PCD Integrating Google Cloud services Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A team is deploying a Cloud Function that needs to connect to a Cloud SQL instance in a VPC. They have set up a VPC connector. After deployment, the function fails to connect to the database. What is the most likely cause?

Accepted Answer

The VPC connector is in a different region than the function. Option A is correct because the VPC connector must be in the same region as the Cloud Function. If they are in different regions, the function cannot use the connector. Option B is less likely because Cloud SQL private IP uses VPC peering, not firewall rules. Option C is possible but usually the default service account has the necessary permissions. Option D is a possible typo but less likely given the exhibit shows 'DB_HOST'.

Answer

The function's service account does not have permissions to use the VPC connector

Answer

The environment variable DB_HOST is misspelled

Answer

The database firewall rules do not allow traffic from the VPC connector's subnet

Question 2

Refer to the exhibit. A developer configured a Pub/Sub push subscription to a Cloud Run service. Messages are not being delivered to the Cloud Run service. The developer verified that the service is running and the IAM permissions are correct. What is the most likely issue?

Accepted Answer

The OIDC token audience does not match the Cloud Run service's URL. Option B is correct because the OIDC token audience must exactly match the URL of the Cloud Run service. In the exhibit, the audience is 'https://my-service.run.app/' which should be the same as the push endpoint, but if the Cloud Run service has a different URL (e.g., with a generated hash), the authentication will fail. Option A is possible but less likely because messages would still be delivered and then acknowledged if processing time is less than 10 seconds. Option C is incorrect because the endpoint is HTTPS. Option D is incorrect because the service account needs the token creator role, not publisher.

Answer

The service account does not have the pubsub.publisher role

Answer

The push endpoint URL is not a valid HTTPS endpoint

Answer

The ackDeadlineSeconds is too short for the Cloud Run service to process messages

Question 3

A company wants to send events from a custom application to Cloud Pub/Sub, then process them with a Cloud Run service. The application runs on Compute Engine. What is the simplest way for the application to authenticate to Pub/Sub?

Accepted Answer

Attach a service account to the Compute Engine instance with necessary Pub/Sub roles.. Option B is correct because using a service account attached to the Compute Engine instance allows automatic authentication via the instance metadata server, which is the simplest and most secure approach. Option A is wrong because storing a JSON key in the application code is not best practice. Option C is wrong because an API key does not provide identity-based access control for Pub/Sub. Option D is wrong because while Cloud Endpoints is an option, it adds unnecessary complexity.

Answer

Use an API key for the Pub/Sub API.

Answer

Embed a service account JSON key in the application code.

Answer

Set up Cloud Endpoints to proxy the Pub/Sub requests.

Question 4

A developer is integrating a legacy on-premises application with Cloud Storage. The application generates files that must be uploaded to a bucket. The developer cannot install any additional software on the on-premises server. Which approach should the developer use?

Accepted Answer

Generate a signed URL and use an HTTP PUT request from the application.. Option C is correct because using a signed URL allows the application to upload files directly via HTTP without needing a Google Cloud SDK or library. Option A is wrong because the gcloud CLI may not be installed. Option B is wrong because Cloud Storage FUSE requires a FUSE driver installation. Option D is wrong because Cloud Functions is an additional service, not a direct upload method.

Answer

Use the gcloud CLI to copy files to the bucket.

Answer

Mount the bucket using Cloud Storage FUSE.

Answer

Deploy a Cloud Function that accepts file uploads and writes to the bucket.

Question 5

A company has a Cloud Run service that ingests messages from a Cloud Pub/Sub subscription. The service uses automatic scaling based on CPU. Recently, the team noticed that when message volume spikes, the service scales up slowly, causing a backlog. What is the most effective solution to reduce the time to scale out?

Accepted Answer

Change the subscription type from pull to push and set the Cloud Run service as the push endpoint.. Option A is correct because Cloud Run can use direct Pub/Sub push subscriptions to trigger invocations, which reduces the polling interval and improves scaling responsiveness compared to pull subscriptions with CPU-based scaling. Option B is wrong because min-instances causes idle cost but does not improve scale-up speed when below min; it only ensures a base level. Option C is wrong because Cloud Tasks adds another queueing layer without solving the scaling delay. Option D is wrong because increasing max instances helps during high load but does not speed initial scaling.

Answer

Increase the max instances for the Cloud Run service to 100.

Answer

Use Cloud Tasks to buffer messages and configure a Cloud Scheduler job to pull from the queue.

Answer

Set a minimum number of instances on the Cloud Run service to 5.

Question 6

A team wants to use Cloud Scheduler to trigger a Cloud Function that calls an external API every hour. The Cloud Function requires an API key for the external service. How should the team securely provide the API key to the function?

Accepted Answer

Store the API key in Secret Manager and access it via the Secret Manager API in the function code.. Option D is correct because Secret Manager is designed for storing secrets like API keys and integrates easily with Cloud Functions. Option A is wrong because hardcoding in code is insecure. Option B is wrong because environment variables are visible in the function configuration. Option C is wrong while encrypted, it's not a standard practice and harder to manage than Secret Manager.

