Answer

Run the application using the standard Go toolchain (go run) and configure the Cloud Firestore and Pub/Sub client libraries to connect to the emulators via environment variables.. For modern App Engine standard runtimes, local development uses the native language toolchain (like go run). The Cloud Firestore and Pub/Sub emulators provide local implementations of these services. By setting environment variables such as FIRESTORE_EMULATOR_HOST and PUBSUB_EMULATOR_HOST, the application's client libraries automatically connect to the emulators, enabling testing without affecting production data.

Answer

Use the gcloud app run command to start a local emulator that automatically configures all Google Cloud services used by the application.

Answer

Use the App Engine standard local development server (dev_appserver.py) with the --support_datastore_emulator flag and set environment variables to point to the emulators.

Answer

Deploy the application to a separate App Engine service in the same project but with a different version, and use that version for testing before promoting to production.

Question 11

You are building a Cloud Run service that needs to access a third-party API. The API key must be stored securely and rotated regularly without redeploying the service. You want to minimize the risk of the key being exposed in logs or source code. What should you do?

Accepted Answer

Store the API key in Secret Manager and mount it as a volume in the Cloud Run service.. Secret Manager is designed for secure secret storage with versioning and IAM access control. Mounting the secret as a volume in Cloud Run makes it available as a file, keeping it out of environment variables and source code. Rotation can be done by adding a new version, and Cloud Run can be configured to use the latest version, avoiding redeployment.

Answer

Embed the API key in the container image as a file and read it at runtime.

Answer

Set the API key as an environment variable in the Cloud Run service configuration.

Answer

Store the API key in a Cloud Storage bucket and have the service download it at startup.

Question 12

An application running on Compute Engine needs to read objects from a Cloud Storage bucket in the same project. The team wants the VM to authenticate to the Cloud Storage API without distributing credentials and with the least privilege. What should they do?

Accepted Answer

Attach a user-managed service account with the Storage Object Viewer role to the VM and let the metadata server provide tokens.. Attaching a dedicated service account gives the VM an automatic, rotating identity through the metadata server, and scoping it to Storage Object Viewer keeps access limited to reading objects. No key files are needed, satisfying both the no-distributed-credentials and least-privilege requirements.

Answer

Enable Cloud Storage's uniform bucket-level access and set the VM's public IP as an allowed network source.

Answer

Create a service account key file and store it on the VM's persistent disk with restrictive file permissions.

Answer

Grant the Compute Engine default service account the Editor role at the project level so the VM can access the bucket.

Question 13

A developer is writing a Cloud Function in Python that is triggered by HTTP. They want to test the function locally using the Functions Framework. Which command should they run to start the local server on port 8080?

Accepted Answer

functions-framework --target=my_function --port=8080. The Functions Framework for Python provides a command-line tool called functions-framework. To run a function locally, you specify the target function name and the port. This starts an HTTP server that invokes the function on each request. This is the recommended approach for local development and testing of HTTP-triggered Cloud Functions.

Answer

docker run -p 8080:8080 my-function-image

Answer

python -m functions_framework --target=my_function --port=8080

Answer

gcloud functions deploy my_function --runtime python39 --trigger-http --port 8080

Question 14

A media company is designing a highly available video transcoding pipeline on Google Cloud. Jobs are submitted to a Pub/Sub topic, and workers run on GKE. They need the pipeline to continue processing if a single zone fails and to avoid losing messages if a worker crashes mid-job. Which TWO design choices should they implement? (Choose two.)

Accepted Answer

Deploy the GKE worker Deployment across multiple zones using a regional cluster and topology spread constraints.. High availability for the pipeline requires workers to survive a zone failure and messages to survive worker crashes. Spreading the worker Deployment across zones in a regional cluster keeps processing alive during a zone outage, and acknowledging only after successful completion lets Pub/Sub redeliver unacknowledged messages to healthy workers. Short retention, immediate acknowledgment, and single-zone deployment all undermine these goals.

Answer

Use a single-zone GKE cluster with a high number of worker replicas to maximize in-zone throughput.

Answer

Configure the worker pods to acknowledge messages immediately upon receipt to reduce duplicate processing.

Answer

Set the Pub/Sub subscription's message retention duration to the minimum allowed value.

Question 15

A financial services company stores customer data in Cloud SQL for MySQL. The security team mandates that all data at rest be encrypted with keys managed in Cloud KMS, and keys must be rotated every 90 days. The application team uses a CI/CD pipeline to deploy the Cloud SQL instance via Terraform. Which configuration should the team use to meet the encryption requirement?

Accepted Answer

Create a Cloud KMS key ring and crypto key, then configure the Cloud SQL instance with a CMEK referencing that key.. Using a customer-managed encryption key (CMEK) from Cloud KMS gives the organization full control over the key's lifecycle, including the ability to set a 90-day rotation policy. This satisfies the security team's mandate for customer-managed encryption and regular rotation. Google-managed keys do not offer this control, and EKM is unnecessary for this use case. The correct approach is to create a KMS key and reference it in the Cloud SQL instance configuration.

Answer

Use a Cloud External Key Manager (EKM) backed by a third-party HSM to encrypt the Cloud SQL instance.

Answer

Enable default encryption at rest and use IAM conditions to restrict key access to the security team.

Answer

Enable Google-managed encryption and schedule automatic key rotation through Cloud KMS.