PCD Designing highly scalable, available, and reliable cloud-native applications Practice Test 2 — 15 Questions

Question 1

A development team is using Cloud Build to deploy containerized applications to GKE. They want to ensure that only containers that have passed security scans and unit tests are deployed to production. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Build with a multi-step pipeline that includes test and security scan steps, and only promote to production after successful completion.. Cloud Build is a CI/CD service that executes a series of build steps defined in a cloudbuild.yaml file. By defining a multi-step pipeline that includes unit test execution and container security scanning (e.g., using Container Analysis or a scanner like Trivy) as prerequisite steps, the build will fail if any step returns a non-zero exit code. Only after all steps succeed does the pipeline proceed to deploy to GKE, ensuring that untested or vulnerable containers never reach production. This approach directly enforces the quality gate within the build process itself.

Answer

Deploy to a staging cluster first, then manually promote to production using kubectl.

Answer

Use Cloud Deploy to automate delivery with approval gates.

Answer

Configure Cloud Build triggers to deploy directly to production on every push.

Question 2

A startup is building a REST API on Cloud Run. They expect unpredictable traffic spikes and want to ensure the service can scale from 0 to many instances automatically. What scaling configuration should they use?

Accepted Answer

Set min instances to 0 and max instances to 1000.. Cloud Run's autoscaling allows min instances to be set to 0, enabling the service to scale down to zero when idle (cost-efficient), and max instances to 1000 to handle unpredictable traffic spikes by scaling out horizontally. This configuration ensures the service can start from zero and automatically add instances up to the maximum limit as demand increases, which is ideal for unpredictable workloads.

Answer

Set max instances to 1 to control costs.

Answer

Use manual scaling with a fixed number of instances.

Answer

Set min instances to 5 and max to 100.

Question 3

A company runs a critical application on Compute Engine with a stateful database. They need to achieve 99.99% availability for the database tier. Which architecture should they implement?

Accepted Answer

A Compute Engine instance group with managed instance groups and a regional persistent disk configured for synchronous replication.. A managed instance group with a regional persistent disk configured for synchronous replication provides the necessary 99.99% availability by ensuring the database runs across two zones with synchronous writes to both replicas. This architecture allows automatic failover within seconds if one zone fails, meeting the high-availability requirement without data loss.

Answer

Use Cloud SQL with automatic failover and read replicas.

Answer

Two Compute Engine instances in different zones with a shared Zonal persistent disk.

Answer

Single Compute Engine instance with a persistent disk snapshot scheduled every hour.

Question 4

A team created the instance template above and used it in a managed instance group. However, instances fail to serve web traffic. What is the most likely cause?

Accepted Answer

The startup script does not configure a firewall rule to allow HTTP traffic.. The instance template likely includes a startup script that installs and starts Nginx, but does not configure a firewall rule (e.g., via `gcloud compute firewall-rules create` or `iptables`) to allow inbound HTTP traffic on port 80. By default, GCP VPC firewall rules deny all ingress traffic unless explicitly allowed, so even if Nginx is running, external requests will be blocked. This is the most common reason why a managed instance group fails to serve web traffic despite the application being installed.

Answer

The image family debian-11 does not have the necessary packages.

Answer

The machine type e2-medium is too small for Nginx.

Answer

The instance template is missing a service account.

Question 5

A security engineer applied the IAM policy above to a Cloud Storage bucket. The service account "my-sa" is used by an application that needs to read and write files to the bucket. The application reports that it cannot write files. What is the issue?

Accepted Answer

The "roles/storage.objectCreator" role only allows creating new objects, but not overwriting existing ones.. The 'roles/storage.objectCreator' role grants permission to create new objects in a Cloud Storage bucket, but it does not allow overwriting existing objects. To overwrite objects, the 'roles/storage.objectAdmin' or 'roles/storage.legacyObjectOwner' role is required, which includes the storage.objects.update permission. Since the application needs to both read and write (including overwrite) files, the objectCreator role is insufficient.

Answer

The policy is missing the "roles/storage.objectAdmin" role.