Answer

Pass the API key as an environment variable in the function's runtime environment.

Answer

Hardcode the API key in the Cloud Function source code.

Answer

Store the key in Cloud Storage with customer-supplied encryption key (CSEK).

Question 7

A company uses Cloud SQL for PostgreSQL and wants to run periodic analytical queries on the data without impacting the transactional workload. The data is updated frequently. Which integration approach is most suitable?

Accepted Answer

Create a read replica of the Cloud SQL instance and point analytical queries to the replica.. Option B is correct because Cloud SQL read replicas allow offloading read queries without affecting the primary instance's performance. Option A is wrong as export/import is batch and not real-time. Option C is wrong because Cloud Spanner is a different database. Option D is wrong because Cloud Composer is an orchestration tool, not a direct solution.

Answer

Use Cloud Composer to schedule ETL jobs that copy data to BigQuery every minute.

Answer

Migrate the database to Cloud Spanner and use strong reads for analytics.

Answer

Export the Cloud SQL data to Cloud Storage and then load into BigQuery for analysis.

Question 8

A developer is integrating an App Engine standard environment app with Cloud Storage. The app needs to read objects from a bucket that is in a different project. The developer has granted the App Engine service account the Storage Object Viewer role on the bucket. However, the app still gets a 403 error when trying to read objects. What is the most likely cause?

Accepted Answer

The service account is from the app's project, not the bucket's project, and the bucket's IAM policy may not include the service account.. Option A is correct because cross-project access requires the service account to be granted access at the bucket level in the source project, but the App Engine service account is in the same project as the app; the bucket is in another project, so the role must be assigned in the bucket's project. The error might persist if the bucket's IAM policy doesn't include the service account. Option B is wrong as no need for service account key. Option C is wrong because VPC-SC could block, but that would be a different error. Option D is wrong because public access disabled is fine for explicit IAM.

Answer

The service account needs to be downloaded as a JSON key and added to the app configuration.

Answer

The bucket has uniform bucket-level access disabled, so ACLs may override IAM permissions.

Answer

The bucket is in a VPC Service Controls perimeter that blocks access from the App Engine service account.

Question 9

A company wants to trigger a Cloud Run job every time a new file is uploaded to a Cloud Storage bucket. Which integration should be used?

Accepted Answer

Use Eventarc to create a trigger that routes Cloud Storage events to the Cloud Run job.. Option C is correct because Eventarc can route Cloud Storage events (like object finalize) to Cloud Run jobs via CloudEvents. Option A is wrong because Cloud Scheduler is time-based, not event-based. Option B is wrong because Cloud Functions can be triggered by storage events, but the question asks for Cloud Run job. Option D is wrong because Pub/Sub alone cannot directly trigger a Cloud Run job without a subscription or push endpoint.

Answer

Use Cloud Pub/Sub notifications from the bucket and create a push subscription to the Cloud Run job.

Answer

Use Cloud Scheduler to poll the bucket and invoke the Cloud Run job every minute.

Answer

Use Cloud Functions to listen for storage events and then call the Cloud Run job via HTTP.

Question 10

A team is building a microservices architecture on Google Cloud. They want services to communicate asynchronously to avoid tight coupling. They also need to guarantee at-least-once delivery of messages. Which two services should they use together? (Choose TWO.)

Accepted Answer

Cloud Tasks. Option A (Cloud Pub/Sub) is correct for asynchronous messaging with at-least-once delivery. Option D (Cloud Tasks) is also correct for asynchronous task execution with retries. Options B and C are synchronous, so they don't fit. Option E (Cloud Datastore) is a database, not a messaging service.

Answer

Cloud Run (HTTP)

Answer

Cloud Endpoints

Answer

Cloud Datastore

Question 11

A company is integrating a legacy application with Google Cloud using Cloud VPN. The application must be accessed from multiple remote offices over the internet. Which TWO technologies should the company use to ensure secure and reliable connectivity? (Choose TWO.)

Accepted Answer

Cloud Interconnect. Option A (Cloud VPN) is correct for site-to-site VPN connectivity. Option C (Cloud Interconnect) is correct for dedicated, reliable connectivity. Option B (Direct Peering) is not recommended for multi-office since it's for on-prem to Google, not hub-spoke. Option D (Cloud NAT) is for outbound internet. Option E (Private Google Access) is for on-prem to Google APIs.

Answer

Private Google Access

Answer

Cloud NAT

Answer

Direct Peering

Question 12

A company has a Cloud Function that processes events from Cloud Pub/Sub. The function uses HTTP client libraries to call external APIs. The team notices that the function sometimes times out during high traffic. Which THREE actions should they take to improve reliability? (Choose THREE.)

Accepted Answer

Use Cloud Tasks to queue the API call invocations and process them asynchronously from the function.. Option A (increase timeout) is correct to allow more processing time. Option D (implement retry with exponential backoff) is correct to handle transient API failures. Option E (use Cloud Tasks for internal queueing) is correct to decouple API calls from the function. Option B (increase memory) may help speed up, but not directly address timeout due to external dependencies. Option C (reduce concurrency) could reduce load but not timeout issue.

