PCD Integrating Google Cloud services Practice Test 2 — 15 Questions

Question 1

A team is designing a data pipeline that uses Cloud Storage for input files, Cloud Functions to process each file, and writes results to BigQuery. The pipeline must guarantee exactly-once processing of each file, even if the function fails and retries. Which approach should the team take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Pub/Sub to store file notification events and use Dataflow for processing with exactly-once guarantees. Using Cloud Pub/Sub to store file notification events and Dataflow for processing provides exactly-once guarantees. Option A may lead to duplicates because Cloud Storage triggers are at-least-once. Option C with Cloud Tasks can deduplicate tasks but processing may still be at-least-once if not idempotent. Option D with Cloud Workflows does not inherently provide exactly-once.

Answer

Use Cloud Storage triggers with event filters and configure the function to delete the file after successful processing

Answer

Use Cloud Tasks to queue file processing tasks and configure retries with deduplication

Answer

Use Cloud Workflows to orchestrate the pipeline and use idempotent writes to BigQuery

Question 2

An organization uses Cloud SQL for MySQL and wants to set up a read replica in a different region to improve read latency for global users. What is the recommended way to configure network connectivity between the primary and replica?

Accepted Answer

Use Private Services Access. Cloud SQL for MySQL uses Private Services Access (also known as private services access) to establish a private network connection between the Cloud SQL instance and the customer's VPC. This is the recommended and default method for enabling private IP connectivity to Cloud SQL, including cross-region read replicas. Private Services Access creates a VPC peering connection between the customer's VPC and the Google-managed service producer VPC, allowing the primary and replica to communicate over internal IP addresses without traversing the public internet.

Answer

Use a Cloud Interconnect

Answer

Use Cloud VPN with dynamic routing

Answer

Use VPC peering between the regions

Question 3

A company uses Cloud Build to build Docker images and push to Artifact Registry. They want to trigger builds automatically when code is pushed to a Cloud Source Repository branch. They also need to ensure that only builds from the repository's main branch are allowed to push to the production Artifact Registry repository. What is the best way to implement this?

Accepted Answer

Use Cloud Build triggers with branch filter and use IAM conditions on the Artifact Registry to restrict push based on the Cloud Build service account. Cloud Build triggers natively support branch filtering via the 'branch' field in the trigger configuration, so only pushes to the main branch fire the production build. To enforce that only the main-branch build can push to the production Artifact Registry repository, you attach an IAM condition on the Artifact Registry repository that grants write permission only to the specific Cloud Build service account used by the main-branch trigger. This combines trigger-level filtering with IAM-level enforcement, which is the defense-in-depth approach Google recommends.

Answer

Use Cloud Source Repository webhooks and a Cloud Function to call Cloud Build

Answer

Use Cloud Build triggers and configure separate service accounts for each branch

Answer

Use Cloud Build triggers with substitution variables and separate build configurations

Question 4

A company is using Cloud Build for CI/CD. They want to automatically trigger builds when code is pushed to a Cloud Source Repository and store the resulting Docker images in a secure, immutable artifact store. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud Source Repository. Cloud Source Repository (A) is correct because it is the Git-based source hosting service that Cloud Build natively integrates with, allowing build triggers to fire automatically on push events to the repository. Artifact Registry (C) is correct because it is Google Cloud's recommended secure, regional artifact store that supports Docker images with fine-grained IAM, vulnerability scanning, and immutable tag/repository policies. Cloud Storage (B) is not a container image registry, so it cannot serve as the Docker artifact store for Cloud Build's image push step. Cloud Functions (D) is an event-driven compute service, not a source repository or artifact registry, so it does not fulfill either requirement. Container Registry (E) is the legacy Docker image registry that is deprecated in favor of Artifact Registry, so it is not the best choice for a secure, immutable artifact store.

