PCD Practice Exam 62 — 20 Questions

Question 1

A company runs a microservices application on Cloud Run. One service, `order-processor`, is invoked asynchronously via a Cloud Tasks queue. The Cloud Tasks queue is configured with an HTTP target pointing to the `order-processor` service URL. The service requires authentication (no unauthenticated invocations). The service account used by Cloud Tasks to invoke the service is `cloud-tasks-system@project.iam.gserviceaccount.com`. After deploying a new revision of `order-processor` using Cloud Build and Cloud Deploy, the team notices that tasks are failing with a 403 status. The Cloud Run service logs show the requests are reaching the service but returning 403. The previous revision worked fine. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM policy binding granting the Cloud Tasks service account the Cloud Run Invoker role was removed during the deployment.. When Cloud Run requires authentication, the invoker's service account must be granted the roles/run.invoker role on the Cloud Run service. Deploying a new revision with Cloud Build and Cloud Deploy may overwrite IAM policy bindings if the deployment pipeline includes IAM policy updates or uses a different service account. In this scenario, the IAM binding for the Cloud Tasks service account was likely removed or not applied to the new revision, causing the 403 error. Option B is incorrect because the service works correctly; the 403 is returned before the service processes the request, indicating an authorization failure, not an internal bug. Option C is incorrect because the OIDC token configuration on the queue is independent of the revision and does not affect IAM permissions. Option D is incorrect because the Cloud Tasks queue's HTTP target URL points to the Cloud Run service, not a specific revision, so it does not need to be updated.

Answer

The new revision has a bug causing a permission denied error when processing tasks.

Answer

The Cloud Tasks queue needs to be configured with an OIDC token and audience for the new revision.

Answer

The Cloud Tasks queue's HTTP target URL needs to be updated to point to the new revision's specific URL.

Question 2

A company uses Cloud Build to build multiple microservices. They want to reuse a set of build steps across all services. What is the most maintainable approach?

Accepted Answer

Use Cloud Build substitutions. Cloud Build substitutions allow you to define reusable variables in a central configuration, enabling you to parameterize build steps across multiple microservices without duplicating code. By referencing substitution variables (e.g., $_SERVICE_NAME) in a single cloudbuild.yaml, you can maintain one source of truth for common steps, making updates easier and reducing errors. This approach is more maintainable than copying steps because changes propagate automatically to all services.

Answer

Copy the steps into each service's cloudbuild.yaml

Answer

Create a custom builder image with the steps

Answer

Use Cloud Build triggers with a common config file

Question 3

During a MySQL 5.7 to Cloud SQL for MySQL 8.0 migration, the team notices that some queries that worked before are now failing with 'ERROR 1055 (42000): Expression #1 of SELECT list is not in GROUP BY clause'. What is the cause and solution?

Accepted Answer

The error is due to the removal of the GROUP BY implicit grouping in MySQL 8.0. Upgrade the application to include all non-aggregated columns in GROUP BY.. The error occurs because MySQL 8.0 defaults to enabling the ONLY_FULL_GROUP_BY SQL mode, which was not enabled by default in MySQL 5.7. This mode requires that all non-aggregated columns in the SELECT list be included in the GROUP BY clause. Queries written for 5.7 that omitted such columns now fail. The correct solution is to modify the queries to include all non-aggregated columns in the GROUP BY clause, as this aligns with standard SQL behavior and is the recommended approach for compatibility.

Answer

The GROUP BY behavior change is due to the new caching SHA-2 password plugin. Disable it.

Answer

The queries are using JSON functions that are incompatible with MySQL 8.0. Rewrite them.

Answer

The default SQL mode in MySQL 8.0 includes ONLY_FULL_GROUP_BY, which was not enabled in 5.7. Set sql_mode to exclude ONLY_FULL_GROUP_BY in Cloud SQL.

Question 4

A developer wants to view real-time latency metrics for their App Engine application. Where can they find this data?

