PCDOE Practice Test 10 — 10 Questions

Question 1

Match each monitoring concept to its purpose.

Accepted Answer

Latency: Time taken to serve a request. The four golden signals are Latency, Traffic, Errors, and Saturation. Correct matches are A, B, C, D. Common confusions swap Error and Traffic definitions.

Answer

Latency: Rate of failed requests

Answer

Errors: Demand placed on the system

Question 2

Which THREE are recommended practices for setting up alerting on Google Cloud?

Accepted Answer

Set alert thresholds with a buffer (e.g., below SLO). Setting alert thresholds with a buffer below the SLO (e.g., alert at 99.9% when SLO is 99.99%) provides early warning before the SLO is breached. This proactive approach allows time for investigation and remediation, preventing actual SLO violations and ensuring service reliability targets are met.

Answer

Use multiple conditions with OR combiner to cover all scenarios

Answer

Use a single alerting policy for all services

Question 3

During a post-incident review, the team discovers that a misconfiguration in Cloud Armor caused legitimate traffic to be blocked, leading to a outage. The misconfiguration was introduced by a junior engineer who had overly permissive IAM roles. What is the best way to prevent similar incidents in the future?

Accepted Answer

Use Organization Policy constraints to restrict allowed IP ranges and rules in Cloud Armor security policies.. Enforcing guardrails with Organization Policies can prevent misconfigurations at scale. Option A is wrong because removing the engineer's access is punitive but doesn't prevent others. Option B is wrong because peer reviews reduce human error but are not automated. Option C is wrong because Cloud Armor logs help detection but not prevention.

Answer

Enforce a mandatory peer review for all Cloud Armor configuration changes.

Answer

Revoke the junior engineer's access to Cloud Armor and grant read-only access.

Answer

Enable Cloud Armor security policy logs and create alerting for blocked traffic spikes.

Question 4

A large enterprise manages costs across multiple GCP projects using a shared billing account. They want to apply a 10% discount on all committed use discounts (CUDs) to specific departments based on resource labels. How should they allocate the CUD savings?

Accepted Answer

Enable 'CUD cost attribution' in the billing account settings to automatically distribute savings based on project labels. The 'CUD cost attribution' feature in the billing account settings automatically distributes committed use discount (CUD) savings based on project labels, allowing departments to receive their share of the discount without manual effort. Option A is incorrect because 'Cost Attribution' is a feature for custom cost allocation using tags, not for CUD savings. Option C is possible using BigQuery, but it is not a built-in automated feature like CUD cost attribution. Option D is incorrect because manual calculation and journal entries are error-prone and not recommended for automated discount allocation.

Answer

Use the Cloud Billing report's 'Cost Attribution' feature to assign CUD savings based on labels

Answer

Use the Cloud Billing cost table in BigQuery with the CUD cost data and allocate using custom queries

Answer

Manually calculate CUD savings and distribute via journal entries

Question 5

A large enterprise is migrating to Google Cloud and wants to bootstrap their organization for DevOps. They have multiple business units, each needing their own folder with projects. Security requires that all projects in the 'prod' folder must have a specific set of organization policies enforced, such as restricting service account key creation. They also want to allow individual teams to create project-level policies as long as they don't conflict with the organization policies. Which approach ensures this while minimizing administrative overhead?

Accepted Answer

Set the required organization policies on the 'prod' folder and allow teams to set additional policies at the project level as long as they don't conflict.. Google Cloud Organization Policies can be set at the folder level, allowing the 'prod' folder to inherit constraints like `iam.disableServiceAccountKeyCreation` across all its projects. Teams can then add additional project-level policies that are more restrictive, as long as they do not conflict with the inherited folder-level policies, which is enforced by the policy hierarchy. This minimizes administrative overhead by centralizing mandatory controls at the folder level while delegating flexibility to teams.

Answer

Set organization policies at the organization level and use IAM conditions to apply them only to the prod folder.

Answer

Create custom roles containing the required constraints and assign them to the team's IAM members.

Answer

Place all production workloads in a single project and use VPC Service Controls for security.

Question 6

A company wants to reduce costs associated with Cloud Monitoring. They have many custom metrics and high ingestion rates. Which cost optimization strategy is most effective?

Accepted Answer

Delete all unused custom metrics and reduce labels.. Deleting unused custom metrics and reducing labels directly reduces the volume of data ingested and stored, which is the primary cost driver in Cloud Monitoring (formerly Stackdriver). Custom metrics incur charges per data point ingested, and each unique label combination creates additional time series, multiplying costs. This strategy eliminates waste without sacrificing necessary monitoring fidelity.

Answer

Use log-based metrics instead of custom metrics.

Answer

Aggregate metrics into buckets and export to BigQuery for analysis.

Answer

Reduce the sampling rate of all custom metrics to 1 minute.

Question 7

During a canary deployment of a new version of a microservice, the engineer notices increased error rates in the canary instances. What is the best immediate action?

Accepted Answer

Perform a rollback of the canary to the previous version.. When error rates increase in a canary, the safest immediate action is to roll back the canary to prevent further impact on users. Pausing and investigating is reasonable but allows continued errors. Scaling up the canary would worsen the issue. Continuing the rollout would be irresponsible.

Answer

Continue the rollout to see if errors stabilize.

Answer

Scale up the canary instances to handle load.

Answer

Pause the rollout and investigate the errors.

Question 8

A DevOps team is bootstrapping a Google Cloud organization. They have created a folder for a business unit and want to prevent users from moving projects out of that folder to other folders. Which organization policy constraint should they apply?

Accepted Answer

constraints/resourcemanager.disableProjectMove. The `constraints/resourcemanager.disableProjectMove` organization policy constraint explicitly prevents users from moving projects out of a specified folder or organization. When applied at the folder level, this constraint blocks any move operation that would relocate a project to a different parent, ensuring projects remain within the designated business unit folder. Options A, B, and C are invalid: `allowedResourceRestrictions` is not a real constraint, `allowedPolicyMemberDomains` restricts member domains, and `allowedProjectParent` does not exist.

Answer

constraints/resourcemanager.allowedResourceRestrictions

Answer

constraints/resourcemanager.allowedPolicyMemberDomains

Answer

constraints/resourcemanager.allowedProjectParent

Question 9

Which TWO of the following are required steps to set up a shared VPC for DevOps teams?

Accepted Answer

Attach the service projects to the host project.. Attaching service projects to the host project is a mandatory step in Shared VPC setup. After designating the host project and enabling Shared VPC, you must attach each service project to the host project so that the service projects can consume subnets from the host project's VPC. Without this attachment, the service projects cannot use the shared networking resources.

Answer

Create a new VPC in the service project and peer it with the host project.

Answer

Configure Cloud Interconnect between the host and service projects.

Answer

Grant the Shared VPC Admin role (roles/compute.xpnAdmin) to the service project team.

Question 10

An organization has a policy that all projects must have Cloud Logging enabled and logs must be retained for at least 365 days. What is the most efficient way to enforce this across all projects?

Accepted Answer

Configure a sink at the organization level to aggregate logs and set retention.. Configuring a sink at the organization level allows you to aggregate logs from all projects into a single destination (e.g., a Cloud Storage bucket or BigQuery dataset) and set a retention policy of 365 days on that destination. This is the most efficient method as it enforces the logging and retention requirements centrally without needing to configure each project individually.

Answer

Create a custom role with logging permissions and assign to all projects.

Answer

Use an organization policy to enforce logging requirements.

Answer

Use Cloud Asset Inventory to monitor logging configurations.