Answer

Cloud Storage

Answer

Cloud Functions

Answer

Container Registry

Question 5

A developer is building a serverless application that processes user-uploaded images. The images are stored in Cloud Storage, and each upload should trigger a Cloud Function that performs image analysis and stores the result in Firestore. Which TWO Google Cloud services are essential for this integration? (Choose 2)

Accepted Answer

Cloud Pub/Sub. Cloud Storage (B) is essential because it is the source of the user-uploaded images and the event origin that triggers the function; the scenario explicitly states images are stored in Cloud Storage. Cloud Pub/Sub (A) is essential because Cloud Storage event notifications are delivered through Pub/Sub topics, which Cloud Functions uses as the underlying event trigger mechanism for object-finalize events. Cloud Tasks (C) is incorrect because it is a task-queue service for asynchronous HTTP/task dispatch, not the event transport for Cloud Storage uploads. Eventarc (D) is incorrect here because, while it can route events to Cloud Run and other targets, the classic Cloud Storage-to-Cloud Function trigger path relies on Pub/Sub notifications rather than Eventarc. Cloud Scheduler (E) is incorrect because it is a cron-based job scheduler, not an event-driven trigger for object uploads.

Answer

Cloud Tasks

Answer

Eventarc

Answer

Cloud Scheduler

Question 6

A company is building a data processing pipeline that needs to ingest events from multiple sources, process them in order, and handle failures with retry. They also need to schedule periodic tasks. Which THREE services should they use? (Choose 3)

Accepted Answer

Cloud Scheduler. Cloud Pub/Sub (D) is correct because it is the managed messaging service designed to ingest events from multiple sources at scale, decoupling producers from consumers and buffering messages for ordered, reliable delivery to downstream processing. Cloud Tasks (B) is correct because it provides a queue that dispatches tasks to handlers with configurable retry policies, making it the right tool for processing work items in order and handling failures with automatic retries. Cloud Scheduler (A) is correct because it is a fully managed cron service that triggers jobs on a recurring schedule, satisfying the requirement for periodic tasks. Cloud Workflows (C) is not selected because it is a serverless orchestration engine for chaining API calls and services, not the primary mechanism for event ingestion, ordered queue processing, or cron scheduling. Cloud Logging (E) is not selected because it is an observability service for storing and querying logs, not a pipeline ingestion, task queue, or scheduling component.

Answer

Cloud Workflows

Answer

Cloud Logging

Question 7

Refer to the exhibit. A developer runs the command and sees that the Cloud Run service is publicly accessible. The security team requires that only authenticated requests from a specific service account in the same project are allowed. What should the developer do to modify the IAM policy?

Accepted Answer

Update the IAM policy to remove the allUsers member from the roles/run.invoker binding. Modifying the IAM policy to remove the allUsers member from the roles/run.invoker binding revokes public access, ensuring only authenticated requests are allowed. The service account can then be granted the roles/run.invoker role if it does not already have it. Option A adds the service account as an invoker but does not remove the allUsers member, so the service remains publicly accessible. Option C changes ingress settings, which controls network-level access, not IAM authentication; it does not address the requirement for authenticated requests. Option D removes the viewer role and adds the service account to invoker, but it fails to remove the allUsers member, leaving public access intact.

Answer

Add a new binding with the service account as the only member of roles/run.invoker

Answer

Change the service's ingress settings to "Internal and Cloud Load Balancing"

Answer

Remove the roles/run.viewer binding and add the service account to roles/run.invoker

Question 8

Refer to the exhibit. A team is deploying a Cloud Function that needs to connect to a Cloud SQL instance in a VPC. They have set up a VPC connector. After deployment, the function fails to connect to the database. What is the most likely cause?

Accepted Answer

The VPC connector is in a different region than the function. The most likely cause is that the VPC connector is in a different region than the Cloud Function. VPC connectors are regional resources and must be in the same region as the Cloud Function (or Cloud Run) to be used. If they are in different regions, the function cannot use the connector to reach the Cloud SQL instance.

Answer

The function's service account does not have permissions to use the VPC connector

Answer

The environment variable DB_HOST is misspelled

Answer

The database firewall rules do not allow traffic from the VPC connector's subnet

Question 9

A company has a Cloud Run service that ingests messages from a Cloud Pub/Sub subscription. The service uses automatic scaling based on CPU. Recently, the team noticed that when message volume spikes, the service scales up slowly, causing a backlog. What is the most effective solution to reduce the time to scale out?

