PCD Integrating Google Cloud services Practice Test 7 — 15 Questions

Question 1

A development team runs a Node.js API on Cloud Run that reads configuration values from Secret Manager at startup. During a load test, the service scales out to 40 instances and the team observes a spike in Secret Manager API calls plus occasional HTTP 429 responses. They want to reduce the call volume and eliminate the throttling without changing the secret values or broadening IAM permissions. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fetch the secret once at container startup and store it in a module-level variable, and set the secret as an environment variable or mounted volume so each instance reads it locally.. Caching the secret in memory after a single startup fetch reduces Secret Manager calls to roughly one per instance, which directly removes the burst of requests that caused throttling. Delivering the value through an environment variable or mounted volume also decouples the running service from the Secret Manager API, so scaling events no longer multiply API traffic.

Answer

Enable the Secret Manager API's server-side caching by setting the --cache-ttl flag on the Cloud Run service.

Answer

Mount the secret as a volume and read it from the filesystem on every request instead of calling the API.

Answer

Increase the Cloud Run maximum instance count and set a higher CPU allocation so instances initialize faster.

Question 2

A company runs a containerized web application on Cloud Run. The application must read configuration values and secrets from environment variables at runtime. The security team requires that secrets are never stored in the container image or in plaintext in the deployment YAML. Which approach should the developer use to securely provide these secrets to the Cloud Run service?

Accepted Answer

Store the secrets in Secret Manager and reference them in the Cloud Run service configuration using the secret's resource name and version.. Cloud Run integrates with Secret Manager to securely inject secrets as environment variables or mounted volumes. By referencing the secret's resource name and version in the service configuration, the secret is fetched at runtime and never exposed in the image or YAML. This satisfies the security team's requirements for secure secret handling.

Answer

Store the secrets as environment variables directly in the Cloud Run service YAML file and apply it with gcloud run services replace.

Answer

Build the secrets into the container image as environment variables using a Dockerfile ENV instruction.

Answer

Store the secrets in a Cloud Storage bucket and have the application download them at startup using the Cloud Storage API.

Question 3

You are deploying a containerized application to Google Kubernetes Engine (GKE). The application needs to access a Cloud SQL for PostgreSQL instance. You want to use the most secure method that avoids managing database passwords and minimizes network exposure. What should you do?

Accepted Answer

Enable the Cloud SQL Auth Proxy as a sidecar container in the application's pod, and configure the application to connect to the proxy via localhost.. The Cloud SQL Auth Proxy uses IAM to authenticate and encrypt connections to Cloud SQL. Running it as a sidecar in the pod allows the application to connect via localhost, keeping traffic local and secure. This avoids password management and public exposure, making it the most secure and recommended method for GKE.

Answer

Use the Cloud SQL JDBC socket factory library in the application code to connect directly to the Cloud SQL instance's private IP.

Answer

Configure the Cloud SQL instance with a public IP and add the GKE node's external IP address to the authorized networks list.

Answer

Store the database password in a Kubernetes Secret and mount it as an environment variable in the application's pod.

Question 4

An application publishes order events to a Pub/Sub topic. A downstream Cloud Run service must process each event exactly once in business terms, but the team sees duplicate orders during retries. They already use a subscription with a 10-minute ack deadline and a dead-letter topic. Which change best prevents duplicate processing while keeping the pipeline resilient?

Accepted Answer

Switch the subscription to exactly-once delivery and make the Cloud Run handler idempotent using the message ID stored in Firestore.. Exactly-once delivery reduces, but does not fully remove, redelivery during failures, so the durable idempotency check is what actually guarantees each order is written once. Storing the message ID in Firestore gives the handler a reliable record to consult before committing work, which makes retries safe.

Answer

Enable message ordering on the subscription and use the ordering key to serialize processing per customer.

Answer

Create a separate subscription per Cloud Run instance and rely on Pub/Sub to route each message to only one subscription.

Answer

Increase the ack deadline to 60 minutes and reduce the Cloud Run maximum concurrency to 1 so only one message is handled at a time.

Question 5

Your team runs a Cloud Run service that must access a Cloud SQL for PostgreSQL instance. Security policy prohibits public IPs and requires IAM-based authentication. You have created the Cloud SQL instance with a private IP and enabled the Cloud SQL Admin API. You need to configure the Cloud Run service to connect. What should you do?

Accepted Answer

In the Cloud Run service configuration, add a Cloud SQL connection to the instance and use the Unix socket path /cloudsql/INSTANCE_CONNECTION_NAME in the connection string.. Cloud Run's built-in Cloud SQL integration automatically provisions the Cloud SQL Auth Proxy and exposes a Unix socket. By adding the connection in the service configuration and using the socket path, the application benefits from IAM-based authentication and private connectivity without managing proxies or VPNs. This meets the security policy and is the standard method.

Answer

Configure the Cloud Run service to use a Serverless VPC Access connector and connect directly to the Cloud SQL private IP on port 5432.

