PCD Practice Exam 56 — 20 Questions

Question 1

A company needs to analyze terabytes of log data for business intelligence. The queries are complex SQL aggregations and run periodically. The data is read-only after ingestion. Which Google Cloud database is most suitable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BigQuery. BigQuery is the correct choice because it is a serverless, highly scalable data warehouse designed for petabyte-scale analytics using SQL. It excels at complex aggregations over terabytes of read-only log data, with automatic partitioning and columnar storage that optimize query performance for periodic analytical workloads.

Answer

Cloud SQL

Answer

Cloud Spanner

Answer

Cloud Bigtable

Question 2

An organisation needs to run SQL queries across data stored in Cloud SQL MySQL and Cloud Storage (CSV files) without moving the data. They want to use BigQuery as the query engine. Which feature should they use?

Accepted Answer

BigQuery federated queries using external tables. BigQuery federated queries using external tables allow you to query data stored in Cloud SQL and Cloud Storage (CSV files) directly from BigQuery without moving the data. This is achieved by creating an external table definition in BigQuery that references the source, enabling SQL queries across both sources in a single query using BigQuery's query engine.

Answer

Cloud SQL cross-database query

Answer

BigQuery Omni

Answer

BigQuery Data Transfer Service

Question 3

You have a Cloud Spanner database with a table that has a secondary index. You notice that queries using the index are performing a back join to the base table. Which index feature can you use to avoid this back join?

Accepted Answer

Use the STORING clause to include the queried columns in the index. In Cloud Spanner, a secondary index does not store all columns of the base table by default. When a query uses the index but needs columns not present in the index, Spanner performs a back join (also called a table lookup) to retrieve those missing columns from the base table. The STORING clause allows you to include additional non-key columns in the index itself, making the index covering and eliminating the need for the back join.

Answer

Use a composite primary key to include those columns

Answer

Use a local secondary index instead of a global one

Answer

Use interleaving with the base table

Question 4

A team needs to replicate changes from an on-premises Oracle database to BigQuery in near real-time. They want to use Google's serverless CDC solution. Which service should they use?

Accepted Answer

Datastream

Answer

Dataflow with JDBC connector

Answer

Database Migration Service

Answer

Cloud Functions with Oracle trigger

Question 5

A company deploys a microservice on Cloud Run and wants to minimize cold starts during traffic spikes. Which two steps should they take? (Select exactly 2.)

Accepted Answer

Enable CPU always allocated. Enabling CPU always allocated (option A) prevents the CPU from being throttled when the container is not handling requests, which reduces cold start latency because the runtime environment remains warm and ready to process incoming traffic immediately. This is particularly effective for minimizing cold starts during traffic spikes because the container's CPU is always active, eliminating the need to spin up resources from a cold state.

Answer

Use Cloud CDN

Answer

Set max_instances to a high value

Answer

Set concurrency to 1

Question 6

Refer to the exhibit. The developer receives an error when creating the delivery pipeline. What is the most likely cause?

Accepted Answer

The canary percentages for the prod target do not sum to 100.. In a canary deployment pipeline, the percentages assigned to the canary and primary stages must sum to 100% to represent the full traffic split. If they do not sum to 100, the pipeline fails as the deployment service cannot determine how to route the remaining traffic, causing the error.

Answer

The prod target is missing a verification step.

Answer

The dev target has four percentages, but only two are allowed.

Answer

The pipeline name is too long.

Question 7

A developer deployed the Kubernetes Deployment shown. The application takes about 45 seconds to fully initialize and respond on the /healthz endpoint. What problem will occur with this configuration?

Accepted Answer

The liveness probe will start too early and cause the pod to be restarted before it becomes ready.. The liveness probe has an initialDelaySeconds of 30 seconds, which is less than the application's initialization time of 45 seconds. Therefore, the liveness probe will start checking the /healthz endpoint at 30 seconds, fail, and Kubernetes will restart the pod before it becomes ready. The readiness probe does not prevent the liveness probe from running and causing restarts.

Answer

The readiness probe will never succeed, and the pod will be removed from service.

Answer

The deployment will not create any pods because of a syntax error.

Answer

The pod will be marked ready immediately because the readiness probe uses the same endpoint as liveness.

Question 8

A Cloud Function (background function, event-driven) consistently logs this timeout error. The function processes messages from Pub/Sub. After increasing the max instances from 10 to 100, the error rate increases. What is the most likely cause of the timeouts?

Accepted Answer

The function depends on an external service that is rate-limited; scaling up causes more calls and timeouts. Increasing the max instances from 10 to 100 amplifies the number of concurrent function invocations. If the function depends on an external service (e.g., a third-party API or database) that enforces rate limits, the higher concurrency causes more requests to be throttled or rejected, leading to increased timeouts. This is a classic scaling anti-pattern where horizontal scaling exacerbates a bottleneck instead of relieving it.

