PCDE Practice Test 46 — 15 Questions

Question 1

A company is adopting Infrastructure as Code with Terraform and wants to enforce policy as code using Open Policy Agent (OPA). Which THREE components are required to implement this in a CI/CD pipeline? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A CI/CD pipeline step that runs the policy check and fails the build on violations.. To enforce OPA policies on Terraform plans, you need: 1) OPA policy files written in Rego, 2) a tool like Conftest or a custom OPA integration to evaluate policies against the Terraform plan JSON, and 3) a CI/CD pipeline step that runs the evaluation and fails the build if policies are violated.

Answer

A GCS bucket to store policy files.

Answer

A Terraform provider for OPA.

Question 2

A SQL query with multiple JOINs is returning duplicate rows. What is the most likely cause?

Accepted Answer

There is a one-to-many relationship between tables.. When a SQL query with multiple JOINs returns duplicate rows, the most likely cause is a one-to-many relationship between the tables being joined. Each matching row in the 'many' side of the join multiplies the rows from the 'one' side, producing duplicates. This is a fundamental behavior of JOIN operations in SQL, where the result set is the Cartesian product of matching rows across the joined tables.

Answer

Using INNER JOIN instead of LEFT JOIN.

Answer

Missing ORDER BY clause.

Answer

Using UNION instead of UNION ALL.

Question 3

A Cloud Pub/Sub subscription is processing a high volume of messages, but the subscriber frequently receives messages that have already been processed (duplicates). The subscriber's processing time varies from 100 ms to 10 seconds. Which parameter should be adjusted to reduce duplicates while maintaining throughput?

Accepted Answer

Increase the acknowledgement deadline to 60 seconds. Pub/Sub redelivers messages if the acknowledgement deadline expires before the subscriber acknowledges. Setting a longer acknowledgement deadline (e.g., 60 seconds) gives the subscriber more time to process and acknowledge, reducing duplicates. Flow control limits outstanding messages but does not prevent duplicates. Using ordering keys ensures order but can increase duplicates due to head-of-line blocking. Increasing the number of pullers increases throughput but not directly reduce duplicates.

Answer

Enable flow control with a max outstanding message count

Answer

Use ordering keys on the subscription

Answer

Increase the number of puller clients

Question 4

A company wants to set up an alert that fires if any Compute Engine instance has a CPU utilization above 80% for more than 5 minutes. They have thousands of instances. Which alerting condition type and configuration is most efficient?

Accepted Answer

Use a metric-threshold condition with resource group filter set to 'gce_instance' and a threshold of 80%. A metric-threshold condition using a policy with multiple conditions (one per instance) would be cumbersome. Instead, use a grouped alert with a threshold on the metric and apply to all instances via a monitored resource filter.

Answer

Use a logs-based alert on CPU logs

Answer

Create a separate alert for each instance using instance-specific conditions

Answer

Use a metric-absent condition to detect when CPU metric stops reporting

Question 5

Order the steps to migrate an on-premises MySQL database to Cloud SQL using Database Migration Service (DMS).

Accepted Answer

Prepare source database, Create connection profile, Create migration job, Start migration, Promote. First prepare source, then create connection profile, create migration job, start migration, and finally promote.

Answer

Prepare source database, Create migration job, Create connection profile, Start migration, Promote

Answer

Create connection profile, Prepare source database, Create migration job, Start migration, Promote

Answer

Prepare source database, Create connection profile, Start migration, Create migration job, Promote

Question 6

An application running on Google Kubernetes Engine (GKE) uses OpenTelemetry SDK to export traces. Which Google Cloud service should receive these traces?

Accepted Answer

Cloud Trace. Cloud Trace is the managed distributed tracing service on Google Cloud. OpenTelemetry SDK can export traces directly to Cloud Trace via the exporter. Cloud Monitoring is for metrics, Cloud Logging for logs, and Error Reporting for exceptions. Traces go to Cloud Trace.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

Error Reporting

Question 7

A company wants to implement least-privilege access for service accounts. Which THREE practices should they follow? (Choose 3)

Accepted Answer

Use Workload Identity Federation instead of service account keys.. Workload Identity Federation allows workloads running outside Google Cloud (e.g., on-premises, AWS, Azure) to authenticate to Google Cloud APIs without using long-lived service account keys. By exchanging tokens from an external identity provider for short-lived Google Cloud access tokens, it eliminates the need to store and manage static keys, directly supporting least-privilege access by reducing the attack surface and enabling automatic credential rotation.

Answer

Grant primitive roles for simplicity.

Answer

Use predefined roles to ensure compatibility.

Question 8

A company is using BigQuery and needs to implement row-level security so that sales representatives only see their own region's data. Which approach?

Accepted Answer

Use authorized views with WHERE clause filtering by session user's region. BigQuery authorized views allow you to enforce row-level security by embedding a WHERE clause that filters data based on the session user's region (e.g., using SESSION_USER() or a mapping table). This ensures each sales representative sees only their own region's data without exposing the underlying tables directly.

