PCDE Multiple Select — 30 Questions

Question 1

A company wants to implement least-privilege access for service accounts. Which THREE practices should they follow? (Choose 3)

Accepted Answer

Use Workload Identity Federation instead of service account keys.. Option A is correct because Workload Identity Federation lets external workloads (e.g., on AWS, Azure, or GitHub) impersonate a service account via short-lived OIDC tokens, eliminating long-lived JSON key files that are the primary credential-leak risk. Option D is correct because when keys must be used, regularly rotating them limits the window of exposure if a key is compromised; rotation should be automated and old keys disabled/deleted promptly. Option E is correct because custom IAM roles let you define a permission set containing only the specific permissions the service account needs, which is the essence of least privilege when predefined roles are too broad. Option B is wrong because primitive roles (Owner, Editor, Viewer) are coarse-grained and grant far more access than needed, directly violating least privilege. Option C is wrong because predefined roles are not inherently least-privilege; they often bundle extra permissions, so choosing them merely for compatibility does not minimize access.

Answer

Grant primitive roles for simplicity.

Answer

Use predefined roles to ensure compatibility.

Question 2

A company wants to reduce BigQuery query costs for their BI workloads. Which THREE actions effectively lower the amount of data processed per query? (Choose THREE.)

Accepted Answer

Use partitioned tables on date column. Partitioned tables in BigQuery allow queries to use the WHERE clause to filter on the partition column (e.g., a date column), so BigQuery can prune entire partitions from the scan. This directly reduces the amount of data read and billed, lowering query costs. Option A is correct because it is a primary cost-control mechanism in BigQuery.

Answer

Use LIMIT in subqueries to reduce output

Answer

Use SELECT * to avoid missing columns

Question 3

A company runs a microservices application on GKE. They want to automatically adjust both the number of pods (for varying load) and the resource limits of individual pods (to avoid resource waste). Which two Kubernetes resources should they configure together? (Choose two.)

Accepted Answer

Vertical Pod Autoscaler (VPA). The Horizontal Pod Autoscaler (HPA) (C) is correct because it automatically scales the number of pod replicas in a Deployment, ReplicaSet, or StatefulSet based on observed metrics such as CPU utilization, memory, or custom metrics, directly addressing the requirement to adjust pod count for varying load. The Vertical Pod Autoscaler (VPA) (B) is correct because it automatically adjusts the CPU and memory requests/limits of individual pods (typically by evicting and recreating them with updated resource values), which addresses the requirement to tune resource limits and avoid resource waste. Used together, HPA handles horizontal scaling while VPA handles vertical right-sizing. PodDisruptionBudget (A) is not correct because it only controls voluntary disruptions to maintain availability during operations like node drains, not autoscaling. Cluster Autoscaler (D) is not correct because it scales the number of nodes in the cluster, not pods or pod resource limits. Node Auto-Provisioning (E) is not correct because it dynamically creates node pools with appropriate machine types, again operating at the node level rather than adjusting pod counts or pod resource limits.

Answer

PodDisruptionBudget

Answer

Cluster Autoscaler

Answer

Node Auto-Provisioning

Question 4

Which THREE components are required to compute a 7-day moving average of daily sales using a window function? (Choose three.)

Accepted Answer

AVG() function. The AVG() function is the aggregate function that computes the arithmetic mean of the sales values over the specified window frame. In a moving average calculation, AVG() is applied to the rows defined by the window frame to produce the average for each row.

Answer

PARTITION BY product

Answer

WINDOW clause

Question 5

A company is designing a data model for a BI dashboard that requires real-time updates and historical analysis. Which THREE practices should be followed?

Accepted Answer

Use clustering on frequently filtered columns.. Clustering on frequently filtered columns in BigQuery organizes data into blocks based on the values of those columns, allowing queries with filters on those columns to skip irrelevant blocks entirely. This reduces the amount of data scanned, improving query performance and lowering costs, which is critical for a BI dashboard that needs real-time updates and fast historical analysis.

Answer

Create a separate table for each day's data.

Answer

Use the default BigQuery table expiration setting.

Question 6

An organization uses Terraform with a GCS backend for state. They want to implement a GitOps workflow where changes merged to the main branch are automatically applied. The CI/CD pipeline uses a service account with Workload Identity Federation. Which THREE components are required? (Choose three.)

