PCDE Practice Exam 58 — 20 Questions

Question 1

Refer to the exhibit. The company wants to achieve a 99.99% SLA for this Cloud SQL instance. What should they do?

Accepted Answer

Change the availability type to REGIONAL.. A 99.99% SLA for Cloud SQL requires a regional (multi-zone) configuration to protect against a zonal failure. By changing the availability type to REGIONAL, the instance is provisioned with a synchronous standby in a different zone, enabling automatic failover and meeting the 99.99% uptime target. The default zonal availability only provides a 99.95% SLA.

Answer

Change to a different tier.

Answer

Enable automatic backups.

Answer

Increase the number of CPUs.

Question 2

Your application uses Cloud SQL for PostgreSQL. You notice that the database CPU utilization has been consistently above 90% during peak hours, causing increased query latency. You have already tuned the most expensive queries. What is the most cost-effective next step?

Accepted Answer

Implement connection pooling via Cloud SQL Proxy or a dedicated pooler like PgBouncer.. The question states that expensive queries have already been tuned, yet CPU remains high. This indicates that the database is spending excessive CPU on handling connection overhead (forking processes, parsing sessions) rather than query execution. Connection pooling with PgBouncer reduces the number of active connections, allowing PostgreSQL to reuse backend processes and significantly lower CPU usage without scaling hardware.

Answer

Enable high availability with a failover replica.

Answer

Increase the machine type to a higher CPU tier.

Answer

Add a read replica to offload read queries.

Question 3

Which TWO actions can a team take immediately to resolve a Cloud SQL instance running out of storage?

Accepted Answer

Enable automatic storage increase. Enabling automatic storage increase on a Cloud SQL instance allows the database to automatically add storage when it detects that the available space is running low, preventing out-of-storage errors without manual intervention. This is a quick, immediate action that requires no downtime and is configured via the Cloud Console or gcloud command.

Answer

Delete binary log files

Answer

Migrate to Cloud Spanner

Answer

Add read replicas

Question 4

A company uses Cloud Spanner with a schema that includes a table 'Events' with primary key (EventId, Timestamp). They need to run range queries on Timestamp across all events. They notice slow queries. Which two actions can improve query performance? (Choose two.)

Accepted Answer

Create a secondary index on Timestamp.. Creating a secondary index on Timestamp allows Cloud Spanner to efficiently perform range queries on that column without scanning the entire table. Without this index, Spanner must perform a full table scan, which is slow for large datasets. The secondary index provides a sorted structure that directly supports the range scan operation.

Answer

Add a hash prefix to EventId to distribute writes.

Answer

Use interleaving with a parent table on EventId.

Answer

Change the primary key to (Timestamp, EventId).

Question 5

A Firestore application stores user profiles that must be queried by any of multiple attributes (age, city, last_login). What is the best schema design to support these queries efficiently?

Accepted Answer

Create a composite index on the attributes in a single collection. Firestore requires composite indexes to efficiently query documents across multiple fields (age, city, last_login) in a single collection. Without a composite index, Firestore would need to perform a full collection scan or merge results from separate index scans, which is inefficient and can lead to high latency or query failures. Creating a composite index on the three attributes allows Firestore to use a single index scan to satisfy queries filtering on any combination of these fields.

Answer

Store attributes in an array field and query with array-contains

Answer

Use subcollections per attribute value

Answer

Create separate documents for each attribute value

Question 6

A Cloud SQL for MySQL instance is being used for a production application. The team wants to implement a disaster recovery plan that can recover from a regional outage with minimal data loss and automatic failover. Which three steps should they take? (Choose THREE.)

Accepted Answer

Enable automated backups with a suitable retention period.. Automated backups in Cloud SQL for MySQL provide a baseline for disaster recovery by creating daily backups that can be restored to a new instance. With a suitable retention period, you can recover from data corruption or accidental deletion, though backups alone do not provide automatic failover or minimal data loss during a regional outage.

Answer

Create a read replica in the same region.

Answer

Increase the storage size to accommodate future growth.

Question 7

An organization wants to restrict the creation of Compute Engine instances in their Google Cloud organization to only certain regions. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The resourceLocations constraint is used to restrict where resources can be created. It can be applied at any level of the resource hierarchy.

Answer

compute.requireShieldedVm

Answer

constraints/compute.vmExternalIpAccess

Answer

iam.allowedPolicyMemberDomains

Question 8

A company is migrating a MySQL OLTP database to Bigtable for a time-series application. The current schema uses a relational model with normalized tables. Which two actions should the team take when designing the Bigtable schema? (Choose TWO.)