Accepted Answer

Change the subscription type from pull to push and set the Cloud Run service as the push endpoint.. Changing the Pub/Sub subscription from pull to push and setting the Cloud Run service as the push endpoint is correct because push subscriptions deliver messages directly to the service, triggering immediate scaling based on incoming requests. This reduces the latency between message arrival and instance scaling, as Cloud Run can scale out in response to the push traffic. Pull subscriptions require the service to poll, which can delay scaling during spikes.

Answer

Increase the max instances for the Cloud Run service to 100.

Answer

Use Cloud Tasks to buffer messages and configure a Cloud Scheduler job to pull from the queue.

Answer

Set a minimum number of instances on the Cloud Run service to 5.

Question 10

A developer is integrating an App Engine standard environment app with Cloud Storage. The app needs to read objects from a bucket that is in a different project. The developer has granted the App Engine service account the Storage Object Viewer role on the bucket. However, the app still gets a 403 error when trying to read objects. What is the most likely cause?

Accepted Answer

The service account is from the app's project, not the bucket's project, and the bucket's IAM policy may not include the service account.. The App Engine service account belongs to the app's project, not the bucket's project. Cross-project access requires the service account to be explicitly granted the Storage Object Viewer role in the bucket's IAM policy. If the role was granted but the policy hasn't propagated or is misconfigured, a 403 error can still occur. Option A is incorrect because downloading a JSON key is unnecessary and insecure; service accounts can be used across projects without key files. Option B is incorrect because uniform bucket-level access being disabled relates to ACLs, but IAM permissions still apply; the issue is cross-project IAM, not ACL/ IAM conflict. Option C is incorrect while VPC Service Controls can block access, the typical error is different and would involve the perimeter, not just a 403 on object reads; the question describes a simple cross-project permission issue.

Answer

The service account needs to be downloaded as a JSON key and added to the app configuration.

Answer

The bucket has uniform bucket-level access disabled, so ACLs may override IAM permissions.

Answer

The bucket is in a VPC Service Controls perimeter that blocks access from the App Engine service account.

Question 11

A company wants to trigger a Cloud Run job every time a new file is uploaded to a Cloud Storage bucket. Which integration should be used?

Accepted Answer

Use Eventarc to create a trigger that routes Cloud Storage events to the Cloud Run job.. Eventarc is Google Cloud's managed event-routing service that natively ingests events from Cloud Storage (via Cloud Audit Logs), Pub/Sub, and other sources, and delivers them to Cloud Run, Cloud Functions, or Workflows with built-in retry, filtering, and IAM handling. Creating an Eventarc trigger with a Cloud Storage event provider and a Cloud Run destination is the canonical, fully managed way to invoke a Cloud Run job on object creation. It eliminates the need to wire up Pub/Sub topics, subscriptions, or intermediary functions manually.

Answer

Use Cloud Pub/Sub notifications from the bucket and create a push subscription to the Cloud Run job.

Answer

Use Cloud Scheduler to poll the bucket and invoke the Cloud Run job every minute.

Answer

Use Cloud Functions to listen for storage events and then call the Cloud Run job via HTTP.

Question 12

A company is integrating a legacy application with Google Cloud using Cloud VPN. The application must be accessed from multiple remote offices over the internet. Which TWO technologies should the company use to ensure secure and reliable connectivity? (Choose TWO.)

Accepted Answer

Cloud VPN. Cloud VPN (Option E) is correct because it creates secure site-to-site VPN tunnels over the internet, allowing encrypted communication from each remote office. This meets the requirement for connectivity over the internet. Cloud Interconnect (Option A) is incorrect because it provides dedicated private connections, not over the internet, and does not satisfy the 'over the internet' requirement. Option B (Private Google Access) enables on-premises hosts to use private IPs to reach Google APIs, not for inter-site connectivity. Option C (Cloud NAT) enables outbound internet access from private instances, not for site-to-site. Option D (Direct Peering) provides direct connection between on-prem and Google but is not designed for hub-spoke topologies across multiple offices and also does not operate over the internet.

Answer

Cloud Interconnect

Answer

Private Google Access

Answer

Cloud NAT

Answer

Direct Peering

Question 13

A company has a Cloud Function that processes events from Cloud Pub/Sub. The function uses HTTP client libraries to call external APIs. The team notices that the function sometimes times out during high traffic. Which THREE actions should they take to improve reliability? (Choose THREE.)

