PCD Practice Exam 60 — 20 Questions

Question 1

A company is migrating a monolithic application to a microservices architecture on Google Cloud. They want to decouple services and ensure that a failure in one service does not impact others. Which pattern should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement circuit breaker pattern using a service mesh like Istio. The circuit breaker pattern, implemented via a service mesh like Istio, is the correct approach because it prevents cascading failures by monitoring service health and stopping requests to a failing service until it recovers. Istio's Envoy sidecar proxies enforce circuit breaking at the network layer, allowing the system to degrade gracefully without impacting other services.

Answer

Implement caching with Memorystore

Answer

Increase the number of instances of each service

Answer

Use synchronous HTTP calls with retries

Question 2

A company is building a real-time analytics application on Google Cloud that ingests data from thousands of IoT devices. The data must be processed with sub-second latency and stored in a time-series database for querying. Which combination of services provides the best scalability and availability?

Accepted Answer

Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable. Cloud Bigtable is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, offering sub-10ms latency for time-series data. Combined with Cloud Pub/Sub for ingesting high-throughput IoT data and Cloud Dataflow for stream processing, this combination provides the best scalability and availability for real-time analytics with sub-second latency requirements.

Answer

Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore

Answer

Cloud Pub/Sub, Cloud Functions, Cloud SQL

Answer

Cloud Pub/Sub, Cloud Dataflow, Cloud Storage

Question 3

You are troubleshooting a web application deployed on Compute Engine instances behind a target pool. Users report intermittent timeouts when accessing the application via the forwarding rule's IP address. Based on the exhibit, what is the most likely cause of the issue?

Accepted Answer

The target pool lacks health checks, causing traffic to be sent to unhealthy instances.. The target pool in a legacy HTTP(S) load balancer does not automatically perform health checks unless they are explicitly configured. Without health checks, the load balancer continues to send traffic to all instances in the pool, including those that are unhealthy or unresponsive. This causes intermittent timeouts when users hit an unhealthy instance, as the forwarding rule distributes connections across the entire pool without verifying instance health.

Answer

The forwarding rule is missing a backend service.

Answer

The port range is set to 80-80, which restricts traffic to port 80 only.

Answer

The forwarding rule should use a backend service instead of a target pool for HTTP traffic.

Question 4

A web application hosted on Compute Engine is experiencing slow response times during peak hours. Which Cloud Monitoring metric should be examined first to identify the bottleneck?

Accepted Answer

95th percentile request latency measured by Cloud Load Balancing. The 95th percentile request latency measured by Cloud Load Balancing is the most direct indicator of user-perceived performance degradation. High latency at the load balancer level captures the end-to-end response time, including network, backend processing, and queuing delays, making it the first metric to examine when diagnosing slow response times during peak hours.

Answer

CPU utilization of backend instances

Answer

Number of incoming requests per second

Answer

Memory usage of backend instances

Question 5

A company is migrating a MySQL database to Cloud SQL. They plan to use Database Migration Service (DMS) with a continuous migration job to minimize downtime. How do they perform the cutover with zero downtime?

Accepted Answer

Use the DMS console to promote the replica; the promotion applies pending changes and makes the Cloud SQL instance writable.. DMS continuous migration uses a promotion step. When the source and target are in sync, the engineer promotes the Cloud SQL replica to a standalone instance. The application then switches to the new Cloud SQL instance. This is called 'promoting the replica' and can achieve near-zero downtime if coordinated correctly.

Answer

Take a snapshot of the Cloud SQL instance and restore it as a new instance.

Answer

Delete the migration job and manually update DNS to point to Cloud SQL.

Answer

Stop the source database, take a final dump, and load it into Cloud SQL.

Question 6

A financial services company uses a polyglot persistence architecture: Cloud SQL for MySQL for transactions, Cloud Bigtable for real-time risk calculations, and BigQuery for historical analytics. They need to move data from Bigtable to BigQuery every hour for reporting, with transformations. Which approach is MOST cost-effective and maintainable?

