PCD Hard Questions — 25 Difficult Questions

Question 1

A DevOps engineer is designing a row key for a Bigtable table storing user activity logs. The pattern is: user_id (UUID) + timestamp. On a cluster with 10 nodes, they observe severe hotspotting on a single node during peak writes. Which row key design change would likely resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a hash of the user_id as the prefix. The correct approach to mitigate hotspotting in Bigtable. Using a hash of the user_id as the row key prefix ensures uniform distribution of writes across tablets because the hash function randomizes the prefix, eliminating sequential patterns. Option D (timestamp + user_id) can still cause hotspotting if timestamps are strictly monotonically increasing, as all writes would target the same tablet at any given moment. While timestamps from multiple distributed sources may vary, this design is less robust than hashing and not a guaranteed solution. Therefore, only Option A reliably resolves the hotspotting issue.

Answer

Use a single table with no row key change

Answer

Increase the number of nodes to 20

Answer

Use a composite key: timestamp + user_id

Question 2

A company is using Cloud Monitoring to track custom metrics published from an on-premises application using the Monitoring API. The metrics are published every 30 seconds. The team wants to create an alert that fires if the metric goes below a threshold for more than 1 minute. Which alert condition type should they use?

Accepted Answer

Metric type: custom.googleapis.com, condition: metric threshold (below value), duration: 60s. The requirement is to fire an alert when the metric value goes below a threshold for more than 1 minute. The 'metric threshold (below value)' condition type directly monitors a metric against a lower bound and evaluates the condition over the specified duration (60s) before triggering. This aligns with the need to detect sustained low values, not just a single data point.

Answer

Metric type: custom.googleapis.com, condition: metric lower bound, duration: 60s

Answer

Metric type: custom.googleapis.com, condition: metric change, duration: 60s

Answer

Metric type: custom.googleapis.com, condition: metric absence, duration: 60s

Question 3

A company runs a microservices application on Google Kubernetes Engine. They use Cloud SQL for persistent data. Recently, during a traffic spike, the application experienced increased latency and some requests failed with timeout errors. The team observed that the Cloud SQL CPU utilization spiked to 100%, and the GKE pods had high memory usage. They are using a standard Cloud SQL tier (db-n1-standard-2). Which course of action would best improve the application's performance and reliability?

Accepted Answer

Implement caching with Memorystore for frequently accessed data.. The primary bottleneck is the Cloud SQL CPU spiking to 100% under heavy read traffic. Implementing Memorystore (Redis) caching offloads repeated read queries from the database, reducing CPU load and query latency. This directly addresses the root cause—database CPU exhaustion—without requiring a larger database instance or adding replicas that would still be limited by the same CPU.

Answer

Upgrade Cloud SQL to a higher tier with more CPU.

Answer

Increase the number of replicas in GKE to reduce load per pod.

Answer

Add read replicas to Cloud SQL.

Question 4

An engineer is deploying AlloyDB for PostgreSQL and needs to support read scaling with automatic scaling of read replicas based on load. They also want to ensure minimal operational overhead. What should they use?

Accepted Answer

Create a read pool instance with autoscaling enabled.. AlloyDB read pool instances are designed specifically for horizontal read scaling. When autoscaling is enabled, AlloyDB automatically adds or removes read replicas in the pool based on CPU utilization and other load metrics, eliminating manual capacity management. This directly satisfies both the read-scaling and minimal-operational-overhead requirements.

Answer

Manually create additional read replicas and set up a load balancer.

Answer

Create multiple cross-region replicas.

Answer

Use AlloyDB Omni to deploy replicas on-premises.

Question 5

Refer to the exhibit. A developer runs the above command to deploy a Cloud Function triggered by Pub/Sub. The function fails to execute when a message is published. The logs show: "Function execution took 60001 ms, finished with status: 'timeout'". What should the developer do?

