PCD Integrating Google Cloud services Practice Test 6 — 15 Questions

Question 1

You want to deploy a containerized application on Google Cloud that requires no server management and automatically scales based on HTTP traffic. Which service should you use?

Accepted Answer

Cloud Run.. Cloud Run is a fully managed serverless container platform that runs stateless containers, scales automatically (including to zero), and integrates natively with HTTP(S) load balancing and traffic-based autoscaling. It requires no cluster or server management.

Answer

Compute Engine.

Answer

Google Kubernetes Engine.

Answer

App Engine Flexible Environment.

Question 2

A developer is building a microservices application on Cloud Run. One service needs to make authenticated HTTP requests to another Cloud Run service in the same project. What is the best practice for authentication?

Accepted Answer

Use IAM roles on the target service and call it with the appropriate identity token from the metadata server. Cloud Run service-to-service authentication is best done using an identity token from the metadata server and setting IAM on the target service. Option A is not recommended as API keys are for external clients. Option B uses the default compute service account, which may have broader permissions than needed and is not the best practice for service-to-service auth. Option C uses OAuth2 client credentials, which are for external applications, not for internal service-to-service calls.

Answer

Use API keys

Answer

Use Cloud Run's built-in service-to-service authentication with the default compute service account

Answer

Use OAuth2 client credentials

Question 3

A developer wants to store application logs from Compute Engine instances in a centralized logging system. Which service should they use?

Accepted Answer

Cloud Logging. Cloud Logging is Google Cloud's fully managed, centralized log management service designed to ingest, store, search, analyze, and alert on log data from all GCP resources, including Compute Engine instances. The Cloud Logging agent (or Ops Agent) running on each VM forwards application and system logs to Cloud Logging, where they become accessible via the Logs Explorer, Log Router, and log-based metrics. This directly satisfies the requirement to store application logs from Compute Engine instances in a centralized system.

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Cloud Debugger

Question 4

A company is migrating a monolithic application to microservices on Google Cloud. They have strict requirements for service-to-service communication: requests must be authenticated, authorized, and encrypted in transit. They also need to enforce fine-grained access control based on the requesting service identity. Which Google Cloud service should they use to achieve these goals?

Accepted Answer

Cloud Service Mesh (Anthos Service Mesh). Cloud Service Mesh (Anthos Service Mesh) provides mutual TLS for encryption in transit, service identity-based authentication and authorization, and fine-grained access control policies between services. It is purpose-built for service-to-service security in microservices architectures on Google Cloud. The other options address ingress, edge protection, or API key management, not workload identity-based service mesh security.

Answer

Cloud Run with ingress control

Answer

Cloud Armor with IAM

Answer

Cloud Endpoints with API keys

Question 5

A developer needs to store configuration parameters for a Cloud Run service, such as database connection strings and API keys. The values must be encrypted at rest and in transit. Which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing configuration parameters like database connection strings and API keys, as it provides encryption at rest and in transit, along with fine-grained access control. Cloud SQL is a relational database service, not designed for secret storage. Cloud Storage is for object storage, not secrets. Firestore is a NoSQL database and not intended for secret management.

Answer

Cloud SQL

Answer

Cloud Storage

Answer

Firestore

Question 6

An application running on Compute Engine needs to publish messages to a Pub/Sub topic. The VPC does not have external internet access. What must be configured to allow the instance to publish?

Accepted Answer

Private Google Access. Private Google Access enables instances without external IP addresses to call Google APIs and services (including Pub/Sub) using internal IPs. Option A is for NAT to internet, option B is for peering, and option C is for dynamic routing.

Answer

Cloud NAT

Answer

VPC Peering with Pub/Sub

Answer

Cloud Router with BGP

Question 7

Refer to the exhibit. A developer configured a Pub/Sub push subscription to a Cloud Run service. Messages are not being delivered to the Cloud Run service. The developer verified that the service is running and the IAM permissions are correct. What is the most likely issue?

Accepted Answer

The OIDC token audience does not match the Cloud Run service's URL. For Pub/Sub push subscriptions to Cloud Run, the push endpoint must include an OIDC token whose audience matches the Cloud Run service's URL. If the audience does not match, Cloud Run rejects the request with a 401 or 403 error, and messages are not delivered. This is the most likely issue when the service is running and IAM permissions are correct.