Accepted Answer

Set up a Dataflow pipeline on a schedule that reads from Bigtable, transforms, and writes to BigQuery. Dataflow provides a fully managed, serverless execution environment that can read from Bigtable, apply transformations (e.g., using Apache Beam's PTransform), and write to BigQuery on a scheduled basis. This approach is cost-effective as it scales to zero when idle and uses autoscaling, and maintainable because the pipeline code is reusable and can be version-controlled. Alternatives either lack transformation capability, incur higher latency, or require custom orchestration that increases operational overhead.

Answer

Use Datastream to stream Bigtable changes to BigQuery

Answer

Use BigQuery federated queries to query Bigtable directly for hourly reports

Answer

Write a Cloud Function that queries Bigtable and loads data into BigQuery every hour

Question 7

A data engineer is migrating a Redshift data warehouse to BigQuery. Which THREE steps are typically required?

Accepted Answer

Load data from Cloud Storage into BigQuery.. Migrating data from Redshift to BigQuery typically involves three steps: unloading data from Redshift to Amazon S3, transferring data from S3 to Google Cloud Storage using Storage Transfer Service, and loading data from Cloud Storage into BigQuery. While converting SQL dialect may be necessary, it is not considered a separate data migration step as it pertains to query compatibility rather than data movement.

Answer

Use BigQuery Data Transfer Service for Redshift.

Answer

Convert Redshift SQL dialect to BigQuery SQL.

Question 8

You need to set up a notification channel that sends alerts to a third-party incident management system using webhooks. What must be configured?

Accepted Answer

A Webhook notification channel in Cloud Monitoring. A webhook notification channel in Cloud Monitoring is the correct choice because webhooks allow Cloud Monitoring to send HTTP POST requests (typically JSON payloads) to a third-party incident management system's endpoint. This enables automated alert delivery without requiring a native integration, making it the standard method for connecting to external systems like PagerDuty, Opsgenie, or custom webhook receivers.

Answer

A Slack channel integration

Answer

A Pub/Sub topic and subscription

Answer

An email notification channel

Question 9

A company uses Datastream to replicate data from an on-premises MySQL database to BigQuery. They notice that the destination BigQuery table has a large number of rows that are duplicates with different timestamps. What is the most likely cause?

Accepted Answer

Datastream is configured in 'at least once' delivery mode. Datastream uses CDC and can deliver duplicate records if the source MySQL binary log is not configured with ROW-based replication and the log position tracking resets due to a restart or network issue. Duplicates can occur if the stream restarts from a checkpoint.

Answer

There is a primary key missing on the source table

Answer

BigQuery merge operation is not deduplicating

Answer

MySQL binary log is in STATEMENT format

Question 10

A company wants to deploy a containerized application on Google Kubernetes Engine (GKE) with zero downtime during updates. The application is stateless and runs on a Deployment with 5 replicas. Which deployment strategy should be used?

Accepted Answer

Rolling update. A rolling update is the default deployment strategy in Kubernetes and is ideal for stateless applications requiring zero downtime. It gradually replaces old Pods with new ones, ensuring that a minimum number of replicas remain available throughout the update. This strategy is configured via the `strategy.type: RollingUpdate` field in the Deployment spec, with parameters like `maxSurge` and `maxUnavailable` controlling the pace.

Answer

Blue/green deployment

Answer

Recreate update

Answer

Canary deployment

Question 11

A company is deploying a three-node Bigtable cluster for production. They anticipate growth in read throughput and want to plan for scaling. Which two actions can they take to increase read throughput? (Choose TWO.)

Accepted Answer

Add more nodes to the existing cluster. Adding nodes increases overall throughput, and adding a secondary cluster in a different zone allows reads to be served from both clusters, improving read throughput and availability. Changing to HDD would reduce performance. The development instance is not for production. Key Visualizer is for analysis only.