Accepted Answer

Check the function code for long-running operations. The timeout error indicates the Cloud Function is exceeding its maximum execution duration. The default timeout for Cloud Functions is 60 seconds, and the logs confirm the function ran for 60001 ms before being forcibly terminated. The most likely cause is that the function code contains long-running operations (e.g., synchronous HTTP calls, database queries, or heavy computation) that do not complete within the allotted time. Therefore, the developer should inspect and optimize the function code to reduce execution time, such as by using asynchronous processing or breaking the work into smaller chunks.

Answer

Change the trigger to HTTP

Answer

Reduce the number of function instances

Answer

Increase the function timeout to 9 minutes

Question 6

Refer to the exhibit. The function returns 'Error' even though the document exists. What is the most likely reason?

Accepted Answer

The document ID in the query parameter is URL-encoded and needs to be decoded using `decodeURIComponent`.. The most likely reason is that the document ID in the query parameter is URL-encoded, and the function does not decode it before using it as a Firestore document reference. Firestore document IDs are case-sensitive and must match exactly; a URL-encoded string like 'doc%20name' will not match the actual document 'doc name', causing the update to fail and return 'Error'. Using `decodeURIComponent` on the parameter before passing it to Firestore resolves this.

Answer

The function has insufficient IAM permissions for Firestore.

Answer

The Firestore emulator is not running.

Answer

The `update` method requires that the document exists.

Question 7

A company is using Cloud Deploy to manage canary deployments to GKE. They want to automatically promote a release to the 'production' target if the canary deployment in the 'staging' target passes a set of automated smoke tests. What is the required configuration?

Accepted Answer

Define a deployment verifier in the pipeline that runs smoke tests and promotes on success.. Cloud Deploy supports deployment verifiers, which are custom Cloud Build jobs that run as part of a rollout. By defining a verifier in the pipeline that executes automated smoke tests, the canary deployment in the staging target can be automatically promoted to production only if the verifier succeeds. This integrates testing directly into the delivery pipeline without manual intervention.

Answer

Create a Cloud Build trigger to redeploy on test success.

Answer

Configure a manual approval gate between staging and production in the delivery pipeline.

Answer

Set the 'automaticPromotion' flag to true on the staging target.

Question 8

Your company runs a multi-tier web application on Google Kubernetes Engine (GKE). The application consists of a frontend service, a backend API service, and a PostgreSQL database managed by Cloud SQL. Recently, users have been reporting intermittent slow response times during peak hours (10 AM - 12 PM). You have set up Cloud Monitoring dashboards and alerts. Cloud Trace shows that the backend API service has high latency, but only for certain requests. You notice that the backend service's CPU utilization is around 60% during peak hours, and memory usage is normal. The Cloud SQL instance's CPU utilization is at 90% and the query latency is high. You have also observed that the backend service makes multiple database queries per request, some of which are repeated. What is the most effective course of action to reduce latency?

Accepted Answer

Increase the CPU and memory of the Cloud SQL instance to handle the load. The primary bottleneck is the Cloud SQL instance, which is running at 90% CPU with high query latency. Since the backend service's CPU is only at 60% and memory is normal, scaling the database directly addresses the root cause. Increasing the Cloud SQL instance's CPU and memory provides more processing power and connection capacity to handle the peak load, reducing query latency and overall response times.

Answer

Scale up the backend API service by increasing the number of replicas

Answer

Scale up the frontend service by increasing the number of replicas

Answer

Implement a caching layer using Memorystore for Redis to cache database query results

Question 9

An application running on GKE uses a custom metric to track order processing time. The metric is exported via Prometheus and ingested by Cloud Monitoring using the Managed Service for Prometheus. The team wants to create an alert when the 95th percentile latency exceeds 2 seconds over a 5-minute window. Which PromQL query should be used?

Accepted Answer

histogram_quantile(0.95, rate(order_processing_duration_seconds_bucket[5m])). `histogram_quantile(0.95, rate(order_processing_duration_seconds_bucket[5m]))` computes the 95th percentile latency over a 5-minute window using Prometheus histogram buckets. The `rate()` function calculates the per-second increase of each bucket, which is required for accurate quantile estimation from cumulative histograms, and the result directly gives the latency threshold below which 95% of requests fall.

