PCDE Practice Test 39 — 15 Questions

Question 1

A company uses Cloud Deploy with a delivery pipeline that has dev, staging, and prod targets. They want to require manual approval before promoting a release to prod. How should they configure this?

Accepted Answer

Add an approval gate in the prod target configuration

Answer

Configure a postDeploy hook that requires approval

Answer

Use Cloud Build triggers with manual invocation for prod deployments

Answer

Set the prod target's deployment strategy to 'BlueGreen'

Question 2

A developer needs to deploy a containerized application to Cloud Run using the gcloud command. Which two flags are required to successfully deploy?

Accepted Answer

--region. The gcloud run deploy command requires --image to specify the container image and --region to specify the region. Other flags like --ingress and --max-instances are optional.

Answer

--max-instances

Answer

--concurrency

Answer

--ingress

Question 3

A financial services company is using Terraform to manage their Google Cloud infrastructure. They have multiple environments (dev, staging, prod) and want to use a single Terraform configuration with separate state files per environment. They also need to store the Terraform state securely in a shared backend. Which approach should they use?

Accepted Answer

Use Terraform workspaces with a GCS backend. Each workspace automatically creates a separate state file (e.g., env:/dev/project.tfstate).. Terraform workspaces allow using the same configuration with separate state files for each environment. Using a GCS backend with a prefix per workspace stores the state files in separate objects.

Answer

Use Terraform Cloud's workspaces feature with a GCS backend configured in the Terraform Cloud workspace settings.

Answer

Create separate Terraform configurations for each environment and store state in a single GCS bucket with different object names.

Answer

Use Terraform workspaces with a local backend and store state files in a Cloud Storage bucket manually.

Question 4

A company uses a shared VPC with multiple service projects. The network team wants to allow a DevOps team to create Cloud Run services in a service project but prevent them from creating Cloud Run services with public access (allowUnauthenticated invocations). What is the best approach?

Accepted Answer

Use the organization policy constraint `run.allowedIngress` to restrict ingress to internal only.. Organization policy `run.allowedIngress` can restrict Cloud Run services to only allow internal or internal-and-cloud-load-balancing traffic, effectively blocking public access. IAM roles control who can create services but not their properties. Service accounts would be used by services themselves, not for enforcement.

Answer

Configure the shared VPC firewall to block incoming traffic from the internet to Cloud Run services.

Answer

Create a custom IAM role that includes only the run.services.create permission, and assign it to the DevOps team.

Answer

Use a service account with the run.services.create permission and enforce that the DevOps team uses it.

Question 5

An engineer is configuring a Cloud Build build pool to connect to resources in a VPC network. They need to ensure the build can access a private Artifact Registry repository. Which three steps should they take?

Accepted Answer

Set up Private Service Connect for Artifact Registry. Private pools allow builds to use a VPC network. To access private Artifact Registry, the pool must be in the same VPC as the registry endpoint (which uses Private Service Connect or VPC peering), and the service account must have permission to read from the registry.

Answer

Enable public access on the Artifact Registry repository

Answer

Configure a Cloud NAT gateway for the VPC

Question 6

An organization uses Cloud Deploy to promote releases across dev, staging, and prod. They want to automatically run integration tests after a deployment to a Cloud Run target, before proceeding to the next stage. How should they implement this?

Accepted Answer

Configure a postDeploy hook on the staging target that runs a Cloud Run Job for integration tests. Cloud Deploy supports deployment hooks: custom scripts that run before (preDeploy) or after (postDeploy) a deployment. postDeploy hooks run after the target is deployed and can be implemented as Cloud Run Jobs.

Answer

Create a separate Cloud Build trigger that runs tests after detecting the deployment

Answer

Use a preDeploy hook on the staging target to run tests

Answer

Add an approval gate after staging that requires manual test results

Question 7

A company wants to enforce Binary Authorization on images deployed to GKE. Images must be signed by an approved authority. What must be configured in the CI/CD pipeline to ensure images are signed before deployment?

Accepted Answer

Use cosign to sign the image in Cloud Build and store the signature in Artifact Registry

Answer

Add a Cloud Build step that runs gcloud container binauthz attestations create

Answer

Configure Cloud Deploy to sign images during the deployment process

Answer

Enable Container Analysis on Artifact Registry to automatically sign images

Question 8

An SRE team wants to ensure that no single person can deploy to production without a peer review. Which Google Cloud service or feature should they use?

