PCD Integrating Google Cloud services Practice Test 2 — 15 Questions

Question 1

Match each Kubernetes resource to its function.

Question 2

Match each Firebase feature to its description.

Question 3

A company is using Cloud Functions (2nd gen) to process files uploaded to Cloud Storage. The function needs to access a Cloud SQL (PostgreSQL) database. What is the most secure way to store and provide the database password to the function?

Accepted Answer

Use Secret Manager and access it via the Secret Manager API within the function.. Option C is correct because Secret Manager is the recommended service for storing secrets with IAM controls. Option A is wrong because Cloud Storage buckets may have broader access and are not designed for secrets. Option B is wrong because hardcoding is insecure. Option D is wrong because KMS encrypts data but Secret Manager provides a simpler and more integrated secret storage solution.

Answer

Use Cloud KMS to encrypt the password and store it in environment variables.

Answer

Hardcode the password in the function code.

Answer

Store the password in a Cloud Storage bucket and read it at startup.

Question 4

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

Accepted Answer

Use Cloud Build triggers with a branch filter set to ^main$.. Option A is correct because Cloud Build triggers support branch filters to specify which branches trigger builds. Option B is wrong because Cloud Run cannot filter deployments by branch. Option C is wrong because IAM conditions apply to principals, not build sources. Option D is wrong because manual management is error-prone.

Answer

Configure Cloud Run to only accept revisions from a specific source repository.

Answer

Use IAM conditions on the Cloud Run service account to allow only main branch builds.

Answer

Create a separate Cloud Build trigger for each branch and manually disable non-main triggers.

Question 5

You are designing a system that ingests high-velocity event streams from IoT devices using Pub/Sub. Each event must be processed exactly once to update a Firestore database. However, due to the distributed nature, at-least-once delivery is guaranteed by Pub/Sub. Which design pattern should you use to achieve exactly-once processing?

Accepted Answer

Make the message processor idempotent by using a unique event ID as the Firestore document ID, and perform upsert operations.. Option D is correct because making the processor idempotent using a unique event ID as the Firestore document ID ensures that duplicate writes are harmless. Option A is wrong because Firestore does not provide built-in deduplication. Option B is wrong because Dataflow's exactly-once mode still requires idempotent sinks. Option C is wrong because Bigtable row keys can help but idempotency is the key.

Answer

Use a Cloud Function with a retry policy to ensure delivery, and deduplicate using a Cloud Bigtable row key.

Answer

Use Cloud Dataflow with exactly-once processing mode and write to Firestore using a custom sink.

Answer

Use a Cloud Run service to pull messages and write to Firestore; rely on Firestore's built-in deduplication using document IDs.

Question 6

A developer wants to allow a Compute Engine instance to send messages to a Pub/Sub topic. What is the recommended way to grant permissions?

Accepted Answer

Use the instance's default Compute Engine service account and assign the Pub/Sub Publisher role to it.. Option B is correct because using the default Compute Engine service account and assigning the Pub/Sub Publisher role is the simplest and recommended approach. Option A works but is less efficient. Option C is wrong because API keys are not for service-to-service auth. Option D is insecure.

Answer

Generate an API key for the instance and include it in HTTP requests.

Answer

Create a service account and assign the Pub/Sub Publisher role; attach the service account to the instance.

Answer

Store the service account key file directly on the instance.

Question 7

An application running on GKE needs to access a Cloud SQL instance. The team wants to avoid using Cloud SQL Auth Proxy to reduce complexity. What is the most secure alternative?

Accepted Answer

Use Private Service Connect to connect privately.. Option A is correct because Private Service Connect provides private, secure connectivity without the need for a proxy. Option B is wrong because whitelisting node IPs is insecure due to shared IPs. Option C is wrong because read replicas with public IP are less secure. Option D is wrong because allowing all VPC traffic is too permissive.

Answer

Whitelist the GKE node external IPs in Cloud SQL authorized networks.

Answer

Use a Cloud SQL read replica with a public IP.

Answer

Configure Cloud SQL to allow all traffic from the VPC.

Question 8

You are deploying a stateful application on GKE that requires persistent storage with high IOPS. You need to ensure that each pod can failover to a different node and still access the same data. Which volume type should you use?

Accepted Answer

PersistentVolumeClaim with ReadWriteMany.. Option D is correct because ReadWriteMany allows multiple nodes to access the same volume simultaneously. Option A is wrong because EmptyDir is ephemeral. Option B is wrong because ConfigMap is for configuration. Option C is wrong because ReadWriteOnce only allows one node at a time.

Answer

ConfigMap.

Answer

EmptyDir.

