PCD Practice Exam 57 — 20 Questions

Question 1

A development team is implementing a CI/CD pipeline using Cloud Build. They need to ensure that sensitive data, such as API keys, are never exposed in build logs. What is the best practice?

Accepted Answer

Use Cloud Build's encrypted variables or Secret Manager to pass secrets at build time.. Cloud Build's encrypted variables and Secret Manager are designed to securely inject sensitive data like API keys at build time without exposing them in logs. Encrypted variables are stored in Cloud KMS and decrypted only during the build, while Secret Manager provides versioned secrets with fine-grained access control. This ensures secrets never appear in plaintext in the build configuration or output logs.

Answer

Store the API keys in a separate file in the source repository and reference it in the build.

Answer

Use custom substitutions with default values and rely on Cloud Build's encryption.

Answer

Store the API keys as plain text in cloudbuild.yaml and restrict access to the file.

Question 2

Which TWO practices should be followed when integrating Cloud Endpoints with a Cloud Run service to enforce API authentication and rate limiting?

Accepted Answer

Set the audience field in the Endpoints service configuration to the Cloud Run service URL. The `audience` field in the Endpoints service configuration must match the Cloud Run service URL (e.g., `https://myservice-xxxxx-uc.a.run.app`). This ensures that the JWT tokens issued by Google's authentication system are validated against the intended recipient, preventing token reuse across different services. Without this match, authentication will fail because the token's `aud` claim will not match the expected audience.

Answer

Use API keys to authenticate end users

Answer

Deploy Cloud Endpoints as a sidecar container in the same Cloud Run instance

Answer

Configure Cloud Armor rules to enforce rate limiting before requests reach Endpoints

Question 3

Refer to the exhibit. A developer is deploying a container to Cloud Run and receives the error shown. What is the most likely cause?

Accepted Answer

The container is trying to listen on a privileged port (e.g., 80) instead of the expected port 8080.. Cloud Run requires containers to listen on the port specified by the PORT environment variable, which defaults to 8080. The error indicates the container is trying to bind to port 80, a privileged port, which is not allowed by the Cloud Run runtime sandbox. This mismatch causes the container to fail health checks and deployment.

Answer

The container's health check is failing because the startup command is incorrect.

Answer

The PORT environment variable is not set correctly in the Cloud Run service configuration.

Answer

The container image does not exist in the specified registry.

Question 4

A developer deploys a containerized application on Cloud Run. The application needs to access a Cloud SQL instance securely without exposing it to the internet. What is the best practice?

Accepted Answer

Use Cloud Run's VPC connector and configure private IP for Cloud SQL.. Cloud Run services cannot directly connect to Cloud SQL using private IP without a VPC connector. The VPC connector allows Cloud Run to send traffic to a VPC network, where the Cloud SQL instance with a private IP resides, ensuring traffic never traverses the public internet. This is the recommended pattern for secure, low-latency access to Cloud SQL from serverless environments.

Answer

Whitelist the Cloud Run IP range in Cloud SQL authorized networks.

Answer

Use a Cloud SQL proxy sidecar container in the same pod.

Answer

Use Cloud NAT to route traffic.

Question 5

A developer is integrating an App Engine standard environment app with Cloud Storage. The app needs to read objects from a bucket that is in a different project. The developer has granted the App Engine service account the Storage Object Viewer role on the bucket. However, the app still gets a 403 error when trying to read objects. What is the most likely cause?

Accepted Answer

The service account is from the app's project, not the bucket's project, and the bucket's IAM policy may not include the service account.. The App Engine service account belongs to the app's project, not the bucket's project. Cross-project access requires the service account to be explicitly granted the Storage Object Viewer role in the bucket's IAM policy. If the role was granted but the policy hasn't propagated or is misconfigured, a 403 error can still occur. Option A is incorrect because downloading a JSON key is unnecessary and insecure; service accounts can be used across projects without key files. Option B is incorrect because uniform bucket-level access being disabled relates to ACLs, but IAM permissions still apply; the issue is cross-project IAM, not ACL/ IAM conflict. Option C is incorrect while VPC Service Controls can block access, the typical error is different and would involve the perimeter, not just a 403 on object reads; the question describes a simple cross-project permission issue.

