PCD Practice Exam 53 — 20 Questions

Question 1

A company is migrating an on-premises PostgreSQL database to Cloud SQL. They need to ensure minimal downtime and continuous replication during the migration. Which approach should they use?

Accepted Answer

Use Database Migration Service with continuous replication.. Database Migration Service (DMS) supports continuous replication from source to Cloud SQL using native PostgreSQL replication (logical replication). It minimizes downtime. Import/export involves downtime. Creating a read replica from on-prem is not directly supported. Cloud SQL does not support cross-region replicas from on-prem.

Answer

Use a cross-region replica from an existing Cloud SQL instance.

Answer

Export the database using pg_dump and import into Cloud SQL.

Answer

Create a Cloud SQL read replica of the on-premises database.

Question 2

Which TWO statements about building container images for Google Cloud Run are correct? (Choose TWO.)

Accepted Answer

The container must respond to health checks on the same port as the main application.. Cloud Run requires the container to respond to health checks (e.g., HTTP GET /health) on the same port as the main application. Cloud Run uses the same port for both user requests and health check probes; if the health check fails, the container is restarted. This ensures the container is always ready to serve traffic.

Answer

The container must use HTTP/1.1; HTTP/2 is not supported.

Answer

The container must listen on port 8080 by default.

Answer

The container must run as root user.

Question 3

A developer is troubleshooting a deployment on Cloud Run. The service fails with 'Container failed to start' error. The container image is built from a Dockerfile that uses CMD ['npm', 'start']. What is the most likely cause?

Accepted Answer

The application does not listen on the port specified by the PORT environment variable.. Cloud Run requires the containerized application to listen on the port specified by the PORT environment variable (default 8080). If the application is hardcoded to listen on a different port (e.g., 3000) or does not read the PORT variable, Cloud Run's health checks and routing will fail, resulting in a 'Container failed to start' error. The CMD instruction is correct for starting npm, but the application must bind to the correct port.

Answer

The Dockerfile uses CMD instead of ENTRYPOINT.

Answer

The container image is too large and exceeds the memory limit.

Answer

The Cloud Run service does not have permission to pull the image from Container Registry.

Question 4

A company is using Database Migration Service to migrate an on-premises PostgreSQL database to Cloud SQL for PostgreSQL. The source database is behind a firewall that does not allow direct connections from Google Cloud. What connectivity option should they use?

Accepted Answer

Use Cloud SQL Auth Proxy on a machine in the source network.. Cloud SQL Auth Proxy provides a secure tunnel and can be run on the source network to connect to Cloud SQL. VPC peering requires direct network connectivity, which may not be possible through a firewall.

Answer

Use a Cloud VPN tunnel to connect the on-premises network to Google Cloud.

Answer

Set up VPC peering between the on-premises network and Google Cloud.

Answer

Configure a public IP for Cloud SQL and whitelist the source IP.

Question 5

A company uses Cloud Build to build Docker images and push them to Artifact Registry. They want to ensure that only images built from a specific Cloud Build trigger are deployed to production. Which combination of steps should they implement?

Accepted Answer

Configure Binary Authorization with a policy requiring attestation from Cloud Build. Binary Authorization enforces deployment-time policies that require images to have a valid attestation from an approved authority. By configuring Cloud Build to create an attestation for images built from the specific trigger, and setting a Binary Authorization policy that requires that attestation, only those attested images can be deployed to production. This directly ensures that only images from that trigger are used.

Answer

Configure IAM roles to restrict push access to Artifact Registry

Answer

Use Cloud Deploy with a manual approval gate

Answer

Use Cloud Build's built-in approval mechanism

Question 6

A company uses Cloud Build for CI/CD. They need to deploy a containerized app to Cloud Run automatically on every push to the main branch. Which Cloud Build configuration step is necessary?

Accepted Answer

Add a step to run 'gcloud run deploy' command.. Cloud Build requires an explicit step to run the `gcloud run deploy` command in order to trigger a deployment to Cloud Run. While Cloud Build can build and push images, it does not automatically deploy to Cloud Run unless a deploy step is included in the build configuration. This step uses the built image (from Artifact Registry) and deploys it as a new revision to the specified Cloud Run service.

Answer

Add a step to build the container with Dockerfile.

Answer

Add a step to push the image to Artifact Registry only.

Answer

Add a step to run unit tests.

Question 7

A company wants to use BigQuery to query data stored in AWS S3 without copying it to Google Cloud. Which Google Cloud feature should they use?

Accepted Answer

BigQuery Omni. BigQuery Omni enables querying data in S3 and Azure Blob Storage using a multi-cloud analytics approach.

Answer

Cloud Datastream

Answer

Cloud Storage FUSE

Answer

BigQuery transfers

Question 8

A DevOps team wants to set up custom metrics for a serverless application running on Cloud Run. The application emits metrics using OpenTelemetry. They need to collect these metrics and create an alerting policy that triggers when the 99th percentile latency exceeds 500ms for 5 minutes. Which TWO actions must they take? (Choose two.)

