PCD Integrating Google Cloud services Practice Test 3 — 15 Questions

Question 1

A company is deploying a containerized application on Cloud Run that requires access to a Cloud SQL PostgreSQL instance. The application needs to connect to the database using private IP to minimize latency and avoid public internet exposure. The Cloud Run service and Cloud SQL instance are in the same region and project. The database user and password are stored in Secret Manager. Which two steps should the developer take to enable the connection? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the Cloud Run service account the Cloud SQL Client role.. Option A is correct because the Cloud Run service account must have the Cloud SQL Client (roles/cloudsql.client) IAM role to authorize connections to the Cloud SQL instance, whether via the built-in Cloud SQL connector or the Auth proxy. Option D is correct because connecting to a Cloud SQL instance over private IP from Cloud Run requires a Serverless VPC Access connector attached to the Cloud Run service, plus a private services access connection (VPC peering) configured on the Cloud SQL instance's network so the instance has a private IP reachable from the VPC. Option B is not required because Cloud Run's integrated Cloud SQL connection is configured via the --add-cloudsql-instances flag (or the run.googleapis.com/cloudsql-instances annotation), not by manually setting CLOUD_SQL_CONNECTION_NAME. Option C is not a required developer step since the Cloud SQL Admin API is enabled at the project level during setup and is not something the developer must do to establish the connection. Option E is unnecessary because Cloud Run has a built-in Cloud SQL connector; running the Auth proxy as a sidecar is not supported/needed for this scenario.

Answer

Set the CLOUD_SQL_CONNECTION_NAME environment variable in the Cloud Run service.

Answer

Enable the Cloud SQL Admin API.

Answer

Deploy the Cloud SQL Auth proxy as a sidecar container in Cloud Run.

Question 2

A company runs a microservices application on Cloud Run. One service, `order-processor`, is invoked asynchronously via a Cloud Tasks queue. The Cloud Tasks queue is configured with an HTTP target pointing to the `order-processor` service URL. The service requires authentication (no unauthenticated invocations). The service account used by Cloud Tasks to invoke the service is `cloud-tasks-system@project.iam.gserviceaccount.com`. After deploying a new revision of `order-processor` using Cloud Build and Cloud Deploy, the team notices that tasks are failing with a 403 status. The Cloud Run service logs show the requests are reaching the service but returning 403. The previous revision worked fine. What is the most likely cause?

Accepted Answer

The IAM policy binding granting the Cloud Tasks service account the Cloud Run Invoker role was removed during the deployment.. When Cloud Run requires authentication, the invoker's service account must be granted the roles/run.invoker role on the Cloud Run service. Deploying a new revision with Cloud Build and Cloud Deploy may overwrite IAM policy bindings if the deployment pipeline includes IAM policy updates or uses a different service account. In this scenario, the IAM binding for the Cloud Tasks service account was likely removed or not applied to the new revision, causing the 403 error. Option B is incorrect because the service works correctly; the 403 is returned before the service processes the request, indicating an authorization failure, not an internal bug. Option C is incorrect because the OIDC token configuration on the queue is independent of the revision and does not affect IAM permissions. Option D is incorrect because the Cloud Tasks queue's HTTP target URL points to the Cloud Run service, not a specific revision, so it does not need to be updated.

Answer

The new revision has a bug causing a permission denied error when processing tasks.

Answer

The Cloud Tasks queue needs to be configured with an OIDC token and audience for the new revision.

Answer

The Cloud Tasks queue's HTTP target URL needs to be updated to point to the new revision's specific URL.

Question 3

A developer is deploying a 2nd gen Cloud Function that needs to connect to a Cloud SQL MySQL instance. The Cloud SQL instance is configured with a private IP only. The Cloud Function is deployed with a VPC connector that is connected to the same VPC network as the Cloud SQL instance. The developer has granted the Cloud Function's service account the Cloud SQL Client role. However, when the function is invoked, connection attempts to the Cloud SQL instance time out. The Cloud Function code uses the MySQL connector with the private IP address of the Cloud SQL instance. The developer has verified that the VPC connector is healthy and that the Cloud SQL instance is running. Which additional configuration is most likely required?

Accepted Answer

Configure Private Services Access to establish a VPC peering between the VPC network and the Cloud SQL service network.. The most likely additional configuration required is to configure Private Services Access to establish a VPC peering between the VPC network and the Cloud SQL service network. Even though the Cloud Function uses a VPC connector in the same VPC network as the Cloud SQL instance, Cloud SQL with private IP requires a private connection between the VPC network and the Google-managed service network. This is achieved through Private Services Access, which sets up VPC peering. Without it, the VPC network cannot route traffic to the Cloud SQL instance's private IP.