Answer

The service account does not have the pubsub.publisher role

Answer

The push endpoint URL is not a valid HTTPS endpoint

Answer

The ackDeadlineSeconds is too short for the Cloud Run service to process messages

Question 8

A company wants to send events from a custom application to Cloud Pub/Sub, then process them with a Cloud Run service. The application runs on Compute Engine. What is the simplest way for the application to authenticate to Pub/Sub?

Accepted Answer

Attach a service account to the Compute Engine instance with necessary Pub/Sub roles.. The simplest and most secure way for an application on Compute Engine to authenticate to Pub/Sub is to attach a service account to the instance. This leverages the metadata server to automatically provide credentials to the application without embedding any secrets. The service account can be granted the necessary Pub/Sub roles (e.g., Pub/Sub Publisher) to allow publishing events. This approach eliminates key management overhead and follows Google Cloud best practices for authentication.

Answer

Use an API key for the Pub/Sub API.

Answer

Embed a service account JSON key in the application code.

Answer

Set up Cloud Endpoints to proxy the Pub/Sub requests.

Question 9

A developer is integrating a legacy on-premises application with Cloud Storage. The application generates files that must be uploaded to a bucket. The developer cannot install any additional software on the on-premises server. Which approach should the developer use?

Accepted Answer

Generate a signed URL and use an HTTP PUT request from the application.. A signed URL allows the legacy application to upload files directly to Cloud Storage using a standard HTTP PUT request, without installing any additional software or SDKs on the on-premises server. The signed URL embeds authentication credentials and permissions, so the application only needs an HTTP client, which is universally available. This satisfies the constraint of no additional software installation.

Answer

Use the gcloud CLI to copy files to the bucket.

Answer

Mount the bucket using Cloud Storage FUSE.

Answer

Deploy a Cloud Function that accepts file uploads and writes to the bucket.

Question 10

A team wants to use Cloud Scheduler to trigger a Cloud Function that calls an external API every hour. The Cloud Function requires an API key for the external service. How should the team securely provide the API key to the function?

Accepted Answer

Store the API key in Secret Manager and access it via the Secret Manager API in the function code.. Secret Manager is Google Cloud's recommended service for storing secrets like API keys. It integrates natively with Cloud Functions, allowing secure access without exposing the key in environment variables or code. Option A is insecure because environment variables can be visible in the function configuration. Option C is insecure because hardcoding exposes the key in the source code. Option D is not the best practice; while Cloud Storage with CSEK provides encryption, it is not designed for secrets management and requires more complex access control.

Answer

Pass the API key as an environment variable in the function's runtime environment.

Answer

Hardcode the API key in the Cloud Function source code.

Answer

Store the key in Cloud Storage with customer-supplied encryption key (CSEK).

Question 11

A company uses Cloud SQL for PostgreSQL and wants to run periodic analytical queries on the data without impacting the transactional workload. The data is updated frequently. Which integration approach is most suitable?

Accepted Answer

Create a read replica of the Cloud SQL instance and point analytical queries to the replica.. A Cloud SQL read replica is a continuously updated copy of the primary instance that serves read-only traffic, so analytical queries can be offloaded to it without competing with the transactional workload on the primary. Because replication is asynchronous and near-real-time, the replica stays current enough for periodic analytics even when the data is updated frequently. This is the lowest-friction, native Cloud SQL approach and avoids building a separate ETL pipeline.

Answer

Use Cloud Composer to schedule ETL jobs that copy data to BigQuery every minute.

Answer

Migrate the database to Cloud Spanner and use strong reads for analytics.

Answer

Export the Cloud SQL data to Cloud Storage and then load into BigQuery for analysis.

Question 12

A team is building a microservices architecture on Google Cloud. They want services to communicate asynchronously to avoid tight coupling. They also need to guarantee at-least-once delivery of messages. Which two services should they use together? (Choose TWO.)