Answer

Increase the allocated memory to 2GB.

Answer

Reduce the maximum number of concurrent function instances.

Question 13

You are a developer at a company that runs a critical pricing engine on Compute Engine instances in a managed instance group (MIG) behind an internal TCP load balancer. The pricing engine is a stateful application that stores state in memory and also writes to a Cloud Bigtable instance for persistence. The application uses a custom port 8080. You need to migrate this application to Cloud Run for better scalability and reduced operational overhead. The application must maintain session affinity so that requests from the same client are routed to the same instance (since the in-memory state is not yet fully externalized). The application currently uses a health check on /healthz that returns 200 OK. You have containerized the application. When you deploy to Cloud Run, you notice that traffic is not sticky; every request might go to a different revision. You also need to ensure that Bigtable writes are performed asynchronously to avoid slowing down the pricing calculations. What should you do?

Accepted Answer

Use Cloud Run with an HTTP(S) External Load Balancer and enable session affinity on the backend service.. Option B is correct because Cloud Run does not support session affinity natively; to achieve stickiness, you need to set the session affinity feature on the external HTTP(S) load balancer and place Cloud Run behind it. Option A is wrong because increasing concurrency does not affect stickiness. Option C is wrong because even with an internal load balancer, Cloud Run does not support session affinity directly; you need an external load balancer with session affinity. Option D is wrong because Cloud Run does not support custom health checks with TCP; it only supports HTTP health checks.

Answer

Implement a custom health check on TCP port 8080 in Cloud Run to ensure only healthy instances receive traffic.

Answer

Increase the container concurrency setting to 1 to force each container to handle one request at a time.

Answer

Deploy the application on Cloud Run and configure an Internal TCP/UDP Load Balancer in front of it with session affinity.

Question 14

You are building a data pipeline that ingests streaming data from thousands of IoT devices. The devices send JSON payloads to a Cloud Pub/Sub topic. You want to process the data in near real-time and store the results in BigQuery for analytics. You also need to handle occasional schema changes in the incoming data (new fields added) without manual intervention. You have set up a Dataflow streaming pipeline using Apache Beam to read from Pub/Sub and write to BigQuery. The pipeline uses the `WriteToBigQuery` transform with `createDisposition=CREATE_NEVER` and `writeDisposition=WRITE_APPEND`. Recently, a batch of devices started sending a new field `temperature_celsius` that does not exist in the BigQuery schema. The pipeline logs errors and the data is not written. You need to modify the pipeline to automatically handle such schema evolution. What should you do?

Accepted Answer

Change `createDisposition` to `CREATE_IF_NEEDED` and ensure the BigQuery table schema has `autodetect=true` or is updated to allow new fields.. Option A is correct because with `createDisposition=CREATE_IF_NEEDED`, BigQuery will automatically add new fields if the schema allows updates. This is the simplest approach. Option B is wrong because storing raw data in Cloud Storage and then loading later loses real-time capability. Option C is wrong because Dataflow does not have a transform that automatically flattens schemas without modification. Option D is wrong because updating the table schema manually defeats the purpose of automation.

Answer

Manually update the BigQuery table schema to include the new field and then restart the pipeline.

Answer

Write the raw JSON payloads to Cloud Storage and use a Cloud Function to load them into BigQuery every 10 minutes with schema autodetect.

Answer

Use a `ParDo` transform to flatten all JSON fields into a fixed schema by ignoring unknown fields.

Question 15

Your organization runs a multi-region application on Cloud Run that serves an API. The API is consumed by clients worldwide. You want to reduce latency by routing users to the nearest regional Cloud Run service. Currently, all traffic goes to a single Cloud Run service in us-central1. You have set up additional Cloud Run services in europe-west1 and asia-east1. Each service is fronted by an external HTTPS load balancer with a regional backend. You want to use a single global anycast IP address that automatically directs users to the closest healthy backend. You also need to support HTTPS with a custom domain and a Google-managed certificate. What should you do?

Accepted Answer

Create a global external HTTPS load balancer with serverless NEGs pointing to each regional Cloud Run service, and attach a Google-managed certificate.. Option D is correct because an External HTTPS Load Balancer with a global backend service can route traffic to the closest backend via the Google Front Ends (GFE). The regional Cloud Run services can be added as backends with the appropriate network endpoint groups (NEGs). Option A is wrong because Cloud CDN caches content but does not route based on locality. Option B is wrong because Cloud DNS with geo-routing can direct to different IPs, but that is not a single anycast IP. Option C is wrong because Cloud Run does not support anycast itself.

Answer

Enable anycast on the Cloud Run service by selecting the 'global' setting in the Cloud Run region selection.

Answer

Use Cloud DNS with geo-routing policy to point users to the appropriate regional load balancer IP based on their location.

Answer

Configure Cloud CDN in front of the Cloud Run services to cache responses at edge locations.

PCD Integrating Google Cloud services Practice Test 4 — 15 Questions

Exhibit

PCD Integrating Google Cloud services Practice Test 4 — 15 Questions

Exhibit