PCD Integrating Google Cloud services — Timed 25 Questions

Question 1

You are designing a system that ingests high-velocity event streams from IoT devices using Pub/Sub. Each event must be processed exactly once to update a Firestore database. However, due to the distributed nature, at-least-once delivery is guaranteed by Pub/Sub. Which design pattern should you use to achieve exactly-once processing?

25 minute time limit — choose an answer to begin.

Accepted Answer

Make the message processor idempotent by using a unique event ID as the Firestore document ID, and perform upsert operations.. Making the message processor idempotent by using a unique event ID as the Firestore document ID ensures that even if Pub/Sub delivers the same event multiple times (at-least-once semantics), the upsert operation will overwrite the document with the same data, resulting in exactly-once processing. This pattern leverages Firestore's document-level write semantics without requiring additional infrastructure for deduplication.

Answer

Use a Cloud Function with a retry policy to ensure delivery, and deduplicate using a Cloud Bigtable row key.

Answer

Use Cloud Dataflow with exactly-once processing mode and write to Firestore using a custom sink.

Answer

Use a Cloud Run service to pull messages and write to Firestore; rely on Firestore's built-in deduplication using document IDs.

Question 2

Your application runs on Compute Engine and uses Cloud Pub/Sub to receive messages from a third-party service. Recently, the message delivery latency has increased significantly. The third-party reports no issues on their end. You notice that the Pub/Sub subscription's 'ackDeadlineSeconds' is set to 10. What is the most likely cause of the latency?

Accepted Answer

The ackDeadlineSeconds is too short, causing frequent message redelivery.. A is correct because a 10-second ackDeadlineSeconds is very short. If your subscriber cannot process and acknowledge messages within 10 seconds, Pub/Sub will consider them unacknowledged and redeliver them. This redelivery causes duplicate processing and increases overall latency as messages are repeatedly sent back to the subscriber, delaying their final consumption.

Answer

The topic's message retention duration is too long.

Answer

The push endpoint is not responding, causing Pub/Sub to retry.

Answer

The subscription has an exponential backoff policy that is too aggressive.

Question 3

You are designing a data pipeline that ingests streaming data from IoT devices using Cloud IoT Core, processes it with Dataflow, and stores results in BigQuery. The data volume is expected to be 10 GB per day with occasional spikes. You need to minimize processing latency and cost. Which configuration should you choose for the Dataflow pipeline?

Accepted Answer

Use streaming mode with streaming engine enabled and 2 workers.. Streaming mode with Streaming Engine is designed for low-latency, continuous data ingestion from IoT Core, and setting 2 workers minimizes cost while handling the expected 10 GB/day volume with occasional spikes through autoscaling. Streaming Engine offloads state management to the backend, reducing worker overhead and improving latency, making it ideal for this use case. Option B (Dataflow Prime) is not optimal because, although it supports both batch and streaming pipelines and offers automatic optimization, for a small, predictable workload like 10 GB/day, the overhead of Prime's automation may not justify the cost. Manual tuning with Streaming Engine and a small initial worker count is more cost-effective while still providing low latency. Autoscaling can handle spikes without over-provisioning, making C a better fit.

Answer

Use streaming mode with autoscaling and maximum workers set to 10.

Answer

Use Dataflow Prime for automatic optimization.

Answer

Use batch mode with a fixed number of workers to reduce cost.

Question 4

A company stores sensitive user data in Cloud Storage. They want to ensure that only authenticated users with the appropriate permissions can access the data, and that data is encrypted at rest. Which two steps should they take? (Choose TWO.)

Accepted Answer

Enable default encryption on the bucket using Google-managed keys.. Cloud Storage buckets are encrypted at rest by default using Google-managed keys, which satisfies the requirement for data encryption without additional configuration. Option C is correct because IAM roles provide fine-grained access control, ensuring only authenticated users with appropriate permissions can access the data.

Answer

Configure a Customer-Managed Encryption Key (CMEK) in Cloud KMS.

Answer

Set bucket-level public access prevention.

Answer

Enable VPC Service Controls to restrict data access.

