PCD Building and testing applications Practice Test 4 — 15 Questions

Question 1

A Cloud SQL for PostgreSQL instance is experiencing high query latency. The database has a high number of read replicas and is used for reporting. The team has identified that index scans are not being used effectively. Which THREE actions should they take to improve query performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze table statistics using VACUUM ANALYZE.. Option A is correct because running VACUUM ANALYZE updates the planner statistics and reclaims dead tuples, allowing PostgreSQL's query planner to choose index scans instead of sequential scans when they are more efficient. Option B is correct because increasing CPUs on the primary instance raises parallel query worker capacity and overall processing throughput, which directly reduces latency for reporting queries that scan large datasets. Option D is correct because pg_stat_statements captures aggregated execution statistics (calls, total/mean time, rows) so the team can pinpoint the exact slow queries and target indexing or rewriting efforts. Option C is not appropriate because automatic storage increase only prevents out-of-disk failures and does not affect query latency or index scan usage. Option E is not appropriate because adding more read replicas distributes read load but does not fix inefficient index scans or improve the performance of individual queries.

Answer

Enable automatic storage increase.

Answer

Create additional read replicas.

Question 2

A developer deployed a Cloud Function that is triggered by a Pub/Sub topic. The function processes messages and writes results to a BigQuery table. The developer notices that some messages are not being processed; they are visible in the Pub/Sub subscription but the function logs show no invocation for those messages. The function's code is correct and handles errors gracefully. What is the most likely cause and fix?

Accepted Answer

Enable retry on failure for the Pub/Sub subscription.. The Pub/Sub subscription has a default 'ack deadline' and if the Cloud Function does not acknowledge the message within that time (or if the function fails to process it and the subscription is not configured to retry), the message may be redelivered but eventually dropped. Enabling retry on failure ensures that messages that cause the function to fail (even if the code handles errors gracefully, the function might still return an error status) are retried until successfully processed.

Answer

Increase the function timeout to 540 seconds.

Answer

Check that the Pub/Sub subscription push endpoint is set to the Cloud Function URL.

Answer

Increase the function memory to 2GB.

Question 3

A team deploys a containerized web application on Cloud Run. The deployment fails with error 'Container failed to start. Failed to start and then listen on the port defined by the PORT environment variable.' The container image runs fine locally on port 8080. The team has not set any environment variables in the Cloud Run service configuration. What is the most likely issue and solution?

Accepted Answer

Set the PORT environment variable to 8080 in the Cloud Run service configuration.. Cloud Run expects the container to listen on the port specified by the PORT environment variable, which defaults to 8080. Since the team did not set any environment variables, Cloud Run assigns PORT=8080 automatically. The container runs fine locally on port 8080, but the error indicates it is not listening on the port defined by PORT. The most likely issue is that the container is hardcoded to listen on port 8080 but does not respect the PORT environment variable, or the application is binding to a different interface (e.g., localhost) that Cloud Run cannot reach. Setting the PORT environment variable explicitly to 8080 in the Cloud Run service configuration ensures the container listens on the expected port.

Answer

Configure a health check for the container.

Answer

Increase the container concurrency setting.

Answer

Set min instances to 1 to keep the container warm.

Question 4

A company uses Cloud Build to build and deploy a microservice. The build step that runs tests fails with a permission denied error when trying to access a private GitHub repository. The build configuration uses a default Cloud Build service account. The team has already added the GitHub repository as a trigger and provided credentials during trigger creation. However, the build step still fails. What is the most likely cause and solution?

Accepted Answer

Create a new service account with access to the secret containing the GitHub SSH key and use it in the build configuration.. The default Cloud Build service account lacks permissions to access the secret containing the GitHub SSH key. Creating a new service account with access to that secret and using it in the build configuration resolves the permission denied error. This ensures the build step can authenticate to the private repository.

Answer

Use Cloud Build's '--no-cache' flag to force a fresh clone.

