PCD Hard Questions — 25 Difficult Questions

Question 1

A company is deploying a microservices architecture on GKE. They need to expose a set of related microservices under a single external IP address with path-based routing. Which Kubernetes resource should they use?

Accepted Answer

Ingress resource. An Ingress resource is the correct choice because it provides HTTP/HTTPS layer-7 routing to expose multiple services under a single external IP address, using path-based or host-based rules. This directly meets the requirement of exposing a set of related microservices with path-based routing on GKE, whereas a Service of type LoadBalancer would create a separate external IP per service.

Answer

Service of type NodePort

Answer

NetworkPolicy

Answer

Service of type LoadBalancer

Question 2

A company uses Cloud Logging to centralize logs from multiple projects. They want to create a log-based metric for tracking 404 errors. However, the metric shows zero data even though 404 errors are occurring. What is the most likely reason?

Accepted Answer

The logs are being excluded by an exclusion filter before the metric is applied. Option D is correct because log-based metrics are computed from logs that have passed through all exclusion filters. If an exclusion filter is configured to discard logs matching certain criteria (e.g., all HTTP 4xx responses), those logs are never evaluated by the metric filter, causing the metric to show zero data even though 404 errors are occurring. Exclusion filters are applied before log-based metric evaluation in Cloud Logging.

Answer

The metric filter uses the wrong resource type

Answer

The metric is sampled and not all logs are considered

Answer

The logs are not being exported to Cloud Logging

Question 3

A company running a high-traffic e-commerce platform on Google Cloud experiences occasional data loss in their Cloud SQL database during failover events. The database is configured with a failover replica in a different zone. What is the most likely cause of the data loss?

Accepted Answer

The database is using asynchronous replication to the failover replica.. Cloud SQL uses synchronous replication for failover replicas by default, ensuring that transactions are committed on both the primary and the replica before acknowledging the write. If asynchronous replication is configured, the replica may lag behind the primary, and during a failover, any transactions not yet replicated are lost. This is the most likely cause of data loss during failover events.

Answer

Automated backups are not enabled.

Answer

The failover replica is configured as a read replica instead of a failover replica.

Answer

The database is not using regional persistent disks.

Question 4

A team is designing a globally distributed application on Google Cloud that requires strong consistency for writes but can tolerate eventual consistency for reads. The application expects millions of concurrent users. Which two strategies should they implement? (Choose two.)

Accepted Answer

Use Cloud Spanner for write operations requiring strong consistency.. Cloud Spanner provides strongly consistent writes globally through synchronous replication using the TrueTime API and Paxos-based consensus. This ensures that all write operations are immediately consistent across regions, meeting the requirement for strong consistency on writes.

Answer

Use Firestore in multi-region mode for all operations.

Answer

Deploy Cloud SQL with cross-region replication for read scalability.

Answer

Use Cloud Bigtable for reading data with strong consistency.

Question 5

A developer finds the JSON key shown in the exhibit in a Cloud Storage bucket that is publicly accessible. Which security best practice was violated?

Accepted Answer

The key was stored in a publicly accessible Cloud Storage bucket.. Option D is correct because storing a JSON key (a service account private key) in a publicly accessible Cloud Storage bucket directly violates the principle of least privilege and exposes sensitive credentials to unauthorized users. Any entity with read access to the bucket can retrieve the key and impersonate the service account, potentially gaining unauthorized access to Google Cloud resources.

Answer

The key is not rotated regularly.

Answer

The key was created as a user-managed key instead of a Google-managed key.

Answer

The key was not encrypted using Cloud KMS.

Question 6

A company runs a stateful application on Compute Engine instances with local SSDs. They need to perform maintenance that requires stopping the instances. What is the best approach to ensure data durability and minimal downtime?