Answer

avg(rate(order_processing_duration_seconds_sum[5m])) / avg(rate(order_processing_duration_seconds_count[5m]))

Answer

histogram_quantile(0.95, sum(rate(order_processing_duration_seconds_bucket[5m])))

Answer

histogram_quantile(0.95, order_processing_duration_seconds_bucket)

Question 10

You are migrating an on-premises Oracle database to Cloud SQL for PostgreSQL. You need to assess the migration feasibility and convert the schema. Which tools should you use?

Accepted Answer

Use Ora2Pg for schema conversion and DMS for data migration.. Ora2Pg is an open-source tool that converts Oracle schema to PostgreSQL. Database Migration Service (DMS) supports migration from Oracle to Cloud SQL for PostgreSQL. For assessment, you can use tools like Oracle Migration Toolkit or Ora2Pg's assessment mode.

Answer

Use mysqldump to export and import to PostgreSQL.

Answer

Use pg_dump to export the Oracle database and import into Cloud SQL.

Answer

Use DMS directly with Oracle source; it automatically converts schema.

Question 11

An organization is migrating from Oracle to Cloud SQL for PostgreSQL. They need to convert Oracle packages (which use PL/SQL) into PostgreSQL equivalents. Which TWO approaches are correct for handling Oracle packages?

Accepted Answer

Rewrite PL/SQL code into PL/pgSQL syntax.. Option A is correct because Oracle packages contain PL/SQL code, and Cloud SQL for PostgreSQL executes procedural logic in PL/pgSQL, so the package bodies must be manually rewritten into PL/pgSQL syntax (including converting constructs like %TYPE, %ROWTYPE, and Oracle-specific built-ins). Option D is correct because PostgreSQL has no native package object; the standard migration pattern is to map each Oracle package to a dedicated PostgreSQL schema that groups the equivalent functions and procedures, preserving the package's namespace and encapsulation. Option B is wrong because pgAgent is only a job scheduler for PostgreSQL and does not translate or execute Oracle PL/SQL packages. Option C is wrong because PostgreSQL (and Cloud SQL for PostgreSQL) does not provide an Oracle compatibility mode that runs PL/SQL packages natively. Option E is wrong because the Orafce extension supplies Oracle-compatible functions and operators (e.g., NVL, DECODE, TO_DATE behaviors) but does not provide a PL/SQL package engine or convert package code.

Answer

Use pgAgent to schedule package execution.

Answer

Use Oracle compatibility mode in PostgreSQL.

Answer

Install the Orafce extension for Oracle compatibility.

Question 12

Refer to the exhibit. A developer configured a Pub/Sub push subscription to a Cloud Run service. Messages are not being delivered to the Cloud Run service. The developer verified that the service is running and the IAM permissions are correct. What is the most likely issue?

Accepted Answer

The OIDC token audience does not match the Cloud Run service's URL. For Pub/Sub push subscriptions to Cloud Run, the push endpoint must include an OIDC token whose audience matches the Cloud Run service's URL. If the audience does not match, Cloud Run rejects the request with a 401 or 403 error, and messages are not delivered. This is the most likely issue when the service is running and IAM permissions are correct.

Answer

The service account does not have the pubsub.publisher role

Answer

The push endpoint URL is not a valid HTTPS endpoint

Answer

The ackDeadlineSeconds is too short for the Cloud Run service to process messages

Question 13

A DevOps team is troubleshooting high latency in a Cloud Bigtable instance. They notice that the row keys are lexicographically sorted timestamps. Which TWO actions will MOST improve performance? (Select 2 answers)

Accepted Answer

Use salt (hash prefix) in the row key. Option D is correct because Bigtable stores rows in lexicographic order and distributes them across tablets by key range; timestamp-only keys cause all new writes to land on the last tablet, creating a hotspot, so adding a salt (hash prefix) spreads writes across many tablets and improves throughput/latency. Option E is correct because prepending a high-cardinality field such as user ID before the timestamp also distributes writes across the key space while still allowing efficient prefix scans per user, eliminating the sequential-write hotspot. Option A is not correct because adding nodes increases capacity but cannot fix a hot tablet caused by a monotonically increasing key, since a single tablet cannot be split to parallelize that hotspot. Option B is not correct because more column families do not change row-key distribution and can even add overhead. Option C is not correct because compression reduces storage and some I/O, but it does not address the write hotspot from lexicographically sorted timestamp keys.

