PCDE Practice Test 4 — 25 Questions

Question 1

A company is designing a disaster recovery strategy for their Cloud Spanner database. They need an RPO of less than 30 seconds and an RTO of less than 1 minute. Which two configurations would meet these requirements? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multi-region configuration with read-write replicas (e.g., nam3). The correct answers are B and D. A multi-region configuration with read-write replicas (e.g., nam3) provides automatic failover across regions with an RPO of approximately 15 seconds and an RTO of less than 1 minute, meeting the requirements for region-level failures. A regional instance in Cloud Spanner provides synchronous replication within the region, achieving an RPO of zero and an RTO of seconds, which meets the requirements for zone-level failures within a region. Option A (cross-region backup and restore) typically has an RPO of hours and RTO of hours, so it does not meet the strict RPO/RTO. Option C (point-in-time recovery) provides RPO of seconds to minutes but depends on backups and may not achieve RTO <1 minute for restore operations. Option E (multi-region with read-only replicas) does not support automatic failover because read-only replicas cannot become the new leader, so failover is not automatic and RTO would be longer.

Answer

Cross-region backup and restore

Answer

Point-in-time recovery (PITR)

Answer

Multi-region configuration with read-only replicas

Question 2

You are designing a Firestore database for a chat application. Documents will store messages with fields: senderId, messageText, timestamp, conversationId. To efficiently retrieve the most recent 50 messages in a conversation, which index should you create?

Accepted Answer

A composite index on (conversationId, timestamp, __name__) descending. To efficiently retrieve the most recent 50 messages for a specific conversation, you need a composite index on (conversationId, timestamp, __name__) with descending order. This allows Firestore to perform a range query on conversationId and then order by timestamp descending, using the index to skip scanning irrelevant documents. The __name__ field is included to ensure the index is covering and to handle document name ordering ties, which is required for consistent pagination with descending order.

Answer

A single-field index on timestamp

Answer

An index on conversationId only

Answer

A composite index on (senderId, timestamp)

Question 3

A company is using DMS to migrate a MySQL database to Cloud SQL with continuous replication. During the CDC phase, the replication lag is increasing and not catching up. The source database is heavily used for OLTP workloads. Which action would most likely reduce the replication lag?

Accepted Answer

Reduce the number of concurrent write operations on the source database.. Increasing the source database's binary log retention period does not reduce lag; it retains more logs. Reducing concurrent writes on source directly slows the rate of change, allowing DMS to catch up.

Answer

Increase the size of the Cloud SQL destination instance.

Answer

Increase the binary log retention period on the source.

Answer

Enable parallel replication on DMS.

Question 4

Which TWO data types are supported in Cloud Spanner schemas?

Accepted Answer

ARRAY. ARRAY is a supported data type in Cloud Spanner, allowing you to store ordered lists of elements of the same primitive type (e.g., ARRAY, ARRAY). This is essential for modeling one-to-many relationships without requiring separate tables, and it integrates seamlessly with Cloud Spanner's query engine for array operations.

Answer

GEOMETRY

Answer

TEXT

Answer

TINYINT

Question 5

A financial services company uses BigQuery to run complex analytical queries on trading data. They notice that a particular query joining a large fact table (10 TB) with a small dimension table (100 MB) is slow. The fact table is partitioned by date and clustered by symbol. The dimension table is not partitioned. The query filters on a specific date range and a few symbols. Which optimization is MOST likely to improve query performance?

Accepted Answer

Enable automatic query rewriting to use clustering keys for pruning on the dimension table join.. BigQuery's automatic query rewriting can leverage clustering keys from the fact table to prune the join, even though the dimension table is not clustered. When the query filters on a specific date range and symbols, BigQuery can use the fact table's clustering on symbol to skip irrelevant blocks during the join, reducing data scanned and improving performance. This optimization is automatic and does not require manual denormalization or repartitioning.

Answer

Denormalize the dimension table into the fact table.

Answer

Partition the dimension table by its primary key.

Answer

Cluster the dimension table on its primary key.

Question 6

A team is reviewing IAM permissions on a Cloud Storage bucket. The exhibit shows the bucket's IAM policy. A developer is using the service account sa-1 and reports that they cannot delete objects in the bucket. What is the likely reason?