Question 5

You are designing a serverless application using Cloud Functions that processes events from Cloud Storage and Cloud Pub/Sub. The function must be idempotent and handle duplicate events. Which three best practices should you implement? (Choose THREE.)

Accepted Answer

Generate a unique idempotency key for each event and store processed keys in a database.. Generating a unique idempotency key for each event and storing processed keys in a database (such as Cloud Firestore) ensures that if the same event is delivered multiple times (e.g., due to at-least-once delivery semantics in Cloud Pub/Sub or Cloud Storage notifications), the function can check the key before processing and skip duplicates. This pattern is essential for idempotent serverless functions, as Cloud Functions may be retried on failure or receive duplicate events from the source.

Answer

Invoke the function synchronously to avoid duplicates.

Answer

Set the function timeout to maximum (540 seconds) to ensure processing completes.

Question 6

You need to monitor the CPU usage of a Compute Engine instance and trigger an alert when it exceeds 80% for 5 minutes. Which Google Cloud service should you use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it provides metrics, dashboards, and alerting policies for Compute Engine instances. You can create a metric-based alert condition that triggers when the CPU utilization metric exceeds 80% for a duration of 5 minutes, using the MQL or policy builder.

Answer

Cloud Debugger

Answer

Cloud Logging

Answer

Error Reporting

Question 7

Your company uses Cloud SQL for MySQL to store transactional data. You need to perform a point-in-time recovery (PITR) to recover from a logical error that occurred 30 minutes ago. Which two prerequisites must be met? (Choose TWO.)

Accepted Answer

Binary logging is enabled.. Point-in-time recovery (PITR) for Cloud SQL for MySQL relies on binary logs to replay transactions up to a specific timestamp. Binary logging must be enabled because it records all changes to the database, allowing you to restore to any point within the retention period. Automated backups are also required because PITR uses the most recent full backup as a base, then applies binary logs from that backup to the target time. Without automated backups, there is no base image to start the recovery process.

Answer

High availability (HA) is configured.

Answer

The backup window is set to a time before the incident.

Answer

A read replica is configured.

Question 8

You are designing a CI/CD pipeline using Cloud Build. You want to automatically trigger a build when code is pushed to a specific branch in Cloud Source Repositories. What is the correct configuration?

Accepted Answer

Create a build trigger in Cloud Build with a regex pattern for the branch name.. Cloud Build natively supports build triggers that can be configured to automatically start a build when code is pushed to a specific branch in Cloud Source Repositories. The trigger uses a regex pattern to match the branch name, and Cloud Build listens for repository push events directly without requiring additional services.

Answer

Create a Cloud Function that invokes Cloud Build via API when a push event occurs.

Answer

Add a build step in cloudbuild.yaml that polls the repository.

Answer

Configure a Cloud Pub/Sub topic to notify Cloud Build on push events.

Question 9

A company is migrating a legacy monolithic application to Google Cloud. They want to minimize code changes and operational overhead while improving scalability. The application currently uses a relational database and stores user-uploaded images on a local filesystem. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud SQL for the database and Cloud Storage with Cloud CDN for images. Cloud SQL provides a fully managed relational database that requires minimal code changes when migrating from an existing relational database, while Cloud Storage with Cloud CDN handles user-uploaded images with scalable object storage and low-latency content delivery. This combination minimizes operational overhead by eliminating the need to manage database servers or file servers, and improves scalability through automatic replication and global edge caching.

Answer

Cloud Spanner for the database and Cloud Storage for images

Answer

Cloud Firestore for the database and Cloud Storage with Cloud CDN for images

Answer

Compute Engine with attached SSD persistent disks for both database and images

Question 10

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They want to automatically build and deploy each service when a new tag is pushed to its repository. They also need to run integration tests against a staging environment before promoting to production. Which service should they use to orchestrate the pipeline?