Accepted Answer

Use Cloud Tasks to queue the API call invocations and process them asynchronously from the function.. Option B is correct because offloading the external API calls to Cloud Tasks decouples the function from the latency of those calls, letting the function return quickly while Cloud Tasks handles queuing, retries, and rate limiting, which directly reduces timeouts under high traffic. Option C is correct because implementing retry logic with exponential backoff handles transient failures and rate-limit (HTTP 429) responses from external APIs, preventing a single slow or failed call from causing the function to time out. Option D is correct because raising the function timeout up to the maximum of 540 seconds gives the function more time to complete slow external API calls before being forcibly terminated, improving reliability for long-running invocations. Option A is not correct because increasing memory to 2GB only increases CPU allocation and does not address the root cause of timeouts caused by slow external API calls. Option E is not correct because reducing the maximum number of concurrent instances would throttle throughput and could actually increase latency and timeouts rather than improve reliability.

Answer

Increase the allocated memory to 2GB.

Answer

Reduce the maximum number of concurrent function instances.

Question 14

You are building a data pipeline that ingests streaming data from thousands of IoT devices. The devices send JSON payloads to a Cloud Pub/Sub topic. You want to process the data in near real-time and store the results in BigQuery for analytics. You also need to handle occasional schema changes in the incoming data (new fields added) without manual intervention. You have set up a Dataflow streaming pipeline using Apache Beam to read from Pub/Sub and write to BigQuery. The pipeline uses the `WriteToBigQuery` transform with `createDisposition=CREATE_NEVER` and `writeDisposition=WRITE_APPEND`. Recently, a batch of devices started sending a new field `temperature_celsius` that does not exist in the BigQuery schema. The pipeline logs errors and the data is not written. You need to modify the pipeline to automatically handle such schema evolution. What should you do?

Accepted Answer

Change `createDisposition` to `CREATE_IF_NEEDED` and ensure the BigQuery table schema has `autodetect=true` or is updated to allow new fields.. To handle schema evolution automatically, the BigQuery sink must be able to create or update the table schema. Setting createDisposition to CREATE_IF_NEEDED allows the pipeline to create the table if it doesn't exist, and enabling schema autodetect or updating the schema to allow new fields lets BigQuery automatically add new columns when they appear in the data. This avoids pipeline failures due to schema mismatches.

Answer

Manually update the BigQuery table schema to include the new field and then restart the pipeline.

Answer

Write the raw JSON payloads to Cloud Storage and use a Cloud Function to load them into BigQuery every 10 minutes with schema autodetect.

Answer

Use a `ParDo` transform to flatten all JSON fields into a fixed schema by ignoring unknown fields.

Question 15

Your organization runs a multi-region application on Cloud Run that serves an API. The API is consumed by clients worldwide. You want to reduce latency by routing users to the nearest regional Cloud Run service. Currently, all traffic goes to a single Cloud Run service in us-central1. You have set up additional Cloud Run services in europe-west1 and asia-east1. Each service is fronted by an external HTTPS load balancer with a regional backend. You want to use a single global anycast IP address that automatically directs users to the closest healthy backend. You also need to support HTTPS with a custom domain and a Google-managed certificate. What should you do?

Accepted Answer

Create a global external HTTPS load balancer with serverless NEGs pointing to each regional Cloud Run service, and attach a Google-managed certificate.. A global external HTTPS load balancer with serverless NEGs is the only Google Cloud construct that provides a single global anycast IP, terminates HTTPS with a Google-managed certificate, and routes users to the closest healthy regional Cloud Run backend. Serverless NEGs are the supported backend type for Cloud Run, Cloud Functions, and App Engine, and the global external Application Load Balancer automatically performs health-checked, latency-based routing across regions. This satisfies all requirements: anycast IP, custom domain HTTPS, and proximity routing.

Answer

Enable anycast on the Cloud Run service by selecting the 'global' setting in the Cloud Run region selection.

Answer

Use Cloud DNS with geo-routing policy to point users to the appropriate regional load balancer IP based on their location.

Answer

Configure Cloud CDN in front of the Cloud Run services to cache responses at edge locations.