Accepted Answer

The service account sa-1 does not have the storage.objects.delete permission.. The IAM policy shown in the exhibit grants the `objectViewer` role to service account `sa-1`, which includes the `storage.objects.get` and `storage.objects.list` permissions but does not include `storage.objects.delete`. Without the `storage.objects.delete` permission, the developer cannot delete objects in the bucket, even if they can view them. The correct answer is B because the service account lacks the necessary delete permission.

Answer

The etag value must be updated before any delete operation.

Answer

A condition is attached to the objectViewer role that prevents deletion.

Answer

The policy only allows deletion by the service account sa-2.

Question 7

A developer wants to deploy a containerized application to Cloud Run with a requirement that the service has at least 2 instances always running to handle low-latency requests. Which flag should they use with gcloud run deploy?

Accepted Answer

--min-instances=2. The `--min-instances` flag in `gcloud run deploy` specifies the minimum number of container instances that must remain warm and ready to serve requests at all times. Setting `--min-instances=2` ensures Cloud Run keeps at least two instances always running, which eliminates cold starts and guarantees low-latency responses for incoming traffic.

Answer

--concurrency=2

Answer

--cpu-throttling

Answer

--max-instances=2

Question 8

A company is implementing Binary Authorization with Cloud Deploy. They want to ensure that only images signed by the CI system (using Cloud Build) are deployed to production. What must be configured?

Accepted Answer

In Cloud Build, use the `gcloud beta artifacts docker images sign` command after building the image, and set the Binary Authorization policy to require attestations from that signer. It describes the exact workflow: Cloud Build signs the container image using the `gcloud beta artifacts docker images sign` command, which creates a cryptographic attestation stored in Cloud Key Management Service (KMS). The Binary Authorization policy is then configured to require an attestation from that specific signer (the CI system's KMS key), ensuring only images signed by the CI pipeline can be deployed to production.

Answer

Configure Artifact Registry to automatically sign images on push

Answer

Use Cloud Deploy's canary deployment with audit logging to verify image provenance

Answer

Enable Binary Authorization on the GKE cluster and configure the admission controller to use Cloud Key Management Service

Question 9

A financial services company is migrating from an on-premises Oracle RAC database to Cloud Spanner. The current application uses sequences to generate globally unique IDs for transactions. To avoid creating hotspots in Spanner, the database architect recommends using a different primary key strategy. Which primary key design is most appropriate for Spanner to avoid hotspots?

Accepted Answer

Use a bit-reversed sequential key generated by the application.. Bit-reversed sequential keys distribute writes evenly across Cloud Spanner's split boundaries, preventing hotspots. Spanner uses key-range-based sharding, so monotonically increasing keys (like Oracle sequences) cause all new writes to hit a single split, leading to contention. Bit-reversal spreads sequential values across the key space, ensuring balanced write distribution.

Answer

Use a UUID string as the primary key.

Answer

Continue using sequential IDs from Oracle sequences to maintain consistency.

Answer

Use a composite key with a hash prefix derived from the transaction timestamp.

Question 10

An organization wants to set up a landing zone with separate projects for development, staging, and production environments. They also need a shared VPC for networking and a centralized logging project. Which folder structure aligns with Google Cloud best practices?

Accepted Answer

Create folders: /environments/dev, /environments/staging, /environments/prod, and /common. Place networking and logging projects in /common.. It follows Google Cloud best practices by separating environments (dev, staging, prod) into their own folder under an /environments parent, and placing shared resources like networking and logging into a /common folder. This structure enables consistent IAM policy inheritance, resource isolation, and centralized management of shared services, which is critical for a landing zone in a DevOps pipeline.

Answer

Create a single folder /landing-zone and put all projects there.

Answer

Create folders: /dev, /staging, /prod. Place all projects directly under the root.

Answer

Create folders: /prod, /non-prod, /shared. Put dev and staging in /non-prod.

Question 11

A DevOps engineer wants to build a CI/CD pipeline that automatically builds and tests code every time a developer pushes a new branch to a Git repository. Which Cloud Build trigger type should they use?