Answer

PersistentVolumeClaim with ReadWriteOnce.

Question 9

Which two statements are true about Cloud Load Balancing? (Choose two.)

Accepted Answer

Global external HTTP(S) load balancer can distribute traffic across multiple regions.. Options A and B are correct. A is correct because global external HTTP(S) load balancers can distribute traffic across multiple regions. B is correct because internal TCP/UDP load balancers operate within a VPC. C is wrong because SSL proxy load balancers only support TCP with SSL. D is wrong because network load balancers support both TCP and UDP. E is wrong because not all load balancers support IPv6.

Answer

All load balancers support IPv6 client traffic.

Answer

SSL proxy load balancer supports non-HTTP traffic.

Answer

Network load balancer can only balance TCP traffic.

Question 10

Which three are valid ways to authenticate a service account when using the Google Cloud client libraries? (Choose three.)

Accepted Answer

Attaching a service account to a Compute Engine instance and letting the metadata server provide credentials.. Options A, B, and C are correct. These are the standard methods for Application Default Credentials (ADC). Option D is wrong because API keys are not used for service account authentication. Option E is wrong because OAuth 2.0 client IDs are for user authentication.

Answer

Using OAuth 2.0 client IDs for web applications.

Answer

Using an API key in the client library initialization.

Question 11

You are designing a CI/CD pipeline using Cloud Build. Which three features can be used to secure the pipeline and enforce compliance? (Choose three.)

Accepted Answer

Configuring Cloud Build to only run builds from approved source repositories via VPC-SC.. Options A, B, and C are correct. A is correct because Cloud Build supports manual approval gates. B is correct because private pools and service perimeters enhance security. C is correct because VPC Service Controls can restrict builds to approved repositories. D is wrong because substitution variables are not secure for secrets. E is wrong because vulnerability scanning is a separate Artifact Analysis feature.

Answer

Using Cloud Build's inline substitution variables to inject secrets.

Answer

Integrating with Cloud Build's vulnerability scanning for container images.

Question 12

A developer ran the following command: `gcloud compute instances list --filter='labels.env=prod'`. The command returned no instances even though there are instances with label env=prod. What is the most likely reason?

Accepted Answer

The filter syntax is incorrect; should use `labels.env:prod`.. Option B is correct because the correct filter syntax for labels uses a colon (:) instead of an equals sign. The proper filter is `labels.env:prod`. Option A is wrong because if the project were different, a different error would appear. Option C is wrong because permission errors produce a different message. Option D is wrong because stopped instances are still listed.

Answer

Instances are in a different project.

Answer

The user lacks compute.instances.list permission.

Answer

The instances are stopped.

Question 13

A security audit reveals that a service account has been granted excessive permissions. The exhibit shows the IAM policy for a project. Which statement best describes the security issue?

Accepted Answer

The service account has more permissions than necessary because objectAdmin includes all objectViewer permissions.. Option C is correct because the objectAdmin role includes all permissions of objectViewer, making the viewer role redundant and indicating over-permissioning. Option A is wrong because there is no conflict. Option B is wrong because the policy is syntactically correct. Option D is wrong because storage.admin would be even more permissive.

Answer

The policy is missing an explicit deny for public access.

Answer

The service account should have roles/storage.admin instead.

Answer

The service account has both admin and viewer roles, causing a conflict.

Question 14

A developer sets environment variables for a Cloud Function as shown. What is the security concern?

Accepted Answer

The password is exposed in plain text and should be stored in Secret Manager.. Option B is correct because the password is exposed in plain text in environment variables. Option A is wrong because the variable name is acceptable. Option C is wrong because build variables are for build time, not runtime. Option D is wrong because encryption at rest is not the issue; the problem is visibility.

Answer

The variable name FOO is too short and does not follow naming conventions.

Answer

The variable DB_PASS should be set as a build variable instead.

Answer

There is no encryption applied to environment variables.

Question 15

A company uses Cloud SQL for MySQL. They need to export data to Cloud Storage regularly. What is the recommended method?

Accepted Answer

Use Cloud SQL export feature to export to Cloud Storage.. Option A is correct because Cloud SQL provides a built-in export feature that writes directly to Cloud Storage. Option B is wrong because mysqldump from Compute Engine is manual and less secure. Option C is wrong because Cloud SQL does not support cron jobs. Option D is wrong because Dataflow is overkill for simple exports.

Answer

Use Dataflow to read from Cloud SQL and write to Cloud Storage.

Answer

Use a cron job on Cloud SQL instance to write to Cloud Storage.

Answer

Use mysqldump command from a Compute Engine instance.