PCD Integrating Google Cloud services Practice Test 8 — 15 Questions

Question 1

A developer is building a Cloud Run service that reads messages from a Pub/Sub subscription. The service must process each message exactly once and acknowledge it only after successful processing. The developer wants to minimize the chance of duplicate processing. Which Pub/Sub feature should be enabled on the subscription?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exactly-once delivery.. Exactly-once delivery is a Pub/Sub subscription setting that ensures each message is delivered and processed only once, provided the subscriber acknowledges within the deadline. It is the only option that directly targets duplicate prevention. Other features like dead-letter topics, ordering keys, and retry policies serve different purposes and do not guarantee exactly-once processing.

Answer

Message ordering with an ordering key.

Answer

Retry policy with exponential backoff.

Answer

Dead-letter topic with a maximum delivery attempt of 5.

Question 2

A developer is writing a Cloud Function in Node.js that is triggered by a Cloud Storage finalize event. The function needs to read the uploaded file and write a transformed version to another bucket. The developer wants to minimize latency and cost. Which approach should the developer take to access the file?

Accepted Answer

Use the Cloud Storage client library to download the file to a temporary directory, process it, and upload the result to the destination bucket.. Cloud Functions provides a writable /tmp directory. The developer should download the file from Cloud Storage to /tmp using the client library, process it, and upload the result. This approach is simple, reliable, and works within the constraints of the Cloud Functions environment.

Answer

Mount the source bucket as a file system in the Cloud Function using Cloud Storage FUSE, then read and write files directly.

Answer

Configure the function to receive the file content in the event payload and process it without additional API calls.

Answer

Use the Cloud Storage API to stream the file directly from the source bucket to the destination bucket, applying transformations on the fly.

Question 3

A developer is building a Cloud Function that needs to read data from a Cloud Storage bucket. The developer wants to follow the principle of least privilege. What should they do to grant the function access to the bucket?

Accepted Answer

Assign the Storage Object Viewer role to the Cloud Function's service account at the bucket level.. To follow least privilege, the Cloud Function's service account should be granted only the permissions required to perform its task. For reading objects from a specific Cloud Storage bucket, the Storage Object Viewer role at the bucket level is the minimal necessary permission. This avoids granting broad project-level access and ensures that the function can only read objects from that bucket. Using a dedicated service account also improves auditability and reduces the blast radius if the function is compromised.

Answer

Use the default App Engine service account and grant it the Editor role at the project level.

Answer

Assign the Storage Admin role to the Cloud Function's service account at the project level.

Answer

Generate a service account key and embed it in the function's code to authenticate as a user with access to the bucket.

Question 4

A team is connecting a Cloud Run service to a Cloud SQL for PostgreSQL instance using the Cloud SQL Auth Proxy via a Unix socket. They want to follow Google-recommended practices for connectivity and identity. Which two actions should they take? (Choose two.)

Accepted Answer

Pass the instance connection name to the Cloud Run service and connect through the /cloudsql/<INSTANCE_CONNECTION_NAME> socket path.. The Cloud SQL Auth Proxy authenticates using the attached service account, so granting only the Cloud SQL Client role satisfies least privilege. The proxy listens on a Unix socket derived from the instance connection name, so passing that name and connecting through the /cloudsql path is the recommended Cloud Run pattern.

Answer

Grant the service account the Cloud SQL Editor role to ensure all required operations are permitted.

Answer

Store the database password in the container image so the application can authenticate without extra configuration.

Answer

Enable a public IP on the Cloud SQL instance and open the Cloud Run egress range in the instance's authorized networks.

Question 5

A company is developing a mobile app backend using Firebase Authentication. They want to allow users to sign in with their existing Google accounts and also with email/password. The backend is hosted on Cloud Run and must verify the Firebase ID token on each API request. Which approach should the developer use to validate the token?

Accepted Answer

Use the Firebase Admin SDK to call verifyIdToken() with the ID token from the Authorization header.. The Firebase Admin SDK provides a robust verifyIdToken() method that validates the token's signature, issuer, audience, and expiration. It is the recommended way to authenticate requests to a backend. Other options either skip signature verification, use an inappropriate API, or introduce unnecessary complexity without security benefits.

Answer

Decode the JWT payload and check the email domain against an allowlist.

Answer

Send the ID token to the Firebase Authentication REST API endpoint /v1/accounts:lookup to validate it.

Answer

Store the ID token in Cloud Secret Manager and retrieve it for each request to compare against the incoming token.

Question 6

A financial analytics company runs a Java application on Compute Engine that must write events to a Cloud Pub/Sub topic. The security team mandates that no long-lived service account keys be stored on the VM. The VM's service account has the `roles/pubsub.publisher` IAM role. A developer writes code using the Google Cloud client library for Java. Which authentication approach should the application use?