Accepted Answer

Push to any branch trigger. A 'Push to any branch' trigger in Cloud Build automatically initiates a build whenever a developer pushes code to any branch in the repository. This matches the requirement to build and test code on every new branch push, without manual intervention or branch-specific filters.

Answer

Scheduled trigger

Answer

Manual trigger

Answer

Pull request trigger

Question 12

A team wants to enforce that all Compute Engine disks must be encrypted with Customer-Managed Encryption Keys (CMEK) stored in Cloud Key Management Service (KMS). Which TWO steps should they take? (Choose two.)

Accepted Answer

Apply an organization policy 'constraints/compute.requireCmek' at the desired level.. The organization policy constraint 'constraints/compute.requireCmek' enforces that all new Compute Engine disks in the specified hierarchy must be encrypted with a Customer-Managed Encryption Key (CMEK) from Cloud KMS. This policy prevents the creation of unencrypted disks or disks encrypted with Google-managed keys, ensuring compliance with security requirements.

Answer

Use gcloud commands to encrypt all existing disks with the KMS key.

Answer

Enable the Cloud KMS API in each project where the policy is enforced.

Answer

Grant the cloudkms.cryptoKeyEncrypterDecrypter role to the Compute Engine service account.

Question 13

An engineer is configuring a Cloud Build trigger for a Java application. The build step uses Maven to compile and test, then builds a Docker image. Which cloudbuild.yaml step configuration is CORRECT for specifying the Maven command?

Accepted Answer

steps:
- name: 'maven:3'
  entrypoint: 'mvn'
  args: ['clean', 'package']. The official Maven Docker image (maven:3) has 'mvn' as its default entrypoint. Therefore, args provided are passed directly to mvn. Option A adds 'mvn' in args, resulting in the command 'mvn mvn clean package', which is invalid. Option D correctly sets entrypoint to 'mvn' and args to ['clean', 'package'], producing the intended 'mvn clean package'. Option B uses bash as entrypoint, which would treat the args as a bash script, likely resulting in an error. Option C uses a nonexistent 'script' field in cloudbuild.yaml steps.

Answer

steps:
- name: 'maven:3'
  args: ['mvn', 'clean', 'package']

Answer

steps:
- name: 'maven:3'
  entrypoint: 'bash'
  args: ['mvn', 'clean', 'package']

Answer

steps:
- name: 'maven:3'
  script: 'mvn clean package'

Question 14

A BI team runs a daily query on a BigQuery table 'events' partitioned by event_date. The query filters on event_date = CURRENT_DATE() and counts rows by event_type. The query is slow. Upon review, the table has 500 partitions but clustering is not set. Which action reduces query cost and latency?

Accepted Answer

Add clustering on event_type. Adding clustering on `event_type` physically co-locates rows with the same event type within each partition. This allows BigQuery to use block-level pruning when reading data, drastically reducing the number of bytes scanned for the COUNT(*) GROUP BY query. Since the query already filters on a single partition (`event_date = CURRENT_DATE()`), the performance bottleneck is scanning all rows in that partition; clustering eliminates that overhead without changing the table's structure or retention.

Answer

Recreate the table with only the last 30 days of data

Answer

Use a wildcard table for daily ingestion

Answer

Increase the partition expiration to 365 days

Question 15

A team uses Cloud Monitoring SLO monitoring with a request-based SLI. The SLO is defined as the proportion of requests returning HTTP 200 with latency under 500ms over a 30-day window. They notice that the SLO is being violated due to a slow increase in latency from a specific backend. Which alerting strategy will best detect this gradual degradation early?

Accepted Answer

Slow burn alert with burn rate 5 and 6-hour window. Slow burn alerts (burn rate threshold ~5, lookback window ~6 hours) detect gradual budget consumption that would exhaust the budget over several days. Fast burn alerts (14x, 1h) catch rapid budget consumption. The scenario describes a slow increase, so a slow burn alert is appropriate.