Accepted Answer

Cloud Build with a build trigger on tag push. Cloud Build with a build trigger on tag push is the correct choice because it natively supports event-driven pipelines triggered by Git tags, enabling automatic build and deployment of each microservice. Combined with Cloud Build's ability to run integration tests in a staging environment and then promote to production, it provides a complete CI/CD solution for GKE without additional orchestration services.

Answer

Deployment Manager with a template

Answer

Cloud Deploy with a delivery pipeline

Answer

Cloud Run with continuous deployment

Question 11

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Accepted Answer

By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.. Cloud Storage automatically encrypts all data at rest using server-side encryption with Google-managed encryption keys by default, without any additional configuration. This ensures that data is protected before it is written to disk and remains encrypted throughout its lifecycle.

Answer

Using a signed URL revokes the underlying object's ACL.

Answer

Enabling uniform bucket-level access disables encryption at rest.

Answer

Bucket-level policies can restrict access to only compute instances with specific service accounts.

Question 12

You are a cloud architect at a financial services company. The company is deploying a new application on Google Kubernetes Engine (GKE) that processes sensitive financial transactions. The application must be highly available across two regions (us-central1 and europe-west1) and must fail over automatically if one region becomes unavailable. The application uses Cloud Spanner as its primary database. Additionally, the application needs to send audit logs to a centralized Cloud Storage bucket for compliance. The current design uses GKE clusters in each region with a global HTTP(S) load balancer. However, during a recent test, when the us-central1 cluster was deliberately taken down, the load balancer continued to send traffic to that region, causing errors. You need to troubleshoot and fix the issue. What is the most likely cause and the best solution?

Accepted Answer

The load balancer backend lacks a health check that marks the backend as unhealthy when the cluster is down. Solution: Configure a health check on the backend service that points to a readiness endpoint on the GKE cluster.. The issue is that the global HTTP(S) load balancer continues to send traffic to the us-central1 region because its backend service lacks a health check that can detect when the GKE cluster is down. By configuring a health check on the backend service that probes a readiness endpoint (e.g., /healthz) on the GKE cluster, the load balancer will automatically stop routing traffic to the unhealthy region and fail over to the healthy region. This ensures high availability across the two regions as required.

Answer

The load balancer is configured with only one backend service. Solution: Create a separate backend service for each region.

Answer

The Cloud Spanner instance is not configured with multi-region replication, causing write failures. Solution: Configure Cloud Spanner as a multi-region instance.

Answer

The GKE clusters are not configured as network endpoint groups (NEGs). Solution: Create NEGs for each cluster and use them as backends.

Question 13

A company is running a critical application on Google Kubernetes Engine (GKE) that stores state in a Cloud SQL PostgreSQL instance. The application's latency-sensitive frontend needs to read data from Cloud SQL with minimal latency. The team wants to reduce read latency and offload read traffic from the primary database. What should they do?

Accepted Answer

Create a read replica of the Cloud SQL instance and direct read traffic to the replica.. Creating a read replica of the Cloud SQL PostgreSQL instance allows read-heavy, latency-sensitive traffic to be offloaded from the primary database. The replica handles SELECT queries independently, reducing load on the primary and lowering read latency for the frontend, as replicas are typically in the same region and can serve data with minimal additional delay.

Answer

Migrate the database to Cloud Spanner for better read scalability.

Answer

Use Memorystore for Redis as a cache layer between the application and Cloud SQL.

Answer

Use Cloud CDN to cache database responses.

Question 14

A company is deploying a microservices application on Google Cloud. They want to securely store and access secrets (e.g., API keys, database passwords) across multiple services. They need to minimize operational overhead and ensure secrets are automatically rotated. Which TWO approaches should they use?

Accepted Answer

Use Secret Manager with a Cloud Function that automatically rotates secrets on a schedule.. Secret Manager is Google Cloud's native service for storing and managing secrets with built-in support for automatic rotation. By enabling automatic rotation on a secret, you eliminate the need for custom infrastructure like Cloud Functions to handle the rotation logic, thereby minimizing operational overhead. Option A is correct because it uses Secret Manager with a Cloud Function for rotation, which is a valid approach, but Option C is more aligned with the requirement to minimize overhead since automatic rotation is a native feature.

