PCDE Practice Test 37 — 15 Questions

Question 1

A company wants to migrate their on-premises PostgreSQL database to Cloud SQL using DMS. The source database is behind a firewall and does not have a public IP. The target Cloud SQL instance uses a private IP. How should the engineer connect the source to DMS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a VPN or VPC peering to connect the source network to the GCP VPC.. The source PostgreSQL database has no public IP and sits behind a firewall, while the Cloud SQL target uses a private IP. To let DMS reach the source, the source network must be connected to the GCP VPC via VPN or VPC peering so that private IP routing works end-to-end. This is the only option that establishes the required network path without exposing the database to the internet.

Answer

Assign a public IP to the source database.

Answer

Use DMS with a connection profile that specifies the source's private IP without any network configuration.

Answer

Configure Cloud SQL Auth Proxy on the source.

Question 2

A DevOps engineer is using Terraform and wants to reference outputs from another Terraform configuration that manages networking. Which approach should they use?

Accepted Answer

Use `terraform_remote_state` data source pointing to the networking project's GCS state. The `terraform_remote_state` data source is the correct approach because it allows one Terraform configuration to securely read the latest state outputs (e.g., VPC IDs, subnet CIDRs) from another configuration's state file stored in a remote backend like Google Cloud Storage (GCS). This avoids hardcoding or manual copying of values, ensures consistency, and supports dependency management across configurations. By pointing to the networking project's GCS state, the DevOps engineer can dynamically reference outputs like `networking.vpc_id` without exposing sensitive data in environment variables or variable files.

Answer

Use Cloud Shell environment variables

Answer

Use Terraform Cloud's variable sets

Answer

Hardcode the networking values in variables

Question 3

You are configuring a Cloud Build pipeline that builds a Docker image, pushes it to Artifact Registry, and deploys to Cloud Run. The build requires network access to a private VPC to download dependencies. Which approach should you use to provide VPC access?

Accepted Answer

Create a Cloud Build private pool connected to the VPC, and run the build using that pool.. Cloud Build private pools provide direct VPC connectivity by running worker VMs inside a customer-managed subnet within the specified VPC. This allows the build to access private resources (e.g., dependency mirrors, internal repositories) without traversing the public internet, meeting the requirement for network access to a private VPC.

Answer

Add the VPC firewall rule to allow traffic from Cloud Build's default IP range.

Answer

Use the default Cloud Build pool and configure VPC peering in the build steps.

Answer

Use Cloud NAT to allow egress from the default pool to the VPC.

Question 4

A company uses Config Sync to manage GKE clusters in a GitOps fashion. They need to ensure that resources are automatically synced from a Git repository to the cluster, and that any drift from the desired state is corrected. Which Config Sync mode should they enable?

Accepted Answer

Sync mode. Config Sync's Sync mode is the operational mode that continuously applies the desired state from the Git repository to the cluster and remediates drift by reconciling the live state to match the source of truth. Dry-run mode only reports differences without applying them, and Monitor mode is not a Config Sync mode. Therefore Sync mode is the correct choice for automatic application and drift correction.

Answer

Dry-run mode

Answer

Monitor mode

Answer

Policy mode

Question 5

A BI team queries this table with a WHERE clause that filters on product_id but does not include a sale_date filter. What is the outcome?

Accepted Answer

The query runs successfully but scans all partitions.. In BigQuery, when a table is partitioned on sale_date but the WHERE clause filters only on product_id (without sale_date), the query cannot prune partitions. Without the require_partition_filter option, the query runs successfully but scans all partitions. Option D correctly describes this outcome.

Answer

The query fails with an error.

Answer

The query runs successfully and only scans partitions containing product_id values.

Answer

The query runs successfully and scans only the latest partition.

Question 6

An engineer needs to create a cross-region read replica for a Cloud SQL for MySQL instance to improve read scalability and provide disaster recovery. What must be configured on the primary instance to support cross-region replication?

Accepted Answer

Enable binary logging on the primary instance.. Cross-region replication for Cloud SQL for MySQL relies on MySQL's native binary log (binlog) based replication. Enabling binary logging on the primary instance records all data changes in binary log files, which the read replica in another region uses as the source for applying changes. Without binary logging enabled, the primary instance cannot provide the change stream necessary for cross-region replication to function.

Answer

Enable automated backups and point-in-time recovery.

Answer

Configure a Cloud VPN between the regions.

Answer

Set the primary instance to use MySQL 8.0.

Question 7

A company needs to store session data for a web application that runs on Google Kubernetes Engine (GKE). The data is temporary and high-availability is required. Which database service is most appropriate?

Accepted Answer

Memorystore for Redis with replication. Memorystore for Redis with replication is the most appropriate choice because session data is temporary, requires high availability, and benefits from Redis's in-memory, low-latency key-value store. Replication provides failover capability, ensuring session continuity if a primary node fails, while Redis's built-in expiry (TTL) handles temporary data cleanup automatically.

Answer

Cloud Spanner

Answer

Cloud SQL for MySQL

Answer

Cloud Bigtable

Question 8

A data engineer needs to grant a service account read-only access to a Cloud Storage bucket containing sensitive data. The service account is used by a Compute Engine instance. What is the most secure way to assign the permissions?

Accepted Answer

Grant the service account the Storage Object Viewer role on the specific bucket.. Granting the Storage Object Viewer role at the bucket level applies the principle of least privilege, restricting the service account's read-only access to only that specific bucket. This avoids granting broader permissions at the project level, which would inadvertently allow access to all buckets in the project. Using IAM roles is more secure and manageable than legacy bucket ACLs.