Answer

Use BigQuery column-level security to filter by region

Answer

Create separate tables for each region and union in views

Answer

Use IAM conditions at the dataset level

Question 9

A team uses Cloud Deploy with a delivery pipeline that has multiple targets (dev, staging, prod). They want to automatically roll back to the previous release if the new release fails a post-deployment health check. Which configuration should they use?

Accepted Answer

Configure a postDeploy hook that runs a health check and uses 'gcloud deploy releases rollback' if it fails. Cloud Deploy does not have a built-in 'rollbackOnFailure' or 'auto-rollback' property for post-deployment health checks. Instead, you must implement a custom postDeploy hook that runs a health check script; if the health check fails, the script can invoke 'gcloud deploy releases rollback' to programmatically trigger a rollback to the previous release. This gives you full control over the rollback logic and conditions.

Answer

Set 'rollbackOnFailure: true' in the pipeline definition

Answer

Use a canary deployment with metric analysis to trigger rollback

Answer

Enable 'auto-rollback' in the target configuration

Question 10

A company stores time-series data in Cloud Spanner with a primary key composed of a timestamp prefix and a user ID suffix. They notice high write latency and hotspotting on a specific node. How should they redesign the primary key to distribute writes evenly?

Accepted Answer

Use a hash of the user ID as the prefix, then timestamp. Hotspots occur in Spanner when using monotonically increasing keys (like timestamps) because all writes go to a single tablet. Using a hash prefix or bit-reversal distributes writes across tablets. Keeping a timestamp suffix still causes hot leading key. None and using a secondary index doesn't fix the primary key issue.

Answer

Use a monotonically increasing counter as the prefix

Answer

Keep the current design but add a secondary index

Answer

Reverse the key order: timestamp suffix, user ID prefix

Question 11

The query returns results but takes a long time. The orders table has 500M rows with order_date as a timestamp and revenue as float. How can the query be optimized?

Accepted Answer

Partition the table by month on order_date.. Partitioning the table by month on order_date (Option B) is correct because it physically separates the data into monthly partitions, allowing the query engine to prune partitions that do not match the query's time range. This dramatically reduces the amount of data scanned, which is the primary cause of slow performance on a 500M-row table. In BigQuery, partitioning by a timestamp column like order_date is a native, cost-effective optimization that directly addresses the scan bottleneck.

Answer

Add a clustering key on order_date.

Answer

Use a wildcard table over multiple date-sharded tables.

Answer

Use a materialized view that caches the query result.

Question 12

A company runs a batch processing job on Compute Engine VMs. The job is fault-tolerant and can handle individual VM failures by restarting tasks. To reduce costs, they want to use the cheapest possible VMs while ensuring the job completes within a flexible time window. Which VM option is MOST cost-effective?

Accepted Answer

Preemptible VMs. Preemptible VMs are significantly cheaper (up to 60-80% discount) than regular VMs but can be terminated at any time. Since the job is fault-tolerant, preemptibles are ideal for cost savings. Committed use discounts require a 1-year or 3-year commitment, less flexible. Standard VMs are more expensive. Sole-tenant nodes are for isolation, not cost savings.

Answer

Standard VMs with committed use discounts

Answer

Sole-tenant VMs

Answer

Standard VMs without discounts

Question 13

Which TWO options are valid ways to authenticate to Artifact Registry from a CI/CD pipeline? (Choose two.)

Accepted Answer

Configure Workload Identity federation for the CI provider. Workload Identity federation allows non-GCP CI systems to authenticate, and the Docker credential helper is used for Docker authentication.

Answer

Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to a service account key

Answer

Use gcloud auth login with user credentials

Answer

Use a service account JSON key in the pipeline

Question 14

Your team uses PagerDuty for incident notifications. You need to configure Cloud Monitoring to send alerts to PagerDuty. Which notification channel type should you select?

Accepted Answer

PagerDuty. Cloud Monitoring supports PagerDuty as a notification channel type directly. You can configure it by providing the PagerDuty integration key. No other channel types (email, Slack, Pub/Sub) are needed.

Answer

Slack

Answer

Cloud Pub/Sub

Answer

SMS

Question 15

You are a database engineer for an e-commerce company. The company uses BigQuery for its BI and analytics. The data pipeline stages raw event data into a table 'raw_events' with columns: event_id, user_id, event_time, event_type, and a JSON string 'event_data'. The BI team wants to query this data for user behavior analysis, but the JSON parsing makes queries slow. They need to perform frequent queries that extract specific fields from the JSON and filter by event_time. The table 'raw_events' is not partitioned and has 2 billion rows. What is the most effective single step to improve query performance and reduce cost?

Accepted Answer

Partition the table on event_time and cluster on event_type. Partitioning the table on event_time allows BigQuery to prune entire partitions when queries filter by event_time, drastically reducing the amount of data scanned. Clustering on event_type further organizes data within each partition, enabling block-level pruning for queries that filter or aggregate by event_type. This combination directly addresses the slow JSON parsing and high cost by minimizing scanned bytes, which is the most effective single step for a 2-billion-row table.

Answer

Create a view that extracts JSON fields into columns

Answer

Increase BigQuery slots to maximum

Answer

Use a materialized view to precompute common queries