PCDE Practice Test 17 — 15 Questions

Question 1

A DevOps engineer needs to create a custom IAM role that allows only the permission to create Compute Engine instances, but not to modify or delete them. What is the best practice for defining this role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom role with permission `compute.instances.create`.. The best practice for a least-privilege custom role is to grant only the exact permission needed, which is compute.instances.create. This ensures the role can create instances but cannot modify, delete, or perform any other Compute Engine action. Custom roles in Google Cloud are defined as a list of individual permissions, so specifying the single create permission is the correct approach.

Answer

Use the predefined role `roles/compute.instanceAdmin.v1` and remove permissions.

Answer

Create a custom role with permission `compute.instances.*`.

Answer

Use the predefined role `roles/compute.instanceAdmin` and restrict it with conditions.

Question 2

A team is migrating a relational database to Cloud Bigtable. They need to design a row key that distributes write traffic evenly across nodes. The original table had a composite primary key of customer_id and order_date. Which row key design is BEST for high write throughput?

Accepted Answer

hash(customer_id) # customer_id # order_date. For Cloud Bigtable, row keys should be designed to distribute writes evenly across nodes. Using a hash of the customer_id as a prefix ensures that sequential customer IDs are spread across the keyspace, avoiding hotspots. Including the original customer_id and order_date after the hash maintains uniqueness and allows for efficient queries by customer and date. This design achieves high write throughput.

Answer

customer_id # order_date

Answer

order_date # customer_id

Answer

customer_id only

Question 3

A DevOps engineer wants to automatically trigger a Cloud Build pipeline when a pull request is opened against the main branch. The pipeline should run unit tests and provide results as a status check on the PR. Which type of trigger should they configure?

Accepted Answer

Pull request trigger. A pull request trigger is the correct choice because it is specifically designed to initiate a Cloud Build pipeline in response to PR events, such as when a PR is opened or updated. This allows the pipeline to run unit tests and report results as a status check on the PR, providing immediate feedback to developers. The trigger can be configured to fire only for PRs targeting the main branch, ensuring the pipeline runs exactly when needed.

Answer

Scheduled trigger

Answer

Manual trigger

Answer

Push to branch trigger

Question 4

You are managing a Spanner instance for a global financial application. The database has a table `transactions` with columns `transaction_id` (INT64), `user_id` (INT64), `amount` (FLOAT64), `timestamp` (TIMESTAMP), and `region` (STRING). The table is interleaved with a parent table `users`. Recently, you observed that point-read queries by `transaction_id` are taking over 100ms on average, whereas they used to take under 10ms. The instance CPU utilization is below 40%, and there are no contention issues. The `transactions` table has a primary key `(user_id, transaction_id)`. Queries filter on `transaction_id` only, without specifying `user_id`. Which optimization should you implement to improve point-read latency?

Accepted Answer

Create a secondary index on `transaction_id` to enable efficient key-based lookups.. Point-read queries by `transaction_id` are slow because the primary key is `(user_id, transaction_id)`, so without `user_id`, Spanner cannot directly locate the split (tablet) and must perform a full table scan or a less efficient lookup. Creating a secondary index on `transaction_id` allows Spanner to use that index for key-based lookups, reducing latency to under 10ms by enabling direct access to the specific split via the index's key.

Answer

Add a secondary index on `user_id` to help narrow down the search.

Answer

Use a Spanner query hint to force a specific index scan.

Answer

Change the primary key to `(transaction_id, user_id)` to enable direct access by transaction_id.

Question 5

An engineer needs to deploy an application to Cloud Run with a canary traffic split: 95% to the stable revision and 5% to a new revision. They also want to test the new revision with specific headers without affecting user traffic. Which approach meets these requirements?

Accepted Answer

Deploy the new revision with a tag and use traffic splitting with --to-revisions. Cloud Run supports traffic splitting via --to-revisions, and assigning a tag to the new revision creates a dedicated URL (e.g., https://-----.run.app) that can be used to test the canary with specific headers or clients without affecting the 95/5 production split. This is the native, supported pattern for canary deployments with isolated testing.