Answer

Add more Bigtable nodes

Answer

Increase the number of column families

Answer

Enable compression on column families

Question 14

A team is deploying a microservice application on Google Kubernetes Engine (GKE). They want to ensure high availability and minimize downtime during rolling updates. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure pod disruption budgets to limit the number of pods that can be unavailable simultaneously.. PodDisruptionBudgets (PDBs) allow you to specify the minimum number of pods that must remain available during voluntary disruptions like rolling updates, ensuring high availability. Option D is correct because readiness probes control when a pod is added to a Service's endpoints; during rolling updates, they prevent traffic from being sent to a pod until it is ready, minimizing downtime.

Answer

Use Horizontal Pod Autoscaler to automatically adjust the number of pods based on CPU utilization.

Answer

Enable liveness probes to automatically restart pods that become unresponsive.

Answer

Enable node auto-repair to automatically replace unhealthy nodes.

Question 15

A company uses Memorystore for Redis as a session store. They observe that sessions are evicted before their TTL expires, causing users to be logged out prematurely. Which action should they take?

Accepted Answer

Increase the memory size of the instance. Premature eviction of sessions before their TTL expires is a classic symptom of memory pressure: Redis evicts keys according to maxmemory-policy when the instance's maxmemory limit is reached. Increasing the instance memory size raises maxmemory, giving the working set enough headroom so that session keys survive until their TTL. This directly addresses the root cause rather than masking it.

Answer

Enable persistence (RDB/AOF)

Answer

Change the eviction policy to volatile-ttl

Answer

Increase the maxmemory-policy to allkeys-lru

Question 16

A company runs a stateful application on Compute Engine with regional persistent disks. They want to achieve high availability with automatic failover in case of a zone failure. Which architecture meets these requirements?

Accepted Answer

Use regional persistent disks with a managed instance group spanning two zones. Regional persistent disks synchronously replicate data across two zones, and when combined with a managed instance group (MIG) spanning those same two zones, the application can automatically fail over to the healthy zone if one zone fails. The MIG's autohealing and health-check mechanisms detect the failure and recreate instances in the surviving zone, while the regional PD remains accessible from either zone, ensuring high availability without manual intervention.

Answer

Use Cloud Storage FUSE to mount a multi-regional bucket as a filesystem

Answer

Use standard persistent disks with scheduled snapshots to a multi-region bucket

Answer

Use zonal persistent disks with a managed instance group in a single zone

Question 17

Which THREE are valid approaches for automating testing in a Cloud Build CI pipeline?

Accepted Answer

Use Cloud Build triggers to run tests on every push to a branch.. Option B is correct because Cloud Build triggers (e.g., a push trigger on a branch) can automatically start a build that executes test steps whenever code is pushed, which is a standard CI testing approach. Option D is correct because Cloud Build supports multiple steps in a build config, and steps run in parallel by default unless you declare waitFor dependencies, so tests can be distributed across parallel steps for faster feedback. Option E is correct because a build step can use a custom builder image (referenced via the 'name' field in cloudbuild.yaml) that contains your test framework and commands, allowing arbitrary test execution inside the pipeline. Option A is not a valid testing approach because Cloud Monitoring is for metrics, dashboards, and alerting, not for shipping or executing test results as part of CI. Option C is not a valid Cloud Build testing approach because Cloud Build does not natively gate steps on manual approval; approvals are handled by external systems or release pipelines, not as a built-in Cloud Build test mechanism.

Answer

Use Cloud Build to ship test results to Cloud Monitoring.

Answer

Use Cloud Build to run tests only after manual approval.