Answer

Modify the connection string to require SSL/TLS.

Answer

Deploy the Cloud SQL Auth proxy as an additional container in the Cloud Function.

Answer

Assign a public IP to the Cloud SQL instance and configure the function to use it.

Question 4

A company is deploying a containerized application on Cloud Run that needs to connect to a Cloud SQL (MySQL) database. The database must not be accessible from the public internet. Which two steps should the company take to secure the connection?

Accepted Answer

Set Cloud SQL to have a private IP address only.. Setting Cloud SQL to have a private IP address only (Option D) ensures the database is accessible only within the VPC network, not from the public internet. This eliminates exposure to external threats and is a fundamental security best practice for private database access.

Answer

Enable automatic IAM database authentication for Cloud SQL.

Answer

Create a Cloud NAT gateway for outbound traffic from Cloud Run.

Answer

Use Cloud SQL Auth proxy within the Cloud Run container.

Question 5

Refer to the exhibit. A Cloud Run service is unable to connect to a Cloud SQL instance. The log entry shows the following. What is the most likely cause?

Accepted Answer

The Cloud Run service account lacks the Cloud SQL Client role.. The Cloud Run service needs the Cloud SQL Client role (roles/cloudsql.client) on its service account to authorize connections to Cloud SQL. Without this IAM permission, the connection attempt is denied, resulting in the 'unable to connect' error shown in the log. This is the most common cause of connectivity failures between Cloud Run and Cloud SQL.

Answer

The database user credentials are incorrect.

Answer

The Cloud SQL instance is in a different region than the Cloud Run service.

Answer

The Cloud SQL instance has a public IP assigned.

Question 6

A retail company processes customer orders through a pipeline. New orders are written to a Cloud Storage bucket as JSON files. A Cloud Function (currently triggered directly by Cloud Storage finalize events) parses the order and sends it to a third-party fulfillment service via an HTTP POST. As order volume grows, the team observes that the Cloud Function often times out (60s default) because the fulfillment service is slow. The team wants to decouple the processing to improve reliability. The order must be attempted at least once, and if the fulfillment service fails, retries should be exponential with a maximum of 5 attempts. Which solution should the team implement?

Accepted Answer

Use Cloud Tasks to create a queue that targets the Cloud Function. Configure the queue with exponential backoff and max retries of 5. Set the Cloud Function trigger to be HTTP instead of Cloud Storage.. Cloud Tasks provides the exact retry semantics required: exponential backoff and a maximum of 5 retry attempts. By using an HTTP-triggered Cloud Function and a Cloud Tasks queue, the order processing is decoupled from the Cloud Storage event, allowing the function to return quickly and rely on Cloud Tasks to handle retries if the fulfillment service is slow or fails. This ensures at-least-once delivery with controlled retries. Option B is incorrect because increasing the timeout does not provide retries; the function would still block for up to 540 seconds without retrying on failure. Option C is suboptimal because Pub/Sub's push delivery retry configuration is less flexible than Cloud Tasks for HTTP endpoints, and it lacks built-in exponential backoff with a configurable max attempts without additional setup. Option D is inefficient because polling every 5 minutes introduces latency and does not provide real-time processing.

Answer

Keep the Cloud Storage trigger, but increase the Cloud Function timeout to 540 seconds and add retry logic in the function code.

Answer

Use Pub/Sub notifications from Cloud Storage to a Pub/Sub topic, with a subscription that pushes to the Cloud Function. Enable dead letter topics for failed deliveries.

Answer

Replace the Cloud Function with a Cloud Run job that polls Cloud Storage for new files and sends orders to the fulfillment service. Use Cloud Scheduler to run the job every 5 minutes.

Question 7

A company has a Java application running on Google Kubernetes Engine (GKE). The application needs to access a Cloud SQL for PostgreSQL database. The security team requires that the database connection be encrypted and that the application authenticate using its Kubernetes service account without managing database passwords. What should the developer do?

Accepted Answer

Configure the application to connect using the Cloud SQL Auth proxy sidecar and IAM database authentication.. The Cloud SQL Auth proxy provides encrypted connections and can authenticate using IAM, which maps Kubernetes service accounts to Cloud SQL users. This removes the need for database passwords and ensures secure connectivity. It is the recommended approach for GKE applications accessing Cloud SQL.

