PCDE Mock Exam 77 — 25 Questions

Question 1

An organization wants to deploy a Cloud Run service using Cloud Deploy. They need to run a database migration script before each new revision starts serving traffic. Which Cloud Deploy feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a preDeploy hook that runs a Cloud Run Job. Cloud Deploy supports deployment hooks that execute Cloud Run Jobs before (preDeploy) or after (postDeploy) a rollout. PreDeploy hooks run before the new revision starts serving traffic, making them ideal for database migrations.

Answer

Use a Cloud Build step in the delivery pipeline

Answer

Add a manual approval gate before deployment

Answer

Use a postDeploy hook to run the migration after traffic is switched

Question 2

An engineer wants to trigger a Cloud Build pipeline whenever a new pull request(PR) is opened against the 'main' branch of a repository. Which type of build trigger should they configure?

Accepted Answer

Pull Request trigger. Cloud Build supports pull request triggers that automatically run a build when a PR is created or updated. This is specifically called a 'Pull Request' trigger.

Answer

Manual trigger

Answer

Scheduled trigger (cron)

Answer

Push trigger on branch

Question 3

Refer to the exhibit. The application requires low-latency reads for users in Europe. The current cluster is in us-central1. What should they do?

Accepted Answer

Add a new cluster in a European region (e.g., europe-west1).. Adding a new cluster in a European region (e.g., europe-west1) is correct because it places data physically closer to users, reducing network latency for read operations. In a multi-region deployment, the application can read from the nearest cluster, achieving low-latency reads without changing the existing cluster's configuration. This approach leverages geographic proximity to minimize round-trip time (RTT) for European users.

Answer

Increase the number of nodes in the existing cluster.

Answer

Use a multi-cluster instance with existing cluster.

Answer

Change the storage type to SSD in the existing cluster.

Question 4

A company stores sensor data in BigQuery. They have a table 'sensor_readings' with columns: sensor_id, reading_time, value. The table is partitioned by reading_time (hourly) and clustered by sensor_id. A BI query aggregates average value per sensor for the last week. The query still scans many bytes. What is the most likely cause?

Accepted Answer

Partition granularity is too fine for the query range. The query scans a full week of data (168 hourly partitions), and each partition must be read entirely even though only a subset of sensors may be active. Hourly partitioning over a 7-day range means the query engine must scan all 168 partitions, which can result in a large number of bytes being processed. Clustering on sensor_id helps within each partition but does not reduce the number of partitions scanned; the fine granularity of hourly partitioning is the primary cause of excessive bytes scanned.

Answer

The query uses SELECT * instead of specific columns

Answer

Clustering on sensor_id is ineffective

Answer

The table is not using columnar storage

Question 5

Which TWO BigQuery features are specifically designed to accelerate BI dashboard query performance? (Choose TWO.)

Accepted Answer

Clustering. Clustering (B) physically co-locates rows with similar values in the same storage blocks, allowing BigQuery to skip entire blocks when processing queries with filters on clustered columns. This dramatically reduces the amount of data scanned, directly accelerating BI dashboard queries that often filter by date, region, or customer ID. Cached results (D) store the output of recent queries for up to 24 hours, so repeated dashboard refreshes or concurrent user requests can be served instantly without re-scanning any data.

Answer

Wildcard tables

Answer

User-defined functions (UDFs)

Answer

Column-level security

Question 6

An organization wants to use Cloud Build to automatically build and test code changes when a developer pushes to any branch in a Cloud Source Repositories repository. Which two configurations are needed?

Accepted Answer

A cloudbuild.yaml file in the repository. A push trigger monitors branch pushes. To capture all branches, the trigger should use a regex pattern like '.*'. Additionally, the cloudbuild.yaml file must be present in the repository to define the build steps.

Answer

A pull request trigger

Answer

A scheduled trigger with cron

Answer

A manual trigger with webhook

Question 7

An organization wants to implement policy-as-code to validate Terraform plans against security policies before applying them. They are using Terraform Cloud (TFE). Which tool is natively integrated with Terraform Cloud for policy checks?

