PCDE Practice Test 37 — 15 Questions

Question 1

Order the steps to export data from Cloud Bigtable to Cloud Storage using Dataflow.

Accepted Answer

First create a Cloud Storage bucket, then set up a Dataflow job using the Bigtable to Cloud Storage template, then configure the job parameters, then run the job, then verify the export.. First create storage, then set up Dataflow job with template, configure, run, verify.

Answer

First set up a Dataflow job using the Bigtable to Cloud Storage template, then create a Cloud Storage bucket, then configure the job, then run the job, then verify.

Answer

First create a Cloud Storage bucket, then configure the Dataflow job, then set up the Dataflow job using the template, then run, then verify.

Answer

First create a Cloud Storage bucket, then set up the Dataflow job using the template, then run the job, then configure the job, then verify.

Question 2

Arrange the steps to configure high availability for a Cloud SQL for MySQL instance.

Accepted Answer

Step 1: Create a Cloud SQL for MySQL instance. Step 2: Enable high availability and configure the standby zone. Step 3: Verify high availability and test failover.. Create instance first, then enable HA and set standby zone, then verify and test.

Answer

Step 1: Enable high availability and configure the standby zone. Step 2: Create a Cloud SQL for MySQL instance. Step 3: Verify high availability and test failover.

Answer

Step 1: Create a Cloud SQL for MySQL instance. Step 2: Verify high availability and test failover. Step 3: Enable high availability and configure the standby zone.

Answer

Step 1: Enable high availability and configure the standby zone. Step 2: Verify high availability and test failover. Step 3: Create a Cloud SQL for MySQL instance.

Question 3

A company uses Config Sync to manage GKE clusters in a GitOps fashion. They need to ensure that resources are automatically synced from a Git repository to the cluster, and that any drift from the desired state is corrected. Which Config Sync mode should they enable?

Accepted Answer

Sync mode. Config Sync supports a 'sync' mode that automatically applies the manifests from the repository and continuously reconciles to correct drift. The 'monitor' mode only detects drift but does not correct it.

Answer

Dry-run mode

Answer

Monitor mode

Answer

Policy mode

Question 4

An organization uses GitOps with Config Sync to manage multiple GKE clusters. They want to automatically deploy a new version of a microservice by pushing to a Git repository. Which component validates and applies the changes to the clusters?

Accepted Answer

Config Sync reconciler. Config Sync's core component is the 'reconciler', which runs in each cluster, watches the Git repo, and applies changes to ensure cluster state matches the repo. The 'admission webhook' provides validation but does not apply.

Answer

Cloud Build trigger

Answer

Admission webhook

Answer

Anthos Service Mesh

Question 5

A company is using Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to require manual approval before deploying to prod. What should they add?

Accepted Answer

Configure a 'requireApproval' property on the prod target. Cloud Deploy supports approval gates: you can define a manual approval step in the delivery pipeline that must be approved before proceeding to the next target.

Answer

Set up a Cloud Function to send approval email

Answer

Use Binary Authorization

Answer

Add a rollout policy

Question 6

A DevOps team is using Terraform to manage infrastructure. They have a module that creates a Cloud Storage bucket. They want to reference the bucket's URL in another part of the configuration without hardcoding. Which approach should they use?

Accepted Answer

Use Terraform outputs and a remote state data source to read the bucket URL from the state of the configuration that created it.. Terraform remote state data sources allow one configuration to read outputs from another configuration's state file stored in a backend like GCS.

Answer

Use a shared Terraform workspace to access the bucket across configurations.

Answer

Use a Terraform data source for the bucket, such as google_storage_bucket.

Answer

Store the bucket URL in a variable and pass it manually.

Question 7

A DevOps engineer needs to ensure that no Compute Engine VM in the organization can have an external IP address, except for a specific set of approved projects. Which organization policy configuration should they use?

Accepted Answer

Set 'constraints/compute.vmExternalIpAccess' to 'Deny' at the organization level, then create a tag-based condition to allow external IPs for approved projects.. Organization policies support inheritance and conditions. Setting policy to 'Enforce' at the organization level with a condition to exclude approved projects (e.g., resource.matchTag:env/approved-external-ip) ensures only those projects can have external IPs.

Answer

Use 'constraints/compute.vmExternalIpAccess' with a condition that denies external IPs unless the project has a specific label.

Answer

Set the policy 'constraints/compute.vmExternalIpAccess' to 'Allowed' at the organization level and 'Denied' on each project except the approved ones.

Answer

Create a custom constraint to block external IPs and apply it to all projects except the approved ones.

Question 8

A DevOps team wants to use Cloud Deploy to promote releases across multiple targets. They need to define a delivery pipeline that includes a canary deployment for a GKE cluster and a standard deployment for Cloud Run. Which two strategies can they use in the same pipeline?

