PCD Timed Practice Test 5 — 10 Questions

Question 1

Which TWO practices should be followed when integrating Cloud Endpoints with a Cloud Run service to enforce API authentication and rate limiting?

Accepted Answer

Set the audience field in the Endpoints service configuration to the Cloud Run service URL. Option B is correct because the `audience` field in the Endpoints service configuration must match the Cloud Run service URL (e.g., `https://myservice-xxxxx-uc.a.run.app`). This ensures that the JWT tokens issued by Google's authentication system are validated against the intended recipient, preventing token reuse across different services. Without this match, authentication will fail because the token's `aud` claim will not match the expected audience.

Answer

Use API keys to authenticate end users

Answer

Deploy Cloud Endpoints as a sidecar container in the same Cloud Run instance

Answer

Configure Cloud Armor rules to enforce rate limiting before requests reach Endpoints

Question 2

A developer runs the above command and cloudbuild.yaml. The build fails at the deploy step with a permission error. The developer has the Cloud Build Editor role on the project. What is the likely cause?

Accepted Answer

The Cloud Build service account lacks the Cloud Run Admin role.. The Cloud Build Editor role grants permissions to submit builds and execute build steps, but the actual execution of those steps (including the deploy step) runs under the Cloud Build service account. By default, this service account does not have the Cloud Run Admin role, which is required to deploy to Cloud Run. Without this role, the `gcloud run deploy` command fails with a permission error.

Answer

The Cloud Build Editor role does not have permission to submit builds.

Answer

The Docker image is not in a format compatible with Cloud Run.

Answer

The build step uses the 'gcloud' command without authentication.

Question 3

A company is developing a microservices application on Google Cloud. Each service is deployed as a Docker container on Cloud Run. The development team wants to ensure that inter-service communication is encrypted and authenticated. What is the best approach?

Accepted Answer

Use Cloud Run's built-in IAM-based authentication and automatic TLS for internal requests.. Cloud Run automatically provisions TLS certificates for all incoming requests and supports IAM-based authentication for internal requests between services in the same Google Cloud project. This means inter-service communication is encrypted by default via HTTPS and can be authenticated by configuring the receiving service to require a valid IAM token from the caller, without any additional infrastructure or sidecar proxies.

Answer

Configure mutual TLS (mTLS) between services using Cloud Endpoints.

Answer

Deploy a sidecar proxy on each Cloud Run service to handle TLS termination.

Answer

Assign a service account to each service and use its private key to sign requests.

Question 4

A developer is designing a CI/CD pipeline for a Node.js application hosted on Cloud Run using Cloud Build. The pipeline should run unit tests, build the container, push to Artifact Registry, and deploy to Cloud Run. The developer wants to minimize build time by caching dependencies. What is the recommended approach?

Accepted Answer

Use Cloud Build's built-in caching with a persistent volume to store node_modules between builds.. Option D is correct because Cloud Build supports built-in caching via persistent volumes (e.g., `/cache` or `/workspace`) that can store `node_modules` across builds. By configuring a cache volume in the `cloudbuild.yaml` and using `npm ci --prefer-offline`, the pipeline avoids re-downloading dependencies on every run, significantly reducing build time for Node.js applications on Cloud Run.

Answer

Run npm install locally and commit the node_modules folder to the repository for faster builds.

Answer

Use Cloud Build's step-level caching by copying the node_modules from a previous build step.

Answer

Create a custom base image that includes all dependencies and reference it in the Dockerfile.

Question 5

A developer is deploying a Cloud Run service that needs to access a Cloud SQL instance. The service is deployed with the --no-allow-unauthenticated flag. What is the recommended way to grant the service access to the database?

Accepted Answer

Grant the Cloud SQL Client role to the Cloud Run service's runtime service account.. The recommended way to grant a Cloud Run service access to a Cloud SQL instance is to grant the Cloud SQL Client role (roles/cloudsql.client) to the Cloud Run service's runtime service account. This role provides the necessary permissions (cloudsql.instances.connect and cloudsql.instances.get) to establish a secure connection via the Cloud SQL Auth Proxy or the Cloud SQL connector library. Using the runtime service account follows the principle of least privilege and avoids managing long-lived credentials.