Accepted Answer

Sentinel. Sentinel is HashiCorp's policy-as-code framework, natively integrated with Terraform Cloud and Terraform Enterprise. OPA and Conftest can be used in CI/CD pipelines but are not natively integrated with Terraform Cloud.

Answer

Open Policy Agent (OPA)

Answer

Cloud Audit Logs

Answer

Conftest

Question 8

A company is designing a global user database that must support strong consistency and horizontal scaling with automatic failover. They have a 99.999% uptime requirement and need to serve writes from a single primary region with reads from multiple regions. Which Google Cloud database and configuration should they use?

Accepted Answer

Cloud Spanner multi-region configuration with a leader region and read-write and read-only replicas. Cloud Spanner multi-region with read-write replicas in one region (leader) and read-only replicas in others provides strong consistency, global reads, and automatic failover. Bigtable is eventually consistent. Cloud SQL cannot span multiple regions natively. Firestore does not provide 99.999% SLA.

Answer

Cloud Firestore in multi-region mode

Answer

Cloud Bigtable with replication and any-replica routing

Answer

Cloud SQL for PostgreSQL with cross-region read replicas and auto-failover

Question 9

A DevOps engineer is setting up a new Google Cloud organization for their company. They need to ensure that all projects are created within a structured hierarchy that separates production, staging, development, and sandbox environments. Which folder structure BEST supports this requirement?

Accepted Answer

Create a folder for each environment (prod, staging, dev, sandbox) directly under the organization node. Within each environment folder, create subfolders for teams or products, and place projects in those subfolders.. The recommended landing zone design uses top-level folders for environments (prod, staging, dev, sandbox) under the organization node, with team/product subfolders inside each environment folder. This allows IAM and org policies to be inherited appropriately.

Answer

Create a folder for each product under the organization node, and within each product folder, create subfolders for environments.

Answer

Create a flat folder structure under the organization node with one folder per team, and place all projects in their team folder regardless of environment.

Answer

Create a flat folder structure with one folder per project type (shared VPC, logging, security) and place all projects in those folders.

Question 10

A DevOps team wants to implement policy-as-code to enforce that all Terraform configurations comply with security rules before deployment. Which tool is most appropriate for pre-commit policy checks on Terraform plans?

Accepted Answer

Conftest. Conftest is a tool that can evaluate policy as code (using Rego language) against structured configuration files like Terraform HCL or plan JSON. It is designed for pre-commit checks in CI/CD pipelines.

Answer

Google Cloud Deployment Manager

Answer

Open Policy Agent (OPA)

Answer

Sentinel

Question 11

An organization wants to enforce that all Compute Engine VMs are created with Shielded VM features enabled to protect against rootkits and boot-level malware. Which Google Cloud mechanism should be used?

Accepted Answer

Organization policies. Organization policies allow you to define constraints that apply to all resources under an organization. The `compute.requireShieldedVm` constraint enforces that VMs must have Shielded VM enabled. IAM roles and service accounts control access but not resource properties. Labels are for metadata, not enforcement.

Answer

Resource labels

Answer

Service accounts

Answer

IAM roles

Question 12

Which Git branching strategy is recommended for infrastructure as code in a DevOps environment to enable continuous delivery?

Accepted Answer

Trunk-based development. Trunk-based development is recommended for IaC to avoid long-lived branches and merge conflicts. It involves short-lived feature branches and frequent merges to main. GitFlow is more complex and not ideal for IaC. GitHub Flow is similar but trunk-based is the standard.

Answer

Forking workflow

Answer

Feature branch workflow without merging to main often

Answer

GitFlow

Question 13

An organization wants to enforce that Compute Engine instances cannot have public IP addresses. Which organization policy constraint should be applied?

Accepted Answer

compute.vmExternalIpAccess. The `compute.vmExternalIpAccess` constraint restricts which VM instances are allowed to have external IP addresses. When enforced as a list deny, it can block all external IPs.

Answer

compute.requireOsLogin

Answer

compute.disableSerialPortAccess

Answer

iam.disableServiceAccountKeyCreation

Question 14

What is the primary benefit of using Workload Identity Federation over service account keys when authenticating workloads running outside Google Cloud?

