PCD Integrating Google Cloud services Practice Test 4 — 15 Questions

Question 1

A retail company runs a Go-based service on Cloud Run that reads product images from a Cloud Storage bucket in the same project. During a load test, the service starts throwing 403 errors from the Cloud Storage client library, even though the same code worked when it ran on a Compute Engine VM with the default compute service account. The Cloud Run service was deployed with the default settings and no explicit service account was configured. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Cloud Run service uses the Compute Engine default service account, which lacks the storage.objects.get permission on the bucket.. Cloud Run services use the Compute Engine default service account unless a custom service account is specified. That account may have Editor role, which includes storage.objects.get, but if the bucket's IAM policy was modified or if the service account was changed, access can be denied. The 403 error indicates the service account lacks the necessary permission, so verifying and granting the correct IAM role is the proper fix.

Answer

The Cloud Run service's container is missing the Cloud Storage client library, causing the 403 error.

Answer

The Cloud Run service is not configured with a VPC connector, so it cannot reach the Cloud Storage API endpoint.

Answer

The Cloud Storage bucket has uniform bucket-level access enabled, which blocks all service accounts by default.

Question 2

A developer is integrating a Cloud Run service with Cloud SQL for PostgreSQL. The service must connect securely without exposing the database to the public internet, and the developer wants to minimize latency. The Cloud Run service and Cloud SQL instance are in the same project and region. Which two methods should the developer use to achieve these goals? (Choose two.)

Accepted Answer

Configure the Cloud Run service to use the Cloud SQL Auth Proxy via a Unix socket.. The Cloud SQL Auth Proxy and Serverless VPC Access connector are both secure, low-latency methods for connecting Cloud Run to Cloud SQL without public exposure. The Auth Proxy handles authentication and encryption, while the VPC connector enables private IP connectivity. Together or individually, they satisfy the requirements. Other options either expose the database or are not supported for Cloud Run.

Answer

Enable the Cloud SQL Admin API and use the Cloud SQL REST API to execute queries directly from the Cloud Run service.

Answer

Assign a public IP address to the Cloud SQL instance and add the Cloud Run service's egress IP to the authorized networks.

Answer

Create a VPN tunnel between the Cloud Run service and the Cloud SQL instance.

Question 3

A developer needs to store and retrieve application configuration data that changes infrequently, such as feature flags and database connection strings, for a service running on Cloud Run. The data must be versioned, and the service must be able to access it without redeploying. The solution should minimize latency and cost. What should they use?

Accepted Answer

Use Secret Manager to store configuration data, and have the service access the latest version at runtime.. Secret Manager provides versioned storage for configuration data, supports dynamic retrieval without redeployment, and integrates seamlessly with Cloud Run. It offers low-latency access and strong security controls, making it ideal for storing database connection strings and feature flags. Other options either require redeployment, add latency, or are deprecated.

Answer

Use Cloud Storage to store configuration files, and have the service download them at startup and periodically refresh.

Answer

Store the configuration in environment variables set on the Cloud Run service, and update them by deploying a new revision when changes occur.

Answer

Use Cloud Runtime Configurator to store configuration variables and access them via the API.

Question 4

You are building a Cloud Run service that reads from a Cloud SQL for PostgreSQL instance. Security policy forbids public IP addresses on the database and requires the connection to stay on Google's private network. Which two configurations should you use? (Choose two.)

Accepted Answer

Create a Serverless VPC Access connector and route Cloud Run egress through it to reach the instance's private IP.. Cloud Run reaches a private-IP Cloud SQL instance either through the built-in Cloud SQL connector using the instance connection name or by routing egress through a Serverless VPC Access connector into the instance's VPC. Both keep traffic on Google's private network and avoid a public IP. The sidecar approach is unavailable because Cloud Run revisions run a single container, and authorized networks do not remove the public IP.

Answer

Deploy a Cloud VPN tunnel between the Cloud Run service and the Cloud SQL instance to encrypt the connection.

Answer

Assign a public IP to the instance but restrict access with authorized networks limited to the Cloud Run egress IP range.

Answer

Enable the Cloud SQL Auth Proxy as a sidecar container in the Cloud Run revision and connect to it over localhost.

Question 5

A developer is integrating a Cloud Function with Cloud Firestore. The function needs to listen for changes to a specific document and update an aggregation document. Which two steps must the developer take to ensure the function has the necessary permissions and is triggered correctly? (Choose two.)

Accepted Answer

Configure the Cloud Function with a Firestore trigger for the specific document path.. To integrate a Cloud Function with Firestore to listen for document changes and update an aggregation document, the developer must grant the function's service account the Cloud Datastore User role, which provides read/write access to Firestore. Additionally, the function must be configured with a Firestore trigger for the specific document path. These two steps ensure that the function has the necessary permissions and is invoked when the document changes. Without the role, the function cannot access Firestore; without the trigger, it will not be invoked.

Answer

Assign the Cloud Function's service account the Cloud Functions Invoker role.

Answer

Enable the Cloud Firestore API and the Cloud Functions API in the project.