Answer

Create a Cloud VPN tunnel between the Cloud Run service and the Cloud SQL instance, then connect using the instance's private IP.

Answer

Mount Cloud SQL Auth Proxy as a sidecar container in the Cloud Run service and configure the application to connect to localhost:5432.

Question 6

A team stores user-uploaded images in a Cloud Storage bucket. They want other Google Cloud services and external clients to access objects using short-lived, signed URLs without making the bucket public, and they want to avoid managing long-lived service account keys. Which approach should they use?

Accepted Answer

Use the IAM SignBlob API with the Cloud Run service account to generate V4 signed URLs, so no downloaded key is needed.. Signing with the IAM SignBlob API lets the workload use its own service account identity to create V4 signed URLs, so access can be scoped and time-limited without any downloadable key. The bucket stays private and no long-lived credential is introduced.

Answer

Set the bucket's default object ACL to public-read and rely on the URL's expiration parameter.

Answer

Create a service account key, download the JSON file, and embed it in the application to sign URLs.

Answer

Grant allUsers the Storage Object Viewer role on the bucket and share direct object URLs.

Question 7

You are building a Cloud Run service that needs to access a third-party API. The API key must be stored securely and rotated regularly without redeploying the service. You want to minimize the risk of the key being exposed in logs or source code. What should you do?

Accepted Answer

Store the API key in Secret Manager and mount it as a volume in the Cloud Run service.. Secret Manager is designed for secure secret storage with versioning and IAM access control. Mounting the secret as a volume in Cloud Run makes it available as a file, keeping it out of environment variables and source code. Rotation can be done by adding a new version, and Cloud Run can be configured to use the latest version, avoiding redeployment.

Answer

Embed the API key in the container image as a file and read it at runtime.

Answer

Set the API key as an environment variable in the Cloud Run service configuration.

Answer

Store the API key in a Cloud Storage bucket and have the service download it at startup.

Question 8

A company runs a real-time bidding service on Compute Engine. They need to publish bid events to a Pub/Sub topic from an application running on a VM. The security team mandates that no long-lived service account keys be stored on the VM. What should the developer do to authenticate the application to Pub/Sub?

Accepted Answer

Assign a service account with the Pub/Sub Publisher role to the VM instance and let the application use Application Default Credentials (ADC).. The most secure and operationally sound approach is to attach a service account to the Compute Engine VM and use Application Default Credentials. The application then retrieves short-lived tokens from the metadata server without any key files. This eliminates key management overhead and aligns with Google's recommendation to avoid long-lived service account keys whenever possible.

Answer

Create a service account key and store it in Cloud Key Management Service (Cloud KMS), then have the application decrypt and use it at runtime.

Answer

Configure the application to use the end-user's OAuth 2.0 refresh token to obtain access tokens for Pub/Sub.

Answer

Generate a JWT signed with the VM's SSH host key and exchange it for a Google Cloud access token.

Question 9

A developer is building a Cloud Function that processes messages from a Pub/Sub topic. The function must acknowledge messages only after successful processing, and failed messages should be retried. The developer wants to minimize code complexity. What should they do?

Accepted Answer

Use a background function triggered by Pub/Sub and rely on the function's automatic acknowledgment when it returns successfully.. Cloud Functions with a Pub/Sub trigger automatically handle message acknowledgment and retries. When the function completes successfully, the message is acknowledged; if it fails, the message is retried according to the subscription's settings. This built-in integration reduces code and ensures reliable processing, making it the simplest and most effective solution.

Answer

Deploy the function with the --retry flag and implement explicit acknowledgment using the Pub/Sub client library.

Answer

Create a pull subscription and have the function poll for messages, then acknowledge them after processing.

Answer

Use an HTTP-triggered function and manually acknowledge messages by calling the Pub/Sub API after processing.

Question 10

Your team runs a Node.js API on Cloud Run that must write to a Cloud Storage bucket in the same project. The service currently uses a downloaded service account key stored in a Secret Manager secret and mounted as a volume. You need to remove the static key entirely while keeping least-privilege access and avoiding any credential files on disk. What should you do?

Accepted Answer

Create a dedicated service account with the roles/storage.objectCreator role, assign it as the Cloud Run service's runtime identity, and delete the secret and key.. Attaching a dedicated runtime service account to the Cloud Run revision lets the container obtain short-lived tokens from the metadata server, so no key file is needed. Scoping that identity to roles/storage.objectCreator enforces least privilege for bucket writes. Removing the Secret Manager secret and downloaded key completes the keyless migration and removes the risk of credential exfiltration from the container filesystem.

Answer

Keep the mounted key but rotate it every 24 hours using a Cloud Scheduler job that calls the IAM API to create a new key version.

Answer

Enable the Cloud Storage API and use the default Compute Engine service account by setting the GOOGLE_APPLICATION_CREDENTIALS variable to the metadata server path.

Answer

Store the key in an environment variable instead of a mounted volume, and restrict access to the Cloud Run service with Cloud IAM.