Answer

The service account lacks permission to list bucket contents.

Answer

The policy has duplicate bindings that cause a conflict.

Question 6

A company wants to deploy a stateless web application that needs to handle unpredictable traffic spikes with minimal operational overhead. Which Google Cloud compute service is most cost-effective and operationally simple?

Accepted Answer

Cloud Run. Cloud Run is the most cost-effective and operationally simple choice for a stateless web application with unpredictable traffic spikes because it automatically scales from zero to thousands of containers based on request load, charges only for resources used during request processing (down to 100ms increments), and eliminates infrastructure management. It supports any language or framework via container images, making it ideal for stateless HTTP workloads without the cold-start latency concerns of Cloud Functions or the cluster management overhead of GKE.

Answer

App Engine Standard

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine with Managed Instance Group

Question 7

A company runs a batch job daily that processes large files from Cloud Storage and stores results in BigQuery. The job requires significant compute for about 10 minutes and is fault-tolerant. Which compute option is most cost-effective?

Accepted Answer

Preemptible VM. Preemptible VMs offer the same compute capacity as regular VMs at a significantly lower cost (up to 80% discount), and since the batch job runs for only 10 minutes daily and is fault-tolerant, it can handle the occasional preemption without data loss. The job's short duration and fault tolerance make preemptible instances ideal, as they can be restarted if terminated.

Answer

Cloud Run Jobs

Answer

Always-on Compute Engine VM

Answer

GKE cluster with a single node

Answer

Cloud Functions (9-minute timeout)

Question 8

A financial services company has a critical application that must survive a regional outage. They deployed on Compute Engine across multiple zones within a single region and now want to redirect traffic to a secondary region if the primary region becomes unavailable. Which load balancing solution should they use?

Accepted Answer

External HTTP(S) Load Balancer. The External HTTP(S) Load Balancer is the correct choice because it supports global load balancing across multiple regions, enabling traffic failover to a secondary region when the primary region becomes unavailable. It uses anycast IP addresses and is designed for HTTP/S traffic, making it suitable for a critical application that must survive a regional outage.

Answer

SSL Proxy Load Balancer

Answer

Proxy Network Load Balancer

Answer

Internal TCP/UDP Load Balancer

Answer

Network Load Balancer

Question 9

A company uses GKE with cluster autoscaling and node auto-upgrade. During a traffic spike, new pods are unschedulable even though the cluster autoscaler adds nodes. What is the most likely cause?

Accepted Answer

The pods have tolerations that don't match node taints. If pods have tolerations that do not match the taints on the nodes, the scheduler will not place them on those nodes, even if the cluster autoscaler has added new nodes. This mismatch prevents scheduling, leading to unschedulable pods despite sufficient node capacity.

Answer

The pods have resource requests that exceed available node capacity

Answer

The cluster autoscaler is disabled

Answer

The node pool has reached its maximum size limit

Answer

The nodes are in unhealthy status

Question 10

A company uses Cloud Spanner for a global application. They want to improve read performance for point-reads (individual row lookups). Which TWO strategies should they adopt?

Accepted Answer

Create secondary indexes. Option B (Create secondary indexes) is correct because Cloud Spanner point-reads that filter on non-primary-key columns otherwise require a full table scan; a secondary index lets Spanner locate the matching row(s) directly, dramatically reducing latency for individual row lookups. Option E (Use interleaved tables) is correct because interleaving a child table's rows physically with the parent row keeps related rows co-located, so point-reads that fetch a parent and its interleaved children can be served with a single, local lookup instead of extra network round trips. Option A (Use read replicas) is not a Spanner feature for this purpose—Spanner provides read-only replicas configured via instance configuration and leader placement, but simply 'using read replicas' is not a valid strategy for improving point-read performance. Option C (Partition the table by time) is not applicable because Spanner does not support user-defined table partitioning; it automatically splits data into key ranges. Option D (Use batch reads) is incorrect because batch reads (ReadAsync/ExecuteStreamingSql) are designed to improve throughput for many reads, not to reduce latency for individual point-reads.