Accepted Answer

Cloud Monitoring - Metrics Explorer. Cloud Monitoring's Metrics Explorer allows you to view real-time latency metrics for App Engine by querying the `appengine.googleapis.com/http/server/response_latencies` metric. This provides a time-series view of request latency distributions, enabling immediate observation of performance changes as they occur.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Trace

Question 5

A company is designing a polyglot persistence architecture for an e-commerce platform. They need to store product catalog (relational), session data (low-latency key-value), and analytics data (large-scale SQL queries). Which TWO Google Cloud databases should they use? (Choose two.)

Accepted Answer

Memorystore. Memorystore is correct because it provides a managed in-memory data store (Redis or Memcached) that delivers sub-millisecond latency for session data, which is a key-value workload requiring fast reads and writes. This directly satisfies the low-latency key-value requirement for session management in the polyglot persistence architecture.

Answer

BigQuery

Answer

Firestore

Answer

Cloud Spanner

Question 6

A company uses Memorystore for Redis as a cache in front of Cloud Spanner. They want to ensure cache updates happen asynchronously when Spanner data changes. Which pattern is most appropriate?

Accepted Answer

Implement a cache-aside pattern with TTL. The cache-aside pattern involves the application checking the cache first, and if not found, loading from the database and updating the cache. Eventual consistency is acceptable for cache. The saga pattern is for distributed transactions, not caching.

Answer

Implement a saga pattern

Answer

Use a two-phase commit between Spanner and Memorystore

Answer

Use Spanner change streams to invalidate cache entries via Pub/Sub

Question 7

Your company runs a multi-tier application on GKE. The frontend is a Deployment with 5 replicas, backend is a StatefulSet with 3 replicas, and a database runs on Cloud SQL. Recently, after a cluster upgrade, the frontend pods are failing with 'Connection refused' errors when trying to reach the backend service. The backend pods are running and healthy. You have verified that the Service and Endpoints objects exist. The backend service is of type ClusterIP on port 8080, and the frontend uses the service name 'backend-svc'. The frontend pods are in a different namespace 'frontend-ns', while the backend is in 'backend-ns'. What is the most likely cause of the error?

Accepted Answer

The frontend pods are not using the correct DNS name that includes the namespace.. When a frontend pod in namespace 'frontend-ns' uses the service name 'backend-svc' to reach a backend service in namespace 'backend-ns', the DNS resolution will only work if the fully qualified domain name (FQDN) is used: 'backend-svc.backend-ns.svc.cluster.local'. Without the namespace qualifier, the DNS query resolves to a non-existent service in the same namespace, causing 'Connection refused'. Option A is incorrect because ClusterIP services are accessible cluster-wide provided the correct DNS name is used; an Ingress is not required. Option B is incorrect because we verified that Endpoints exist for the backend service, indicating the StatefulSet pods are correctly selected. Option C is incorrect because a NetworkPolicy blocking traffic would typically result in a timeout or no route, not an immediate 'Connection refused'; the error here is due to DNS resolution to a nonexistent endpoint.

Answer

The backend Service is not exposed via an Ingress, so it is not reachable from other namespaces.

Answer

The StatefulSet pods are not part of the backend Service's selector.

Answer

A NetworkPolicy is blocking traffic between the namespaces.

Question 8

A company is deploying a microservices application on Google Cloud. They want to securely store and access secrets (e.g., API keys, database passwords) across multiple services. They need to minimize operational overhead and ensure secrets are automatically rotated. Which TWO approaches should they use?

Accepted Answer

Use Secret Manager with a Cloud Function that automatically rotates secrets on a schedule.. Secret Manager is Google Cloud's native service for storing and managing secrets with built-in support for automatic rotation. By enabling automatic rotation on a secret, you eliminate the need for custom infrastructure like Cloud Functions to handle the rotation logic, thereby minimizing operational overhead. Option A is correct because it uses Secret Manager with a Cloud Function for rotation, which is a valid approach, but Option C is more aligned with the requirement to minimize overhead since automatic rotation is a native feature.

