PCD Practice Exam 54 — 20 Questions

Question 1

Which Google Cloud service would you use to cache session data for a web application to reduce database load? The cache must support pub/sub messaging and have sub-millisecond latency.

Accepted Answer

Memorystore for Redis. Memorystore for Redis is ideal for caching, session storage, and pub/sub messaging with sub-millisecond latency. Memorystore for Memcached is also for caching but does not support pub/sub. Firestore and Bigtable are not caching solutions.

Answer

Memorystore for Memcached

Answer

Bigtable

Answer

Firestore

Question 2

A company is deploying a Cloud Spanner instance for a global application. They need to minimize write latency for users in Asia, Europe, and North America while maintaining strong consistency. Which two configurations should they choose? (Choose two.)

Accepted Answer

Use nodes for compute capacity. Nodes provide dedicated compute and storage resources in Cloud Spanner, which are necessary to achieve low write latency and high throughput for a global application. Nodes scale linearly with performance, ensuring that write operations are processed quickly across multiple regions. For a multi-region instance, nodes are the only supported compute capacity option, as processing units are limited to regional instances.

Answer

Use a regional instance configuration

Answer

Use processing units for compute capacity

Answer

Enable auto-scaling with a high-priority CPU target

Question 3

A retail company uses Cloud SQL for transactional data, Cloud Bigtable for real-time inventory updates, and BigQuery for analytics. They want to build a real-time dashboard that shows current inventory levels across all stores, updated within seconds of a transaction. The dashboard will query Bigtable for the latest inventory count. Which TWO services should they use to stream transactions from Cloud SQL to Bigtable?

Accepted Answer

Datastream. Datastream is a serverless change data capture (CDC) and replication service that can continuously stream changes from Cloud SQL (including transactional data) to Bigtable. It captures inserts, updates, and deletes in near real-time, enabling the dashboard to reflect current inventory levels within seconds of a transaction.

Answer

Cloud Composer

Answer

BigQuery Omni

Answer

Cloud Functions

Question 4

A developer needs to view detailed performance profiles of a Java application running on Compute Engine to identify CPU hotspots. Which Google Cloud service should they use?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct service because it provides continuous, low-overhead CPU and heap profiling for Java applications running on Compute Engine. It uses statistical sampling to identify which methods consume the most CPU time, enabling developers to pinpoint hotspots without requiring code changes or redeployment.

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Cloud Logging

Question 5

Match each error code to its meaning in Google Cloud.

Accepted Answer

400: The server cannot process the request due to a client error (e.g., malformed syntax).. The correct matches are: 400 = Bad Request, 401 = Unauthorized, 403 = Forbidden. Common confusions involve swapping definitions for similar errors (e.g., 401 vs 403) or misattributing server-side errors to client errors.

Answer

400: The request is unauthorized.

Answer

401: The requested resource was not found.

Answer

403: The server encountered an internal error.

Question 6

You are a Cloud Developer at a fintech company. Your team has developed a Node.js application that processes real-time financial transactions. The application is deployed on Cloud Run and uses Cloud Pub/Sub to receive transaction messages. The application must have high availability and low latency. Recently, the team noticed that during peak hours, the application experiences increased latency and some messages are not processed within the required 10-minute SLA. The team has configured Cloud Run with a minimum of 5 instances and a maximum of 50, with a concurrency setting of 80. The CPU usage per instance rarely exceeds 40% during peak times. The team also uses Cloud Monitoring and Logging for observability. After analyzing the logs, you find that the message processing time increases due to a database call that often takes 2-3 seconds. The Pub/Sub subscription is configured with a delivery deadline of 10 minutes. What should you recommend to reduce latency and ensure messages are processed within SLA?

Accepted Answer

Increase the concurrency setting to 200 to allow each instance to handle more requests simultaneously, reducing queuing.. Increasing the concurrency setting to 200 allows each Cloud Run instance to handle more requests simultaneously, which reduces the queuing delay caused by the 2-3 second database call. Since CPU usage is only 40%, the instances have headroom to process additional concurrent requests without being CPU-bound, directly addressing the latency issue within the 10-minute SLA.