Answer

Add a build step to run 'git config' to set user credentials.

Answer

Grant the Cloud Build service account the role 'Cloud Build Service Agent'.

Question 5

A company uses Cloud Deploy for continuous delivery with multiple targets (dev, staging, prod). After a successful promotion to staging, the team discovers a critical bug and needs to roll back the production target to the previous release. The production target has already been promoted to the current release, but the staging target should remain on the current release. How should the team roll back the production target?

Accepted Answer

Use the 'gcloud deploy rollback' command targeting the production target.. The 'gcloud deploy rollback' command is specifically designed to roll back a Cloud Deploy target to its previous successful release without affecting other targets. This command reverts the production target to the prior release while leaving the staging target on the current release, as required. It operates by redeploying the last known good release to the specified target, ensuring minimal disruption and preserving the promotion history.

Answer

Create a new release with the same image tag as the previous release and promote it to production.

Answer

Redeploy the previous release by running the previous Cloud Deploy command.

Answer

Manually delete the current release and then promote the previous release again.

Question 6

A team uses Cloud Tasks to process orders asynchronously. Each order is enqueued after payment verification. Processing involves calling an external shipping API that occasionally returns 503 (Service Unavailable). The Cloud Tasks queue is configured with default retry parameters: max retries = 100, max retry duration = 1 hour. The team notices that some orders are never processed; they remain in the queue until the max retry duration expires and then are discarded. What is the most likely cause and solution?

Accepted Answer

Increase the max retry duration to 24 hours.. The default Cloud Tasks retry parameters include a max retry duration of 1 hour. If an order repeatedly fails due to 503 errors from the external shipping API, the task will be retried up to 100 times within that hour. However, if the API remains unavailable for longer than the max retry duration, the task will be discarded even if the retry count hasn't been exhausted. Increasing the max retry duration to 24 hours gives the external API more time to recover, ensuring that orders are not prematurely discarded.

Answer

Set a custom retry deadline of 2 hours.

Answer

Use exponential backoff in the task handler instead of relying on Cloud Tasks.

Answer

Check the task queue rate limits and increase max dispatches per second.

Question 7

A company runs a web application on Google Kubernetes Engine (GKE) that uses Cloud SQL for its database. The application is deployed via Cloud Build and uses a custom container image stored in Artifact Registry. Recently, the development team noticed that new deployments are failing with a 'CrashLoopBackOff' error in the pod logs. The logs indicate that the application cannot connect to the Cloud SQL instance. The application uses the Cloud SQL Proxy sidecar container to connect. The Cloud SQL Proxy configuration has not changed recently. The GKE cluster is in region us-central1, and the Cloud SQL instance is in us-central1 as well. The team verified that the Cloud SQL instance is running and accepting connections from authorized networks. They also confirmed that the service account used by the pod has the 'Cloud SQL Client' role. The application has been running stable for months until a recent GKE cluster upgrade. The deployment YAML uses environment variables for database connection. The Cloud SQL Proxy is deployed as a sidecar container with command: '/cloud_sql_proxy -instances=<instance-connection-name>=tcp:5432'. The pod logs show the proxy attempting to connect but timing out. The network team confirms that there are no firewall rules blocking the connection. The Cloud SQL instance has an authorized network entry for the GKE cluster's nodes' IP range. What is the most likely cause of the connection failure?

Accepted Answer

The Cloud SQL instance is configured with a private IP and the GKE cluster is VPC-native but the Cloud SQL Proxy is configured to connect via public IP.. The Cloud SQL Proxy sidecar is configured to connect via public IP (using the instance connection name without the `-private-ip` flag), but the Cloud SQL instance is configured with a private IP. Since the GKE cluster is VPC-native, the pod can reach the private IP within the VPC, but the proxy is attempting a public IP connection, which fails because the instance's authorized networks only include the GKE nodes' IP range (public IPs of nodes), not the pod's private IP range. The recent GKE cluster upgrade may have changed the node's public IP or networking configuration, exacerbating the mismatch.