Answer

Store secrets in Cloud Storage buckets encrypted with Cloud KMS (CMEK).

Answer

Store secrets in a Cloud SQL database and use Cloud Scheduler to rotate them.

Answer

Store secrets in Cloud Firestore and use Firestore triggers to rotate them.

Question 9

A company is migrating an Oracle database to Cloud SQL for PostgreSQL using Ora2Pg. They need to convert stored procedures and functions. After conversion, they find that some PL/SQL code is not working. What is the most likely reason?

Accepted Answer

Ora2Pg does not convert Oracle-specific PL/SQL packages like DBMS_*.. Ora2Pg is an open-source tool that automates migration from Oracle to PostgreSQL, but it does not convert Oracle-specific PL/SQL packages such as DBMS_*, UTL_*, or other built-in Oracle libraries. These packages have no direct equivalent in PostgreSQL, so any stored procedures or functions that rely on them will fail after conversion. Manual rewriting or using PostgreSQL-compatible extensions (e.g., pg_dbms_* community modules) is required.

Answer

pgTap is needed to validate the converted code.

Answer

The Database Migration Service is required to convert stored procedures.

Answer

The PostgreSQL target instance is running an incompatible version.

Question 10

A database administrator is using Liquibase for schema versioning during a migration to Cloud SQL. What is the primary benefit of using Liquibase?

Accepted Answer

Version control and rollback of schema changes. Liquibase provides version control of database schema changes, allowing rollbacks and tracking in a declarative manner (changelogs).

Answer

Real-time replication of data

Answer

Automated performance tuning

Answer

Automatic data type conversion

Question 11

A Cloud Spanner instance has been running with 2 nodes. The team wants to migrate to processing units for more granular scaling. What is the equivalent number of processing units for 2 nodes?

Accepted Answer

2000 processing units. In Cloud Spanner, 1 node equals 1000 processing units. Therefore, 2 nodes equal 2000 processing units. This conversion is standard, though the documentation may vary slightly (some sources say 1 node = 1000 PUs). 500 PUs would be half a node, and 4000 would be 4 nodes.

Answer

1000 processing units

Answer

4000 processing units

Answer

500 processing units

Question 12

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Accepted Answer

Automate the teardown of test resources after test completion. End-to-end testing of a Cloud Run service that interacts with Firestore and Pub/Sub must include automated teardown of test resources (e.g., Pub/Sub topics, subscriptions, Firestore documents) to prevent resource leaks and avoid incurring ongoing costs. Without teardown, leftover resources can cause quota exhaustion and interfere with subsequent test runs, making automation essential for reliable CI/CD pipelines.

Answer

Use the Cloud Run emulator to run the service locally

Answer

Use the Firestore emulator to simulate Firestore operations

Question 13

A developer is building a Cloud Function that processes Pub/Sub messages. They want to run the function locally with simulated events before deployment. Which tool should they use?

Accepted Answer

Functions Framework. The Functions Framework is the correct tool because it provides a local development server that emulates the Cloud Functions runtime environment, allowing developers to invoke functions with simulated Pub/Sub events via HTTP requests. This enables testing and debugging of event-driven logic before deploying to production, without requiring actual Google Cloud infrastructure.

Answer

Cloud Scheduler

Answer

Cloud Build

Answer

Cloud Shell

Question 14

Drag and drop the steps to create a Cloud Run service in the correct order.

Accepted Answer

Select container image, then configure service settings, then deploy the service. Creating a Cloud Run service involves selecting the container image and configuring settings before deployment.

Answer

Configure service settings, then select container image, then deploy the service

Answer

Deploy the service, then select container image, then configure service settings

Answer

Select container image, then deploy the service, then configure service settings

Question 15

Drag and drop the steps to grant a service account access to a Cloud Storage bucket in the correct order.

Accepted Answer

Step 1: Add the service account as a principal, Step 2: Select the appropriate role, Step 3: Save the changes.. Granting access to a bucket involves adding the service account as a principal with a role.

