PCD Integrating Google Cloud services Practice Test 5 — 15 Questions

Question 1

You are designing a CI/CD pipeline using Cloud Build. You want to automatically trigger a build when code is pushed to a specific branch in Cloud Source Repositories. What is the correct configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a build trigger in Cloud Build with a regex pattern for the branch name.. Cloud Build natively supports build triggers that can be configured to automatically start a build when code is pushed to a specific branch in Cloud Source Repositories. The trigger uses a regex pattern to match the branch name, and Cloud Build listens for repository push events directly without requiring additional services.

Answer

Create a Cloud Function that invokes Cloud Build via API when a push event occurs.

Answer

Add a build step in cloudbuild.yaml that polls the repository.

Answer

Configure a Cloud Pub/Sub topic to notify Cloud Build on push events.

Question 2

A company is migrating a legacy monolithic application to Google Cloud. They want to minimize code changes and operational overhead while improving scalability. The application currently uses a relational database and stores user-uploaded images on a local filesystem. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud SQL for the database and Cloud Storage with Cloud CDN for images. Cloud SQL provides a fully managed relational database that requires minimal code changes when migrating from an existing relational database, while Cloud Storage with Cloud CDN handles user-uploaded images with scalable object storage and low-latency content delivery. This combination minimizes operational overhead by eliminating the need to manage database servers or file servers, and improves scalability through automatic replication and global edge caching.

Answer

Cloud Spanner for the database and Cloud Storage for images

Answer

Cloud Firestore for the database and Cloud Storage with Cloud CDN for images

Answer

Compute Engine with attached SSD persistent disks for both database and images

Question 3

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Accepted Answer

By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.. Option A is correct because Cloud Storage always encrypts data at rest by default using Google-managed encryption keys (AES-256), requiring no configuration from the customer. Option D is correct because CMEK (Customer-Managed Encryption Keys), backed by Cloud KMS, lets the company generate, rotate, and control the keys protecting its objects, satisfying stricter key-ownership requirements. Option B is wrong because a signed URL only grants time-limited access to an object; it does not revoke or modify the object's ACLs. Option C is wrong because uniform bucket-level access changes how permissions are managed (IAM at the bucket level) and has no effect on encryption at rest, which remains enabled. Option E is wrong because bucket-level IAM policies grant access to principals (users, groups, service accounts) and cannot be scoped to compute instances with specific service accounts.

Answer

Using a signed URL revokes the underlying object's ACL.

Answer

Enabling uniform bucket-level access disables encryption at rest.

Answer

Bucket-level policies can restrict access to only compute instances with specific service accounts.

Question 4

A company is running a critical application on Google Kubernetes Engine (GKE) that stores state in a Cloud SQL PostgreSQL instance. The application's latency-sensitive frontend needs to read data from Cloud SQL with minimal latency. The team wants to reduce read latency and offload read traffic from the primary database. What should they do?

Accepted Answer

Create a read replica of the Cloud SQL instance and direct read traffic to the replica.. Creating a read replica of the Cloud SQL PostgreSQL instance allows read-heavy, latency-sensitive traffic to be offloaded from the primary database. The replica handles SELECT queries independently, reducing load on the primary and lowering read latency for the frontend, as replicas are typically in the same region and can serve data with minimal additional delay.

Answer

Migrate the database to Cloud Spanner for better read scalability.

Answer

Use Memorystore for Redis as a cache layer between the application and Cloud SQL.

Answer

Use Cloud CDN to cache database responses.

Question 5

Drag and drop the steps to set up a Cloud SQL instance with a private IP in the correct order.

Accepted Answer

Create VPC network, Allocate IP range for private services access, Create private services access connection, Create Cloud SQL instance with private IP. Setting up private IP Cloud SQL requires a VPC, private services access, and creating the instance with private IP.

Answer

Create VPC network, Create private services access connection, Allocate IP range for private services access, Create Cloud SQL instance with private IP

Answer

Allocate IP range for private services access, Create VPC network, Create private services access connection, Create Cloud SQL instance with private IP

Answer

Create Cloud SQL instance with private IP, Create VPC network, Allocate IP range for private services access, Create private services access connection

Question 6

Drag and drop the steps to troubleshoot a failed Cloud Build in the correct order.

Accepted Answer

Check Cloud Build logs first, then examine build configuration, then fix identified issues, then re-run the build.. Troubleshooting involves reviewing logs and configuration, then fixing and re-running.

Answer

Re-run the build first, then check logs, then examine configuration, then fix issues.

Answer

Examine build configuration first, then re-run the build, then check logs, then fix issues.

Answer

Fix issues first, then check logs, then examine configuration, then re-run.

Question 7

Match each Kubernetes resource to its function.

Accepted Answer

Pod: The smallest and simplest Kubernetes object. It represents a single instance of a running process in your cluster.. These are fundamental Kubernetes objects for running containerized applications.

Answer

ConfigMap: Stores sensitive data such as passwords, OAuth tokens, and ssh keys.

Answer

Secret: Manages external access to the services in a cluster, typically HTTP.

Answer

Ingress: Allows you to decouple configuration artifacts from image content to keep containerized applications portable.

Question 8

Match each Firebase feature to its description.

Accepted Answer

Cloud Firestore: A NoSQL document database for storing and syncing data in real time.. Firebase features include Cloud Firestore (NoSQL database), Authentication (user login), and Cloud Functions (backend code). Common confusions: mixing NoSQL vs relational, and hosting vs functions.