Answer

Migrate the application to GKE with Horizontal Pod Autoscaler to scale based on custom metrics.

Answer

Increase the CPU limit per container to 2 CPUs to speed up database call.

Answer

Increase the minimum number of instances to 50 to ensure capacity during peak hours.

Question 7

A developer needs to store session state for a user in a cloud-native application. Which storage solution is most appropriate?

Accepted Answer

Memorystore. Memorystore (Redis) is the most appropriate solution for storing session state in a cloud-native application because it provides an in-memory data store with sub-millisecond latency, which is critical for fast session reads and writes. Session state is ephemeral, key-value data that requires high throughput and low latency, and Memorystore supports features like TTL (time-to-live) for automatic session expiration and persistence options for durability. This aligns with the cloud-native principle of stateless application tiers offloading state to a managed caching layer.

Answer

Cloud SQL

Answer

Cloud Storage

Answer

Bigtable

Question 8

A team created the instance template above and used it in a managed instance group. However, instances fail to serve web traffic. What is the most likely cause?

Accepted Answer

The startup script does not configure a firewall rule to allow HTTP traffic.. The instance template likely includes a startup script that installs and starts Nginx, but does not configure a firewall rule (e.g., via `gcloud compute firewall-rules create` or `iptables`) to allow inbound HTTP traffic on port 80. By default, GCP VPC firewall rules deny all ingress traffic unless explicitly allowed, so even if Nginx is running, external requests will be blocked. This is the most common reason why a managed instance group fails to serve web traffic despite the application being installed.

Answer

The image family debian-11 does not have the necessary packages.

Answer

The machine type e2-medium is too small for Nginx.

Answer

The instance template is missing a service account.

Question 9

A Cloud Run service is experiencing intermittent high latency. The team has enabled Cloud Trace. They want to identify the root cause by analyzing traces. What should they look for in the Trace viewer?

Accepted Answer

Spans with high latency and error status. In Cloud Trace, the root cause of intermittent high latency is identified by examining spans—the fundamental units representing work in a distributed system. Spans with high latency directly indicate where time is being spent, and an error status (e.g., HTTP 5xx or gRPC error codes) pinpoints a failure that could be causing retries or blocking, leading to the observed latency. This combination is the most direct signal for root cause analysis in trace data.

Answer

High container CPU usage

Answer

Large number of concurrent requests

Answer

Frequent log entries with 'WARNING'

Question 10

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

Accepted Answer

Use Cloud Build triggers with a branch filter set to ^main$.. Cloud Build triggers support branch filters to control which branches trigger builds. By setting the branch filter to ^main$, only commits to the main branch will initiate the build and subsequent deployment to Cloud Run. Option A is wrong because Cloud Run does not filter revisions by source repository; it deploys whatever image is pushed. Option B is wrong because IAM conditions control who can perform actions, not which branch triggered a build. Option D is wrong because it requires manual management and is error-prone; Cloud Build automatically handles branch filtering.

Answer

Configure Cloud Run to only accept revisions from a specific source repository.

Answer

Use IAM conditions on the Cloud Run service account to allow only main branch builds.

Answer

Create a separate Cloud Build trigger for each branch and manually disable non-main triggers.

Question 11

A company needs to build a CI/CD pipeline for a microservices architecture. They want to run unit tests quickly by only testing code that has changed. Which approach should they use?

Accepted Answer

Use Cloud Build with a step that checks `git diff` against the previous commit and runs tests only on affected modules using a test runner that supports file-based filtering.. It uses `git diff` to identify only the files that have changed and then runs tests on the affected modules, which is the most efficient approach for selective testing. Option A is not ideal because implementing a custom caching mechanism based on file hashes is complex and may not reliably skip tests when dependencies change. Option B runs all tests in parallel, but that does not reduce the test scope—it still runs the full test suite. Option C uses `git log`, which provides commit history rather than a direct diff of the current changes, making it less precise than `git diff` for identifying changed files.