Answer

Alert on any single request exceeding 500ms

Answer

Fast burn alert with burn rate 14 and 1-hour window

Answer

Alert when average latency exceeds 500ms for 1 minute

Question 16

A team uses Cloud Deploy to manage deployments to GKE across dev, staging, and prod. They want to implement a canary deployment strategy that automatically progresses based on latency metrics and includes a manual approval step before the full rollout. Which three Cloud Deploy features should they use together?

Accepted Answer

Canary deployment strategy. Cloud Deploy's canary deployment strategy allows you to progressively shift traffic to a new version, which aligns with the requirement for a gradual rollout. Option C is correct because SLO-based verification uses latency metrics (e.g., from Cloud Monitoring) to automatically determine whether the canary should progress, meeting the need for automated progression based on latency. Option E is correct because a manual approval gate can be inserted before the final full rollout, satisfying the requirement for a manual approval step.

Answer

Blue/green strategy

Answer

Automated rollback

Question 17

A financial services company uses Cloud Spanner for a ledger application. The ledger table has a primary key of 'transaction_id' which is a monotonically increasing integer. During peak hours, they observe high write latencies due to hot spots on the last tablet. They need to redesign the schema to distribute writes evenly while still allowing efficient point lookups by transaction ID. What is the best approach?

Accepted Answer

Use a composite primary key with a hash prefix of the transaction ID as the first component, followed by the transaction ID.. Using a hash prefix of the transaction ID as the first component of a composite primary key distributes writes across multiple tablets in Cloud Spanner, avoiding hot spots on a single tablet. The transaction ID as the second component still enables efficient point lookups by transaction ID, as Spanner can use the hash prefix to locate the tablet and then scan within it for the exact row.

Answer

Reverse the timestamp and use it as the primary key.

Answer

Use a UUID as the primary key to ensure randomness.

Answer

Use a composite primary key with a timestamp and a random number.

Question 18

An organization uses Binary Authorization with Container Analysis to enforce that only images that have passed vulnerability scanning and have been signed by an approved authority can be deployed to GKE. A DevOps engineer notices that an unsigned image is still being deployed. What is the most likely cause?

Accepted Answer

The Binary Authorization admission controller is not enabled on the GKE cluster.. Binary Authorization enforcement requires the admission controller to be enabled on the GKE cluster. Without the admission controller, the cluster will not intercept pod creation requests to verify image attestations, so unsigned images can be deployed regardless of the Binary Authorization policy configuration.

Answer

The Build service account does not have the signer role.

Answer

The image is stored in a different project than the one where Binary Authorization is configured.

Answer

The Container Analysis API is not enabled in the project.

Question 19

A DevOps engineer needs to deploy the same application to multiple GKE clusters across environments (dev, staging, prod) with environment-specific configurations. They want to use a single source of truth for Kubernetes manifests. Which approach is most suitable?

Accepted Answer

Use Kustomize with overlays for each environment. Kustomize is the most suitable approach because it allows you to maintain a single base set of Kubernetes manifests and apply environment-specific overlays (dev, staging, prod) without templating. This aligns with the requirement for a single source of truth while enabling environment-specific configurations through patches and transformers, all managed natively by kubectl.

Answer

Use Helm charts with separate values files per environment

Answer

Use kubectl apply with different manifest files for each environment

Answer

Use Config Connector to manage GKE clusters

Question 20

A social media platform uses Cloud SQL for PostgreSQL for its user and post data. The schema has a normalized design with separate 'users' and 'posts' tables. Queries that fetch a user's timeline (joining users and posts) are slow due to heavy read volume. The team wants to optimize the schema for this read-heavy workload without changing the application logic significantly. What schema design change is most appropriate?

Accepted Answer

Denormalize by embedding commonly accessed user fields (e.g., username, avatar URL) into the posts table.. Denormalizing by storing relevant user data (e.g., username, avatar) directly in the posts table reduces the need for JOINs, significantly improving read performance. Option A (Migrate to NoSQL like Firestore) is a major architectural change that may not be worth the effort. Option B (Create a materialized view) could help but may introduce staleness and overhead. Option C (GIN indexes) are for full-text search, not join performance.

Answer

Migrate to a NoSQL database like Firestore for better read performance.

Answer

Create a materialized view that joins users and posts, refreshed periodically.

Answer

Add GIN indexes on the posts table for faster full-text search.