PCD Multiple Select — 40 Questions

Question 1

An organization is migrating a critical application to Google Cloud and needs to ensure high availability and disaster recovery. The application runs on Compute Engine and uses a stateful database. Which three design choices should they make? (Choose three.)

Accepted Answer

Use managed instance groups distributed across multiple zones.. Option A is correct because managed instance groups (MIGs) distributed across multiple zones provide automatic failover and self-healing for the Compute Engine instances. If a zone fails, the MIG automatically recreates instances in healthy zones, ensuring high availability for the application layer. This aligns with Google Cloud's best practices for regional resilience.

Answer

Use preemptible VMs to reduce costs for the database layer.

Answer

Deploy all instances in a single zone and use snapshots for backup.

Question 2

A team is designing a globally distributed application on Google Cloud that requires strong consistency for writes but can tolerate eventual consistency for reads. The application expects millions of concurrent users. Which two strategies should they implement? (Choose two.)

Accepted Answer

Use Cloud Spanner for write operations requiring strong consistency.. Cloud Spanner provides strongly consistent writes globally through synchronous replication using the TrueTime API and Paxos-based consensus. This ensures that all write operations are immediately consistent across regions, meeting the requirement for strong consistency on writes.

Answer

Use Firestore in multi-region mode for all operations.

Answer

Deploy Cloud SQL with cross-region replication for read scalability.

Answer

Use Cloud Bigtable for reading data with strong consistency.

Question 3

A company is designing a highly available application on Google Cloud using multiple regions. Which TWO strategies should they implement to achieve this?

Accepted Answer

Use a global load balancer to distribute traffic across regions.. Option B is correct because a global load balancer (e.g., Google Cloud External HTTPS Load Balancer) can distribute traffic across multiple regions, providing cross-region failover and low-latency routing. This is a fundamental pattern for multi-region high availability, as it allows traffic to be directed to healthy backends in any region, even if an entire region fails.

Answer

Use zonal persistent disks for stateful data.

Answer

Deploy a single instance group in one region for simplicity.

Answer

Store all data in a single Cloud Storage bucket.

Question 4

Which TWO statements about building container images for Google Cloud Run are correct? (Choose TWO.)

Accepted Answer

The container must respond to health checks on the same port as the main application.. Option B is correct because Cloud Run requires the container to respond to health checks (e.g., HTTP GET /health) on the same port as the main application. Cloud Run uses the same port for both user requests and health check probes; if the health check fails, the container is restarted. This ensures the container is always ready to serve traffic.

Answer

The container must use HTTP/1.1; HTTP/2 is not supported.

Answer

The container must listen on port 8080 by default.

Answer

The container must run as root user.

Question 5

Which THREE steps are required to set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub? (Choose THREE.)

Accepted Answer

Enable the Cloud Build, Cloud Run, and Artifact Registry APIs.. Options A, B, and D are required. Option C is optional; Cloud Build can connect to GitHub without a mirror. Option E is wrong because Artifact Registry is used, not Container Registry (deprecated).

Answer

Push the container image to Container Registry.

Answer

Mirror the GitHub repository to Cloud Source Repositories.

Question 6

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Accepted Answer

Automate the teardown of test resources after test completion. Option A is correct because end-to-end testing of a Cloud Run service that interacts with Firestore and Pub/Sub must include automated teardown of test resources (e.g., Pub/Sub topics, subscriptions, Firestore documents) to prevent resource leaks and avoid incurring ongoing costs. Without teardown, leftover resources can cause quota exhaustion and interfere with subsequent test runs, making automation essential for reliable CI/CD pipelines.

Answer

Use the Cloud Run emulator to run the service locally

Answer

Use the Firestore emulator to simulate Firestore operations

Question 7

Which TWO practices should be followed when integrating Cloud Endpoints with a Cloud Run service to enforce API authentication and rate limiting?

Accepted Answer

Set the audience field in the Endpoints service configuration to the Cloud Run service URL. Option B is correct because the `audience` field in the Endpoints service configuration must match the Cloud Run service URL (e.g., `https://myservice-xxxxx-uc.a.run.app`). This ensures that the JWT tokens issued by Google's authentication system are validated against the intended recipient, preventing token reuse across different services. Without this match, authentication will fail because the token's `aud` claim will not match the expected audience.

Answer

Use API keys to authenticate end users

Answer

Deploy Cloud Endpoints as a sidecar container in the same Cloud Run instance

Answer

Configure Cloud Armor rules to enforce rate limiting before requests reach Endpoints

Question 8

A team is deploying a critical application on Google Kubernetes Engine (GKE) and needs to ensure high availability and disaster recovery. Which THREE actions should they take?

