PCDE Practice Test 9 — 10 Questions

Question 1

A team is reviewing IAM permissions on a Cloud Storage bucket. The exhibit shows the bucket's IAM policy. A developer is using the service account sa-1 and reports that they cannot delete objects in the bucket. What is the likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service account sa-1 does not have the storage.objects.delete permission.. The IAM policy shown in the exhibit grants the `objectViewer` role to service account `sa-1`, which includes the `storage.objects.get` and `storage.objects.list` permissions but does not include `storage.objects.delete`. Without the `storage.objects.delete` permission, the developer cannot delete objects in the bucket, even if they can view them. The correct answer is B because the service account lacks the necessary delete permission.

Answer

The etag value must be updated before any delete operation.

Answer

A condition is attached to the objectViewer role that prevents deletion.

Answer

The policy only allows deletion by the service account sa-2.

Question 2

A developer wants to deploy a containerized application to Cloud Run with a requirement that the service has at least 2 instances always running to handle low-latency requests. Which flag should they use with gcloud run deploy?

Accepted Answer

--min-instances=2. The `--min-instances` flag in `gcloud run deploy` specifies the minimum number of container instances that must remain warm and ready to serve requests at all times. Setting `--min-instances=2` ensures Cloud Run keeps at least two instances always running, which eliminates cold starts and guarantees low-latency responses for incoming traffic.

Answer

--concurrency=2

Answer

--cpu-throttling

Answer

--max-instances=2

Question 3

A company is implementing Binary Authorization with Cloud Deploy. They want to ensure that only images signed by the CI system (using Cloud Build) are deployed to production. What must be configured?

Accepted Answer

In Cloud Build, use the `gcloud beta artifacts docker images sign` command after building the image, and set the Binary Authorization policy to require attestations from that signer. It describes the exact workflow: Cloud Build signs the container image using the `gcloud beta artifacts docker images sign` command, which creates a cryptographic attestation stored in Cloud Key Management Service (KMS). The Binary Authorization policy is then configured to require an attestation from that specific signer (the CI system's KMS key), ensuring only images signed by the CI pipeline can be deployed to production.

Answer

Configure Artifact Registry to automatically sign images on push

Answer

Use Cloud Deploy's canary deployment with audit logging to verify image provenance

Answer

Enable Binary Authorization on the GKE cluster and configure the admission controller to use Cloud Key Management Service

Question 4

A financial services company is migrating from an on-premises Oracle RAC database to Cloud Spanner. The current application uses sequences to generate globally unique IDs for transactions. To avoid creating hotspots in Spanner, the database architect recommends using a different primary key strategy. Which primary key design is most appropriate for Spanner to avoid hotspots?

Accepted Answer

Use a bit-reversed sequential key generated by the application.. Bit-reversed sequential keys distribute writes evenly across Cloud Spanner's split boundaries, preventing hotspots. Spanner uses key-range-based sharding, so monotonically increasing keys (like Oracle sequences) cause all new writes to hit a single split, leading to contention. Bit-reversal spreads sequential values across the key space, ensuring balanced write distribution.

Answer

Use a UUID string as the primary key.

Answer

Continue using sequential IDs from Oracle sequences to maintain consistency.

Answer

Use a composite key with a hash prefix derived from the transaction timestamp.

Question 5

An organization wants to set up a landing zone with separate projects for development, staging, and production environments. They also need a shared VPC for networking and a centralized logging project. Which folder structure aligns with Google Cloud best practices?

Accepted Answer

Create folders: /environments/dev, /environments/staging, /environments/prod, and /common. Place networking and logging projects in /common.. It follows Google Cloud best practices by separating environments (dev, staging, prod) into their own folder under an /environments parent, and placing shared resources like networking and logging into a /common folder. This structure enables consistent IAM policy inheritance, resource isolation, and centralized management of shared services, which is critical for a landing zone in a DevOps pipeline.

Answer

Create a single folder /landing-zone and put all projects there.

Answer

Create folders: /dev, /staging, /prod. Place all projects directly under the root.

Answer

Create folders: /prod, /non-prod, /shared. Put dev and staging in /non-prod.

