PCDE Practice Test 38 — 15 Questions

Question 1

A team is using Helm charts to deploy to GKE. They want to manage environment-specific values (dev, staging, prod) while keeping a single chart. Which approach is recommended?

Accepted Answer

Use --values flags with environment-specific value files. Helm supports multiple values files; you can use --values to specify environment-specific files, overriding default values. This keeps one chart and separate configs.

Answer

Store all environment values in a single values.yaml and use --set to override

Answer

Use Kustomize overlays to manage Helm values

Answer

Create separate Helm charts for each environment

Question 2

A team is using Cloud Build to build Docker images and push them to Artifact Registry. They want to speed up builds by caching the Docker layers. Which approach is recommended for caching in Cloud Build?

Accepted Answer

Configure Cloud Build to use Kaniko cache with a destination in Artifact Registry. Cloud Build supports Kaniko caching for Docker images. Kaniko can cache layers in a registry, significantly reducing build times by reusing cached layers when the Dockerfile hasn't changed.

Answer

Use Google Cloud Storage as a layer cache for Docker builds

Answer

Use 'gcloud builds submit --cache-from' with a local cache

Answer

Set up a Docker registry proxy in Compute Engine to cache images

Question 3

A company wants to enforce that all Cloud Run services must not be publicly accessible. They need a preventive control rather than a detective one. Which approach should they use?

Accepted Answer

Apply an organization policy with constraint 'constraints/run.allowedIngress' set to 'Internal and Cloud Load Balancing'.. Organization policies provide preventive controls. The 'constraints/run.allowedIngress' policy can be set to 'Internal' or 'Internal and Cloud Load Balancing' to prevent public access. IAM roles can be used to grant/revoke access but are not preventive for resource configuration.

Answer

Use Cloud Audit Logs to monitor for public Cloud Run services and alert the security team.

Answer

Create a custom IAM role that denies the run.services.create permission.

Answer

Configure VPC Service Controls to restrict Cloud Run access to within the VPC.

Question 4

A developer wants to use Cloud Build to deploy a container to Cloud Run. They have written a cloudbuild.yaml file with a step that runs gcloud run deploy. The build fails with a permission error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Cloud Run Admin role

Answer

The gcloud command is incorrect

Answer

The Cloud Build trigger is misconfigured

Answer

The Cloud Run API is not enabled in the project

Question 5

A company wants to centralize audit logs and billing data from multiple projects in a single project for analysis. What is the best approach?

Accepted Answer

Create a dedicated logging project, set up aggregated log sinks from all projects to that project, and export billing data to BigQuery in the same project. Using a separate project for logging centralization with aggregated sinks to export logs and billing export to BigQuery in that project is the recommended landing zone design pattern.

Answer

Use Cloud Monitoring to view logs from all projects in one dashboard

Answer

Create a shared VPC project and enable VPC flow logs

Answer

Enable billing export to BigQuery in each project and query across projects

Question 6

A team uses Cloud Build private pools to build Docker images that need access to on-premises resources via VPC peering. The build step fails with a 'connection refused' error. What is the most likely missing configuration?

Accepted Answer

The private pool does not have a route to the on-premises network

Answer

The build step is using a wrong Docker image

Answer

The Cloud Build service account lacks permissions to use the private pool

Answer

The on-premises firewall is blocking egress from GCP

Question 7

An organization wants to enforce policy as code for Terraform configurations. Which TWO tools can be used to validate Terraform plans against custom policies before apply? (Choose 2)

Accepted Answer

Open Policy Agent (OPA) with Conftest. Sentinel is a policy-as-code framework for Terraform Enterprise/Cloud, and OPA (Open Policy Agent) with Conftest can be used to evaluate policies against Terraform plans or HCL files. Both can be integrated into CI/CD.

Answer

Cloud Build

Answer

Cloud Audit Logs

Answer

gcloud CLI

Question 8

A Cloud SQL for MySQL instance requires a patch update. How can you minimize downtime during the update?

Accepted Answer

Schedule the maintenance during a maintenance window. Cloud SQL for MySQL uses a maintenance window to schedule patching during a period of low traffic, minimizing user impact. While a restart is typically required for patch application, the maintenance window allows you to control when that restart occurs, reducing downtime exposure. This is the standard recommended approach for managed database patching in Google Cloud.