Accepted Answer

Cloud Tasks. To achieve asynchronous communication with at-least-once delivery, the team should use Cloud Tasks (option C) for reliable task execution with retries and Cloud Pub/Sub (option D) for asynchronous messaging with guaranteed at-least-once delivery. Cloud Run (HTTP) is synchronous, Cloud Endpoints is an API gateway, and Cloud Datastore is a database, so none of these meet the async and delivery requirements.

Answer

Cloud Run (HTTP)

Answer

Cloud Endpoints

Answer

Cloud Datastore

Question 13

You are a developer at a company that runs a critical pricing engine on Compute Engine instances in a managed instance group (MIG) behind an internal TCP load balancer. The pricing engine is a stateful application that stores state in memory and also writes to a Cloud Bigtable instance for persistence. The application uses a custom port 8080. You need to migrate this application to Cloud Run for better scalability and reduced operational overhead. The application must maintain session affinity so that requests from the same client are routed to the same instance (since the in-memory state is not yet fully externalized). The application currently uses a health check on /healthz that returns 200 OK. You have containerized the application. When you deploy to Cloud Run, you notice that traffic is not sticky; every request might go to a different revision. You also need to ensure that Bigtable writes are performed asynchronously to avoid slowing down the pricing calculations. What should you do?

Accepted Answer

Use Cloud Run with an HTTP(S) External Load Balancer and enable session affinity on the backend service.. Cloud Run does not natively support session affinity, but you can achieve it by placing Cloud Run behind an external HTTP(S) load balancer and enabling session affinity on the backend service. This ensures that requests from the same client are routed to the same Cloud Run revision, maintaining session stickiness for the in-memory state. Option A is incorrect because Cloud Run does not support custom TCP health checks; it only supports HTTP health checks, and Cloud Run automatically handles health checks via the /healthz endpoint. Option B is incorrect because setting concurrency to 1 does not provide session affinity; it only limits the number of concurrent requests per container, but subsequent requests from the same client may still go to different containers without a load balancer with session affinity. Option D is incorrect because Cloud Run cannot be placed behind an internal TCP/UDP load balancer; it only supports HTTP(S) traffic and must use an external load balancer for session affinity.

Answer

Implement a custom health check on TCP port 8080 in Cloud Run to ensure only healthy instances receive traffic.

Answer

Increase the container concurrency setting to 1 to force each container to handle one request at a time.

Answer

Deploy the application on Cloud Run and configure an Internal TCP/UDP Load Balancer in front of it with session affinity.

Question 14

You are building an event-driven pipeline on Google Cloud. A Cloud Run service publishes messages to a Pub/Sub topic whenever a new customer record is created. A separate Cloud Run service must process these messages. You want to decouple the services, automatically retry failed processing, and ensure messages are not lost if the processing service is temporarily unavailable. What should you do?

Accepted Answer

Create a Pub/Sub push subscription to the processing Cloud Run service, and configure the service to return a 2xx status code only after successful processing.. A Pub/Sub push subscription delivers messages to a Cloud Run service over HTTP. If the service returns a non-2xx status, Pub/Sub retries with exponential backoff, ensuring reliable processing. This decouples the publisher and processor, and Pub/Sub retains messages if the service is down, preventing data loss.

Answer

Create a Pub/Sub pull subscription and have the processing Cloud Run service poll for messages using the Pub/Sub client library.

Answer

Use Cloud Tasks to enqueue messages from the publisher and have the processing service process them via HTTP.

Answer

Configure the publishing Cloud Run service to call the processing service directly via HTTP, and implement retries in the publisher.

Question 15

You are developing a Cloud Function that needs to read data from a Cloud Storage bucket. The function runs under a specific service account. You want to follow the principle of least privilege. What should you do?

Accepted Answer

Grant the service account the roles/storage.objectViewer role on the bucket.. The storage.objectViewer role grants read-only access to objects. Assigning it on the specific bucket ensures the service account can only read objects in that bucket, which is the minimal permission required. This follows the principle of least privilege and reduces the blast radius if the function is compromised.

Answer

Grant the service account the roles/storage.objectCreator role on the bucket.

Answer

Grant the service account the roles/editor role on the project.

Answer

Grant the service account the roles/storage.admin role on the project.