Answer

Use Cloud Load Balancing with URL maps to route 5% of traffic

Answer

Deploy the new revision without any tag and use gcloud run services update-traffic

Answer

Use a separate Cloud Run service for the canary and split traffic via HTTP redirects

Question 6

A team uses Terraform to manage infrastructure. They want to ensure that all Terraform code passes policy checks before being applied. They use Terraform Cloud. Which built-in feature allows them to define policies that are checked during the plan phase?

Accepted Answer

Sentinel. Sentinel is Terraform Cloud's built-in policy-as-code framework that allows teams to define and enforce policies during the plan phase. It integrates directly with Terraform Cloud's run lifecycle, enabling policy checks to be evaluated against the planned infrastructure changes before they are applied. This ensures compliance and governance without requiring external tools.

Answer

`terraform validate`

Answer

Conftest

Answer

OPA (Open Policy Agent)

Question 7

An organization wants to enforce that no Compute Engine VM has an external IP address. Which approach should be used?

Accepted Answer

Use an organization policy with constraint `compute.vmExternalIpAccess`. The organization policy constraint `compute.vmExternalIpAccess` is specifically designed to prevent Compute Engine VMs from being assigned external IP addresses. This policy can be applied at the organization, folder, or project level to enforce that no VM in the scope can have an external IP, regardless of how the VM is created. It directly addresses the requirement without affecting other resources or relying on indirect controls.

Answer

Set IAM roles to deny `compute.instances.create` on all projects

Answer

Configure a firewall rule to block all traffic to 0.0.0.0/0

Answer

Use Shared VPC and only allow internal IPs

Question 8

A company is migrating a MySQL 5.7 database to Cloud SQL for MySQL 8.0 using Database Migration Service (DMS). The source database has binary logging disabled. The team needs to perform a continuous migration with minimal downtime. What must be done before creating the DMS migration job?

Accepted Answer

Enable binary logging on the source MySQL instance.. Database Migration Service (DMS) for MySQL requires binary logging to be enabled on the source instance to perform continuous (ongoing) replication. Binary logs capture all data changes and are essential for the change data capture (CDC) phase that keeps the source and destination in sync with minimal downtime. Without binary logging, DMS can only perform a one-time dump, not a continuous migration.

Answer

Create a Cloud SQL Auth Proxy connection to the source.

Answer

Create a service account with Cloud SQL Admin role.

Answer

Set up VPC peering between the source network and Cloud SQL.

Question 9

A company is migrating a legacy on-premises MySQL database to Cloud SQL for PostgreSQL. The database uses composite primary keys on multiple tables and heavily relies on cross-table joins with foreign keys. The team wants to minimize application code changes during migration. Which schema design strategy should the Cloud Database Engineer recommend to ensure compatibility and performance?

Accepted Answer

Use the same composite primary keys and foreign key constraints in Cloud SQL for PostgreSQL, leveraging its full support for these features.. Cloud SQL for PostgreSQL fully supports composite primary keys and foreign key constraints, which are standard SQL features. By maintaining the same schema, the team minimizes application code changes while preserving referential integrity and join performance, as PostgreSQL's query planner handles these constructs efficiently.

Answer

Maintain the same schema and rewrite joins as materialized views in PostgreSQL to optimize queries.

Answer

Migrate to Cloud Spanner instead, using interleaved tables to replace join-heavy operations.

Answer

Remove composite primary keys and replace them with surrogate keys; use look-up tables for foreign key relationships.

Question 10

A bigquery job is running slower than expected. Checking the job information, you see that the slot usage is at 100% for the entire duration of the query. You are using on-demand pricing. What is the most effective way to improve query performance?

Accepted Answer

Purchase a slot reservation and assign the project to it.. With on-demand pricing, your query is limited to the default per-project slot capacity (typically 2,000 slots in BigQuery). If slot usage is at 100% for the entire duration, the query is resource-constrained and cannot be sped up without additional slots. Purchasing a slot reservation and assigning the project to it provides dedicated slots, eliminating the contention and allowing the query to run faster.

Answer

Create materialized views for common aggregations.

Answer

Cluster the tables on frequently filtered columns.