Accepted Answer

Migrate data to persistent disks and configure the application to use persistent disks. Local SSDs provide ephemeral storage that is tied to the lifecycle of the Compute Engine instance. When an instance is stopped or terminated, data on local SSDs is permanently lost. To ensure data durability during maintenance that requires stopping the instance, the application must use persistent disks, which are durable network-attached storage that persists independently of the instance. Option D is correct because migrating the application to persistent disks ensures data survives the stop and allows the instance to be restarted with the same data, minimizing downtime.

Answer

Create a snapshot of the local SSD before stopping the instance

Answer

Use instance groups with autohealing to automatically recreate instances

Answer

Enable live migration on the instance

Question 7

You are troubleshooting a web application deployed on Compute Engine instances behind a target pool. Users report intermittent timeouts when accessing the application via the forwarding rule's IP address. Based on the exhibit, what is the most likely cause of the issue?

Accepted Answer

The target pool lacks health checks, causing traffic to be sent to unhealthy instances.. The target pool in a legacy HTTP(S) load balancer does not automatically perform health checks unless they are explicitly configured. Without health checks, the load balancer continues to send traffic to all instances in the pool, including those that are unhealthy or unresponsive. This causes intermittent timeouts when users hit an unhealthy instance, as the forwarding rule distributes connections across the entire pool without verifying instance health.

Answer

The forwarding rule is missing a backend service.

Answer

The port range is set to 80-80, which restricts traffic to port 80 only.

Answer

The forwarding rule should use a backend service instead of a target pool for HTTP traffic.

Question 8

Refer to the exhibit. A developer deployed a Cloud Run service as shown. Authenticated requests from another service in the same project using a service account receive 403 Forbidden. What is the most likely cause?

Accepted Answer

The service account used to authenticate is not granted the roles/run.invoker role on the Cloud Run service. Option C is correct because the Cloud Run service requires the IAM role `roles/run.invoker` on the service itself for any principal (including a service account) to invoke it. Since the service was deployed with `--no-allow-unauthenticated`, only explicitly granted principals can invoke it. The service account used for authentication lacks this role, causing the 403 Forbidden response.

Answer

The Cloud Run service requires the 'allAuthenticatedUsers' member to be added

Answer

The --no-allow-unauthenticated flag blocks all requests including authenticated ones

Answer

The container image was built without proper authentication headers

Question 9

Which THREE steps are required to set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub? (Choose THREE.)

Accepted Answer

Enable the Cloud Build, Cloud Run, and Artifact Registry APIs.. Options A, B, and D are required. Option C is optional; Cloud Build can connect to GitHub without a mirror. Option E is wrong because Artifact Registry is used, not Container Registry (deprecated).

Answer

Push the container image to Container Registry.

Answer

Mirror the GitHub repository to Cloud Source Repositories.

Question 10

A developer runs the above command and cloudbuild.yaml. The build fails at the deploy step with a permission error. The developer has the Cloud Build Editor role on the project. What is the likely cause?

Accepted Answer

The Cloud Build service account lacks the Cloud Run Admin role.. The Cloud Build Editor role grants permissions to submit builds and execute build steps, but the actual execution of those steps (including the deploy step) runs under the Cloud Build service account. By default, this service account does not have the Cloud Run Admin role, which is required to deploy to Cloud Run. Without this role, the `gcloud run deploy` command fails with a permission error.

Answer

The Cloud Build Editor role does not have permission to submit builds.

Answer

The Docker image is not in a format compatible with Cloud Run.

Answer

The build step uses the 'gcloud' command without authentication.

Question 11

A developer is designing a CI/CD pipeline for a Node.js application hosted on Cloud Run using Cloud Build. The pipeline should run unit tests, build the container, push to Artifact Registry, and deploy to Cloud Run. The developer wants to minimize build time by caching dependencies. What is the recommended approach?