Accepted Answer

Canary strategy for GKE. Cloud Deploy allows different deployment strategies per target. You can mix 'canary' for GKE and 'standard' for Cloud Run in the same delivery pipeline. 'Blue/green' is also supported but not required.

Answer

Progressive delivery strategy with manual approval

Answer

Blue/green strategy for Cloud Run

Answer

Rolling update strategy for GKE

Question 9

A company is designing a landing zone for a large enterprise with multiple business units. They need to implement cost tracking and billing management. Which TWO actions should they take?

Accepted Answer

Enable billing export to BigQuery for detailed cost analysis.. Labels can be applied to resources for cost breakdown in billing reports. Billing export to BigQuery enables detailed analysis. Budgets and alerts provide notifications but do not enable tracking at the resource level. Using a billing account per project would be inefficient.

Answer

Create a separate billing account for each project.

Answer

Set up budgets and alerts for each project to monitor spending.

Answer

Use Cloud Armor to restrict access to billing data.

Question 10

A developer is using Cloud Build to build a Docker image and wants to use build substitutions to dynamically set the image tag. Which built-in substitutions can they use? (Choose 2)

Accepted Answer

$SHORT_SHA. Cloud Build provides built-in substitutions like $SHORT_SHA (short commit SHA) and $BRANCH_NAME. $TAG_NAME is not a built-in substitution; $_USER_DEFINED is a custom substitution with underscore prefix.

Answer

$TAG_NAME

Answer

$_IMAGE_NAME

Answer

$_CUSTOM_TAG

Question 11

An organization wants to enforce that all Compute Engine instances in their Google Cloud organization are created with Shielded VM enabled. What is the MOST effective way to enforce this requirement?

Accepted Answer

Set an organization policy with the constraint compute.requireShieldedVm at the organization level.. Organization policies can enforce constraints on resource creation. The compute.requireShieldedVm constraint ensures that any new VM must have Shielded VM enabled; otherwise, the creation fails.

Answer

Configure a VPC Service Controls perimeter to only allow Shielded VMs.

Answer

Create a custom IAM role that only allows creating VMs with Shielded VM enabled.

Answer

Use Cloud Audit Logs to detect non-compliant VMs and trigger a Cloud Function to delete them.

Question 12

A team is designing a CI/CD pipeline for a microservice that requires canary deployments with metrics-based rollback. They want to use Cloud Deploy and Cloud Run. Which three features must they configure? (Choose 3)

Accepted Answer

Canary deployment strategy with canary percentage and metric thresholds. Cloud Deploy's canary strategy requires a delivery pipeline with stages, targets using Cloud Run, and a canary deployment strategy with percentage and metrics. Approval gates are optional.

Answer

Binary Authorization policy

Answer

Manual approval gate on the prod target

Question 13

A DevOps team is designing a landing zone for a multi-team organization. They need to separate environments (prod, staging, dev) and also provide isolated projects for each team's sandbox testing. The team wants to centrally manage networking and security through a shared VPC. Which folder structure best supports this design?

Accepted Answer

Folders: prod, staging, dev, common; inside each, folders for teams with their projects; plus a sandbox folder. A common best practice is to have environment folders (prod, staging, dev) and within each, team folders with team-specific projects. A separate 'common' folder for shared services like networking and security aligns with a landing zone design. The 'Sandbox' folder can contain sandbox projects outside the environment hierarchy.

Answer

Folders: TeamA, TeamB; inside each: prod, staging, dev projects

Answer

Folders: prod, staging, dev; inside each, folders for each team's project; no sandbox folder

Answer

Folders: prod, staging, dev, sandbox; all projects inside with no team subfolders

Question 14

An engineer needs to build a Docker image using Cloud Build and ensure the image is cached across builds to speed up subsequent runs. The build uses Kaniko. What should the engineer add to the cloudbuild.yaml to enable layer caching?

Accepted Answer

Use the 'kaniko' builder and set '--cache=true' and '--cache-repo'. Cloud Build with Kaniko supports caching by specifying a destination for cached layers. The --cache=true flag enables caching, and --cache-repo sets the repository where cached layers are stored. --destination is used for the final image but not for cache configuration alone.

Answer

Configure a build pool with a persistent disk for caching

Answer

Add step using 'docker build' with '--cache-from'

Answer

Set the 'images' field in cloudbuild.yaml to enable automatic caching

Question 15

A company uses Cloud Build to deploy to Cloud Run. They want to use a custom service account for the deployment step, not the default Cloud Build service account. How should they configure this?

Accepted Answer

Specify 'serviceAccount' in the step definition in cloudbuild.yaml. In cloudbuild.yaml, you can specify a service account for each step using the 'serviceAccount' field. This overrides the default build service account for that step.

Answer

Set the service account in the build trigger's service account field

Answer

Use 'gcloud config set account' in the step's entrypoint

Answer

Use 'impersonate-service-account' flag in gcloud commands