Answer

Create a Cloud Pub/Sub topic and configure the function to trigger from it.

Question 6

A fintech company uses Pub/Sub to ingest transaction events. They have a subscription with exactly-once delivery enabled and a 10-minute acknowledgement deadline. A subscriber using the Python client library processes messages but occasionally acknowledges a message after performing a database write. During a spike, some messages are redelivered and the database write is duplicated. What should the developer do to prevent duplicate writes while maintaining exactly-once delivery semantics?

Accepted Answer

Use the Pub/Sub message ID as an idempotency key in the database write to ensure duplicates are ignored.. Exactly-once delivery in Pub/Sub guarantees that messages are not redelivered within the acknowledgement deadline, but if the deadline is exceeded, redelivery can occur. To achieve end-to-end exactly-once processing, the subscriber must implement idempotent writes using the message ID. This ensures that duplicate deliveries do not result in duplicate database entries. Other options do not address the fundamental need for idempotency.

Answer

Enable dead-letter topic on the subscription to capture messages that fail processing and prevent redelivery.

Answer

Increase the acknowledgement deadline to the maximum of 10 minutes to ensure all messages are acknowledged in time.

Answer

Switch the subscription to use pull delivery instead of push delivery to avoid duplicate messages.

Question 7

A logistics company uses a Cloud Run service to accept shipment tracking updates from partners. Partners authenticate with OAuth 2.0 bearer tokens issued by an external identity provider. The service must validate the token's signature, issuer, audience, and expiry before processing each request. The team wants to minimize custom authentication code. Which approach should they take?

Accepted Answer

Implement a middleware in the application that fetches the identity provider's JSON Web Key Set (JWKS) and validates the JWT signature, issuer, audience, and expiry on each request.. For externally issued OAuth 2.0 JWTs, the service must verify the signature using the provider's published keys and check the issuer, audience, and expiry claims. A middleware using a standard JWT library fetches and caches the JWKS, performs cryptographic verification, and rejects invalid tokens. This keeps authentication logic small, leverages well-tested code, and correctly handles key rotation through JWKS caching.

Answer

Deploy the Cloud Run service with IAM invoker restrictions and rely on Cloud Run's built-in authentication to validate the external OAuth tokens.

Answer

Use API Gateway with an OpenAPI specification and a custom authentication backend that calls the identity provider's introspection endpoint for every request.

Answer

Enable Identity-Aware Proxy (IAP) on the Cloud Run service and configure it to trust the external identity provider.

Question 8

A company uses Cloud Build to build and deploy a containerized application to Cloud Run. They want to ensure that the build fails if any unit tests fail. The tests are run as part of the build process. They also want to minimize build time by caching dependencies. Which Cloud Build configuration should they use?

Accepted Answer

Define separate build steps for dependency installation, testing, and image building. Use Cloud Build's built-in caching by specifying a Cloud Storage bucket for the cache, and ensure the test step fails the build on error.. Separating build steps allows for clear failure points and caching. By using a Cloud Storage bucket to cache dependencies, subsequent builds can reuse them, reducing time. The test step will fail the build if tests fail, ensuring quality gates. This configuration meets both requirements: failing on test failure and minimizing build time through caching.

Answer

Use Cloud Build's 'timeout' field to limit test duration, and rely on the default caching behavior of the build environment.

Answer

Use a single build step that runs tests and then builds the image, and configure Cloud Build to use a Kaniko cache.

Answer

Define a build step that runs the tests, and use the 'waitFor' field to ensure the test step completes before the deploy step. Use a persistent volume to cache dependencies.

Question 9

A Cloud Functions (2nd gen) function must send events to a third-party HTTP endpoint. The endpoint requires an API key, and the security team mandates that the key never appear in the function's source, environment variables, or logs. Which integration should you use?

Accepted Answer

Store the key in Secret Manager, mount it as a volume, and read the file path from the function's runtime environment.. Mounting a Secret Manager secret as a volume on a Cloud Functions 2nd gen deployment injects the value at runtime as a file, keeping it out of source, environment variables, and logs. The function reads the file from the mount path when needed. This leverages the underlying Cloud Run volume support and satisfies the security team's explicit constraints without custom decryption logic.

Answer

Encrypt the key with a Cloud KMS key, commit the ciphertext to the repository, and decrypt it at runtime using the KMS API.

Answer

Pass the key as a runtime argument when deploying the function using the gcloud functions deploy command.

Answer

Store the key in Secret Manager and reference it with the --set-secrets flag, which exposes it as an environment variable in the function.

Question 10

A media company uses Cloud Firestore in Native mode to store user profiles. They need to query profiles by a combination of 'country' and 'lastActive' fields, and also retrieve a single profile by its document ID. The application experiences high read traffic. They want to minimize latency and cost. What should they do?

Accepted Answer

Create a composite index on 'country' and 'lastActive' and rely on Firestore's automatic single-field indexes for document ID lookups.. Firestore automatically indexes single fields, including the document ID, so document ID lookups are fast without extra configuration. Composite indexes are required for queries that filter or order by multiple fields. Creating a composite index on 'country' and 'lastActive' satisfies the query requirement. Relying on automatic indexes for document ID lookups avoids unnecessary index creation and keeps costs low.