Accepted Answer

A service account with permissions to modify resources in the target projects.. Option C is correct because the pipeline's service account must hold IAM roles (e.g., roles/editor or specific resource-level roles) on the target projects so that Terraform apply can create, modify, and delete the managed resources. Option D is correct because a GitOps workflow requires a Git repository holding the Terraform configurations; merges to main are the trigger and the repo is the source of truth for desired state. Option E is correct because an automated CI/CD system such as Cloud Build is needed to run terraform init, plan, and apply on merge to main, using Workload Identity Federation to impersonate the service account without long-lived keys. Option A is not required: while GCS object versioning is a recommended safeguard for state recovery, it is not a mandatory component for the GitOps apply workflow itself. Option B is not required: Terraform Cloud is an alternative execution platform and is unnecessary when the pipeline runs Terraform directly against a GCS backend.

Answer

A Cloud Storage bucket with object versioning enabled for Terraform state.

Answer

A Terraform Cloud workspace configured with the same GCS backend.

Question 7

A data engineer is designing a BigQuery schema for a dataset that will be used for both ad-hoc analysis and scheduled dashboards. They want to optimize costs and performance. Which three strategies should they consider? (Choose three.)

Accepted Answer

Use partitioning on a date column for time-based queries.. Partitioning on a date column (Option C) is correct because BigQuery uses the date column to prune partitions during query execution, significantly reducing the amount of data scanned and thus lowering costs and improving performance for time-based queries. This is a core optimization for both ad-hoc analysis and scheduled dashboards that frequently filter by date ranges.

Answer

Use wildcard tables with a suffix filter.

Answer

Store data in multiple tables per day.

Question 8

Which TWO actions are required to set up point-in-time recovery (PITR) for Cloud SQL for MySQL? (Choose 2)

Accepted Answer

Enable binary logging.

Answer

Set the 'log_bin' flag to ON in the database flags.

Answer

Create a read replica in a different region.

Answer

Configure a cross-region backup replica.

Question 9

A team uses Cloud Deploy to manage deployments to GKE across dev, staging, and prod. They want to implement a canary deployment strategy that automatically progresses based on latency metrics and includes a manual approval step before the full rollout. Which three Cloud Deploy features should they use together?

Accepted Answer

Canary deployment strategy. Option B (Canary deployment strategy) is correct because Cloud Deploy's canary strategy lets you define a progressive rollout with percentage-based phases (e.g., 25%, 50%, 75%) so traffic to the new revision increases incrementally rather than all at once. Option C (SLO-based verification) is correct because Cloud Deploy supports deployment verification using SLOs defined in Cloud Monitoring, allowing the pipeline to automatically evaluate latency (and other) metrics after each canary phase and advance or halt based on those results. Option E (Manual approval gate) is correct because Cloud Deploy supports an approval step in the pipeline that pauses the rollout and requires a human to approve before the final full-rollout phase proceeds. Option A (Blue/green strategy) is not correct because blue/green switches all traffic at once between two environments and does not provide the incremental canary progression the team wants. Option D (Automated rollback) is not correct because, while Cloud Deploy can roll back a failed rollout, it is not the feature that drives metric-based progression or the pre-full-rollout approval; the question asks for the features used together to implement the canary-with-verification-and-approval workflow.

Answer

Blue/green strategy

Answer

Automated rollback

Question 10

Refer to the exhibit. A company has a Cloud Spanner instance with the backup configuration shown. They need to improve disaster recovery. Which THREE strategies should they implement?

Accepted Answer

Enable point-in-time recovery (PITR). Option B is correct because enabling point-in-time recovery (PITR) on the Cloud Spanner instance lets the company restore the database to any timestamp within the configurable retention window (up to 7 days), which directly strengthens disaster recovery against accidental data corruption or deletion. Option C is correct because using a multi-region instance configuration replicates data synchronously across multiple regions with a 99.999% SLA, providing resilience if an entire region becomes unavailable. Option D is correct because configuring cross-region backups stores backup copies in a different region than the source instance, protecting recovery data even if the instance's home region is lost. Option A is not the best fit because exports to Cloud Storage are manual or scheduled logical dumps that are not automatically managed as Spanner backups and have slower, less granular restore capabilities. Option E is not correct because read replicas in another region improve read latency and read availability but do not by themselves provide a recovery mechanism for restoring lost or corrupted data.