Accepted Answer

Rely on Application Default Credentials (ADC), which automatically uses the Compute Engine metadata server to obtain tokens for the attached service account.. Application Default Credentials is the idiomatic way for Google Cloud client libraries to discover credentials. On Compute Engine, ADC queries the metadata server, which vends short-lived OAuth2 tokens for the attached service account. This avoids distributing service account keys entirely, aligning with the security team's requirement and with Google's recommended practice of using attached service accounts for workloads on Google Cloud infrastructure.

Answer

Embed the service account's private key directly in the application source code and instantiate a credential object with it.

Answer

Download a JSON key for the VM's service account, store it in a file on the persistent disk, and set GOOGLE_APPLICATION_CREDENTIALS to its path.

Answer

Configure the application to use the Cloud Pub/Sub REST API with an API key passed in the request query string.

Question 7

A company uses Cloud Build to build and deploy a containerized application to Google Kubernetes Engine (GKE). They want to ensure that the build process can push images to Artifact Registry and deploy to GKE without storing long-lived credentials. What should they do?

Accepted Answer

Configure the Cloud Build trigger to use a user-specified service account that has the Artifact Registry Writer and Kubernetes Engine Developer roles.. The secure and recommended approach is to configure Cloud Build to use a user-specified service account that has the necessary IAM roles: Artifact Registry Writer to push images and Kubernetes Engine Developer to deploy to GKE. This leverages short-lived credentials managed by Google Cloud, eliminating the need for long-lived keys. It also adheres to least privilege by granting only the required roles. This method integrates seamlessly with Cloud Build triggers and is the standard practice for CI/CD on Google Cloud.

Answer

Embed the credentials in the Docker image and use them during deployment to GKE.

Answer

Create a service account key and store it in Cloud Key Management Service (KMS), then reference it in the Cloud Build configuration.

Answer

Use the default Cloud Build service account and grant it the Editor role at the project level.

Question 8

A media company stores user-uploaded video files in a Cloud Storage bucket. They want to automatically transcode each uploaded video and store the output in a second bucket. They need a fully managed, event-driven solution with minimal operational overhead. Which Google Cloud service should they use to trigger the transcoding workflow when a new object is finalized?

Accepted Answer

Cloud Storage Pub/Sub notifications on the source bucket, delivered to a Pub/Sub topic.. Cloud Storage integrates with Pub/Sub by publishing notifications when objects are created, updated, or deleted. Subscribing a serverless compute service to the OBJECT_FINALIZE event creates a push-based pipeline that reacts immediately to uploads. This is the recommended pattern for event-driven media processing because it decouples storage from compute, requires no polling, and scales automatically with upload volume.

Answer

Cloud Storage Object Lifecycle Management rules that move objects to a transcoding bucket when they are uploaded.

Answer

A Cloud Storage transfer job created with Storage Transfer Service that copies new objects to a Compute Engine instance for processing.

Answer

A Cloud Scheduler job that lists the bucket every minute and compares results to a database of processed files.

Question 9

A startup is building an event-driven application on Google Cloud. They need a fully managed, scalable messaging service that can ingest millions of events per second and deliver them to multiple subscribers with at-least-once delivery. They also want to retain messages for up to 7 days. Which Google Cloud service should they use?

Accepted Answer

Cloud Pub/Sub. Cloud Pub/Sub is the correct choice because it is a fully managed messaging service that supports high-throughput ingestion, multiple subscribers, at-least-once delivery, and configurable message retention up to 7 days. It is purpose-built for event-driven architectures and scales automatically without provisioning.

Answer

Cloud Dataflow

Answer

Cloud Scheduler

Answer

Cloud Tasks

Question 10

A company is developing a mobile app that uses Firebase Authentication. They want to allow users to sign in with their Google accounts and also store user profile data in a Firestore database. The app must ensure that only authenticated users can read and write their own profile data. What should they do?

Accepted Answer

Use Firebase Authentication to sign in users with Google, and configure Firestore security rules to allow read/write only if request.auth.uid matches the document ID.. The correct approach is to use Firebase Authentication for Google Sign-In and Firestore security rules that check if the authenticated user's UID matches the document ID. This ensures that each user can only access their own profile data. The other options either use inappropriate storage, add unnecessary complexity, or fail to enforce per-user access control.

Answer

Use Firebase Authentication to sign in users with Google, and use Cloud Functions to validate the user's ID token before allowing access to Firestore.

Answer

Use Firebase Authentication to sign in users with Google, and store the user profile data in Cloud Storage with a bucket policy that allows only authenticated users.

Answer

Use Firebase Authentication to sign in users with Google, and configure Firestore security rules to allow read/write to all authenticated users.