Question 11

A team runs a Cloud Run service that receives messages from a Pub/Sub push subscription. They need to ensure that only Pub/Sub can invoke the service, and that the requests are authenticated. They have already configured the Pub/Sub subscription with a push endpoint pointing to the Cloud Run service URL. What should they do to secure the service?

Accepted Answer

Grant the Cloud Run Invoker role to the Pub/Sub service account and configure the push subscription to use OIDC authentication.. To secure a Cloud Run service so that only Pub/Sub can invoke it, you must grant the Pub/Sub service account the Cloud Run Invoker role and configure the push subscription to use OIDC authentication. This ensures that Pub/Sub includes a signed identity token in each request, and Cloud Run verifies that token against IAM permissions. This approach leverages native Google Cloud security features and is the recommended practice for service-to-service authentication with Pub/Sub push subscriptions.

Answer

Create a service account with the Pub/Sub Subscriber role and attach it to the Cloud Run service.

Answer

Use Cloud Endpoints to validate the Pub/Sub message signature before allowing the request to reach the Cloud Run service.

Answer

Set the Cloud Run service to allow unauthenticated invocations and rely on the Pub/Sub message payload to validate the source.

Question 12

A financial services company runs a batch processing job on Google Cloud that reads data from BigQuery and writes results to Cloud Storage. The job must run only during a specific maintenance window and must be able to restart from where it left off if interrupted. The developer needs to implement checkpointing. Which Google Cloud service should the developer use to store the checkpoint state?

Accepted Answer

Cloud Storage. Cloud Storage is the ideal service for storing checkpoint files because it is durable, scalable, and simple to use. Batch jobs can write their progress to a Cloud Storage object and read it back when restarting. This pattern is widely used and integrates well with tools like Apache Beam and Dataflow.

Answer

Cloud Pub/Sub

Answer

Cloud Firestore in Datastore mode

Answer

Cloud SQL

Question 13

A retail company runs a Python web application on Compute Engine. The application needs to read messages from a Pub/Sub subscription, enrich them using a Cloud SQL for PostgreSQL database, and write results to a Cloud Storage bucket. The security team mandates that no service account keys be downloaded to the VM. The application must authenticate to all three services. Which approach should the developer implement?

Accepted Answer

Create a user-managed service account, grant it the required IAM roles, and attach it to the Compute Engine instance. Use the Application Default Credentials (ADC) libraries in the application code.. The correct approach is to attach a user-managed service account to the Compute Engine instance and use Application Default Credentials. This eliminates the need to download or manage keys, as the metadata server provides short-lived tokens. Granting the service account only the necessary IAM roles adheres to least privilege while enabling access to Pub/Sub, Cloud SQL, and Cloud Storage.

Answer

Create a service account and configure the application to use the service account's OAuth 2.0 client ID and secret to obtain access tokens for each API call.

Answer

Use the Compute Engine default service account and grant it the Editor role at the project level to ensure it has permissions for all three services.

Answer

Create a service account and generate a JSON key. Store the key in Cloud Storage, then have the application download it at startup and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Question 14

A company runs a critical application on Compute Engine instances managed by a managed instance group (MIG). They need to ensure that the application can access a Cloud Storage bucket without exposing credentials on the instances. The instances must also be able to call the Cloud Storage API with the least privilege necessary. What should they do?

Accepted Answer

Assign a service account with the Storage Object Viewer role to the instance template, and grant the service account access to the bucket.. The correct approach is to assign a service account to the instance template so that all instances in the managed instance group inherit it. This service account can be granted the Storage Object Viewer role, which allows read-only access to the bucket's objects. This method avoids storing credentials on instances and follows the principle of least privilege. The other options either involve insecure key management, excessive permissions, or unnecessary complexity.

Answer

Use the default Compute Engine service account and grant it the Storage Admin role to ensure the instances can access the bucket.

Answer

Configure the instances to use Application Default Credentials by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a shared credentials file on a persistent disk.

Answer

Create a service account with the Storage Object Viewer role, download its key as a JSON file, and store it on each instance.

Question 15

An application running on Compute Engine needs to read objects from a Cloud Storage bucket in the same project. The team wants the VM to authenticate to the Cloud Storage API without distributing credentials and with the least privilege. What should they do?

Accepted Answer

Attach a user-managed service account with the Storage Object Viewer role to the VM and let the metadata server provide tokens.. Attaching a dedicated service account gives the VM an automatic, rotating identity through the metadata server, and scoping it to Storage Object Viewer keeps access limited to reading objects. No key files are needed, satisfying both the no-distributed-credentials and least-privilege requirements.

Answer

Enable Cloud Storage's uniform bucket-level access and set the VM's public IP as an allowed network source.

Answer

Create a service account key file and store it on the VM's persistent disk with restrictive file permissions.

Answer

Grant the Compute Engine default service account the Editor role at the project level so the VM can access the bucket.