Answer

Cloud Firestore: A relational database with SQL queries for structured data.

Answer

Firebase Hosting: A Firebase feature for running backend code in response to events.

Question 9

A company is using Cloud Functions (2nd gen) to process files uploaded to Cloud Storage. The function needs to access a Cloud SQL (PostgreSQL) database. What is the most secure way to store and provide the database password to the function?

Accepted Answer

Use Secret Manager and access it via the Secret Manager API within the function.. Secret Manager is Google Cloud's purpose-built service for storing, versioning, and accessing secrets with IAM-based access control and audit logging. Accessing it via the Secret Manager API from the function means the password is never persisted in code, environment variables, or storage buckets, and access can be tightly scoped to the function's service account.

Answer

Use Cloud KMS to encrypt the password and store it in environment variables.

Answer

Hardcode the password in the function code.

Answer

Store the password in a Cloud Storage bucket and read it at startup.

Question 10

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

Accepted Answer

Use Cloud Build triggers with a branch filter set to ^main$.. Cloud Build triggers support a branch filter using a regular expression, so setting the filter to ^main$ ensures the trigger only fires for builds originating from the main branch. This is the native, declarative way to restrict deployments to production based on branch. It directly enforces the policy at the trigger level without manual intervention.

Answer

Configure Cloud Run to only accept revisions from a specific source repository.

Answer

Use IAM conditions on the Cloud Run service account to allow only main branch builds.

Answer

Create a separate Cloud Build trigger for each branch and manually disable non-main triggers.

Question 11

You are designing a system that ingests high-velocity event streams from IoT devices using Pub/Sub. Each event must be processed exactly once to update a Firestore database. However, due to the distributed nature, at-least-once delivery is guaranteed by Pub/Sub. Which design pattern should you use to achieve exactly-once processing?

Accepted Answer

Make the message processor idempotent by using a unique event ID as the Firestore document ID, and perform upsert operations.. Making the message processor idempotent by using a unique event ID as the Firestore document ID ensures that even if Pub/Sub delivers the same event multiple times (at-least-once semantics), the upsert operation will overwrite the document with the same data, resulting in exactly-once processing. This pattern leverages Firestore's document-level write semantics without requiring additional infrastructure for deduplication.

Answer

Use a Cloud Function with a retry policy to ensure delivery, and deduplicate using a Cloud Bigtable row key.

Answer

Use Cloud Dataflow with exactly-once processing mode and write to Firestore using a custom sink.

Answer

Use a Cloud Run service to pull messages and write to Firestore; rely on Firestore's built-in deduplication using document IDs.

Question 12

An application running on GKE needs to access a Cloud SQL instance. The team wants to avoid using Cloud SQL Auth Proxy to reduce complexity. What is the most secure alternative?

Accepted Answer

Use Private Service Connect to connect privately.. Private Service Connect (PSC) allows your GKE cluster to connect to Cloud SQL privately using internal IPs within the same VPC, without exposing traffic to the public internet or requiring the Cloud SQL Auth Proxy. PSC creates a private endpoint that routes traffic through Google's internal network, providing secure, low-latency connectivity while reducing operational overhead.

Answer

Whitelist the GKE node external IPs in Cloud SQL authorized networks.

Answer

Use a Cloud SQL read replica with a public IP.

Answer

Configure Cloud SQL to allow all traffic from the VPC.

Question 13

Which three are valid ways to authenticate a service account when using the Google Cloud client libraries? (Choose three.)

Accepted Answer

Attaching a service account to a Compute Engine instance and letting the metadata server provide credentials.. Options A, B, and D are correct. These are standard methods for Application Default Credentials (ADC). Attaching a service account to a Compute Engine instance allows the metadata server to provide credentials (A). Setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a service account key file is another valid method (B). Using the gcloud CLI default application credentials is also a valid approach (D). Option C is incorrect because OAuth 2.0 client IDs for web applications are used for user authentication, not service account authentication. Option E is incorrect because API keys are not used for service account authentication; they are used for simple API access without a service account.

Answer

Using OAuth 2.0 client IDs for web applications.

Answer

Using an API key in the client library initialization.

Question 14

A developer sets environment variables for a Cloud Function as shown. What is the security concern?

Accepted Answer

The password is exposed in plain text and should be stored in Secret Manager.. Storing a database password directly in a Cloud Function's environment variables (e.g., DB_PASS=mysecretpassword) exposes it in plain text. Environment variables are visible in the function's configuration, logs, and deployment metadata, and anyone with read access to the function can see the secret. Google Cloud recommends using Secret Manager to store sensitive data and referencing it at runtime, which provides encryption, access control, and audit logging.

Answer

The variable name FOO is too short and does not follow naming conventions.

Answer

The variable DB_PASS should be set as a build variable instead.

Answer

There is no encryption applied to environment variables.

Question 15

A company uses Cloud SQL for MySQL. They need to export data to Cloud Storage regularly. What is the recommended method?

Accepted Answer

Use Cloud SQL export feature to export to Cloud Storage.. Using the Cloud SQL export feature to export to Cloud Storage is correct because it is the native, recommended method for exporting data from Cloud SQL to Cloud Storage. It handles the export in a managed way, supports CSV and SQL formats, and integrates with IAM and Cloud Storage permissions. This method is efficient and requires minimal setup.

Answer

Use Dataflow to read from Cloud SQL and write to Cloud Storage.

Answer

Use a cron job on Cloud SQL instance to write to Cloud Storage.

Answer

Use mysqldump command from a Compute Engine instance.