Accepted Answer

Create a custom distribution metric for the latency data and set up a metric threshold alert using the 99th percentile value.. To alert on the 99th percentile of latency, you must create a custom distribution metric, which stores a histogram of values and allows percentile calculations. A metric-threshold alert policy can then be configured to evaluate the 99th percentile value against the 500ms threshold over a 5-minute window.

Answer

Install the Cloud Monitoring agent on the Cloud Run instance to collect custom metrics.

Answer

Define a log-based metric from the application logs that captures latency entries.

Answer

Configure the Cloud Monitoring dashboard to query the metrics using PromQL.

Question 9

A developer runs the command shown in the exhibit. They need to ensure that the application running on instance-3 can be restored quickly if it fails. What should they do?

Accepted Answer

Create a managed instance group using an instance template based on instance-3's boot disk.. A managed instance group (MIG) with an instance template based on instance-3's boot disk provides automated health checking, auto-healing, and managed instance replacement. If instance-3 fails, the MIG automatically recreates it from the template, ensuring rapid restoration without manual intervention. This aligns with the goal of designing highly available and reliable applications on Google Cloud.

Answer

Add instance-3 to an unmanaged instance group.

Answer

Configure Cloud DNS with a health check pointing to instance-3.

Answer

Take a snapshot of instance-3's disk and use it to create a new instance manually.

Question 10

A company is deploying a static website on Cloud Storage with a custom domain. They want to serve the website over HTTPS. They have created a bucket with the same name as the domain and uploaded the files. They have verified the domain ownership in Search Console and added the bucket as a CNAME record in their DNS. Users report that when they navigate to the domain, they get a 404 error. The company has verified that the bucket's main page suffix is set to index.html. The team is confident the files are uploaded correctly. They need to resolve the 404 error and serve the site over HTTPS. What should they do?

Accepted Answer

Create a Cloud Load Balancer with the bucket as backend and update DNS.. To serve a static website hosted on Cloud Storage with a custom domain over HTTPS, you must configure an external HTTP(S) load balancer with the bucket as the backend. The load balancer handles SSL termination and provides a static IP address or hostname. You then update your DNS to point the custom domain to the load balancer's IP (using an A record) or to the load balancer's hostname. Option B is incorrect because a DNS A record pointing directly to a load balancer IP still requires the load balancer; the CNAME is not the issue. Option C is incorrect because Cloud CDN alone does not enable HTTPS for a custom domain; it requires a load balancer or other origin. Option D is incorrect because making objects publicly readable does not provide HTTPS support; the bucket's static website feature only supports HTTP.

Answer

Add a DNS A record pointing to the load balancer IP instead of a CNAME.

Answer

Enable Cloud CDN on the bucket.

Answer

Set the bucket's default object ACL to public read.

Question 11

You are configuring a Cloud Monitoring alerting policy for a Cloud Run service. The service has a maximum of 10 concurrent requests per instance. You want to be alerted when the average number of concurrent requests per instance exceeds 8 for at least 1 minute. Which metric and condition type should you use?

Accepted Answer

Metric: run.googleapis.com/request_count, Condition type: Metric Threshold, Threshold: >8. The `run.googleapis.com/request_count` metric tracks the number of concurrent requests per instance, which directly matches the requirement. A Metric Threshold condition with a threshold of >8 triggers an alert when the average exceeds 8 for at least 1 minute, aligning with the specified criteria.

Answer

Metric: run.googleapis.com/request_count, Condition type: Metric Absence, Duration: 1 min

Answer

Metric: resource/container/cpu/utilization, Condition type: Metric Threshold, Threshold: >80%

Answer

Metric: run.googleapis.com/request_count, Condition type: Change Rate, Threshold: >0.5

Question 12

A company is using Cloud Monitoring to set up an SLO for a latency-sensitive API. They have defined a custom SLI: the proportion of requests with latency under 200ms. Which three components must they define to create a complete SLO configuration? (Choose three.)

Accepted Answer

A target (e.g., 99.9%). A target (e.g., 99.9%) defines the desired proportion of good events over a compliance window, which is essential for an SLO. In Cloud Monitoring, the target is the threshold against which the SLI is measured to determine if the SLO is met.

Answer

A burn rate alert policy

Answer

A metric threshold alert

Question 13

A developer needs to test a Cloud Function locally before deploying. Which tool should they use?

Accepted Answer

Functions Framework for your language.. The Functions Framework is the correct tool because it is an open-source library that allows you to run Cloud Functions locally on your machine, emulating the Cloud Functions runtime environment. This enables you to test your function's behavior, including HTTP triggers and event handling, without deploying to Google Cloud. Option D is correct because the Functions Framework is specifically designed for local development and testing of Cloud Functions.

Answer

Docker container with a custom entrypoint.