Answer

The service account needs to be downloaded as a JSON key and added to the app configuration.

Answer

The bucket has uniform bucket-level access disabled, so ACLs may override IAM permissions.

Answer

The bucket is in a VPC Service Controls perimeter that blocks access from the App Engine service account.

Question 6

You want to identify performance bottlenecks in your application's code, such as functions consuming excessive CPU. Which Google Cloud tool should you use?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and memory usage data from your application's functions and methods, presenting a flame graph or call graph that pinpoints which code paths consume the most resources. This allows you to identify performance bottlenecks like functions consuming excessive CPU without adding significant overhead to your production environment.

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Cloud Logging

Question 7

A developer is deploying a Cloud Run service that needs to access a Cloud SQL instance. The service is deployed with the --no-allow-unauthenticated flag. What is the recommended way to grant the service access to the database?

Accepted Answer

Grant the Cloud SQL Client role to the Cloud Run service's runtime service account.. The recommended way to grant a Cloud Run service access to a Cloud SQL instance is to grant the Cloud SQL Client role (roles/cloudsql.client) to the Cloud Run service's runtime service account. This role provides the necessary permissions (cloudsql.instances.connect and cloudsql.instances.get) to establish a secure connection via the Cloud SQL Auth Proxy or the Cloud SQL connector library. Using the runtime service account follows the principle of least privilege and avoids managing long-lived credentials.

Answer

Create a service account key and store it in Secret Manager, then mount it as a volume.

Answer

Use the default Compute Engine service account and grant it the Cloud SQL Client role.

Answer

Enable the Cloud SQL Admin API and use Application Default Credentials from the Cloud Run service.

Question 8

You are building a data pipeline that ingests streaming data from thousands of IoT devices. The devices send JSON payloads to a Cloud Pub/Sub topic. You want to process the data in near real-time and store the results in BigQuery for analytics. You also need to handle occasional schema changes in the incoming data (new fields added) without manual intervention. You have set up a Dataflow streaming pipeline using Apache Beam to read from Pub/Sub and write to BigQuery. The pipeline uses the `WriteToBigQuery` transform with `createDisposition=CREATE_NEVER` and `writeDisposition=WRITE_APPEND`. Recently, a batch of devices started sending a new field `temperature_celsius` that does not exist in the BigQuery schema. The pipeline logs errors and the data is not written. You need to modify the pipeline to automatically handle such schema evolution. What should you do?

Accepted Answer

Change `createDisposition` to `CREATE_IF_NEEDED` and ensure the BigQuery table schema has `autodetect=true` or is updated to allow new fields.. With `createDisposition=CREATE_IF_NEEDED`, BigQuery will automatically add new fields if the schema allows updates. This is the simplest approach. Option B is wrong because manually updating the schema and restarting the pipeline defeats the purpose of automation and requires manual intervention. Option C is wrong because storing raw data in Cloud Storage and using Cloud Functions loses real-time capability and adds complexity. Option D is wrong because using a `ParDo` to flatten or ignore unknown fields discards data and does not handle schema evolution properly.

Answer

Manually update the BigQuery table schema to include the new field and then restart the pipeline.

Answer

Write the raw JSON payloads to Cloud Storage and use a Cloud Function to load them into BigQuery every 10 minutes with schema autodetect.

Answer

Use a `ParDo` transform to flatten all JSON fields into a fixed schema by ignoring unknown fields.

Question 9

During an Oracle to Cloud SQL for PostgreSQL migration using DMS, the full dump phase completes successfully, but the CDC phase fails with a 'missing table' error. What is the most likely cause?

Accepted Answer

Some tables in the source database lack primary keys or a valid replica identity.. CDC typically requires a primary key or replica identity on each table to track changes. If tables lack these, CDC may fail. DMS expects tables to have primary keys or a valid replica identity for logging.

Answer

The source Oracle database does not have archivelog enabled.

Answer

The Cloud SQL instance does not have enough storage to accommodate CDC logs.

Answer

The DMS connection profile for the source is misconfigured.