Answer

Switch to a development instance type

Answer

Change storage to HDD

Answer

Use Key Visualizer to increase performance

Question 12

A company stores sensitive user data in Cloud Storage. They want to ensure that only authenticated users with the appropriate permissions can access the data, and that data is encrypted at rest. Which two steps should they take? (Choose TWO.)

Accepted Answer

Enable default encryption on the bucket using Google-managed keys.. Cloud Storage buckets are encrypted at rest by default using Google-managed keys, which satisfies the requirement for data encryption without additional configuration. Option C is correct because IAM roles provide fine-grained access control, ensuring only authenticated users with appropriate permissions can access the data.

Answer

Configure a Customer-Managed Encryption Key (CMEK) in Cloud KMS.

Answer

Set bucket-level public access prevention.

Answer

Enable VPC Service Controls to restrict data access.

Question 13

A company uses Cloud Spanner for its global ordering system and needs to stream order changes to a Pub/Sub topic for real-time inventory updates. They also need to archive old orders to BigQuery for historical analysis. What is the simplest architecture to achieve both goals?

Accepted Answer

Enable Spanner change streams to publish to Pub/Sub, and then use a Dataflow pipeline to subscribe to the Pub/Sub topic and write to BigQuery. It leverages Spanner change streams' native ability to publish directly to Pub/Sub, which is the simplest integration path. A single Dataflow pipeline then subscribes to that Pub/Sub topic to write to BigQuery, fulfilling both the real-time streaming and archival requirements with minimal moving parts. This avoids the complexity of reading change streams directly in Dataflow or managing multiple pipelines.

Answer

Use a single Dataflow pipeline that reads from Spanner change streams and writes to both Pub/Sub and BigQuery

Answer

Use two separate Dataflow pipelines: one reading from change streams to Pub/Sub, another reading from Pub/Sub to BigQuery

Answer

Export Spanner tables to Avro in GCS nightly and load into BigQuery; use Cloud Functions to capture changes to Pub/Sub

Question 14

A developer runs the above command and receives the error. What is the most likely cause?

Accepted Answer

The cloudbuild.yaml file has a syntax error, such as incorrect indentation.. The error is most likely due to a syntax error in the cloudbuild.yaml file, such as incorrect indentation. Cloud Build uses YAML for configuration, and YAML is sensitive to indentation; a missing space or incorrect alignment can cause the build to fail with a parsing error. The command `gcloud builds submit` reads the cloudbuild.yaml file from the current directory, and if the YAML is malformed, the submission will fail before any Docker or build steps are executed.

Answer

The image tag format is incorrect.

Answer

The cloudbuild.yaml file is not present in the current directory.

Answer

The Dockerfile is missing from the repository.

Question 15

An application deployed on Google Kubernetes Engine is experiencing intermittent latency spikes. The team has enabled Cloud Trace and sees that a specific gRPC call to a backend service occasionally takes >500ms. However, the backend service's logs show no errors. What is the most likely cause that the team should investigate further?

Accepted Answer

The gRPC client is not using connection pooling, causing frequent TLS handshakes.. GRPC relies on HTTP/2, which multiplexes multiple requests over a single persistent connection. If the client does not reuse connections, each new request triggers a new TLS handshake, which can add significant latency (often 100-500ms) due to certificate exchange and cryptographic operations. This intermittent behavior occurs when the client creates a new channel per request rather than reusing a connection pool, leading to sporadic high-latency calls without backend errors.

Answer

The Cloud Trace sampling rate is too low, causing statistical noise.

Answer

The backend service is under-provisioned and experiencing resource contention only during peak traffic.

Answer

The network latency between the client and backend is high due to a misconfigured VPC firewall.

Question 16

A team deploys a stateful application on GKE using StatefulSets. They need to test data persistence after pod rescheduling. Which test scenario best validates this?