Answer

Schedule regular exports to Cloud Storage

Answer

Use read replicas in another region

Question 11

A DevOps team is designing a landing zone in Google Cloud. They need to set up a folder structure that supports multiple teams and environments. Which TWO practices should they follow? (Choose 2)

Accepted Answer

Create separate folders for each team (e.g., 'Team-A', 'Team-B') under the environment folders.. Option D is correct because creating environment folders such as prod, staging, and dev under the organization or a top-level folder lets you apply distinct IAM policies, organization policies, and billing/quota controls per environment, achieving strong isolation between production and non-production workloads. Option C is correct because nesting separate team folders (e.g., Team-A, Team-B) under each environment folder maps the resource hierarchy to both organizational and environmental boundaries, so permissions and policies can be inherited and scoped precisely at the team level within each environment. Option A is not appropriate because organization policies are best applied at higher nodes (organization, folder) so they inherit down; applying them only at the project level creates gaps and inconsistent compliance. Option B is wrong because a flat project structure with no folders prevents hierarchical policy inheritance and scalable governance. Option E is wrong because lumping all team projects into a single 'Teams' folder without further grouping removes the per-team and per-environment separation needed for least-privilege IAM and policy scoping.

Answer

Use organization policies at the project level only to enforce compliance.

Answer

Create a flat project structure under the organization node with no folders.

Answer

Place all team projects in a single folder named 'Teams' without further grouping.

Question 12

A company is using Cloud Spanner and wants to perform disaster recovery testing. They need to validate that their backup and restore process works without impacting production. Which TWO actions should they take? (Choose 2 correct answers.)

Accepted Answer

Restore a backup to a new database in the same instance using a different database ID. Option A is correct because Cloud Spanner backups can be restored to a new database within the same instance by specifying a different database ID, which lets the team validate the restore process without touching the production database. Option D is correct because restoring a backup to a new Spanner instance in a separate test project provides full isolation from production, allowing disaster recovery testing with no impact on live workloads. Option B is not appropriate because exporting to Cloud Storage and importing is a data movement method, not the native Cloud Spanner backup/restore validation path, and it does not test the backup restore process itself. Option C is incorrect because read replica failover tests availability and replication behavior, not backup and restore. Option E is incorrect because restoring directly to the production database would overwrite or disrupt production data, violating the requirement to avoid impacting production.

Answer

Export the database to Cloud Storage and import it into a new instance

Answer

Perform a failover to a read replica and then fail back

Answer

Directly restore a backup to the production database to test recovery time

Question 13

Which THREE are considerations when designing a schema for Cloud Firestore?

Accepted Answer

Use subcollections to organize related data. Subcollections in Cloud Firestore allow you to organize related data hierarchically within a document, enabling efficient queries and scalability without hitting the 1 MiB document size limit. This structure is ideal for data like user posts or product reviews, where each subcollection can grow independently.

Answer

Use nested maps for deeply structured data

Answer

Always use transactional writes to ensure consistency

Question 14

Which TWO actions can help reduce the number of read replicas needed for a Cloud SQL for PostgreSQL instance that serves a read-heavy workload?

Accepted Answer

Implement connection pooling to reuse database connections.. Connection pooling reduces the overhead of establishing new database connections, which can consume significant CPU and memory resources on the primary instance. By reusing existing connections, the primary instance can handle more read requests without needing additional read replicas to offload the connection management load. This directly reduces the number of replicas required for a read-heavy workload.

Answer

Enable synchronous replication on all read replicas.

Answer

Use smaller machine types for read replicas.

Answer

Increase the max_connections parameter on the primary instance.

Question 15

A data engineer is creating a reporting layer in BigQuery for BI tools. Which TWO practices improve query performance?

Accepted Answer

Use approximate aggregate functions when exact accuracy is not needed.. BigQuery's approximate aggregate functions (e.g., APPROX_COUNT_DISTINCT, APPROX_QUANTILES) use HyperLogLog++ and other sketching algorithms to return results with a small, bounded error (typically <1%) while drastically reducing the amount of data scanned and shuffled. This trade-off is ideal for BI dashboards where exact counts are not critical, as it can cut query execution time by orders of magnitude.

Answer

Use SELECT * in queries.

Answer

Use ORDER BY in subqueries unnecessarily.

Answer

Store all data in a single table without partitioning.

Question 16

A company is migrating a MySQL OLTP database to Bigtable for a time-series application. The current schema uses a relational model with normalized tables. Which two actions should the team take when designing the Bigtable schema? (Choose TWO.)