Answer

Increase memory allocation to speed up processing

Answer

Use a larger instance type (Cloud Functions does not have instance types)

Answer

Migrate the function to Cloud Run for longer timeouts

Answer

The function timeout is set too low; increase it to 9 minutes

Question 9

A company deploys a web app on Cloud Run and configures a custom domain mapping with a managed SSL certificate. After mapping, the domain returns 404 errors. The Cloud Run service is accessible via its default URL. What is the most likely issue?

Accepted Answer

The domain mapping is pointing to a different Cloud Run service or region.. The most likely issue is that the custom domain mapping is pointing to a different Cloud Run service or region. When a custom domain is mapped to Cloud Run, the DNS CNAME must point to the domain mapping's resolved target (e.g., `ghs.googlehosted.com`), not to the default Cloud Run URL. If the mapping points to a different service or region, the request reaches Cloud Run but the service cannot handle it, resulting in a 404 error from the Cloud Run frontend. The default URL works because it bypasses the custom domain mapping and routes directly to the correct service.

Answer

The SSL certificate is not yet provisioned.

Answer

The Cloud Run service does not have the correct IAM permissions.

Answer

The DNS CNAME record is not configured correctly.

Question 10

You need to deploy a critical update to a production service on GKE with zero downtime. Which deployment strategy should you use?

Accepted Answer

Blue/green deployment using a Kubernetes Service and label selector. Blue/green deployment creates two identical environments (blue and green) and switches traffic atomically by updating the Kubernetes Service's label selector to point to the new version. This ensures zero downtime because the old version remains fully serving until the new version is verified, and traffic cutover is instantaneous with no overlapping broken requests.

Answer

Recreate strategy

Answer

Canary deployment with 10% traffic

Answer

Rolling update with maxSurge=25%, maxUnavailable=25%

Question 11

A team uses Cloud Build to automatically deploy a Cloud Function on push to a repository. The build fails intermittently with 'PERMISSION_DENIED' when executing gcloud functions deploy. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the necessary IAM permissions on the Cloud Functions API.. The intermittent 'PERMISSION_DENIED' error when Cloud Build runs `gcloud functions deploy` indicates that the Cloud Build service account does not have the required IAM roles (e.g., Cloud Functions Developer or Cloud Functions Admin) on the Cloud Functions API. Cloud Build uses its default compute engine service account (or a user-specified service account) to execute build steps; if this account lacks the `cloudfunctions.functions.create` or `cloudfunctions.functions.update` permission, the deployment will fail, and the intermittent nature may be due to eventual consistency or race conditions in IAM propagation.

Answer

The region specified in the build configuration does not match the function's region.

Answer

The build configuration file has a syntax error.

Answer

The Cloud Source Repository does not have the correct triggers.

Question 12

Refer to the exhibit. A team is deploying a Cloud Function that needs to connect to a Cloud SQL instance in a VPC. They have set up a VPC connector. After deployment, the function fails to connect to the database. What is the most likely cause?

Accepted Answer

The VPC connector is in a different region than the function. The VPC connector must be in the same region as the Cloud Function. If they are in different regions, the function cannot use the connector to reach resources in the VPC. Option B is incorrect because the service account needs the 'roles/cloudfunctions.serviceAgent' role to use the VPC connector, but this is usually granted automatically; the more common issue is region mismatch. Option C is incorrect because a misspelled environment variable would cause a connection failure, but it is not the most likely cause given the setup shown in the exhibit. Option D is incorrect because Cloud SQL private IP connections are managed by VPC peering, not by database firewall rules; firewall rules would apply to public IP, not private IP via VPC connector.

Answer

The function's service account does not have permissions to use the VPC connector

Answer

The environment variable DB_HOST is misspelled

Answer

The database firewall rules do not allow traffic from the VPC connector's subnet

Question 13

A developer is deploying a 2nd gen Cloud Function that needs to connect to a Cloud SQL MySQL instance. The Cloud SQL instance is configured with a private IP only. The Cloud Function is deployed with a VPC connector that is connected to the same VPC network as the Cloud SQL instance. The developer has granted the Cloud Function's service account the Cloud SQL Client role. However, when the function is invoked, connection attempts to the Cloud SQL instance time out. The Cloud Function code uses the MySQL connector with the private IP address of the Cloud SQL instance. The developer has verified that the VPC connector is healthy and that the Cloud SQL instance is running. Which additional configuration is most likely required?

Accepted Answer

Configure Private Services Access to establish a VPC peering between the VPC network and the Cloud SQL service network.. Even though the VPC connector is on the same VPC network as Cloud SQL, the Cloud SQL private IP address is allocated from a private services access range that is not automatically routed. You must set up Private Services Access to create a route from the VPC to the Cloud SQL private IP range. Without this, traffic from the VPC connector cannot reach the Cloud SQL instance. Option A is incorrect because modifying the connection string to require SSL/TLS would not resolve the routing issue; it would only affect encryption. Option B is incorrect because the Cloud SQL Auth proxy is not required for private IP connections; it is typically used for connections without private IP or for IAM authentication, but it cannot fix a routing problem. Option D is incorrect because assigning a public IP would defeat the purpose of using private IP and is not necessary if the routing is properly configured.

Answer

Modify the connection string to require SSL/TLS.