Answer

Create a service account key and store it in Secret Manager, then mount it as a volume.

Answer

Use the default Compute Engine service account and grant it the Cloud SQL Client role.

Answer

Enable the Cloud SQL Admin API and use Application Default Credentials from the Cloud Run service.

Question 6

A developer runs the above command and receives the error. What is the most likely cause?

Accepted Answer

The cloudbuild.yaml file has a syntax error, such as incorrect indentation.. The error is most likely due to a syntax error in the cloudbuild.yaml file, such as incorrect indentation. Cloud Build uses YAML for configuration, and YAML is sensitive to indentation; a missing space or incorrect alignment can cause the build to fail with a parsing error. The command `gcloud builds submit` reads the cloudbuild.yaml file from the current directory, and if the YAML is malformed, the submission will fail before any Docker or build steps are executed.

Answer

The image tag format is incorrect.

Answer

The cloudbuild.yaml file is not present in the current directory.

Answer

The Dockerfile is missing from the repository.

Question 7

A team is deploying a critical application on Google Kubernetes Engine (GKE) and needs to ensure high availability and disaster recovery. Which THREE actions should they take?

Accepted Answer

Use a regional cluster with control plane replicated across zones.. Option B is correct because a regional cluster in GKE replicates the control plane across multiple zones within a region, ensuring that if one zone fails, the control plane remains available. This is essential for high availability and disaster recovery, as it eliminates a single point of failure for cluster management operations.

Answer

Deploy all pods in a single zone for simplicity.

Answer

Use a zonal cluster to reduce costs.

Question 8

A company deploys a Java application on Compute Engine with a preemptible VM instance group managed by an instance template. The application writes critical state to local SSD. After a preemption event, the new instance starts fresh and loses state. What is the best practice to ensure state persistence?

Accepted Answer

Refactor the application to write state to a persistent service like Cloud Storage. Option B is correct because local SSD data is ephemeral and lost on VM preemption or termination. Refactoring the application to write critical state to a persistent service like Cloud Storage ensures data durability independent of the VM lifecycle. This aligns with the best practice of designing preemptible workloads to be stateless, where state is stored externally.

Answer

Modify the startup script to recover state from a snapshot

Answer

Configure the managed instance group as stateful to preserve local SSD data

Answer

Use a regular (non-preemptible) VM instead of preemptible

Question 9

A company runs a stateful application on Compute Engine instances with persistent disks. The application must be highly available and be able to recover from a zonal failure with minimal data loss. The current architecture uses a single instance in one zone. Which design should the team implement?

Accepted Answer

Use a regional persistent disk attached to a managed instance group across two zones.. Option C is correct because a regional persistent disk synchronously replicates data across two zones, and when attached to a managed instance group (MIG) spanning those zones, it provides automatic failover with minimal data loss. This design ensures that if one zone fails, the MIG can detach the disk from the failed instance and attach it to a healthy instance in the surviving zone, preserving state with near-zero RPO.

Answer

Use a standard persistent disk and configure a global load balancer to failover.

Answer

Create a snapshot schedule and restore the snapshot to a new instance in another zone on failure.

Answer

Migrate to Cloud Filestore for shared file storage across zones.

Question 10

An administrator runs the above command to create a Compute Engine instance. However, the nginx service does not start. What is the most likely cause?

Accepted Answer

The instance has no external IP address and cannot reach the internet to download packages.. The command likely creates a Compute Engine instance without specifying an external IP address (e.g., using `--no-address` or omitting `--address`). Without an external IP, the instance cannot reach the internet to download the nginx package from repositories, causing the startup script that installs and starts nginx to fail. This is the most direct cause of the nginx service not starting.

Answer

The metadata key is misspelled; it should be 'startup-script-url'.

Answer

The instance does not have the compute.instance.update permission.

Answer

The startup script runs before the boot disk is fully mounted.