Accepted Answer

Use Cloud Build's built-in caching with a persistent volume to store node_modules between builds.. Option D is correct because Cloud Build supports built-in caching via persistent volumes (e.g., `/cache` or `/workspace`) that can store `node_modules` across builds. By configuring a cache volume in the `cloudbuild.yaml` and using `npm ci --prefer-offline`, the pipeline avoids re-downloading dependencies on every run, significantly reducing build time for Node.js applications on Cloud Run.

Answer

Run npm install locally and commit the node_modules folder to the repository for faster builds.

Answer

Use Cloud Build's step-level caching by copying the node_modules from a previous build step.

Answer

Create a custom base image that includes all dependencies and reference it in the Dockerfile.

Question 12

A team is deploying a critical application on Google Kubernetes Engine (GKE) and needs to ensure high availability and disaster recovery. Which THREE actions should they take?

Accepted Answer

Use a regional cluster with control plane replicated across zones.. Option B is correct because a regional cluster in GKE replicates the control plane across multiple zones within a region, ensuring that if one zone fails, the control plane remains available. This is essential for high availability and disaster recovery, as it eliminates a single point of failure for cluster management operations.

Answer

Deploy all pods in a single zone for simplicity.

Answer

Use a zonal cluster to reduce costs.

Question 13

A company deploys a Java application on Compute Engine with a preemptible VM instance group managed by an instance template. The application writes critical state to local SSD. After a preemption event, the new instance starts fresh and loses state. What is the best practice to ensure state persistence?

Accepted Answer

Refactor the application to write state to a persistent service like Cloud Storage. Option B is correct because local SSD data is ephemeral and lost on VM preemption or termination. Refactoring the application to write critical state to a persistent service like Cloud Storage ensures data durability independent of the VM lifecycle. This aligns with the best practice of designing preemptible workloads to be stateless, where state is stored externally.

Answer

Modify the startup script to recover state from a snapshot

Answer

Configure the managed instance group as stateful to preserve local SSD data

Answer

Use a regular (non-preemptible) VM instead of preemptible

Question 14

An administrator runs the above command to create a Compute Engine instance. However, the nginx service does not start. What is the most likely cause?

Accepted Answer

The instance has no external IP address and cannot reach the internet to download packages.. The command likely creates a Compute Engine instance without specifying an external IP address (e.g., using `--no-address` or omitting `--address`). Without an external IP, the instance cannot reach the internet to download the nginx package from repositories, causing the startup script that installs and starts nginx to fail. This is the most direct cause of the nginx service not starting.

Answer

The metadata key is misspelled; it should be 'startup-script-url'.

Answer

The instance does not have the compute.instance.update permission.

Answer

The startup script runs before the boot disk is fully mounted.

Question 15

Which TWO actions should a developer take to ensure that a Cloud Run service can access a Cloud SQL instance securely?

Accepted Answer

Use the Cloud SQL Auth Proxy as a sidecar container in the same pod.. Option C is correct because the Cloud SQL Auth Proxy, when deployed as a sidecar container in the same pod, provides encrypted connections and IAM-based authentication to Cloud SQL without requiring a public IP or complex network configuration. It automatically handles TLS 1.3 encryption and uses the service account's IAM permissions to authorize connections, ensuring secure access from Cloud Run.

Answer

Use a Cloud NAT to provide outbound internet access for the service.

Answer

Assign a public IP to the Cloud SQL instance and allow all traffic from Cloud Run.

Answer

Create a service account with the cloudsql.instances.connect permission.

Question 16

A team is building a serverless event-driven application using Cloud Functions and Cloud Pub/Sub. The function processes messages from a Pub/Sub subscription and writes results to Firestore. During peak hours, the function experiences high latency and some messages are being retried multiple times. Which three steps should the team take to improve reliability and scalability? (Choose three.)

Accepted Answer

Enable retry policy on the Pub/Sub subscription to automatically retry failed messages.. Option A is correct because enabling a retry policy on the Pub/Sub subscription ensures that messages that fail to be processed (e.g., due to transient errors or timeouts) are automatically retried. This prevents message loss and improves reliability by allowing the Cloud Function to reprocess messages without manual intervention. The retry policy works with the subscription's acknowledgement deadline, so messages are redelivered if not acknowledged in time.