Answer

Apply the patch without restart

Answer

Use database migration to a new instance

Answer

Failover to a read replica during the update

Question 9

A team uses Skaffold for local development and CI/CD. They want to run integration tests against the deployed application before releasing to production. Which THREE Skaffold features can they use?

Accepted Answer

Custom test via the 'test' config section

Answer

Port forwarding to access the application locally

Answer

Skaffold debug for interactive debugging

Question 10

A DevOps engineer is building a CI/CD pipeline and needs to securely pass a database password to a Cloud Build step. The password is stored in Secret Manager. What is the correct way to access it in cloudbuild.yaml?

Accepted Answer

Define the secret in 'availableSecrets' and reference it via 'secretEnv' in the step. Cloud Build can access secrets from Secret Manager using the 'availableSecrets' and 'secretEnv' configuration. The secret is then injected as an environment variable in the build step.

Answer

Use 'gcloud secrets versions access' directly in a step's entrypoint

Answer

Store the password in a Cloud Storage bucket and download it during build

Answer

Pass the password as a build substitution variable

Question 11

An engineer needs to create a build trigger in Cloud Build that runs every day at midnight. Which type of trigger should they use?

Accepted Answer

Scheduled trigger. Cloud Build supports scheduled triggers using a cron syntax. This allows running builds at specific times or intervals.

Answer

Push to branch trigger

Answer

Pull request trigger

Answer

Manual trigger

Question 12

A company has a Google Cloud organization with separate folders for development, staging, and production. They want to deploy Terraform using a CI/CD pipeline that runs in a shared tools project. Where should the Terraform state files be stored and how should the pipeline authenticate?

Accepted Answer

Store state in a central Cloud Storage bucket in the tools project; use a service account in the tools project with Workload Identity Federation to access the bucket and assume roles in environment projects.. Terraform state should be stored in a GCS bucket with versioning enabled. The pipeline should use a service account from the tools project with Workload Identity Federation to access the bucket. This avoids long-lived keys and follows security best practices.

Answer

Store state in Cloud Firestore; use a service account key stored in Secret Manager.

Answer

Store state in a Cloud Storage bucket in each environment project; use user credentials passed as secrets.

Answer

Store state locally in the CI/CD runner; use Application Default Credentials from the runner's environment.

Question 13

A DevOps engineer wants to trigger a Cloud Build pipeline automatically every time a pull request is created against the main branch of a Cloud Source Repositories repository. Which type of build trigger should they configure?

Accepted Answer

Pull request trigger. Cloud Build supports pull request triggers that fire on PR creation or update. Manual triggers require human action, push triggers fire on branch commits, and scheduled triggers run on a cron schedule.

Answer

Push trigger

Answer

Manual trigger

Answer

Scheduled trigger

Question 14

An organization has a Cloud Deploy delivery pipeline with a canary deployment strategy to GKE. They want to automatically pause the rollout if the canary revision's error rate exceeds 5% for 5 minutes. Which feature should they use?

Accepted Answer

Canary deployment strategy with metric analysis. Cloud Deploy can integrate with Cloud Monitoring metrics to automate canary verification. By defining a canary deployment strategy with metric-based analysis, the rollout can be paused or rolled back if predefined thresholds are breached.

Answer

PreDeploy hook

Answer

Rollback on deploy failure

Answer

Manual approval gate

Question 15

A DevOps engineer is bootstrapping a new Google Cloud organization. They need to enforce that all Compute Engine VM instances must use Shielded VM features. Which method should they use?

Accepted Answer

Apply an organization policy with constraint constraints/compute.requireShieldedVm at the organization level.. Organization policies allow you to centrally constrain resource usage across the entire resource hierarchy. The 'constraints/compute.requireShieldedVm' policy enforces Shielded VM on all new VMs. IAM roles control access but not resource configurations.

Answer

Create a custom IAM role that grants compute.instances.create permission only for Shielded VM projects.

Answer

Use Deployment Manager templates that include Shielded VM initialization config.

Answer

Enable Shielded VM as a default in the Compute Engine service quota settings.