Accepted Answer

Delete a pod and verify the new pod has the same data from PersistentVolumeClaim. Deleting a pod in a StatefulSet triggers Kubernetes to reschedule a new pod with the same identity and PersistentVolumeClaim (PVC). The PVC retains the data from the original pod, so verifying that the new pod has the same data directly confirms that the PersistentVolume (PV) is correctly bound and the data persists across pod rescheduling. This tests the core persistence guarantee of StatefulSets without altering the replica count or cluster state.

Answer

Use a CronJob to regularly snapshot the data

Answer

Scale down the StatefulSet to 0 and scale up again, then check data

Answer

Delete the entire cluster and recreate it from backups

Question 17

An application running on Compute Engine needs to publish messages to a Pub/Sub topic. The VPC does not have external internet access. What must be configured to allow the instance to publish?

Accepted Answer

Private Google Access. Private Google Access enables instances without external IP addresses to call Google APIs and services (including Pub/Sub) using internal IPs. Option A is for NAT to internet, option B is for peering, and option C is for dynamic routing.

Answer

Cloud NAT

Answer

VPC Peering with Pub/Sub

Answer

Cloud Router with BGP

Question 18

A team is setting up a CI/CD pipeline for a Node.js App Engine application using Cloud Build. The source code is in Cloud Source Repositories. What must be configured to automatically run unit tests before deployment?

Accepted Answer

Add a cloudbuild.yaml file with a test step. Cloud Build uses a cloudbuild.yaml file to define build steps, and adding a test step ensures unit tests run automatically before deployment. Without this configuration, Cloud Build will not execute tests; it only runs the steps explicitly defined in the build configuration file.

Answer

Enable Cloud Build triggers on the repository

Answer

Use the App Engine deployment wizard

Answer

Use a Dockerfile to run tests

Question 19

A company is migrating a legacy Java application to Cloud Run. The application requires a specific Java version (Java 11) and writes temporary files to disk. The application also uses a proprietary library that is not available in public repositories. The team has created a Dockerfile that installs Java 11, copies the JAR file, and sets the entrypoint. They are using Cloud Build to build the container and deploying to Cloud Run. The deployment succeeds, but when they send requests, the application fails with a "Permission denied" error when trying to write to /tmp. The team has verified that the Cloud Run service has the correct permissions via a service account. They have also checked that the filesystem is writable at /tmp by default. What is the most likely cause of the error?

Accepted Answer

Change the base image to one that includes Java 11 and ensures the /tmp directory is writable.. The most common cause of write permission errors in Cloud Run is using a base image that does not have a writable /tmp directory or has the wrong filesystem permissions. Official base images like gcr.io/distroless/java or OpenJDK images are configured with a writable /tmp. Option A is incorrect because running chmod inside the Dockerfile may not fix the underlying issue if the filesystem is read-only or if the user doesn't have sufficient privileges; plus, Cloud Run may enforce security policies that prevent such operations. Option B is incorrect because memory limits do not affect filesystem write permissions; they relate to memory allocation. Option D is incorrect because Cloud Storage FUSE is an overcomplication; the issue is simply the base image's /tmp configuration.

Answer

Add a RUN chmod 777 /tmp command in the Dockerfile before the entrypoint.

Answer

Increase the memory limit of the Cloud Run service.

Answer

Use a Cloud Storage FUSE mount for temporary storage.

Question 20

A team is using Cloud Trace to analyze performance of a microservices application. They notice that some spans are missing from the trace. What is the most likely cause?

Accepted Answer

The trace sampling rate is set too low. The most likely cause of missing spans in Cloud Trace is that the trace sampling rate is set too low. Cloud Trace uses a configurable sampling rate to control how many requests are traced; if the rate is low, many requests are not sampled, resulting in incomplete traces. This is a common configuration issue, not a failure to send traces or a network problem.

Answer

The application is not sending traces for all services

Answer

There is a network latency issue

Answer

The Cloud Trace API is disabled for some projects