Question 18

A company is migrating a 2 TB Oracle database to AlloyDB for PostgreSQL using Oracle to PostgreSQL migration tool (Ora2Pg). The migration must have minimal downtime. The team plans to use a two-phase approach: first a full dump, then incremental CDC. However, Ora2Pg does not natively support CDC. How should they achieve near-zero downtime migration?

Accepted Answer

Use Database Migration Service (DMS) with Oracle as source and AlloyDB as destination. Database Migration Service (DMS) supports continuous change data capture (CDC) from Oracle to AlloyDB for PostgreSQL, enabling near-zero downtime migration. Unlike Ora2Pg, which only handles full dump and restore, DMS uses Oracle LogMiner or binary logs to capture incremental changes and apply them to AlloyDB in near real-time, making it the correct choice for a two-phase migration with minimal downtime.

Answer

Use Dataflow to stream Oracle changes from Pub/Sub to AlloyDB

Answer

Use Ora2Pg for the full dump, then manually capture Oracle redo logs and apply them to AlloyDB

Answer

Export Oracle data to CSV, load into AlloyDB, then use a custom script with cron to apply changes

Question 19

Which THREE are best practices for building applications on GKE? (Choose three.)

Accepted Answer

Set resource requests and limits for CPU and memory. Option A is correct because setting CPU and memory requests lets the scheduler place pods on nodes with sufficient capacity, while limits prevent a single container from starving others and enable proper QoS classes and autoscaling decisions. Option C is correct because readiness probes ensure traffic only reaches containers that are ready to serve, and liveness probes let kubelet restart containers that are stuck or deadlocked, improving availability and reliability. Option E is correct because Google-managed SSL certificates integrate with GKE Ingress to automatically provision and renew TLS certificates for HTTPS, reducing operational overhead and avoiding expired-certificate outages. Option B is not a best practice because pinning pods to specific node instances via nodeSelector reduces scheduling flexibility and resilience, and performance consistency is better achieved with node affinity, taints/tolerations, or dedicated node pools. Option D is not a best practice because StatefulSets are intended for stateful workloads needing stable identities and persistent storage, while stateless applications should generally use Deployments for simpler scaling and rolling updates.

Answer

Use nodeSelector to pin pods to specific node instances for performance consistency

Answer

Use StatefulSets for all applications to preserve state across restarts

Question 20

You are managing a microservices application deployed on Google Kubernetes Engine (GKE) that uses Cloud Monitoring and Cloud Logging. Recently, users have reported intermittent slow response times, especially during peak hours. You have enabled the Ops Agent on GKE nodes and configured custom metrics for your services. The application consists of a frontend service, a backend API service, and a database service. The frontend calls the backend, which in turn queries the database. You notice that when the response time spikes, the frontend service's CPU utilization remains low, but the backend service's CPU utilization increases. The database service shows normal latency and no errors. You have examined the logs and found no application errors. The GKE cluster has three node pools: one for each service, with autoscaling enabled. The backend service is configured with a HorizontalPodAutoscaler (HPA) based on CPU utilization, but the HPA does not seem to scale up quickly enough during traffic spikes. You want to identify the root cause of the performance degradation. Which course of action should you take first?

Accepted Answer

Analyze the backend service's request latency distribution using Cloud Monitoring metrics to identify whether the issue is due to increased request volume or slow request processing.. The intermittent slow response times during peak hours, combined with low frontend CPU but high backend CPU and normal database latency, strongly suggest the backend service is struggling to process requests quickly under load. Analyzing the backend's request latency distribution using Cloud Monitoring metrics (e.g., 99th percentile latency) will reveal whether the issue stems from increased request volume (which would show a shift in latency distribution) or from individual requests taking longer to process (e.g., due to inefficient code or resource contention). This diagnostic step directly addresses the symptom without making assumptions about scaling or network issues.

Answer

Check the network latency between the frontend and backend services using Cloud Monitoring's network metrics.

Answer

Configure the backend service's HPA to use custom metrics based on request latency instead of CPU utilization.

Answer

Increase the minimum number of replicas for the backend service to handle peak traffic.