Answer

Use Cloud Build with a step that caches test results based on file hashes.

Answer

Use Cloud Build with a step that runs all tests in parallel.

Answer

Use Cloud Build with a step that uses `git log` to find changed files and run tests.

Question 12

A security audit reveals that a service account has been granted excessive permissions. The exhibit shows the IAM policy for a project. Which statement best describes the security issue?

Accepted Answer

The service account has more permissions than necessary because objectAdmin includes all objectViewer permissions.. The objectAdmin role (roles/storage.objectAdmin) inherently includes all permissions of the objectViewer role (roles/storage.objectViewer). Granting both roles to the same service account is redundant and indicates over-permissioning. Option A is incorrect because IAM policies are allow-by-default; missing an explicit deny is not the issue here. Option C is incorrect because roles/storage.admin would be even more permissive than the current set of roles. Option D is incorrect because there is no conflict; IAM roles are additive, not conflicting.

Answer

The policy is missing an explicit deny for public access.

Answer

The service account should have roles/storage.admin instead.

Answer

The service account has both admin and viewer roles, causing a conflict.

Question 13

An organization uses Cloud SQL for MySQL and wants to set up a read replica in a different region to improve read latency for global users. What is the recommended way to configure network connectivity between the primary and replica?

Accepted Answer

Use Private Services Access. Private Services Access. Cross-region Cloud SQL read replicas require Private Services Access to establish private connectivity between the peered VPC and the Cloud SQL service. Private Services Access allows the primary and replica to communicate privately without traversing the public internet. Cloud Interconnect (A) provides dedicated connectivity but is unnecessary for this use case. Cloud VPN (B) is typically used for hybrid connectivity, not for Cloud SQL replication. VPC peering (C) is used for connecting VPCs directly but does not provide the service-level networking required for Cloud SQL.

Answer

Use a Cloud Interconnect

Answer

Use Cloud VPN with dynamic routing

Answer

Use VPC peering between the regions

Question 14

A startup is deploying a Node.js application on App Engine Standard Environment. They have configured the application in app.yaml with runtime: nodejs16. After deploying with gcloud app deploy, the deployment succeeds, but when they access the application, they get a 502 Bad Gateway error. They check the logs and see "Failed to start container" and "Error: Cannot find module 'express'". The application uses Express. The team has confirmed that the package.json file includes express as a dependency. What is the most likely cause?

Accepted Answer

The node_modules folder was not uploaded because it is in the .gcloudignore file.. The error 'Cannot find module express' indicates that the Express module is not available to the application. In App Engine Standard Environment, dependencies are automatically installed based on package.json during deployment. However, if the node_modules folder is present in the project directory and is excluded via .gcloudignore, the automatic installation may be skipped or overridden, leading to missing modules. The most likely cause is that node_modules is listed in .gcloudignore, so it wasn't uploaded and the automatic install didn't run correctly. Option B correctly identifies this issue.

Answer

The application is running on a different port than the one specified in the environment variable PORT.

Answer

The package.json file is missing the express dependency.

Answer

The request exceeds the 60-second timeout.

Question 15

A team notices that a Cloud Run service occasionally returns HTTP 500 errors. They have enabled Cloud Error Reporting. What is the best way to rapidly diagnose the root cause of these errors?

Accepted Answer

Examine the error group details in Cloud Error Reporting.. Cloud Error Reporting automatically groups similar errors (like HTTP 500s) into error groups, providing stack traces, request details, and occurrence timelines. Examining the error group details is the fastest path to root cause because it surfaces the exact exception and context without requiring manual log filtering or metric setup.

Answer

Search Cloud Logging manually for '500' events.

Answer

View the Cloud Trace dashboard for error traces.