Answer

Deploy the Cloud SQL Auth proxy as an additional container in the Cloud Function.

Answer

Assign a public IP to the Cloud SQL instance and configure the function to use it.

Question 14

A company is deploying a Cloud Spanner database for a global application. They need to minimize write latency for users in North America and Europe while ensuring strong consistency. They also want to control costs by only paying for the capacity they use. Which THREE features should they use?

Accepted Answer

Enable autoscaling with processing units.. A multi-region instance configuration (e.g., nam3, eur3) spans continents, reducing write latency for users in North America and Europe while maintaining strong consistency. Enabling autoscaling with processing units adjusts capacity based on demand, allowing the company to pay only for the capacity they use, controlling costs. Setting up read replicas in each continent reduces read latency for users and offloads reads from the primary, which can indirectly improve write performance by reducing load. The other options are incorrect: a dual-region instance configuration is limited to two regions within one continent and does not provide global write performance; a fixed number of nodes does not allow cost control since you pay for provisioned nodes regardless of usage.

Answer

Dual-region instance configuration.

Answer

Use a fixed number of nodes to simplify management.

Question 15

An engineer is designing a Cloud Spanner instance for a global e-commerce application. They need strong consistency across continents and the ability to automatically scale compute capacity. Which THREE configurations should they choose?

Accepted Answer

Enable autoscaling with processing units and set min and max. For global strong consistency, a multi-region configuration is required (e.g., nam3, eur3). To auto-scale, you use processing units with a min and max, and set a target high-priority CPU utilization. Nodes are not used with autoscaling. Regional configurations only cover one region. Single-region does not provide global consistency.

Answer

Use nodes with a fixed number

Answer

Use a regional configuration

Question 16

A company uses Cloud Monitoring to create an uptime check for their external HTTP endpoint. The check fails periodically even though the service is healthy. What is the most likely cause?

Accepted Answer

The firewall is blocking the uptime check IP ranges. The most likely cause is that the firewall is blocking the uptime check IP ranges. Cloud Monitoring uses specific source IP ranges for its uptime checks, and if these are not explicitly allowed through the firewall, the checks will fail even though the service itself is healthy. This is a common configuration issue where the firewall rules are not updated to include the monitoring system's probe IPs.

Answer

The service is down during those periods

Answer

The SSL certificate is expired

Answer

The endpoint has high latency

Question 17

A company wants to use Firestore security rules to allow users to read documents only if they are the owner (user ID matches the 'owner' field in the document). Which rule is correct?

Accepted Answer

allow read: if resource.data.owner == request.auth.uid;. The correct rule uses request.auth.uid to get the authenticated user's ID and resource.data.owner to compare against the document's owner field. The 'owner' field must exist and match the user ID.

Answer

allow read: if resource.data.uid == request.auth.token.email;

Answer

allow read: if request.auth.token.owner == resource.data.uid;

Answer

allow read: if request.auth.uid == 'owner';

Question 18

A company is using Cloud Spanner for a global inventory system. They need to ensure that queries for an order and its line items are fast. Which THREE design choices will help achieve this? (Choose three)

Accepted Answer

Use interleaved tables for orders and line items. Interleaved tables in Cloud Spanner physically co-locate parent and child rows on the same split, so a query joining orders and line items by the parent key (order_id) can be served from a single split without distributed reads. This eliminates cross-node network hops, dramatically reducing latency for the inventory system's order+line-item queries.

Answer

Store orders and line items in separate regions

Answer

Use global secondary indexes on line items

Question 19

A company uses GKE with cluster autoscaling and node auto-upgrade. During a traffic spike, new pods are unschedulable even though the cluster autoscaler adds nodes. What is the most likely cause?

Accepted Answer

The pods have tolerations that don't match node taints. If pods have tolerations that do not match the taints on the nodes, the scheduler will not place them on those nodes, even if the cluster autoscaler has added new nodes. This mismatch prevents scheduling, leading to unschedulable pods despite sufficient node capacity.

Answer

The pods have resource requests that exceed available node capacity

Answer

The cluster autoscaler is disabled

Answer

The node pool has reached its maximum size limit

Answer

The nodes are in unhealthy status

Question 20

An e-commerce application uses Cloud SQL for transactional data and Cloud Bigtable for user session logs. A new requirement demands real-time analytics that joins order data with session behavior. The team wants to avoid moving data into a separate data warehouse. Which approach should they take?

Accepted Answer

Use BigQuery federated queries with external tables for both Cloud SQL and Bigtable. BigQuery federated queries allow you to query data in Cloud SQL and Cloud Bigtable directly using external tables, without moving the data. This approach meets the real-time analytics requirement by joining order data (Cloud SQL) with session logs (Cloud Bigtable) in a single SQL query, avoiding the need for a separate data warehouse or data movement.

Answer

Use Dataflow to continuously stream both Cloud SQL and Bigtable data into a single BigQuery dataset

Answer

Use Cloud Spanner as a unified database for both transactional and session data

Answer

Use Datastream to replicate Cloud SQL data to BigQuery, then join with Bigtable data using BigQuery's Bigtable external table