Question 11

A retail company runs an application on Google Kubernetes Engine (GKE) that reads from a Cloud SQL for PostgreSQL instance. The security team requires that database traffic never traverse the public internet and that the database have no public IP. The GKE cluster is VPC-native and runs in the same VPC as the Cloud SQL instance. Which connection method should the application use?

Accepted Answer

Connect using the Cloud SQL Auth Proxy sidecar, which authenticates with IAM and connects over the instance's private IP.. Private IP connectivity keeps database traffic on Google's internal network. The Cloud SQL Auth Proxy adds IAM-based authentication and encryption without managing SSL certificates manually. Running it as a sidecar in the GKE pod means the application connects to localhost, and the proxy securely tunnels to the instance's private IP. This combination satisfies both the no-public-IP and no-public-internet constraints while providing strong identity controls.

Answer

Connect directly to the instance's public IP and rely on Cloud SQL's built-in SSL enforcement for encryption.

Answer

Configure the application to use the Cloud SQL Connector for Java, which establishes a direct TCP connection using the instance's public IP and IAM database authentication.

Answer

Use a Cloud VPN tunnel from the GKE cluster to a remote network that forwards traffic to the Cloud SQL public endpoint.

Question 12

A team has a Cloud Run service that writes to a Cloud SQL for PostgreSQL instance. They want to connect the service to Cloud SQL without exposing the database to the public internet and without managing a Cloud SQL Auth Proxy sidecar manually. What should they do?

Accepted Answer

Configure the Cloud Run service to use the Cloud SQL connections feature, specifying the instance connection name, and grant the service account the Cloud SQL Client role.. Cloud Run's built-in Cloud SQL connections feature automatically runs the Cloud SQL Auth Proxy, connects over a Unix socket, and uses IAM for authentication. Specifying the instance connection name and granting the Cloud SQL Client role satisfies the need for private, secure connectivity without manual proxy management. The other options either expose the database publicly, require manual sidecar management, or add unnecessary networking complexity.

Answer

Assign a public IP to the Cloud SQL instance, create a firewall rule to allow the Cloud Run service's egress IP range, and connect using the instance's public IP address.

Answer

Deploy a Cloud SQL Auth Proxy as a sidecar container in the Cloud Run service and connect to the proxy over localhost.

Answer

Use a Serverless VPC Access connector to connect the Cloud Run service to the Cloud SQL instance's private IP address, and configure the database to allow connections from the connector's IP range.

Question 13

A company is deploying a new microservice on Cloud Run. The service must connect to a Cloud SQL for PostgreSQL instance and a Memorystore for Redis instance. The security team requires that all connections use private IP addresses and that no public IPs are exposed. The developer needs to configure the Cloud Run service. (Choose two.)

Accepted Answer

Configure the Cloud Run service to use a Serverless VPC Access connector to connect to the VPC network.. To connect a Cloud Run service to Cloud SQL and Memorystore using private IPs, you must use a Serverless VPC Access connector to route traffic into the VPC, and ensure both Cloud SQL and Memorystore instances are configured with private IPs in the same VPC network. This keeps all traffic internal and satisfies the security requirement.

Answer

Set the Cloud SQL instance to have a public IP and configure the Cloud Run service to connect using the Cloud SQL Auth Proxy with SSL.

Answer

Enable Cloud Run's built-in Cloud SQL connection using the --add-cloudsql-instances flag and rely on that for both Cloud SQL and Memorystore connectivity.

Answer

Assign the Cloud Run service a public IP address and use VPC peering to route traffic to the private resources.

Question 14

A developer is building a Cloud Function that processes files uploaded to a Cloud Storage bucket. The function must be triggered only when new files are created, not when existing files are modified or deleted. Which event type should the developer configure for the Cloud Storage trigger?

Accepted Answer

google.storage.object.finalize. The google.storage.object.finalize event is the correct trigger for new file creation in Cloud Storage. It fires when a new object is successfully written to the bucket. Other events like metadataUpdate, delete, and archive correspond to different lifecycle actions and would not meet the requirement of processing only new files.

Answer

google.storage.object.archive

Answer

google.storage.object.delete

Answer

google.storage.object.metadataUpdate

Question 15

A developer is building a service on Cloud Run that publishes messages to a Pub/Sub topic. The service must be able to publish messages and must not be able to manage the topic or subscriptions. The developer wants to follow the principle of least privilege. Which IAM role should be granted to the Cloud Run service account?

Accepted Answer

roles/pubsub.publisher. The Pub/Sub Publisher role provides exactly the permission to publish messages without granting management capabilities. It is the least privileged role that satisfies the requirement. The Editor and Admin roles include management permissions, and the Subscriber role is for consuming messages, not publishing. Therefore, only the Publisher role meets the scenario's constraints.

Answer

roles/pubsub.editor

Answer

roles/pubsub.admin

Answer

roles/pubsub.subscriber