Question 10

Your organization runs a multi-region application on Cloud Run that serves an API. The API is consumed by clients worldwide. You want to reduce latency by routing users to the nearest regional Cloud Run service. Currently, all traffic goes to a single Cloud Run service in us-central1. You have set up additional Cloud Run services in europe-west1 and asia-east1. Each service is fronted by an external HTTPS load balancer with a regional backend. You want to use a single global anycast IP address that automatically directs users to the closest healthy backend. You also need to support HTTPS with a custom domain and a Google-managed certificate. What should you do?

Accepted Answer

Create a global external HTTPS load balancer with serverless NEGs pointing to each regional Cloud Run service, and attach a Google-managed certificate.. A global external HTTPS load balancer with serverless NEGs (Network Endpoint Groups) can route traffic to the nearest healthy backend (Cloud Run service) via a single anycast IP address, leveraging Google Front Ends (GFEs) for global anycast. This also supports a Google-managed certificate attached to the load balancer for HTTPS with a custom domain. Option B is incorrect because Cloud Run itself does not support anycast; it is a regional service. Option C is incorrect because geo-routing DNS does not provide a single anycast IP; it returns different IPs based on location, which can cause issues with client DNS caching and doesn't provide true anycast routing. Option D is incorrect because Cloud CDN is for caching content, not for routing traffic based on proximity.

Answer

Enable anycast on the Cloud Run service by selecting the 'global' setting in the Cloud Run region selection.

Answer

Use Cloud DNS with geo-routing policy to point users to the appropriate regional load balancer IP based on their location.

Answer

Configure Cloud CDN in front of the Cloud Run services to cache responses at edge locations.

Question 11

A development team wants to test their application locally with Cloud Bigtable without incurring costs. Which instance type should they create?

Accepted Answer

Development instance. Cloud Bigtable offers a 'Development' instance type for testing and development. It uses a single node (or limited cluster) and costs significantly less than a production instance. Production instances are for live workloads. An HDD cluster is for production with slower storage. A multi-cluster is for replication.

Answer

Production instance with a single node

Answer

Production instance with a multi-cluster configuration

Answer

Production instance with HDD storage

Question 12

Refer to the exhibit. A developer deployed a Cloud Run service as shown. Authenticated requests from another service in the same project using a service account receive 403 Forbidden. What is the most likely cause?

Accepted Answer

The service account used to authenticate is not granted the roles/run.invoker role on the Cloud Run service. The Cloud Run service requires the IAM role `roles/run.invoker` on the service itself for any principal (including a service account) to invoke it. Since the service was deployed with `--no-allow-unauthenticated`, only explicitly granted principals can invoke it. The service account used for authentication lacks this role, causing the 403 Forbidden response.

Answer

The Cloud Run service requires the 'allAuthenticatedUsers' member to be added

Answer

The --no-allow-unauthenticated flag blocks all requests including authenticated ones

Answer

The container image was built without proper authentication headers

Question 13

A team wants to monitor the availability of an external API by pinging it every minute from multiple locations around the world. Which Cloud Monitoring feature should they use?

Accepted Answer

Uptime checks. Uptime checks are the correct Cloud Monitoring feature because they are specifically designed to verify the availability of external services by sending HTTP, HTTPS, or TCP requests from multiple locations around the world. This matches the requirement to ping an external API every minute from multiple global locations, providing detailed latency and status data without custom scripting.

Answer

Synthetic monitoring

Answer

Custom metrics from a cron job

Answer

Log-based metrics

Question 14

Refer to the exhibit. A team is using Cloud Monitoring with MQL to alert on CPU utilization per zone. They notice that the alert fires even when no single instance in a zone has CPU>80%, because the average across instances in the zone exceeds 80%. What change should they make to the MQL query to alert only when any individual instance exceeds 80%?

Accepted Answer

Change the group_by to group_by [instance_id] and remove zone grouping.. The current MQL query uses `group_by [zone]` to compute the mean CPU utilization per zone, which averages all instances in a zone together. By changing the grouping to `group_by [instance_id]` and removing the zone grouping, the alert will evaluate each instance individually, firing only when a single instance's CPU exceeds 80%, rather than when the zone-wide average exceeds the threshold.