Answer

Partition the tables by date.

Question 11

A company wants to store and analyze data with BigQuery. They have customers in Europe and need to comply with GDPR data residency requirements. What should they do to ensure data stays within the European Union?

Accepted Answer

Create the dataset with the location set to 'EU'.. BigQuery enforces data residency at the dataset level. When you create a dataset with the location set to 'EU', all tables, views, and data within that dataset are physically stored in a Google Cloud region within the European Union. This ensures compliance with GDPR data residency requirements, as data will not be moved or replicated outside the EU without explicit user action.

Answer

Use the default dataset location and rely on BigQuery's automatic compliance.

Answer

Set the query job location to 'EU' for all queries.

Answer

Choose a dataset location of 'us-central1' for performance.

Question 12

The exhibit shows query metadata for a query that scans 10 GB. Given the table is 100 GB and partitioned by hire_date, why did the query scan 10 GB and not less?

Accepted Answer

The filter on hire_date is not selective enough to prune most partitions. Partition pruning in Google BigQuery depends on the selectivity of the filter predicate. If the filter on `hire_date` matches a large number of partitions (e.g., filtering on a range that covers 10 GB out of 100 GB), the query scans exactly those partitions. The table is 100 GB and partitioned by `hire_date`, so a 10 GB scan implies the filter pruned 90 GB of partitions but was not selective enough to reduce the scan further—e.g., the predicate may be a broad range or lack a precise equality condition.

Answer

Clustering on department is not being used because the query has ORDER BY

Answer

The query uses GROUP BY, which forces a full table scan

Answer

The table is not clustered properly

Question 13

A gaming company uses Cloud Spanner to store player profiles and game state. They need to run a one-time analytic query on historical data that would take minutes and cannot impact production performance. What is the best approach?

Accepted Answer

Export the required data to BigQuery using Dataflow and run the query there. Exporting the data to BigQuery via Dataflow isolates the analytic workload from Cloud Spanner, ensuring zero impact on production performance. Cloud Spanner is designed for transactional workloads, not heavy analytic queries that take minutes, and BigQuery is purpose-built for such analytics. This approach also avoids consuming Spanner's CPU or memory resources, which could degrade real-time game state operations.

Answer

Create a read-only replica and query it

Answer

Use the gcloud spanner databases execute-sql command with --query-mode=read-only

Answer

Run the query using a read-only transaction with strong reads

Question 14

A company uses Cloud Bigtable for time-series data from IoT devices. Each device sends a reading every second. The row key is device_id#timestamp (reverse timestamp). The team reports that queries for a specific device's data over the last hour are fast, but queries for all devices' data over the last minute are very slow. What is the most likely cause?

Accepted Answer

The row key design does not allow efficient scanning for all devices because device_id is the prefix.. The row key design uses device_id as the prefix, which means all data for a given device is co-located in contiguous rows, making per-device scans efficient. However, a query for all devices over the last minute requires scanning every row in the table because the timestamp suffix is reversed and not a prefix; Bigtable cannot perform a range scan across all devices for a recent time window without a full table scan, which is extremely slow.

Answer

The Bigtable cluster does not have enough nodes to handle the scan.

Answer

The query is scanning multiple column families.

Answer

The table has too many tablets, causing high overhead.

Question 15

A DevOps engineer is setting up Docker credential helper for Artifact Registry on a Cloud Build worker. They want the build steps to authenticate to Artifact Registry without storing service account keys. What is the recommended approach?

Accepted Answer

Run gcloud auth configure-docker as a build step; Cloud Build's service account will be used automatically.. `gcloud auth configure-docker` configures Docker to use `gcloud` as a credential helper, which automatically uses the Cloud Build worker's attached service account to obtain short-lived access tokens for Artifact Registry. This avoids storing any long-lived service account keys, aligning with Google Cloud's security best practices for CI/CD pipelines.

Answer

Use a custom builder that includes Docker with Artifact Registry credentials.

Answer

Store a service account key in Cloud Secret Manager and load it in a build step.

Answer

Set environment variable ARTIFACT_REGISTRY_KEY in cloudbuild.yaml.