Accepted Answer

Use a regional cluster with control plane replicated across zones.. Option B is correct because a regional cluster in GKE replicates the control plane across multiple zones within a region, ensuring that if one zone fails, the control plane remains available. This is essential for high availability and disaster recovery, as it eliminates a single point of failure for cluster management operations.

Answer

Deploy all pods in a single zone for simplicity.

Answer

Use a zonal cluster to reduce costs.

Question 9

Which TWO actions should a developer take to ensure that a Cloud Run service can access a Cloud SQL instance securely?

Accepted Answer

Use the Cloud SQL Auth Proxy as a sidecar container in the same pod.. Option C is correct because the Cloud SQL Auth Proxy, when deployed as a sidecar container in the same pod, provides encrypted connections and IAM-based authentication to Cloud SQL without requiring a public IP or complex network configuration. It automatically handles TLS 1.3 encryption and uses the service account's IAM permissions to authorize connections, ensuring secure access from Cloud Run.

Answer

Use a Cloud NAT to provide outbound internet access for the service.

Answer

Assign a public IP to the Cloud SQL instance and allow all traffic from Cloud Run.

Answer

Create a service account with the cloudsql.instances.connect permission.

Question 10

A team is building a serverless event-driven application using Cloud Functions and Cloud Pub/Sub. The function processes messages from a Pub/Sub subscription and writes results to Firestore. During peak hours, the function experiences high latency and some messages are being retried multiple times. Which three steps should the team take to improve reliability and scalability? (Choose three.)

Accepted Answer

Enable retry policy on the Pub/Sub subscription to automatically retry failed messages.. Option A is correct because enabling a retry policy on the Pub/Sub subscription ensures that messages that fail to be processed (e.g., due to transient errors or timeouts) are automatically retried. This prevents message loss and improves reliability by allowing the Cloud Function to reprocess messages without manual intervention. The retry policy works with the subscription's acknowledgement deadline, so messages are redelivered if not acknowledged in time.

Answer

Batch multiple Pub/Sub messages into a single Cloud Function invocation.

Answer

Increase the Cloud Function timeout to the maximum allowed value.

Question 11

A DevOps team wants to set up custom metrics for a serverless application running on Cloud Run. The application emits metrics using OpenTelemetry. They need to collect these metrics and create an alerting policy that triggers when the 99th percentile latency exceeds 500ms for 5 minutes. Which TWO actions must they take? (Choose two.)

Accepted Answer

Create a custom distribution metric for the latency data and set up a metric threshold alert using the 99th percentile value.. Option A is correct because to alert on the 99th percentile of latency, you must create a custom distribution metric, which stores a histogram of values and allows percentile calculations. A metric-threshold alert policy can then be configured to evaluate the 99th percentile value against the 500ms threshold over a 5-minute window.

Answer

Install the Cloud Monitoring agent on the Cloud Run instance to collect custom metrics.

Answer

Define a log-based metric from the application logs that captures latency entries.

Answer

Configure the Cloud Monitoring dashboard to query the metrics using PromQL.

Question 12

A company is designing a globally distributed application using Cloud Spanner. The application requires strong consistency and the ability to handle high read/write throughput. The team is concerned about inter-continental latency. Which two design choices would optimize performance while maintaining strong consistency? (Choose two.)

Accepted Answer

Enable leader-optimized routing to direct reads to the nearest leader region.. A is correct because leader-optimized routing directs read requests to the nearest region that contains the leader replica for the requested data, reducing inter-continental latency while still reading from the leader to ensure strong consistency. C is correct because placing a multi-region Spanner instance in geographic locations close to users minimizes network round-trip time, and Spanner's synchronous replication across regions maintains strong consistency even with high read/write throughput.

Answer

Use read-only replicas in each continent to serve reads locally.

Answer

Implement client-side caching with a short TTL for frequently accessed data.

Answer

Increase the number of nodes in the Spanner instance to improve throughput.

Question 13

You are designing a serverless application using Cloud Functions that processes events from Cloud Storage and Cloud Pub/Sub. The function must be idempotent and handle duplicate events. Which three best practices should you implement? (Choose THREE.)

Accepted Answer

Generate a unique idempotency key for each event and store processed keys in a database.. Option A is correct because generating a unique idempotency key for each event and storing processed keys in a database (such as Cloud Firestore) ensures that if the same event is delivered multiple times (e.g., due to at-least-once delivery semantics in Cloud Pub/Sub or Cloud Storage notifications), the function can check the key before processing and skip duplicates. This pattern is essential for idempotent serverless functions, as Cloud Functions may be retried on failure or receive duplicate events from the source.

Answer

Invoke the function synchronously to avoid duplicates.

Answer

Set the function timeout to maximum (540 seconds) to ensure processing completes.