Answer

Store secrets in Cloud Storage buckets encrypted with Cloud KMS (CMEK).

Answer

Store secrets in a Cloud SQL database and use Cloud Scheduler to rotate them.

Answer

Store secrets in Cloud Firestore and use Firestore triggers to rotate them.

Question 15

Drag and drop the steps to set up a Cloud SQL instance with a private IP in the correct order.

Accepted Answer

Create VPC network, Allocate IP range for private services access, Create private services access connection, Create Cloud SQL instance with private IP. Setting up private IP Cloud SQL requires a VPC, private services access, and creating the instance with private IP.

Answer

Create VPC network, Create private services access connection, Allocate IP range for private services access, Create Cloud SQL instance with private IP

Answer

Allocate IP range for private services access, Create VPC network, Create private services access connection, Create Cloud SQL instance with private IP

Answer

Create Cloud SQL instance with private IP, Create VPC network, Allocate IP range for private services access, Create private services access connection

Question 16

Drag and drop the steps to troubleshoot a failed Cloud Build in the correct order.

Accepted Answer

Check Cloud Build logs first, then examine build configuration, then fix identified issues, then re-run the build.. Troubleshooting involves reviewing logs and configuration, then fixing and re-running.

Answer

Re-run the build first, then check logs, then examine configuration, then fix issues.

Answer

Examine build configuration first, then re-run the build, then check logs, then fix issues.

Answer

Fix issues first, then check logs, then examine configuration, then re-run.

Question 17

Match each Kubernetes resource to its function.

Accepted Answer

Pod: The smallest and simplest Kubernetes object. It represents a single instance of a running process in your cluster.. These are fundamental Kubernetes objects for running containerized applications.

Answer

ConfigMap: Stores sensitive data such as passwords, OAuth tokens, and ssh keys.

Answer

Secret: Manages external access to the services in a cluster, typically HTTP.

Answer

Ingress: Allows you to decouple configuration artifacts from image content to keep containerized applications portable.

Question 18

Match each Firebase feature to its description.

Accepted Answer

Cloud Firestore: A NoSQL document database for storing and syncing data in real time.. Firebase features include Cloud Firestore (NoSQL database), Authentication (user login), and Cloud Functions (backend code). Common confusions: mixing NoSQL vs relational, and hosting vs functions.

Answer

Cloud Firestore: A relational database with SQL queries for structured data.

Answer

Firebase Hosting: A Firebase feature for running backend code in response to events.

Question 19

A company is using Cloud Functions (2nd gen) to process files uploaded to Cloud Storage. The function needs to access a Cloud SQL (PostgreSQL) database. What is the most secure way to store and provide the database password to the function?

Accepted Answer

Use Secret Manager and access it via the Secret Manager API within the function.. Secret Manager is the recommended service for storing secrets with IAM controls. Option A is wrong because Cloud Storage buckets may have broader access and are not designed for secrets. Option B is wrong because hardcoding is insecure. Option D is wrong because KMS encrypts data but Secret Manager provides a simpler and more integrated secret storage solution.

Answer

Use Cloud KMS to encrypt the password and store it in environment variables.

Answer

Hardcode the password in the function code.

Answer

Store the password in a Cloud Storage bucket and read it at startup.

Question 20

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

Accepted Answer

Use Cloud Build triggers with a branch filter set to ^main$.. Cloud Build triggers support branch filters to control which branches trigger builds. By setting the branch filter to ^main$, only commits to the main branch will initiate the build and subsequent deployment to Cloud Run. Option A is wrong because Cloud Run does not filter revisions by source repository; it deploys whatever image is pushed. Option B is wrong because IAM conditions control who can perform actions, not which branch triggered a build. Option D is wrong because it requires manual management and is error-prone; Cloud Build automatically handles branch filtering.

Answer

Configure Cloud Run to only accept revisions from a specific source repository.

Answer

Use IAM conditions on the Cloud Run service account to allow only main branch builds.

Answer

Create a separate Cloud Build trigger for each branch and manually disable non-main triggers.