Answer

Create a Cloud Monitoring dashboard for 5xx metrics.

Question 16

A company needs to run HTAP (hybrid transactional/analytical processing) workloads on PostgreSQL. They require 4x faster OLTP performance than standard PostgreSQL and the ability to run analytical queries directly on transactional data without ETL. Which TWO Google Cloud databases should they consider? (Choose two)

Accepted Answer

AlloyDB with BigQuery Omni. AlloyDB is a PostgreSQL-compatible database designed for HTAP workloads. It offers 4x faster OLTP performance compared to standard PostgreSQL and includes a built-in columnar engine that allows running analytical queries directly on transactional data without ETL. Therefore, AlloyDB alone (option D) satisfies the requirements. Additionally, AlloyDB can be combined with BigQuery Omni (option C) to leverage BigQuery's analytical capabilities on AlloyDB data without ETL, providing another valid solution for HTAP. Cloud SQL for PostgreSQL (option B) and Cloud Spanner (option A) lack the columnar analytics engine, and BigQuery alone (option E) is not transactional. Hence, options C and D are correct.

Answer

Cloud Spanner

Answer

Cloud SQL for PostgreSQL

Answer

BigQuery

Question 17

An application writes structured logs to Cloud Logging. The team wants to create a metric based on the value of a JSON field 'order_total' to alert when totals exceed $1000. What type of metric should they use?

Accepted Answer

Log-based metric.. A log-based metric extracts a numeric value from a log entry's JSON payload using a regular expression or a label extractor. By defining a log-based metric on the 'order_total' field and setting an alert threshold of $1000, the team can monitor and alert on high-value orders directly from Cloud Logging without additional instrumentation.

Answer

Uptime check metric.

Answer

Error Reporting metric.

Answer

Custom metric from Cloud Monitoring agent.

Question 18

A Cloud Bigtable instance has a single cluster. To improve availability and read throughput, the team decides to add a second cluster in a different zone. What is the effect on write performance?

Accepted Answer

Write latency increases due to replication across clusters. In Cloud Bigtable, adding a second cluster in a different zone enables replication across clusters. Writes must be replicated to all clusters to maintain consistency, which introduces additional network round-trips and acknowledgment overhead. This increases write latency because each write must be committed to both clusters before the client receives a success response.

Answer

Write performance remains unchanged

Answer

Write throughput doubles

Answer

Write latency decreases because of parallel replication

Question 19

Refer to the exhibit. You run the above command to build and push a Docker image to Container Registry. The build fails with an error: 'denied: Unauthenticated access'. What should you do to resolve this?

Accepted Answer

Grant the Cloud Build service account the Storage Object Admin role on the project. The error 'denied: Unauthenticated access' indicates that the Cloud Build service account does not have permission to push images to Container Registry. By default, Cloud Build uses the Cloud Build service account (service-[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com) to execute builds. Granting the Storage Object Admin role (roles/storage.admin) to this service account provides the necessary permissions to write objects (Docker image layers) to the Container Registry bucket in Cloud Storage, resolving the authentication failure.

Answer

Grant the Cloud Build service account the Project Editor role

Answer

Grant the Compute Engine default service account the Storage Object Creator role

Answer

Run gcloud auth login as the project owner before submitting the build

Question 20

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They want to automatically build and deploy each service when a new tag is pushed to its repository. They also need to run integration tests against a staging environment before promoting to production. Which service should they use to orchestrate the pipeline?

Accepted Answer

Cloud Build with a build trigger on tag push. Cloud Build with a build trigger on tag push is the correct choice because it natively supports event-driven pipelines triggered by Git tags, enabling automatic build and deployment of each microservice. Combined with Cloud Build's ability to run integration tests in a staging environment and then promote to production, it provides a complete CI/CD solution for GKE without additional orchestration services.

Answer

Deployment Manager with a template

Answer

Cloud Deploy with a delivery pipeline

Answer

Cloud Run with continuous deployment