Answer

Connect directly to the Cloud SQL instance's private IP using the PostgreSQL JDBC driver with a username and password stored in Cloud KMS.

Answer

Expose the Cloud SQL instance with a public IP and use SSL certificates for encryption, storing the password in a Kubernetes Secret.

Answer

Use the Cloud SQL Auth proxy with a service account key file mounted as a volume, and connect with a database password.

Question 8

A company runs a Node.js API on Cloud Run (fully managed). The API must read secrets from Secret Manager and write logs to Cloud Logging. The security team requires that the secrets are not exposed as environment variables or in the container image, and that the service authenticates without a downloaded service account key. What should the developer do?

Accepted Answer

Grant the Cloud Run service's attached service account the Secret Manager Secret Accessor role, and mount the secret as a volume in the Cloud Run service configuration.. The correct approach uses Secret Manager with the Cloud Run service's attached service account and mounts the secret as a volume. This avoids environment variables and service account keys, both of which were explicitly disallowed. The volume mount makes the secret available as a file, and IAM controls access. The other options either expose the secret in environment variables, reintroduce long-lived keys, or use an inappropriate storage service.

Answer

Set the secret as an environment variable in the Cloud Run revision using the --set-secrets flag, and rely on Cloud Run's automatic IAM authentication for Secret Manager access.

Answer

Create a service account key, store it in Secret Manager, grant the Cloud Run service account access to that secret, and have the application retrieve the key at startup to authenticate.

Answer

Store the secret in a Cloud Storage bucket, grant the Cloud Run service account Storage Object Viewer, and download the secret file at container startup.

Question 9

A company is deploying a Java application on App Engine standard environment. The application needs to connect to a Cloud SQL for MySQL instance. The security team requires that the connection uses private IP and that credentials are managed securely. Which two steps should the developer take to meet these requirements? (Choose two.)

Accepted Answer

Store the database credentials in Secret Manager and reference them in the App Engine app.yaml using environment variables.. To connect App Engine standard to Cloud SQL using private IP, you need a Serverless VPC Access connector and a Cloud SQL instance with private IP. For secure credentials, store them in Secret Manager and reference them in app.yaml. These two steps together satisfy the private IP and secure credential requirements.

Answer

Embed the database username and password in the application code and use the Cloud SQL JDBC socket factory for connectivity.

Answer

Use the Cloud SQL Auth proxy with a public IP address and configure the application to connect to 127.0.0.1.

Answer

Assign the App Engine default service account the Cloud SQL Client role and use IAM database authentication.

Question 10

A company runs a GKE cluster and wants to integrate with Cloud Logging and Cloud Monitoring. They need to ensure that application logs are collected and that custom metrics are visible in Cloud Monitoring. They also want to minimize operational overhead. Which two actions should they take? (Choose two.)

Accepted Answer

Enable Cloud Logging and Cloud Monitoring on the GKE cluster by using the default GKE integration, which deploys the Fluentd-based logging agent and the monitoring agent.. GKE's built-in integration with Cloud Logging and Cloud Monitoring automatically deploys and manages the necessary agents, providing log and metric collection with minimal effort. Additionally, the Cloud Monitoring agent can scrape Prometheus endpoints, allowing custom application metrics to be ingested. Together, these actions meet the requirements while reducing operational overhead.

Answer

Install the Cloud Logging agent and Cloud Monitoring agent as DaemonSets manually in each namespace.

Answer

Configure the applications to write logs directly to the Cloud Logging API using client libraries, and use the Cloud Monitoring API to push metrics.

Answer

Use the Cloud Monitoring API to create custom metrics from within the application code, and configure the GKE cluster to use a custom logging sink.

Question 11

A Cloud Run service subscribes to a Pub/Sub topic through a push subscription and must process each message exactly once before acknowledging. During a regional incident, some requests time out and Pub/Sub redelivers them, causing duplicate database inserts. You want the platform to suppress duplicate deliveries automatically without changing the database schema. What should you do?

Accepted Answer

Enable exactly-once delivery on the push subscription and acknowledge each message after the database transaction commits.. Pub/Sub exactly-once delivery, when enabled on a push subscription, attaches a delivery token to each message and rejects acknowledgements that do not match the current outstanding delivery. If a request times out and the message is redelivered, the stale delivery's acknowledgement is ignored and the duplicate is suppressed. Acknowledging after the database commit aligns the acknowledgement with the actual side effect, preventing duplicate inserts during regional incidents.