Answer

Remove the group_by and use a filter instead.

Answer

Add a filter for each instance individually.

Answer

Use a ratio instead of mean.

Question 15

You are deploying a Python Cloud Function using the Google Cloud CLI. The deployment fails with 'ERROR: (gcloud.functions.deploy) ResponseError: status=[404], code=[OK], message=[The function ... does not exist]' but the function already exists. What is the most likely cause?

Accepted Answer

The gcloud config's region does not match the region where the function was deployed.. The 404 error indicates the deployment command cannot locate the function in the specified region. When you deploy a Cloud Function using the gcloud CLI, the command uses the default region set in your gcloud configuration (or the --region flag). If the function was originally deployed in a different region, the CLI will look for it in the wrong region and fail with a 404, even though the function exists elsewhere. This is the most common cause of this specific error message.

Answer

The function was already deployed with the same name, causing a conflict.

Answer

The Python runtime version is not supported in that region.

Answer

The Cloud Functions API is not enabled.

Question 16

A company uses Cloud Spanner for a globally distributed application. They need to capture all changes from a Spanner table and send them to a BigQuery dataset for real-time analytics. Which THREE Google Cloud services or features should they use?

Accepted Answer

Dataflow. Spanner change streams capture row-level changes. Dataflow can read from change streams and write to BigQuery. Pub/Sub can be an intermediary but is not required; Dataflow can directly write to BigQuery. However, the typical architecture uses Pub/Sub for decoupling. The question expects the three core components: change streams, Dataflow, and BigQuery.

Answer

Datastream

Answer

Cloud Functions

Question 17

A developer wants to deploy a Compute Engine instance using Terraform. They want to run a startup script to install software. How should they provide the script?

Accepted Answer

Use the metadata block with key 'startup-script' and the script content as value.. Terraform's `google_compute_instance` resource supports a `metadata` block where you can set the key `startup-script` with the script content as the value. When the Compute Engine instance boots, the `google-guest-agent` reads this metadata key and executes the script as the root user, which is the standard method for running startup scripts on Linux instances without additional configuration.

Answer

Use a cloud-init configuration file passed via user-data metadata.

Answer

Use the user-data metadata key with the script content.

Answer

Use the gcloud compute instances create command with --metadata-from-file flag.

Question 18

An engineer needs to create a Cloud SQL for PostgreSQL instance with high availability. Which configuration ensures automatic failover in less than 60 seconds if the primary zone fails?

Accepted Answer

Select a regional instance with synchronous standby in a different zone.. Cloud SQL HA uses a regional instance with a synchronous standby in a different zone within the same region. Automatic failover occurs within 60 seconds. Zonal instances do not provide HA. Cross-region replication is not supported for HA; it's used for disaster recovery.

Answer

Select a zonal instance with a read replica in a different zone.

Answer

Select a zonal instance with automatic storage increase enabled.

Answer

Select a cross-region replica for disaster recovery.

Question 19

Refer to the exhibit. Which schema or index change would most improve this query?

Accepted Answer

Create a secondary index on Orders.CustomerID and Customers.CustomerID. Creating secondary indexes on both `Orders.CustomerID` and `Customers.CustomerID` allows Spanner to perform an index-based join without scanning the full base tables. Spanner uses distributed, strongly consistent secondary indexes to avoid full table scans, which dramatically reduces latency and resource consumption for join queries. Without these indexes, Spanner must perform a broadcast join or a full table scan on both tables, which is inefficient at scale.

Answer

Create a primary key on CustomerID

Answer

Rewrite the query as a subquery

Answer

Increase the number of Spanner nodes

Question 20

A company runs a Cloud Spanner instance with 2000 processing units. They notice that the high-priority CPU utilization is consistently above 80% during peak hours. Which action should they take to improve performance?

Accepted Answer

Enable auto-scaling with a high-priority CPU target of 65%. Auto-scaling can adjust processing units based on high-priority CPU target. Manually increasing processing units or nodes also works, but auto-scaling is the recommended approach.

Answer

Enable read replicas to offload CPU

Answer

Reduce the number of processing units to save cost

Answer

Switch to node-based scaling and add 2 nodes