Question 14

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Accepted Answer

By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.. Option A is correct because Cloud Storage automatically encrypts all data at rest using server-side encryption with Google-managed encryption keys by default, without any additional configuration. This ensures that data is protected before it is written to disk and remains encrypted throughout its lifecycle.

Answer

Using a signed URL revokes the underlying object's ACL.

Answer

Enabling uniform bucket-level access disables encryption at rest.

Answer

Bucket-level policies can restrict access to only compute instances with specific service accounts.

Question 15

Which THREE components are essential for a complete application performance monitoring (APM) solution on Google Cloud?

Accepted Answer

Cloud Monitoring for metrics and alerting.. Cloud Monitoring is essential for an APM solution because it provides metrics, dashboards, and alerting policies to track application health and performance. It integrates with other services like Cloud Trace and Cloud Logging to offer a unified observability platform, enabling proactive detection of issues such as latency spikes or error rate increases.

Answer

Cloud Scheduler for job scheduling.

Answer

Cloud CDN for content caching.

Question 16

Which THREE are valid uses of Cloud Trace? (Choose three.)

Accepted Answer

Identifying latency bottlenecks in a distributed application. Cloud Trace is a distributed tracing system that captures latency data from applications, allowing you to identify performance bottlenecks across services. Option A is correct because Cloud Trace provides detailed traces that show the time spent in each component of a distributed application, enabling you to pinpoint where delays occur.

Answer

Monitoring CPU usage of a Compute Engine instance

Answer

Exporting traces to Prometheus for long-term storage

Question 17

Which TWO statements about deploying applications on Google Kubernetes Engine (GKE) are correct?

Accepted Answer

HorizontalPodAutoscaler can use custom metrics from Cloud Monitoring.. HorizontalPodAutoscaler (HPA) in GKE can scale pods based on custom metrics from Cloud Monitoring (formerly Stackdriver). This is achieved by using the custom.metrics.k8s.io API, which allows HPA to query metrics like custom application latency or queue depth, not just default CPU/memory. This enables fine-grained, application-specific autoscaling.

Answer

Kubernetes Secrets are encrypted at rest by default.

Answer

A zonal GKE cluster automatically uses regional persistent disks for high availability.

Answer

To expose a Deployment externally, you must create an Ingress resource.

Question 18

A team is deploying a microservice application on Google Kubernetes Engine (GKE). They want to ensure high availability and minimize downtime during rolling updates. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure pod disruption budgets to limit the number of pods that can be unavailable simultaneously.. Option C is correct because PodDisruptionBudgets (PDBs) allow you to specify the minimum number of pods that must remain available during voluntary disruptions like rolling updates, ensuring high availability. Option D is correct because readiness probes control when a pod is added to a Service's endpoints; during rolling updates, they prevent traffic from being sent to a pod until it is ready, minimizing downtime.

Answer

Use Horizontal Pod Autoscaler to automatically adjust the number of pods based on CPU utilization.

Answer

Enable liveness probes to automatically restart pods that become unresponsive.

Answer

Enable node auto-repair to automatically replace unhealthy nodes.

Question 19

Which THREE practices should be followed when deploying a containerized application to Cloud Run?

Accepted Answer

Avoid writing to the local filesystem for data that must persist across requests.. Option A is correct because Cloud Run instances are ephemeral and the local filesystem is not persisted across requests or instance restarts. Writing to local disk for data that must survive beyond a single request will cause data loss when the instance is recycled, which is a fundamental characteristic of serverless container platforms.

Answer

Set a maximum request timeout of 10 minutes to avoid cold starts.

Answer

Hardcode port 8080 in the container.

Question 20

A company is deploying a microservices application on Google Cloud. They want to securely store and access secrets (e.g., API keys, database passwords) across multiple services. They need to minimize operational overhead and ensure secrets are automatically rotated. Which TWO approaches should they use?

Accepted Answer

Use Secret Manager with a Cloud Function that automatically rotates secrets on a schedule.. Secret Manager is Google Cloud's native service for storing and managing secrets with built-in support for automatic rotation. By enabling automatic rotation on a secret, you eliminate the need for custom infrastructure like Cloud Functions to handle the rotation logic, thereby minimizing operational overhead. Option A is correct because it uses Secret Manager with a Cloud Function for rotation, which is a valid approach, but Option C is more aligned with the requirement to minimize overhead since automatic rotation is a native feature.

Answer

Store secrets in Cloud Storage buckets encrypted with Cloud KMS (CMEK).

Answer

Store secrets in a Cloud SQL database and use Cloud Scheduler to rotate them.

Answer

Store secrets in Cloud Firestore and use Firestore triggers to rotate them.