Accepted Answer

Denormalize the data into a single wide-column table.. Option A is correct because Bigtable is a wide-column NoSQL store with no joins, so the normalized relational model must be denormalized into a single wide-column table where related data is stored together for efficient reads. Option C is correct because Bigtable row keys are sorted lexicographically and writes to sequential keys (such as timestamps) create hotspots; salting the row key (e.g., prepending a hash or bucket prefix) distributes writes evenly across nodes. Option B is incorrect because Bigtable only supports single-row atomic operations, not multi-row ACID transactions like a relational database. Option D is incorrect because Bigtable does not support secondary indexes; query patterns must be served by row key design or by maintaining separate index tables. Option E is incorrect because normalizing to reduce duplication is a relational design practice that would require joins, which Bigtable cannot perform.

Answer

Maintain transactional integrity using Bigtable transactions.

Answer

Create secondary indexes on timestamp columns.

Answer

Normalize the schema to reduce data duplication.

Question 17

A company runs a Bigtable instance for time-series data. They need to reduce storage costs without compromising query performance for the most recent 30 days. Which two strategies should they implement?

Accepted Answer

Use Cloud Storage as a cold storage tier for historical data. Option B is correct because exporting historical time-series data to Cloud Storage (e.g., as Parquet/Avro files) moves cold data off Bigtable's SSD-backed storage, directly reducing the storage cost of the Bigtable instance while keeping the most recent 30 days in Bigtable for fast query performance. Option D is correct because configuring a garbage collection policy with an age-based rule (maxage=30d) automatically deletes cells older than 30 days, so Bigtable only stores and bills for the recent 30 days of data, which is exactly the retention window required. Option A is not appropriate because adding cluster nodes increases compute cost and does not reduce storage cost, and compaction is managed automatically by Bigtable. Option C is wrong because replication actually multiplies storage and compute costs across clusters, and deleting data from one cluster does not reduce the cost of the remaining cluster. Option E is wrong because reducing cluster nodes lowers compute capacity and can degrade performance, but it does not reduce the storage footprint of the data.

Answer

Increase the number of cluster nodes to improve compaction

Answer

Enable Bigtable replication and delete data from one cluster

Answer

Reduce the number of cluster nodes to save costs

Question 18

Your company runs a global e-commerce platform on Cloud Spanner. You need to capture real-time changes to a table (e.g., orders) and stream them to a downstream analytics pipeline in near real-time. Which TWO Google Cloud features or services should you combine to achieve this? (Choose two.)

Accepted Answer

Dataflow streaming pipeline. A Dataflow streaming pipeline can consume Cloud Spanner change streams in near real-time, process the data (e.g., transform, filter, aggregate), and write it to a downstream analytics system. Dataflow provides exactly-once processing semantics and auto-scaling, making it ideal for continuous change data capture (CDC) pipelines.

Answer

Cloud Functions

Answer

Cloud Pub/Sub

Answer

Cloud SQL for PostgreSQL

Question 19

A company wants to enforce least-privilege IAM for their DevOps team. They need to grant permissions to manage Compute Engine instances but not to delete them. Which TWO approaches should they use?

Accepted Answer

Use a predefined role with an IAM condition that denies delete operations.. Predefined roles like `roles/compute.instanceAdmin.v1` include delete permissions. Custom roles allow fine-grained selection of specific permissions. Predefined roles with conditions can restrict actions (e.g., prevent delete), but conditions can be complex. The simplest is to create a custom role with only the required permissions (e.g., compute.instances.create, etc., but not delete).

Answer

Grant the `roles/compute.instanceAdmin.v1` role.

Answer

Grant the `roles/owner` role at the project level.

Answer

Grant the `roles/compute.admin` role.

Question 20

Which THREE are key principles of a blameless postmortem culture in SRE? (Choose 3)

Accepted Answer

Creating action items with owners and due dates. Option A is correct because a blameless postmortem must produce concrete, trackable action items with assigned owners and due dates so that identified weaknesses are actually remediated rather than left as vague intentions. Option C is correct because the goal of the postmortem is to reconstruct the incident timeline and document all contributing factors—technical, human, and organizational—that combined to cause the failure, which is how SREs learn from complex systems. Option E is correct because blameless culture explicitly shifts focus from punishing individuals to fixing the systemic conditions (e.g., missing safeguards, poor observability, ambiguous runbooks) that allowed the error to propagate. Option B is wrong because postmortems are meant to be shared broadly—often published internally—so the whole organization can learn; secrecy defeats the purpose. Option D is wrong because assigning responsibility to individuals for errors is the opposite of a blameless culture, which assumes people act with good intent given the information and tools available at the time.

Answer

Ensuring incidents are never discussed outside the team

Answer

Assigning responsibility to individuals for errors