Question 6

A DevOps engineer wants to build a CI/CD pipeline that automatically builds and tests code every time a developer pushes a new branch to a Git repository. Which Cloud Build trigger type should they use?

Accepted Answer

Push to any branch trigger. A 'Push to any branch' trigger in Cloud Build automatically initiates a build whenever a developer pushes code to any branch in the repository. This matches the requirement to build and test code on every new branch push, without manual intervention or branch-specific filters.

Answer

Scheduled trigger

Answer

Manual trigger

Answer

Pull request trigger

Question 7

A team wants to enforce that all Compute Engine disks must be encrypted with Customer-Managed Encryption Keys (CMEK) stored in Cloud Key Management Service (KMS). Which TWO steps should they take? (Choose two.)

Accepted Answer

Apply an organization policy 'constraints/compute.requireCmek' at the desired level.. The organization policy constraint 'constraints/compute.requireCmek' enforces that all new Compute Engine disks in the specified hierarchy must be encrypted with a Customer-Managed Encryption Key (CMEK) from Cloud KMS. This policy prevents the creation of unencrypted disks or disks encrypted with Google-managed keys, ensuring compliance with security requirements.

Answer

Use gcloud commands to encrypt all existing disks with the KMS key.

Answer

Enable the Cloud KMS API in each project where the policy is enforced.

Answer

Grant the cloudkms.cryptoKeyEncrypterDecrypter role to the Compute Engine service account.

Question 8

An engineer is configuring a Cloud Build trigger for a Java application. The build step uses Maven to compile and test, then builds a Docker image. Which cloudbuild.yaml step configuration is CORRECT for specifying the Maven command?

Accepted Answer

steps:
- name: 'maven:3'
  entrypoint: 'mvn'
  args: ['clean', 'package']. The official Maven Docker image (maven:3) has 'mvn' as its default entrypoint. Therefore, args provided are passed directly to mvn. Option A adds 'mvn' in args, resulting in the command 'mvn mvn clean package', which is invalid. Option D correctly sets entrypoint to 'mvn' and args to ['clean', 'package'], producing the intended 'mvn clean package'. Option B uses bash as entrypoint, which would treat the args as a bash script, likely resulting in an error. Option C uses a nonexistent 'script' field in cloudbuild.yaml steps.

Answer

steps:
- name: 'maven:3'
  args: ['mvn', 'clean', 'package']

Answer

steps:
- name: 'maven:3'
  entrypoint: 'bash'
  args: ['mvn', 'clean', 'package']

Answer

steps:
- name: 'maven:3'
  script: 'mvn clean package'

Question 9

A BI team runs a daily query on a BigQuery table 'events' partitioned by event_date. The query filters on event_date = CURRENT_DATE() and counts rows by event_type. The query is slow. Upon review, the table has 500 partitions but clustering is not set. Which action reduces query cost and latency?

Accepted Answer

Add clustering on event_type. Adding clustering on `event_type` physically co-locates rows with the same event type within each partition. This allows BigQuery to use block-level pruning when reading data, drastically reducing the number of bytes scanned for the COUNT(*) GROUP BY query. Since the query already filters on a single partition (`event_date = CURRENT_DATE()`), the performance bottleneck is scanning all rows in that partition; clustering eliminates that overhead without changing the table's structure or retention.

Answer

Recreate the table with only the last 30 days of data

Answer

Use a wildcard table for daily ingestion

Answer

Increase the partition expiration to 365 days

Question 10

A team uses Cloud Monitoring SLO monitoring with a request-based SLI. The SLO is defined as the proportion of requests returning HTTP 200 with latency under 500ms over a 30-day window. They notice that the SLO is being violated due to a slow increase in latency from a specific backend. Which alerting strategy will best detect this gradual degradation early?

Accepted Answer

Slow burn alert with burn rate 5 and 6-hour window. Slow burn alerts (burn rate threshold ~5, lookback window ~6 hours) detect gradual budget consumption that would exhaust the budget over several days. Fast burn alerts (14x, 1h) catch rapid budget consumption. The scenario describes a slow increase, so a slow burn alert is appropriate.

Answer

Alert on any single request exceeding 500ms

Answer

Fast burn alert with burn rate 14 and 1-hour window

Answer

Alert when average latency exceeds 500ms for 1 minute