Answer

Step 1: Select the appropriate role, Step 2: Add the service account as a principal, Step 3: Save the changes.

Answer

Step 1: Add the service account as a principal, Step 2: Save the changes, Step 3: Select the appropriate role.

Answer

Step 1: Save the changes, Step 2: Add the service account as a principal, Step 3: Select the appropriate role.

Question 16

Drag and drop the steps to set up a Cloud Function triggered by a Cloud Storage event in the correct order.

Accepted Answer

Write the Cloud Function code, then Deploy the function with the Cloud Storage bucket as trigger, then Upload a file to the Cloud Storage bucket, then Check the Cloud Function logs to verify execution. Cloud Functions can be triggered by Cloud Storage events; deployment includes specifying the bucket trigger.

Answer

Deploy the function with the Cloud Storage bucket as trigger, then Write the Cloud Function code, then Upload a file to the Cloud Storage bucket, then Check the Cloud Function logs to verify execution

Answer

Upload a file to the Cloud Storage bucket, then Write the Cloud Function code, then Deploy the function with the Cloud Storage bucket as trigger, then Check the Cloud Function logs to verify execution

Answer

Check the Cloud Function logs to verify execution, then Write the Cloud Function code, then Deploy the function with the Cloud Storage bucket as trigger, then Upload a file to the Cloud Storage bucket

Question 17

Your company uses Cloud SQL for MySQL to store transactional data. You need to perform a point-in-time recovery (PITR) to recover from a logical error that occurred 30 minutes ago. Which two prerequisites must be met? (Choose TWO.)

Accepted Answer

Binary logging is enabled.. Point-in-time recovery (PITR) for Cloud SQL for MySQL relies on binary logs to replay transactions up to a specific timestamp. Binary logging must be enabled because it records all changes to the database, allowing you to restore to any point within the retention period. Automated backups are also required because PITR uses the most recent full backup as a base, then applies binary logs from that backup to the target time. Without automated backups, there is no base image to start the recovery process.

Answer

High availability (HA) is configured.

Answer

The backup window is set to a time before the incident.

Answer

A read replica is configured.

Question 18

A developer finds the JSON key shown in the exhibit in a Cloud Storage bucket that is publicly accessible. Which security best practice was violated?

Accepted Answer

The key was stored in a publicly accessible Cloud Storage bucket.. Storing a JSON key (a service account private key) in a publicly accessible Cloud Storage bucket directly violates the principle of least privilege and exposes sensitive credentials to unauthorized users. Any entity with read access to the bucket can retrieve the key and impersonate the service account, potentially gaining unauthorized access to Google Cloud resources.

Answer

The key is not rotated regularly.

Answer

The key was created as a user-managed key instead of a Google-managed key.

Answer

The key was not encrypted using Cloud KMS.

Question 19

Match each IAM role to its description.

Accepted Answer

Viewer: Read-only access to resources. IAM basic roles include Viewer (read-only), Editor (read/write without IAM management), and Owner (full control). The distractors swap these definitions.

Answer

Viewer: Full access to resources

Answer

Editor: Read-only access to resources

Question 20

You are designing a Cloud Spanner database for a global user application that must enforce strong consistency across regions. The primary key of the main table is a UUID. You notice that write latency is high and suspect hotspotting. Which design change is MOST likely to reduce hotspotting?

Accepted Answer

Use a composite primary key with a leading hash prefix of the UUID. Using a composite primary key with a leading hash prefix distributes writes evenly across all Cloud Spanner splits, preventing hotspotting. A UUID primary key alone can still cause hotspots if the UUID generation is not perfectly random or if the application uses sequential UUIDs; a hash prefix ensures uniform distribution regardless of the UUID's characteristics.

Answer

Use a monotonically increasing integer as the primary key

Answer

Switch to regional Spanner instance instead of multi-region

Answer

Use a secondary index on the UUID column and keep the primary key as a UUID