Accepted Answer

Cloud Build with a trigger that runs only on merges to main branch that have passed pull request approval in Cloud Source Repositories. Cloud Source Repositories can enforce pull request approvals. Cloud Build can integrate with approval mechanisms. However, a common approach is to use Cloud Build triggers with a requirement for a pull request approval via Cloud Source Repositories. Alternatively, Binary Authorization can enforce attestations from reviewers. But the most direct is to use Cloud Build with a trigger that only runs on pull request merges that have required approvals.

Answer

Cloud Audit Logs to monitor who deploys

Answer

Cloud Scheduler to run deployments at fixed times

Answer

IAM roles to restrict deployment to a single user

Question 9

A team uses Terraform with remote state stored in a GCS bucket. They are implementing policy as code using Conftest to validate Terraform plans before apply. The Conftest checks run in a CI/CD pipeline. Which approach ensures that Conftest policies are enforced consistently across all Terraform workspaces?

Accepted Answer

Create a separate Git repository for Conftest policies. In the CI/CD pipeline, clone this repo and run conftest test against the Terraform plan.. Conftest uses Rego policies. To enforce consistently, the policies should be version-controlled in a separate repository and the CI/CD pipeline should fetch the latest policy bundle before running tests. Using a centralized policy repo ensures all workspaces are checked against the same rules.

Answer

Use Terraform Cloud's Sentinel policies instead of Conftest, as they are more integrated.

Answer

Embed Conftest policies directly into the Terraform modules using JSON files.

Answer

Store Conftest policies in each Terraform workspace's directory and reference them in the pipeline configuration.

Question 10

A Cloud Bigtable instance has a hot spot causing performance degradation. Which tool helps identify the hot spot?

Accepted Answer

Key Visualizer. Key Visualizer is a built-in Bigtable tool that visualizes access patterns and helps identify hot spots (uneven load across row keys).

Answer

Cloud Monitoring dashboard

Answer

Cloud Logging

Answer

Bigtable Admin API

Question 11

A DevOps team wants to reduce toil by automating manual, repetitive tasks that have no enduring value and scale with service growth. Which two characteristics define toil according to SRE principles?

Accepted Answer

It is repetitive and scales with service growth. According to Google's SRE principles, toil is manual, repetitive, automatable, tactical (no enduring value), and scales with service growth. The question asks for two, so the correct answer pairs two of these.

Answer

It is strategic and non-repetitive

Answer

It is automated and provides enduring value

Answer

It is manual and has enduring value

Question 12

A company wants to enforce least-privilege IAM for their DevOps team. They need to grant permissions to manage Compute Engine instances but not to delete them. Which TWO approaches should they use?

Accepted Answer

Use a predefined role with an IAM condition that denies delete operations.. Predefined roles like `roles/compute.instanceAdmin.v1` include delete permissions. Custom roles allow fine-grained selection of specific permissions. Predefined roles with conditions can restrict actions (e.g., prevent delete), but conditions can be complex. The simplest is to create a custom role with only the required permissions (e.g., compute.instances.create, etc., but not delete).

Answer

Grant the `roles/compute.instanceAdmin.v1` role.

Answer

Grant the `roles/owner` role at the project level.

Answer

Grant the `roles/compute.admin` role.

Question 13

An organization wants to track cloud costs per team and per project. They have already enabled billing export to BigQuery. What additional step should they take to enable cost attribution?

Accepted Answer

Apply labels to resources (team, environment) and query BigQuery billing export. Labels are key-value pairs attached to resources. By applying labels like `team` and `environment`, billing data in BigQuery can be queried to attribute costs.

Answer

Create separate billing accounts per team

Answer

Use resource hierarchy folders to track costs

Answer

Enable VPC flow logs for cost tracking

Question 14

Which TWO are valid methods to define an SLI for a request-driven service? (Choose 2.)

Accepted Answer

Proportion of requests completed within a latency threshold. Common SLIs: proportion of successful requests (availability) and proportion of requests meeting a latency threshold.

Answer

CPU utilization of the server

Answer

Number of code commits per week

Answer

Number of running instances

Question 15

A DevOps engineer is designing a shared VPC topology for a multi-project environment. Which service project permission allows a project to use subnets from a host project?

Accepted Answer

compute.networkUser on the host project. To use shared VPC, the service project must have the compute.networkUser role on the host project's subnets.

Answer

resourcemanager.projectIamAdmin on the service project

Answer

compute.networkAdmin on the host project

Answer

compute.instanceAdmin on the service project