Accepted Answer

Denormalize the data into a single wide-column table.. Bigtable is a NoSQL wide-column store optimized for time-series data. Denormalization (option A) is recommended because it avoids joins and creates a single wide table that enables efficient scans over time ranges. Salting the row key (option C) distributes writes across nodes, preventing hot spotting on heavily written time-series data. Option B is incorrect because Bigtable only supports single-row transactions, not multi-row transactions. Option D is incorrect because Bigtable does not support secondary indexes; queries must rely on row key design. Option E is incorrect because normalization leads to multiple tables, which are inefficient in Bigtable.

Answer

Maintain transactional integrity using Bigtable transactions.

Answer

Create secondary indexes on timestamp columns.

Answer

Normalize the schema to reduce data duplication.

Question 9

A company is planning to migrate their on-premises Oracle database to Cloud SQL. Which THREE prerequisites must be satisfied?

Accepted Answer

Convert Oracle-specific syntax to PostgreSQL or MySQL. Cloud SQL does not support Oracle's proprietary PL/SQL syntax. When migrating from Oracle to Cloud SQL, you must convert Oracle-specific syntax (e.g., sequences, packages, hierarchical queries) to the target dialect—either PostgreSQL or MySQL—since Cloud SQL offers only these two engines. This conversion is a prerequisite to ensure the migrated database functions correctly after the move.

Answer

Purchase Cloud SQL Enterprise Plus edition for the target instance

Answer

Create a Cloud Storage bucket for staging migration data

Question 10

A team is implementing Binary Authorization for containers deployed to GKE. They want to enforce that only images signed by their CI pipeline can be deployed. The CI pipeline runs in Cloud Build. What must they configure to allow Cloud Build to sign images?

Accepted Answer

Grant the Cloud Build service account the roles/containeranalysis.notes.attacher role on the project.. The Cloud Build service account needs the `roles/containeranalysis.notes.attacher` role to create attestations in Container Analysis. This role allows the service account to attach attestations to vulnerability notes, which are then used by Binary Authorization to verify that an image has been signed by the CI pipeline. Without this role, Cloud Build cannot create the attestations required for the Binary Authorization policy to enforce image signing.

Answer

Use Cloud KMS to sign the image digest and store the signature in Cloud Storage.

Answer

Enable the Binary Authorization API and configure a policy that requires attestations.

Answer

Configure a Cloud Build step to run gcloud container binauthz attestations sign command.

Question 11

A team is migrating a MySQL database to Cloud SQL using a manual approach (mysqldump + import) instead of DMS. They have limited bandwidth. Which TWO considerations should they take into account when choosing between DMS and manual migration? (Choose TWO.)

Accepted Answer

DMS requires the source to have binary logging enabled for continuous migration.. DMS can compress data and supports CDC, reducing downtime. Manual migration gives more control over the process but may require more scripting.

Answer

Manual migration does not support resumable uploads.

Answer

DMS does not support MySQL 8.0 as a source.

Answer

Manual migration is always faster than DMS.

Question 12

A team uses Cloud Build to deploy to Cloud Run via gcloud run deploy. They need to perform a canary deployment where 10% of traffic goes to the new revision for 10 minutes before shifting to 100%. The deployment must be automated without manual steps. What approach should they take?

Accepted Answer

Use Cloud Deploy with a canary strategy targeting Cloud Run. Cloud Run supports traffic splitting via the --no-traffic flag (deploy without serving traffic) and then gradually updating traffic with update-traffic. This can be automated in a Cloud Build step with a sleep or using Cloud Deploy's canary strategy.

Answer

Use Cloud Build with a substitution variable to control traffic percentage across two builds

Answer

Use two separate Cloud Build steps: first deploy with --no-traffic, then second step after 10 minutes with --to-revisions

Answer

Use a single gcloud run deploy with --traffic flags to set 10% initially, then manually update traffic later

Question 13

Which THREE are considerations when designing a schema for Cloud Firestore?

Accepted Answer

Use subcollections to organize related data. Subcollections in Cloud Firestore allow you to organize related data hierarchically within a document, enabling efficient queries and scalability without hitting the 1 MiB document size limit. This structure is ideal for data like user posts or product reviews, where each subcollection can grow independently.

Answer

Use nested maps for deeply structured data

Answer

Always use transactional writes to ensure consistency

Question 14

A team uses Cloud Build with a private pool to access resources in a VPC. After configuring the private pool, builds fail with a timeout error when pulling images from Artifact Registry. What is the most likely cause?