Accepted Answer

It eliminates the need to create and manage long-lived service account keys, reducing the risk of key exposure.. Workload Identity Federation allows external workloads to impersonate a service account temporarily without needing to manage long-lived service account keys, which are a security risk.

Answer

It allows using multiple service accounts simultaneously.

Answer

It enables workloads to run without any service account.

Answer

It provides higher performance for authentication requests.

Question 15

A DevOps engineer is bootstrapping a new organization. They need to set up a centralized logging project to collect audit logs from all projects. What is the required step to enable cross-project log sinks?

Accepted Answer

Create a log sink in each source project with the destination set to the central project's BigQuery dataset.. To send logs from one project to another, you create a sink in the source project with a destination in the central project. The sink can be configured to include all logs or specific ones (e.g., audit logs). The destination must be a BigQuery dataset, Cloud Storage bucket, or Pub/Sub topic in the central project.

Answer

Create a log sink in the central project that pulls logs from other projects.

Answer

Use Cloud Audit Logs API to stream logs to the central project.

Answer

Grant the central project's logging service account the `roles/logging.admin` role in each source project.

Question 16

An SRE team wants to reduce toil by automating the response to common alert notifications. For example, when a disk usage alert fires, they want to automatically run a script to clean up temporary files. Which Google Cloud service is best suited for this?

Accepted Answer

Cloud Functions. Cloud Functions can be triggered by Cloud Monitoring alerts via Pub/Sub and execute arbitrary code (e.g., script to clean disk). This is a common pattern for automated remediation. Workflows could orchestrate multiple steps but adds complexity. Cloud Build is CI/CD, not event-driven. Cloud Scheduler is for scheduled tasks.

Answer

Cloud Build

Answer

Workflows

Answer

Cloud Scheduler

Question 17

A company uses BigQuery for BI. They need to create a table that stores daily sales data with millions of rows. The query pattern is to aggregate sales by month for specific product categories. Which table design is most cost-effective and performant?

Accepted Answer

Partitioned table by date with clustering on product_category. Partitioning by date allows BigQuery to prune entire partitions when querying monthly aggregates, drastically reducing the data scanned. Clustering on product_category further organizes data within each partition, enabling efficient block-level pruning for category filters. This combination minimizes both cost (bytes billed) and query latency for the described workload.

Answer

Non-partitioned table with clustering on product_category

Answer

Non-partitioned, non-clustered table with manual sharding by date

Answer

Partitioned table by product_category with clustering on date

Question 18

An engineer needs to reduce toil. Which of the following tasks is considered toil according to SRE principles?

Accepted Answer

Manually rotating service account keys every week. Toil is manual, repetitive, automatable, and has no enduring value. Manually rotating service account keys weekly is a classic example of toil.

Answer

Writing a postmortem after an incident

Answer

Designing a new microservice architecture

Answer

Reviewing code changes for a new feature

Question 19

An SRE wants to measure latency SLI for a web service. Which metric is the BEST indicator of user-perceived performance?

Accepted Answer

Proportion of requests served in under 200ms.. The proportion of requests that complete within a defined threshold (e.g., 200ms) directly measures user-perceived performance. Other options are less representative.

Answer

Maximum latency observed in the last 5 minutes.

Answer

Average latency over the last hour.

Answer

99th percentile latency.

Question 20

Which TWO statements correctly describe characteristics of toil in SRE? (Choose 2 answers)

Accepted Answer

Toil is repetitive and manually performed.. Toil in SRE is defined as manual, repetitive work that does not produce enduring value. As a service scales, toil typically increases rather than decreases. Option B correctly identifies toil as repetitive and manually performed. Option E correctly states that toil provides no enduring value. Option A is incorrect because toil is not always automatable; some toil may be difficult or impractical to automate. Option C is incorrect because toil scales with service growth, not decreases. Option D is incorrect because toil does not add enduring value; that is a characteristic of engineering work.

Answer

Toil is always automatable.

Answer

Toil decreases as the service scales.

Answer

Toil adds enduring value to the service.