Answer

The Cloud SQL Proxy container is using an outdated version that is incompatible with the current Cloud SQL API.

Answer

The application is using a wrong database password in the connection string.

Answer

The pod's namespace does not have the Cloud SQL Proxy configuration correctly set up.

Question 8

A developer is deploying a Cloud Run service that must connect to a private Cloud SQL for PostgreSQL instance in the same project. The Cloud Run service is deployed with the default service account and the Cloud SQL connection is configured using the `--add-cloudsql-instances` flag. During testing, the service cannot reach the database and logs show connection timeouts. The developer has verified that the Cloud SQL instance is running and that the correct connection name is used. What is the most likely cause of the connection failure?

Accepted Answer

The default service account lacks the 'Cloud SQL Client' IAM role, so the Cloud SQL Auth Proxy cannot authenticate to the instance.. The Cloud SQL Auth Proxy in Cloud Run uses the service account's IAM permissions to authenticate. The default service account often lacks the Cloud SQL Client role, causing connection timeouts. Configuring the connection with the instance name is correct, but without the role, the proxy cannot establish a secure tunnel. Granting the role enables the proxy to connect, resolving the issue.

Answer

The Cloud SQL instance's authorized networks do not include the Cloud Run service's IP address range, blocking the connection.

Answer

The Cloud Run service's egress is set to 'all' traffic, but the Cloud SQL instance requires a private IP and the service must use a Serverless VPC Access connector.

Answer

The Cloud Run service must be configured with a VPC connector to reach the private IP of the Cloud SQL instance, and the connector is missing.

Question 9

A developer is writing unit tests for a Cloud Function written in Node.js that reads from Cloud Firestore. To keep tests fast and isolated, they want to avoid any network calls. Which combination of tools should they use?

Accepted Answer

Use the @google-cloud/firestore client with the Firestore emulator via the FIRESTORE_EMULATOR_HOST environment variable.. The Firestore emulator is the recommended local testing tool. Setting the FIRESTORE_EMULATOR_HOST environment variable directs the client library to the emulator, so no network calls are made. This allows fast, isolated tests that still exercise the real client behavior. Other options either require network access or mock at a level that reduces test fidelity.

Answer

Use a mocking library such as proxyquire to stub out the Firestore client methods.

Answer

Use the gcloud firestore emulator start command and connect the client by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Answer

Use the @google-cloud/firestore client with a service account and connect to a dedicated test project in production.

Question 10

A developer is building a Cloud Run service that reads from Firestore. During local testing, they want to ensure the code uses the same Firestore client library version and authentication flow as in production, but without deploying to Google Cloud. Which approach should they use?

Accepted Answer

Set the FIRESTORE_EMULATOR_HOST environment variable and run the Firestore emulator locally.. The Firestore emulator is designed for local development and testing. It runs locally, supports the same client libraries, and uses the same authentication flow as production when the FIRESTORE_EMULATOR_HOST environment variable is set. This allows developers to test their code locally without deploying to Google Cloud, ensuring consistency with production behavior.

Answer

Use the Firestore REST API with an API key to simulate production access.

Answer

Deploy a temporary Cloud Run revision with a test Firestore database and run integration tests against it.

Answer

Mock the Firestore client library using a framework like Mockito or unittest.mock.

Question 11

A developer is building a Go application that will run on Cloud Run. The application reads a configuration value from an environment variable `API_ENDPOINT`. During local testing with the Cloud Run emulator, the variable is not being picked up, even though it is defined in the service's YAML configuration. What is the most likely cause?

Accepted Answer

The environment variable is defined under the `env` section of the container spec, but the developer is running the emulator without specifying the service configuration file.. When using the Cloud Run emulator locally, the service configuration YAML must be explicitly provided so that environment variables and other settings are applied. Running the emulator without the YAML file means the container starts with default settings and no custom environment variables. The developer should ensure the emulator command includes the path to the service YAML.

