PCDOE Practice Test 1 — 10 Questions

Question 1

A company is setting up a new Google Cloud organization. They want to ensure that all projects inherit common IAM policies. What is the best practice?

Accepted Answer

Apply IAM policies at the organization level.. Applying policies at the organization level ensures all projects and folders inherit them, providing consistent enforcement and reducing administrative overhead.

Answer

Apply IAM policies at the folder level.

Answer

Apply IAM policies at the project level.

Answer

Use multiple organizations to isolate policies.

Question 2

You are designing alerting policies for a microservice architecture. Which TWO metrics are most suitable for triggering a page to the on-call engineer?

Accepted Answer

Latency P99 exceeding the SLO target for 5 minutes.. Error budget burn rate and high latency (P99 breaching SLO) directly indicate customer-facing issues and require immediate attention. CPU and request count are less critical.

Answer

Number of requests per second.

Answer

CPU utilization at 50%.

Answer

Memory usage trend.

Question 3

A team uses Cloud Build with a cloudbuild.yaml that deploys to multiple environments. They want to ensure that the production deployment step only runs when the build is triggered by a tag matching 'v*.*.*'. Which TWO configurations achieve this? (Choose two.)

Accepted Answer

In the cloudbuild.yaml, use a 'waitFor' condition that only runs the production step when the substitution variable $TAG_NAME matches 'v*.*.*'.. Cloud Build supports substitution variables like $TAG_NAME, which can be used in a 'waitFor' condition or as part of a step's entrypoint logic to gate execution. By checking if $TAG_NAME matches the glob pattern 'v*.*.*', the production deployment step will only run when the build is triggered by a matching tag, ensuring environment-specific control within a single cloudbuild.yaml.

Answer

In the cloudbuild.yaml, add a condition that checks if the branch name matches 'v*.*.*'.

Answer

Create a separate cloudbuild.yaml for production and use a branch filter '^main$' to trigger it.

Answer

Configure a manual approval step in Cloud Build that requires a production manager to approve before running the production deployment.

Question 4

During a post-mortem, you identify that an incident was caused by a configuration change that was not reviewed. Which of the following is the most effective preventive action?

Accepted Answer

Implement a change management process with mandatory peer review.. A change management process with mandatory peer review directly addresses the root cause: a configuration change was made without oversight. By requiring at least one additional engineer to review and approve changes before implementation, the process catches misconfigurations, policy violations, or unintended side effects before they reach production. This is a preventive control, not a detective or corrective one, and aligns with ITIL best practices for change management.

Answer

Add more monitoring alerts.

Answer

Schedule weekly meetings to review changes.

Answer

Use a configuration management database (CMDB).

Question 5

A company wants to enforce that all projects in the organization have a specific VPC Service Controls perimeter. What is the most efficient way to achieve this?

Accepted Answer

Use folder-level VPC Service Controls perimeters.. Folder-level VPC Service Controls perimeters allow you to apply a single perimeter configuration to all projects within a folder, ensuring consistent enforcement across the organization without needing to configure each project individually. This is the most efficient method because it leverages the resource hierarchy to inherit the policy, reducing administrative overhead and preventing misconfigurations.

Answer

Use project-level VPC Service Controls perimeters.

Answer

Use organization policies to set the perimeter.

Answer

Use a custom script to monitor and alert on non-compliant projects.

Question 6

A DevOps team is bootstrapping a new Google Cloud organization. They want to grant a group of engineers the ability to create and manage projects within the organization, but not to modify organization policies or folders. Which IAM role should be assigned at the organization level?

Accepted Answer

roles/resourcemanager.projectCreator. Roles/resourcemanager.projectCreator, is correct because it grants the specific permission to create and manage projects within the organization without allowing modifications to organization policies or folders. This role includes permissions like resourcemanager.projects.create and resourcemanager.projects.update, but explicitly excludes permissions for organization-level policy management (e.g., resourcemanager.organizations.setIamPolicy) or folder administration (e.g., resourcemanager.folders.update).

Answer

roles/owner

Answer

roles/resourcemanager.folderAdmin

Answer

roles/editor

Question 7

Refer to the exhibit. An App Engine application returns 504 errors. The application calls an external API and processes the result. Which change is most likely to resolve the errors?

Accepted Answer

Increase the App Engine request timeout in app.yaml to 120 seconds.. A 504 error from App Engine indicates the request exceeded the timeout limit before the application could respond. The default App Engine request timeout is 60 seconds, and since the application calls an external API and processes the result, the total time may exceed this limit. Increasing the request timeout in app.yaml to 120 seconds allows the application more time to complete the external API call and processing, resolving the 504 error.

Answer

Reduce the idle timeout in the scaling settings.

Answer

Change the scaling type from automatic to manual.

Answer

Increase the number of instances to handle the load.

Question 8

A CI/CD pipeline must deploy to multiple environments (dev, staging, prod) with manual approval required before prod deployment. Which Google Cloud service is best for orchestrating this?

Accepted Answer

Cloud Deploy with promotion. Cloud Deploy provides a delivery pipeline with sequential stages and manual approval gates, making it ideal for multi-environment deployments.

Answer

Spinnaker

Answer

Jenkins on GKE

Answer

Cloud Build with manual steps

Question 9

A company is using Cloud Build to build a Go application. The build fails with an error 'no Go files in /workspace'. What is the most likely cause?

Accepted Answer

The build step is running in the wrong directory.. Cloud Build copies the repository contents to /workspace. If the Go source files are in a subdirectory, the build step might be pointing to the wrong directory.

Answer

The repository has no Go files.

Answer

The Go module is not properly initialized.

Answer

Cloud Build is unable to clone the repository.

Question 10

A DevOps engineer notices that the monthly compute cost is higher than expected for a Kubernetes Engine cluster. They want to identify which namespaces or workloads are contributing most to the cost. What should they do?

Accepted Answer

Enable GKE Usage Metering and export to BigQuery.. GKE Usage Metering exports detailed per-cluster resource consumption data (CPU, memory, storage, and network) to BigQuery, enabling cost attribution by namespace, label, or workload. This is the only option that directly provides granular cost breakdowns for Kubernetes resources, allowing the engineer to identify which namespaces or workloads drive compute costs.

Answer

Enable Logging for all containers and analyze logs.

Answer

Use Cloud Monitoring dashboards with Kubernetes metrics.

Answer

Add labels to nodes and use Cost Table reports.