PCD Integrating Google Cloud services — 10 Questions

Question 1

Your application runs on Compute Engine and uses Cloud Pub/Sub to receive messages from a third-party service. Recently, the message delivery latency has increased significantly. The third-party reports no issues on their end. You notice that the Pub/Sub subscription's 'ackDeadlineSeconds' is set to 10. What is the most likely cause of the latency?

Accepted Answer

The ackDeadlineSeconds is too short, causing frequent message redelivery.. A is correct because a 10-second ackDeadlineSeconds is very short. If your subscriber cannot process and acknowledge messages within 10 seconds, Pub/Sub will consider them unacknowledged and redeliver them. This redelivery causes duplicate processing and increases overall latency as messages are repeatedly sent back to the subscriber, delaying their final consumption.

Answer

The topic's message retention duration is too long.

Answer

The push endpoint is not responding, causing Pub/Sub to retry.

Answer

The subscription has an exponential backoff policy that is too aggressive.

Question 2

You are designing a data pipeline that ingests streaming data from IoT devices using Cloud IoT Core, processes it with Dataflow, and stores results in BigQuery. The data volume is expected to be 10 GB per day with occasional spikes. You need to minimize processing latency and cost. Which configuration should you choose for the Dataflow pipeline?

Accepted Answer

Use streaming mode with streaming engine enabled and 2 workers.. Option C is correct because streaming mode with Streaming Engine is designed for low-latency, continuous data ingestion from IoT Core, and setting 2 workers minimizes cost while handling the expected 10 GB/day volume with occasional spikes through autoscaling. Streaming Engine offloads state management to the backend, reducing worker overhead and improving latency, making it ideal for this use case.

Answer

Use streaming mode with autoscaling and maximum workers set to 10.

Answer

Use Dataflow Prime for automatic optimization.

Answer

Use batch mode with a fixed number of workers to reduce cost.

Question 3

A company stores sensitive user data in Cloud Storage. They want to ensure that only authenticated users with the appropriate permissions can access the data, and that data is encrypted at rest. Which two steps should they take? (Choose TWO.)

Accepted Answer

Enable default encryption on the bucket using Google-managed keys.. Option B is correct because Cloud Storage buckets are encrypted at rest by default using Google-managed keys, which satisfies the requirement for data encryption without additional configuration. Option C is correct because IAM roles provide fine-grained access control, ensuring only authenticated users with appropriate permissions can access the data.

Answer

Configure a Customer-Managed Encryption Key (CMEK) in Cloud KMS.

Answer

Set bucket-level public access prevention.

Answer

Enable VPC Service Controls to restrict data access.

Question 4

You are designing a serverless application using Cloud Functions that processes events from Cloud Storage and Cloud Pub/Sub. The function must be idempotent and handle duplicate events. Which three best practices should you implement? (Choose THREE.)

Accepted Answer

Generate a unique idempotency key for each event and store processed keys in a database.. Option A is correct because generating a unique idempotency key for each event and storing processed keys in a database (such as Cloud Firestore) ensures that if the same event is delivered multiple times (e.g., due to at-least-once delivery semantics in Cloud Pub/Sub or Cloud Storage notifications), the function can check the key before processing and skip duplicates. This pattern is essential for idempotent serverless functions, as Cloud Functions may be retried on failure or receive duplicate events from the source.

Answer

Invoke the function synchronously to avoid duplicates.

Answer

Set the function timeout to maximum (540 seconds) to ensure processing completes.

Question 5

You need to monitor the CPU usage of a Compute Engine instance and trigger an alert when it exceeds 80% for 5 minutes. Which Google Cloud service should you use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it provides metrics, dashboards, and alerting policies for Compute Engine instances. You can create a metric-based alert condition that triggers when the CPU utilization metric exceeds 80% for a duration of 5 minutes, using the MQL or policy builder.

Answer

Cloud Debugger

Answer

Cloud Logging

Answer

Error Reporting

Question 6

Your company uses Cloud SQL for MySQL to store transactional data. You need to perform a point-in-time recovery (PITR) to recover from a logical error that occurred 30 minutes ago. Which two prerequisites must be met? (Choose TWO.)

Accepted Answer

Binary logging is enabled.. Point-in-time recovery (PITR) for Cloud SQL for MySQL relies on binary logs to replay transactions up to a specific timestamp. Binary logging must be enabled because it records all changes to the database, allowing you to restore to any point within the retention period. Automated backups are also required because PITR uses the most recent full backup as a base, then applies binary logs from that backup to the target time. Without automated backups, there is no base image to start the recovery process.

Answer

High availability (HA) is configured.

Answer

The backup window is set to a time before the incident.

Answer

A read replica is configured.

Question 7

You are designing a CI/CD pipeline using Cloud Build. You want to automatically trigger a build when code is pushed to a specific branch in Cloud Source Repositories. What is the correct configuration?

Accepted Answer

Create a build trigger in Cloud Build with a regex pattern for the branch name.. Option D is correct because Cloud Build natively supports build triggers that can be configured to automatically start a build when code is pushed to a specific branch in Cloud Source Repositories. The trigger uses a regex pattern to match the branch name, and Cloud Build listens for repository push events directly without requiring additional services.

Answer

Create a Cloud Function that invokes Cloud Build via API when a push event occurs.

Answer

Add a build step in cloudbuild.yaml that polls the repository.

Answer

Configure a Cloud Pub/Sub topic to notify Cloud Build on push events.

Question 8

A company is migrating a legacy monolithic application to Google Cloud. They want to minimize code changes and operational overhead while improving scalability. The application currently uses a relational database and stores user-uploaded images on a local filesystem. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud SQL for the database and Cloud Storage with Cloud CDN for images. Option C is correct because Cloud SQL provides a fully managed relational database that requires minimal code changes when migrating from an existing relational database, while Cloud Storage with Cloud CDN handles user-uploaded images with scalable object storage and low-latency content delivery. This combination minimizes operational overhead by eliminating the need to manage database servers or file servers, and improves scalability through automatic replication and global edge caching.

Answer

Cloud Spanner for the database and Cloud Storage for images

Answer

Cloud Firestore for the database and Cloud Storage with Cloud CDN for images

Answer

Compute Engine with attached SSD persistent disks for both database and images

Question 9

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They want to automatically build and deploy each service when a new tag is pushed to its repository. They also need to run integration tests against a staging environment before promoting to production. Which service should they use to orchestrate the pipeline?

Accepted Answer

Cloud Build with a build trigger on tag push. Cloud Build with a build trigger on tag push is the correct choice because it natively supports event-driven pipelines triggered by Git tags, enabling automatic build and deployment of each microservice. Combined with Cloud Build's ability to run integration tests in a staging environment and then promote to production, it provides a complete CI/CD solution for GKE without additional orchestration services.

Answer

Deployment Manager with a template

Answer

Cloud Deploy with a delivery pipeline

Answer

Cloud Run with continuous deployment

Question 10

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Accepted Answer

By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.. Option A is correct because Cloud Storage automatically encrypts all data at rest using server-side encryption with Google-managed encryption keys by default, without any additional configuration. This ensures that data is protected before it is written to disk and remains encrypted throughout its lifecycle.

Answer

Using a signed URL revokes the underlying object's ACL.

Answer

Enabling uniform bucket-level access disables encryption at rest.

Answer

Bucket-level policies can restrict access to only compute instances with specific service accounts.