Answer

The environment variable is defined in the YAML but the application is not reading it correctly because the emulator runs the container with a different working directory.

Answer

The environment variable name must be prefixed with `CLOUD_RUN_` to be recognized by the emulator.

Answer

The Cloud Run emulator does not support environment variables defined in the service YAML; they must be passed via the `--set-env-vars` flag.

Question 12

A developer is containerizing a Java application for Cloud Run. They need to optimize the Docker image for production. Which two practices should they follow? (Choose two.)

Accepted Answer

Use a distroless or slim base image for the runtime stage to minimize the image size.. Multi-stage builds and using distroless or slim base images are key practices for optimizing Docker images for production. Multi-stage builds separate build-time dependencies from the runtime image, and distroless/slim images minimize the runtime footprint. Both reduce image size, improve security, and enhance startup performance, which are critical for Cloud Run services.

Answer

Include the full JDK in the runtime image to ensure all Java features are available.

Answer

Set the ENTRYPOINT to the shell script that starts the application, and use the shell form to allow environment variable expansion.

Answer

Add a .dockerignore file to exclude unnecessary files from the build context.

Question 13

A developer is writing unit tests for a Cloud Function that interacts with Cloud Storage. To isolate the function logic and avoid making real network calls during tests, the developer wants to simulate Cloud Storage responses. Which approach should the developer use?

Accepted Answer

Mock the Cloud Storage client library using a mocking framework to return predefined responses.. Mocking the Cloud Storage client library is the standard way to isolate unit tests from external dependencies. It allows precise control over responses and avoids network calls, ensuring fast and reliable tests. Using a real bucket or deploying the function does not achieve isolation and is better suited for integration or end-to-end testing.

Answer

Use the Cloud Storage emulator by setting the STORAGE_EMULATOR_HOST environment variable.

Answer

Deploy the function to a test environment and run tests against the deployed version.

Answer

Create a dedicated test bucket in Cloud Storage and configure the function to use it during tests.

Question 14

A team is developing a Python Cloud Function that processes Pub/Sub messages. They want to write unit tests that simulate the Pub/Sub event. Which approach correctly constructs a Pub/Sub event object for testing?

Accepted Answer

Construct a dictionary with a `data` key containing a base64-encoded string and a `context` key containing `eventId`, `timestamp`, and `eventType` fields, matching the legacy Pub/Sub event format.. For 1st gen Cloud Functions triggered by Pub/Sub, the event object passed to the function has a `data` field (base64-encoded message data) and a `context` field with metadata such as `eventId`, `timestamp`, and `eventType`. Unit tests should construct a dictionary matching this format to accurately simulate the event. This allows testing the function's logic without deploying to Google Cloud.

Answer

Use the `pubsub` emulator to publish a message and let the function receive it, then capture the event object for testing.

Answer

Create a dictionary with keys `data` and `attributes`, where `data` is a base64-encoded string, and pass it to the function as the `event` parameter.

Answer

Use the `google.cloud.functions` library's `Event` class to create an event with the appropriate `data` and `context` fields.

Question 15

A developer is writing integration tests for a Cloud Run service that publishes messages to Pub/Sub. They want to run these tests locally without affecting production topics. Which two actions should they take? (Choose two.)

Accepted Answer

Use the Pub/Sub emulator and set the PUBSUB_EMULATOR_HOST environment variable.. The Pub/Sub emulator provides a local, isolated environment for testing Pub/Sub interactions. To use it, start the emulator and set the PUBSUB_EMULATOR_HOST environment variable so client libraries connect to it. This avoids network calls and prevents any impact on production topics. Other options either still use the real service or do not test actual integration.

Answer

Mock the Pub/Sub client library using a framework like unittest.mock to intercept publish calls.

Answer

Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to a service account key with Pub/Sub Publisher role.

Answer

Create a separate Pub/Sub topic in a dedicated test project and use service account credentials to access it.