Answer

Use read replicas

Answer

Partition the table by time

Answer

Use batch reads

Question 11

A company runs a microservices architecture on GKE with gRPC services. They want to implement traffic splitting for canary deployments. Which THREE components should they use?

Accepted Answer

Istio or Anthos Service Mesh. Option B (Istio or Anthos Service Mesh) is correct because a service mesh provides the fine-grained traffic management layer needed for gRPC canary deployments, using VirtualService and DestinationRule resources to split traffic by percentage between service subsets. Option C (Ingress resource) is correct because GKE Ingress can be combined with a service mesh or with BackendConfig/weighted backends to route external traffic to the canary and stable versions of the gRPC services. Option D (Google Cloud Load Balancer) is correct because GKE Ingress provisions a Google Cloud HTTP(S) Load Balancer that supports weighted traffic splitting across backend services, enabling the canary percentage routing at the edge. Option A (ClusterIP service) is not correct on its own because a ClusterIP service only provides a stable virtual IP for pod access and has no native traffic-splitting capability. Option E (Headless service) is not correct because a headless service (clusterIP: None) is used for direct pod DNS discovery, typically for stateful sets, and does not perform weighted traffic distribution for canaries.

Answer

ClusterIP service

Answer

Headless service

Question 12

The developer runs the command above and sees both instances are unhealthy. The instances are running and serving traffic on port 80 when accessed directly. What is the most likely cause?

Accepted Answer

Firewall rules block the health check probe IP ranges. The most likely cause is that firewall rules are blocking the health check probe IP ranges. Google Cloud Platform (GCP) load balancers use specific, documented IP ranges for health check probes. If a firewall rule denies traffic from these ranges, the load balancer will mark the instances as unhealthy even though the instances are running and serving traffic on port 80 when accessed directly. This is a common misconfiguration because the health check probes originate from these special IP ranges, not from the load balancer's frontend IP.

Answer

The instances have been deleted

Answer

The instances are not running the specified health check port

Answer

The load balancer is misconfigured

Answer

The instances are out of memory and unable to respond

Question 13

A developer deploys this Cloud Run service. During a load test, each incoming request starts a new container instance, even though concurrency is set to 80. What is the reason?

Accepted Answer

The container is not designed to handle multiple concurrent requests (single-threaded). Cloud Run's concurrency setting controls how many requests the runtime can send to a container instance, but the container itself must be capable of handling those requests concurrently. If the application is single-threaded or uses a blocking I/O model (e.g., a simple Flask or Express server without async workers), it can only process one request at a time. Cloud Run detects that the container is busy and starts a new instance for each incoming request, effectively ignoring the concurrency setting.

Answer

The memory limit is too low

Answer

The container is CPU-bound and cannot handle multiple requests concurrently

Answer

The CPU limit is too low

Answer

The concurrency setting of 80 is too high and Cloud Run ignores it

Question 14

A company is designing a microservices architecture on Google Kubernetes Engine (GKE). They want to ensure zero-downtime deployments. Which strategy should they use?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct strategy for achieving zero-downtime deployments on GKE because it runs two identical environments (blue and green) and switches traffic instantly via a Kubernetes Service or Ingress. This eliminates any period where the application is unavailable, as the old version remains live until the new version is fully ready and traffic is cut over. GKE's LoadBalancer or Ingress controller can route all traffic to the new environment with a single configuration update, ensuring no requests are dropped.

Answer

Recreate

Answer

Rolling update

Answer

Canary deployment

Question 15

A developer is using Cloud Spanner for a global application. They need to design a schema to avoid hotspots. Which practice should they follow?

Accepted Answer

Use a hash prefix on the primary key. Cloud Spanner uses a distributed architecture that splits data across splits based on the primary key. A monotonically increasing or timestamp-based key causes all new writes to hit a single split, creating a hotspot. By using a hash prefix on the primary key, writes are distributed uniformly across all splits, avoiding hotspots and maximizing write throughput.

Answer

Use a UUID primary key

Answer

Use a monotonically increasing primary key

Answer

Use a composite primary key with a timestamp