Answer

Use a collection group query to retrieve profiles by 'country' and 'lastActive', and denormalize the document ID into a field for faster lookups.

Answer

Create a composite index on 'country' and 'lastActive' and also create a composite index including the document ID to speed up lookups.

Answer

Enable Firestore in Datastore mode to leverage automatic multi-field indexes for the query.

Question 11

A healthcare company runs a batch analytics pipeline on Compute Engine that reads from BigQuery. The pipeline uses a service account and runs nightly. The security team wants to grant the minimum permissions necessary for the pipeline to read data from a specific dataset and create temporary tables in that dataset. The pipeline must not be able to read other datasets or modify existing tables. Which two IAM roles should be granted to the service account? (Choose two.)

Accepted Answer

roles/bigquery.jobUser granted at the project level.. Running a BigQuery query requires two distinct permissions: the ability to create jobs in the project, provided by BigQuery Job User, and the ability to read the underlying data, provided by BigQuery Data Viewer scoped to the dataset. Granting Data Viewer at the dataset level limits access to the specific dataset, while Job User at the project level is required because jobs are project-scoped. Together they enable the pipeline without granting write or project-wide read access.

Answer

roles/bigquery.dataEditor granted at the dataset level.

Answer

roles/bigquery.admin granted at the project level.

Answer

roles/bigquery.metadataViewer granted at the project level.

Question 12

A logistics company runs a Java application on Google Kubernetes Engine (GKE) that needs to access a Cloud SQL for PostgreSQL instance. The security team requires that all connections use private IP and are encrypted. The application is deployed as a Deployment with multiple replicas. What should the developer do to configure connectivity?

Accepted Answer

Deploy the Cloud SQL Auth Proxy as a sidecar container in the pod and configure the application to connect to localhost.. The Cloud SQL Auth Proxy sidecar pattern provides secure, encrypted connections to Cloud SQL using IAM authentication and automatic certificate management. It supports private IP and works well with Kubernetes Deployments, as each pod runs its own proxy. This minimizes code changes and operational overhead. Other options either require manual certificate management, are technically infeasible, or involve more invasive code changes.

Answer

Configure the application to connect directly to the Cloud SQL instance's private IP address and enable SSL in the JDBC connection string.

Answer

Enable the Cloud SQL Admin API and use the Cloud SQL Connector for Java to connect with private IP.

Answer

Use a Kubernetes Service of type LoadBalancer to expose the Cloud SQL instance and connect through it.

Question 13

A company is building a new application on Google Cloud that uses Cloud Run, Pub/Sub, and Firestore. They want to ensure that the application can securely access these services with least privilege. They plan to use a dedicated service account for the Cloud Run service. Which two actions should they take? (Choose two.)

Accepted Answer

Grant the service account the roles/pubsub.publisher role to allow publishing messages to the Pub/Sub topic.. To follow least privilege, the Cloud Run service account should be granted only the roles needed for the services it uses. It needs to publish to Pub/Sub, so roles/pubsub.publisher is required. It needs to read and write Firestore documents, so roles/datastore.user is required. Basic roles like Editor are too broad, and roles for unused services like Cloud SQL or Pub/Sub subscriber are unnecessary.

Answer

Grant the service account the roles/pubsub.subscriber role to allow receiving messages from a Pub/Sub subscription.

Answer

Grant the service account the roles/cloudsql.client role to allow connecting to a Cloud SQL instance.

Answer

Grant the service account the roles/editor role to ensure it has all necessary permissions for the services.

Question 14

You need to monitor the CPU usage of a Compute Engine instance and trigger an alert when it exceeds 80% for 5 minutes. Which Google Cloud service should you use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it provides metrics, dashboards, and alerting policies for Compute Engine instances. You can create a metric-based alert condition that triggers when the CPU utilization metric exceeds 80% for a duration of 5 minutes, using the MQL or policy builder.

Answer

Cloud Debugger

Answer

Cloud Logging

Answer

Error Reporting

Question 15

Your company uses Cloud SQL for MySQL to store transactional data. You need to perform a point-in-time recovery (PITR) to recover from a logical error that occurred 30 minutes ago. Which two prerequisites must be met? (Choose TWO.)

Accepted Answer

Binary logging is enabled.. Option B is correct because Cloud SQL for MySQL performs point-in-time recovery by replaying binary log (binlog) events on top of a base backup, so binary logging must be enabled for PITR to work. Option C is correct because PITR requires a base automated backup to which the binary logs can be applied; without automated backups enabled, there is no recovery point to start from. Option A is not required because high availability is about failover to a standby instance, not about PITR capability. Option D is not required because the backup window only controls when automated backups run; PITR can recover to any point within the retention period regardless of the window. Option E is not required because a read replica is for read scaling and does not provide the binary-log-based recovery mechanism needed for PITR.

Answer

High availability (HA) is configured.

Answer

The backup window is set to a time before the incident.

Answer

A read replica is configured.