Answer

gcloud functions call command.

Answer

Cloud Code for VS Code or IntelliJ.

Question 14

A company is migrating from Snowflake to BigQuery. They have a large amount of historical data. What is the recommended service to automate the data transfer?

Accepted Answer

BigQuery Data Transfer Service. BigQuery Data Transfer Service supports Snowflake as a source, allowing scheduled and automated transfers of data to BigQuery.

Answer

Database Migration Service

Answer

Cloud Storage Transfer Service

Answer

Cloud Data Fusion

Question 15

Your company is migrating a 2 TB Oracle database to Cloud SQL for PostgreSQL using Database Migration Service (DMS). The source database is behind a firewall and only allows connections from specific IP ranges. The migration must have minimal downtime. Which TWO actions should you take? (Choose 2 options.)

Accepted Answer

Set up a Compute Engine VM as a proxy and whitelist its static IP in the source firewall.. For minimal downtime, continuous migration is needed. To connect to the source behind a firewall, you need either VPC peering with a VPN or a Compute Engine forwarding proxy with a whitelisted IP. Cloud SQL Auth Proxy is for connecting to Cloud SQL, not for source connectivity. A one-time migration would cause downtime.

Answer

Use Cloud SQL Auth Proxy to connect DMS to the source database.

Answer

Expose the source database on a public IP with SSL.

Answer

Configure Database Migration Service to use a one-time migration job.

Question 16

A company uses Cloud Bigtable for a time-series application. They need to create a backup that can be restored to a different cluster in a different region for disaster recovery. Which THREE statements about Bigtable backups are correct?

Accepted Answer

The target cluster for restore must exist before the restore operation.. When restoring a Cloud Bigtable backup, the target cluster must already exist in the specified region. The restore operation does not create a new cluster; it populates an existing cluster with the backed-up data. This ensures the cluster's configuration (e.g., node count, storage type) is predefined and meets the recovery requirements.

Answer

Backups can be used to migrate data across projects.

Answer

Backups are incremental, capturing only changes since the last backup.

Question 17

A company needs to synchronize sales transactions from an on-premises Oracle database to BigQuery for near-real-time analytics. They want a serverless solution that requires minimal operational overhead. Which TWO services should they consider?

Accepted Answer

Pub/Sub. Pub/Sub is correct because it provides a serverless, highly scalable ingestion service that can receive change data capture (CDC) events from an on-premises Oracle database via a connector like Debezium or Oracle GoldenGate, and stream them into BigQuery for near-real-time analytics without managing servers. Datastream is correct because it is a serverless CDC service specifically designed to replicate data from sources like Oracle directly to BigQuery, handling schema mapping and minimal operational overhead.

Answer

Dataflow

Answer

Cloud Scheduler

Answer

Cloud Functions

Question 18

You need to set up disaster recovery for a Cloud SQL for PostgreSQL instance that is currently configured with a HA instance in us-central1. You want a standby in a different region (us-west1) with automated failover. Which two steps should you take? (Choose TWO.)

Accepted Answer

Promote the read replica to become the primary if us-central1 fails. Promoting a cross-region read replica to primary is the standard method for manual or automated failover in Cloud SQL for PostgreSQL when the primary region fails. Cloud SQL does not support automatic cross-region failover; you must use a read replica and promote it to take over as the new primary instance.

Answer

Use a load balancer to automatically route traffic to the replica during failover

Answer

Enable cross-region HA in the Cloud SQL instance settings

Answer

Configure synchronous replication between the two regions

Question 19

A company uses Cloud Logging to centralize logs from multiple projects. They want to create a log-based metric for tracking 404 errors. However, the metric shows zero data even though 404 errors are occurring. What is the most likely reason?

Accepted Answer

The logs are being excluded by an exclusion filter before the metric is applied. Log-based metrics are computed from logs that have passed through all exclusion filters. If an exclusion filter is configured to discard logs matching certain criteria (e.g., all HTTP 4xx responses), those logs are never evaluated by the metric filter, causing the metric to show zero data even though 404 errors are occurring. Exclusion filters are applied before log-based metric evaluation in Cloud Logging.

Answer

The metric filter uses the wrong resource type

Answer

The metric is sampled and not all logs are considered

Answer

The logs are not being exported to Cloud Logging

Question 20

A company wants to deploy a Bigtable instance for a production workload that requires high availability across zones. They also need to ensure consistent single-digit millisecond latency for reads. Which configuration should they choose?

Accepted Answer

Create a production instance with two clusters across two zones using SSD storage.. Bigtable replication across zones provides HA and read scaling. Production instances are required for production workloads. Development instances are limited and not for production. HDD is slower, not recommended for low latency. A single cluster does not provide zone-level HA.

Answer

Create a production instance with one cluster and enable replication within the cluster.

Answer

Create a production instance with one cluster in a single zone using SSD storage.

Answer

Create a development instance with two clusters across two zones using HDD storage.