Answer

Set bucket ACLs to allow read access for the service account.

Answer

Make the bucket public and rely on network restrictions.

Answer

Grant the service account the Storage Object Viewer role at the project level.

Question 9

A company is planning a cutover from an on-premises MySQL database to Cloud SQL after a DMS continuous migration. To ensure minimal downtime and a successful cutover, which TWO actions should be part of the cutover procedure? (Choose TWO.)

Accepted Answer

Stop all writes to the source database.. Option A is correct because stopping all writes to the on-premises MySQL source quiesces the database, ensuring no new transactions are generated that DMS would still need to replicate, which is essential before promoting Cloud SQL to avoid data loss during cutover. Option E is correct because verifying that DMS replication lag is zero confirms the destination Cloud SQL instance has fully caught up with the source, so the two databases are in sync at the moment of cutover. Options B, C, and D do not belong: increasing source CPU (B) does not address synchronization or downtime, deleting the DMS migration job immediately (C) would break replication before the destination is verified as current, and enabling binary logging on Cloud SQL (D) is unnecessary because Cloud SQL is the target replica, not the source, so binary logging for outbound replication is not required for the cutover.

Answer

Increase the source database's CPU.

Answer

Delete the DMS migration job immediately.

Answer

Enable binary logging on Cloud SQL.

Question 10

An SRE team wants to automate a repetitive manual task that involves moving files from Cloud Storage to BigQuery and then deleting the source files. Which GCP service is BEST suited for this toil reduction?

Accepted Answer

Cloud Functions. Cloud Functions is a serverless compute service that can be triggered by events, such as a file being uploaded to Cloud Storage. It is ideal for automating repetitive tasks like moving files from Cloud Storage to BigQuery and then deleting the source files, as it requires no infrastructure management and scales automatically. The other services are not as well-suited for this event-driven, lightweight task.

Answer

Cloud Build

Answer

Cloud Scheduler

Answer

Compute Engine

Question 11

An SRE team wants to define an SLO for a microservice that processes HTTP requests. They need an SLI that measures the proportion of requests that are answered within 200ms with a non-5xx status code. Which type of SLI should they use?

Accepted Answer

Request-based SLI counting good requests divided by total requests. A request-based SLI is the correct choice because it directly measures the proportion of individual requests that meet the defined criteria (latency ≤ 200ms and non-5xx status). This aligns with the SRE definition of an SLI as a ratio of good events to total events, where each HTTP request is an event. It provides a precise, user-centric view of service quality, as it captures the experience of each request rather than aggregating over time windows or measuring system throughput.

Answer

Availability-based SLI using a rolling window of 30 days

Answer

Window-based SLI counting good minutes

Answer

Throughput-based SLI measuring requests per second

Question 12

A service has an SLO of 99.9% availability over a 30-day rolling window. The team wants to use Cloud Monitoring to create a request-based SLO. Which configuration is correct?

Accepted Answer

Use a request-based metric: good request count / valid request count. A request-based SLO measures the ratio of good requests to total valid requests, which is exactly what Cloud Monitoring's request-based SLI supports. For a 99.9% availability SLO, the SLI is defined as the count of requests that succeeded (good) divided by the count of all valid requests received, evaluated over the 30-day rolling window. This produces the availability ratio that the SLO then compares against the 99.9% target.

Answer

Use an error budget metric: total allowed errors over 30 days

Answer

Use a latency metric: proportion of requests under threshold

Answer

Use a window-based metric: good minutes / total minutes

Question 13

A company has an SLA of 99.95% availability for its service. The SRE team defines an SLO of 99.99% availability. The error budget is calculated as 0.01% over a 30-day window. How much downtime is allowed per month according to the error budget?

Accepted Answer

4.32 minutes. The error budget is calculated as 100% minus the SLO, which is 0.01% (since SLO is 99.99%). Over a 30-day window, the total minutes are 30 days * 24 hours * 60 minutes = 43,200 minutes. 0.01% of 43,200 minutes is 4.32 minutes. Therefore, the allowed downtime per month according to the error budget is 4.32 minutes.

Answer

432 minutes

Answer

0.432 minutes

Answer

43.2 minutes

Question 14

A team uses Cloud Monitoring SLO monitoring with a request-based SLI for availability. They define good requests as those returning HTTP 200. Which configuration correctly creates this SLO?

Accepted Answer

good-request-count = successful requests, valid-request-count = total requests. In Cloud Monitoring SLOs, the SLI is expressed as a ratio of good requests to valid (total) requests. For a request-based availability SLI where good = HTTP 200, good-request-count must count successful (200) responses and valid-request-count must count all requests considered in scope. This produces the availability ratio (good/total) that the SLO targets.

Answer

good-request-count = requests with latency < 500ms, valid-request-count = total requests

Answer

good-request-count = total requests, valid-request-count = successful requests

Answer

good-request-count = 200 responses, valid-request-count = 400+500 responses

Question 15

A team wants to implement Chaos Engineering on GKE to test the resilience of their microservices by randomly killing pods and injecting network latency. Which tool is specifically designed for this purpose on GKE?

Accepted Answer

Chaos Mesh. Chaos Mesh is specifically designed for Chaos Engineering on Kubernetes, including GKE. It provides a suite of tools to simulate various failures such as pod kills, network latency, and stress testing, making it ideal for testing microservices resilience. It integrates natively with Kubernetes and can be deployed on GKE.

Answer

Cloud Armor

Answer

Cloud Shell

Answer

Traffic Director