Accepted Answer

The private pool is not peered with the VPC that contains Artifact Registry. When using a Cloud Build private pool, the pool runs in a Google-managed environment that must be peered with your VPC to access internal resources. If the private pool is not peered with the VPC that contains Artifact Registry (which is a regional service accessible via Private Service Connect or VPC peering), the build worker cannot reach the Artifact Registry API endpoint over the private network, causing a timeout when pulling images. Option D directly addresses this missing network connectivity.

Answer

The Artifact Registry repository is in a different region than the private pool

Answer

The image name contains a typo

Answer

The Cloud Build service account lacks permissions to pull images from Artifact Registry

Question 15

An e-commerce platform uses Cloud Bigtable for real-time user sessions. Write latency is high. On investigation, they find that rows are being written with monotonically increasing row keys (e.g., user_id + timestamp). What is the likely cause and solution?

Accepted Answer

Hotspotting on a single node; use salting or field promotion. Monotonically increasing row keys (e.g., user_id + timestamp) cause all writes to target a single tablet server, creating a hotspot. Cloud Bigtable distributes writes across nodes by row key range; sequential keys concentrate load on one node, degrading write latency. Salting (prepending a hash or random prefix) or field promotion (using a high-cardinality field as the first part of the key) spreads writes evenly across the cluster.

Answer

Too many column families; merge them

Answer

Inefficient reads; use reverse scan

Answer

Tablet splits are misconfigured; pre-split the table

Question 16

An organization uses Cloud Build to build and deploy applications. They need to ensure that build secrets (e.g., API tokens) are securely injected into build steps without being exposed in the build logs. Which two actions should they take?

Accepted Answer

Use the 'secretEnv' field in the build step to reference a secret from Secret Manager. The `secretEnv` field in a Cloud Build step allows you to inject a secret from Secret Manager into the build environment as an environment variable, without the secret value being written to build logs. This ensures the secret is available to the step at runtime but never exposed in log output.

Answer

Use the 'env' field to pass the secret as a build substitution variable

Answer

Encrypt the entire cloudbuild.yaml using Cloud KMS

Answer

Store the secret value directly in the cloudbuild.yaml file

Question 17

You are building a global application that requires strong consistency across regions. The application needs to support SQL queries and horizontal scaling. Which database service should you choose?

Accepted Answer

Cloud Spanner

Answer

Cloud SQL with cross-region replicas

Answer

Cloud Bigtable

Answer

Firestore

Question 18

Refer to the exhibit. A developer deployed these Firestore security rules. What is a security concern with this configuration?

Accepted Answer

All authenticated users can read all documents. The Firestore security rules shown grant read access to all authenticated users without any document-level or collection-level restrictions. The rule `match /databases/{database}/documents { allow read: if request.auth != null; }` applies to all documents in the database, meaning any authenticated user can read every document, including those they should not have access to. This violates the principle of least privilege and can lead to unauthorized data exposure.

Answer

Only the owner can write to documents

Answer

The rules do not explicitly allow delete operations

Answer

The wildcard path matches all databases

Question 19

Order the steps to set up a Cloud Spanner instance with a global database.

Accepted Answer

Step 1: Create instance, Step 2: Create database, Step 3: Define schema, Step 4: Insert data, Step 5: Configure IAM. The correct sequence for setting up Cloud Spanner starts with creating the instance to provide compute and storage resources, then creating the database within that instance, followed by defining the schema (tables and indexes), inserting data, and finally configuring IAM to manage access. This logical progression ensures that each step builds on the previous one, avoiding dependency errors.

Answer

Step 1: Create instance, Step 2: Create database, Step 3: Configure IAM, Step 4: Define schema, Step 5: Insert data

Answer

Step 1: Create instance, Step 2: Define schema, Step 3: Create database, Step 4: Insert data, Step 5: Configure IAM

Answer

Step 1: Configure IAM, Step 2: Create instance, Step 3: Create database, Step 4: Define schema, Step 5: Insert data

Question 20

During a blameless postmortem after an incident, the team identified that the root cause was a misconfigured load balancer health check. Which practice should the team prioritize to prevent recurrence?

Accepted Answer

Add a test in CI/CD to validate health check configuration. A blameless postmortem focuses on finding contributing factors and creating action items to improve the system. The action item should be to fix the health check configuration and automate validation. Implementing a runbook for future incidents is reactive, not preventive. Creating a rollback plan is also reactive.

Answer

Create a rollback plan for health check changes

Answer

Schedule a weekly manual review of load balancer settings

Answer

Write a runbook for future load balancer incidents