Answer

Batch multiple Pub/Sub messages into a single Cloud Function invocation.

Answer

Increase the Cloud Function timeout to the maximum allowed value.

Question 17

A DevOps team wants to set up custom metrics for a serverless application running on Cloud Run. The application emits metrics using OpenTelemetry. They need to collect these metrics and create an alerting policy that triggers when the 99th percentile latency exceeds 500ms for 5 minutes. Which TWO actions must they take? (Choose two.)

Accepted Answer

Create a custom distribution metric for the latency data and set up a metric threshold alert using the 99th percentile value.. Option A is correct because to alert on the 99th percentile of latency, you must create a custom distribution metric, which stores a histogram of values and allows percentile calculations. A metric-threshold alert policy can then be configured to evaluate the 99th percentile value against the 500ms threshold over a 5-minute window.

Answer

Install the Cloud Monitoring agent on the Cloud Run instance to collect custom metrics.

Answer

Define a log-based metric from the application logs that captures latency entries.

Answer

Configure the Cloud Monitoring dashboard to query the metrics using PromQL.

Question 18

You are designing a serverless application using Cloud Functions that processes events from Cloud Storage and Cloud Pub/Sub. The function must be idempotent and handle duplicate events. Which three best practices should you implement? (Choose THREE.)

Accepted Answer

Generate a unique idempotency key for each event and store processed keys in a database.. Option A is correct because generating a unique idempotency key for each event and storing processed keys in a database (such as Cloud Firestore) ensures that if the same event is delivered multiple times (e.g., due to at-least-once delivery semantics in Cloud Pub/Sub or Cloud Storage notifications), the function can check the key before processing and skip duplicates. This pattern is essential for idempotent serverless functions, as Cloud Functions may be retried on failure or receive duplicate events from the source.

Answer

Invoke the function synchronously to avoid duplicates.

Answer

Set the function timeout to maximum (540 seconds) to ensure processing completes.

Question 19

You are designing a monitoring strategy for a microservices architecture running on GKE. Each service emits custom business metrics (e.g., order processing time). You want to create a dashboard that shows the 99th percentile latency for each service over the last 7 days. Which approach should you take?

Accepted Answer

Write custom metrics to Cloud Monitoring and create a dashboard with the 99th percentile aligner.. Option B is correct because Cloud Monitoring supports custom metrics and provides built-in aligners, including a 99th percentile aligner, which can be applied directly in a dashboard chart. This allows you to compute the 99th percentile latency for each service over the last 7 days without manual calculation or exporting logs. Custom metrics are the appropriate mechanism for business metrics like order processing time, as they are designed for numeric time-series data.

Answer

Export logs to Cloud Logging and use Log Analytics to compute percentiles.

Answer

Use Metrics Explorer to view the metrics and manually compute percentiles.

Answer

Use Prometheus monitoring built into GKE and query the avg() function.

Question 20

A team is migrating a monolithic .NET application to Cloud Run. The application uses .NET Framework 4.8 and depends on Windows-specific libraries. What is the recommended approach to containerize and deploy this application?

Accepted Answer

Port the application to .NET Core/.NET 6+ and run on Linux. Cloud Run only supports Linux containers, so a .NET Framework 4.8 application that depends on Windows-specific libraries cannot be directly deployed. The recommended approach is to port the application to .NET Core/.NET 6+ (now .NET 8/9), which is cross-platform and can run on Linux containers, enabling deployment to Cloud Run. This aligns with Google's guidance for modernizing legacy .NET applications to leverage serverless platforms.

Answer

Deploy the application on Compute Engine with Windows Server

Answer

Use Cloud Run for Anthos on a Windows node pool

Answer

Use a Windows base image and deploy to Cloud Run