Answer

Enable exactly-once delivery on the pull subscription and use the message's ordering key to deduplicate writes.

Answer

Increase the subscription's ack deadline to the maximum and enable retry policy with a minimum backoff of 600 seconds.

Answer

Add a unique constraint on a message ID column and catch duplicate-key errors in the application code.

Question 12

A financial services company runs a containerized application on Google Kubernetes Engine (GKE). The application needs to access a Cloud SQL for MySQL instance. The security team requires that the database credentials never be stored in the container image or in Kubernetes Secrets, and that the credentials be automatically rotated. Which solution should the developer implement?

Accepted Answer

Use the Cloud SQL Auth Proxy as a sidecar container. Configure the application to authenticate using IAM database authentication with a Kubernetes service account annotated with a Google service account.. IAM database authentication with Workload Identity eliminates the need to store database passwords. The Kubernetes service account is mapped to a Google service account, and the Cloud SQL Auth Proxy uses that identity to authenticate. IAM credentials are short-lived and rotated automatically, satisfying the security team's requirements without storing secrets in the container image or Kubernetes Secrets.

Answer

Store the database password in a ConfigMap and inject it as an environment variable into the application container.

Answer

Use the Cloud SQL Auth Proxy as a sidecar container. Store the database password in a Kubernetes Secret and mount it as a volume.

Answer

Use the Cloud SQL Auth Proxy as a sidecar container. Store the database password in Secret Manager and use the Secret Manager CSI driver to mount it as a volume.

Question 13

A developer is building a Cloud Run service that needs to read messages from a Pub/Sub subscription and write data to a Cloud SQL for PostgreSQL database. The service must authenticate to both services securely without embedding credentials in the container image. Which two methods should the developer use to authenticate to Pub/Sub and Cloud SQL? (Choose two.)

Accepted Answer

Use Application Default Credentials (ADC) with the Cloud Run service's attached service account to authenticate to Pub/Sub and Cloud SQL.. The correct methods are to assign a user-managed service account with the necessary IAM roles to the Cloud Run service, and to use Application Default Credentials (ADC) to authenticate. ADC automatically leverages the attached service account, so no credentials are embedded in the container. The other options either use overly broad permissions, involve insecure key files, or only address one service. These two methods together provide secure, least-privilege authentication to both Pub/Sub and Cloud SQL.

Answer

Enable the Cloud SQL Admin API and use the Cloud SQL Auth Proxy sidecar to connect to the database.

Answer

Use the default Compute Engine service account and grant it the Pub/Sub Editor and Cloud SQL Admin roles.

Answer

Store a service account key JSON file in a Cloud Storage bucket and mount it as a volume in the Cloud Run service.

Question 14

A developer is building a Cloud Run service that must be invoked by an internal Cloud Scheduler job. The service is private and must not be publicly accessible. The developer wants to ensure that only the Cloud Scheduler job can call the service. Which two steps should the developer take? (Choose two.)

Accepted Answer

Configure the Cloud Run service to require authentication by setting the ingress control to internal and allowing only authenticated invocations.. To keep a Cloud Run service private and allow only Cloud Scheduler to invoke it, the developer must require authentication and restrict ingress, then grant a dedicated scheduler service account the Cloud Run Invoker role and use OIDC tokens. These two steps together enforce identity-based access and prevent public access. The other options either make the service public, misuse networking features, or add unnecessary complexity with IAP.

Answer

Set the Cloud Run service to allow unauthenticated invocations and rely on a shared secret in the request header to validate the caller.

Answer

Deploy the Cloud Run service with a Serverless VPC Access connector and configure Cloud Scheduler to send requests through the same VPC.

Answer

Enable Identity-Aware Proxy (IAP) on the Cloud Run service and grant the Cloud Scheduler service account the IAP-secured Web App User role.

Question 15

A company runs a GKE cluster and wants to expose an internal microservice to other services in the same VPC network. The microservice must be accessible only from within the VPC and must have a stable IP address. Which Kubernetes Service type should the developer use?

Accepted Answer

LoadBalancer with the networking.gke.io/load-balancer-type: "Internal" annotation.. To expose a service internally within the VPC with a stable IP, use a LoadBalancer Service with the internal load balancer annotation. This creates an internal passthrough Network Load Balancer that is only accessible from within the VPC and provides a stable internal IP address.

Answer

ClusterIP with an internal load balancer annotation.

Answer

ExternalName pointing to an internal DNS name.

Answer

NodePort with a firewall rule allowing traffic from the VPC CIDR range.