PCDOE Practice Test 11 — 15 Questions

Question 1

A team uses Cloud Build to deploy a Cloud Run service. The build fails with: 'ERROR: (gcloud.run.services.update) PERMISSION_DENIED: Permission 'run.services.update' denied on resource.' The Cloud Build service account has the Cloud Run Admin role. What is missing?

Accepted Answer

The Cloud Build service account needs the 'run.services.update' permission or the Cloud Run Admin role.. Option D is correct because the error message explicitly states that the 'run.services.update' permission is denied, which means the Cloud Build service account lacks this specific permission. Although the Cloud Run Admin role includes 'run.services.update', the error indicates the role is not properly assigned or the service account is not using it. Reassigning the Cloud Run Admin role or directly granting the 'run.services.update' permission resolves the issue.

Answer

The build config must use the Cloud Run deployer step instead of the gcloud command.

Answer

The Cloud Build service account should have the Owner role on the project.

Answer

The Cloud Run service must be deployed in the same region as the build.

Question 2

A company is implementing CI/CD for a microservices application on Google Kubernetes Engine (GKE). The team wants to ensure that each service can be built and deployed independently without affecting other services. They also need to enforce that only successfully tested builds are deployed to production. Which CI/CD approach should they use?

Accepted Answer

Create separate Cloud Build triggers per microservice, each building a container image, and use Cloud Deploy to manage canary deployments to GKE with automated promotion after tests pass.. Option A is correct because it uses separate Cloud Build triggers per microservice to enable independent builds, and Cloud Deploy with canary deployments and automated promotion after tests pass ensures that only successfully tested builds reach production. This approach aligns with the requirements of independent service deployment and gated promotion to production on GKE.

Answer

Use Cloud Build to build all services and deploy to Cloud Run, then use traffic splitting to promote new versions.

Answer

Create a single Cloud Build trigger that builds all services and deploys to a staging cluster, then manually promote to production.

Answer

Use Spinnaker with a single pipeline that builds all services, and configure manual judgment gates for production promotion.

Question 3

A team is monitoring a production service on Google Kubernetes Engine (GKE) and notices that a deployment is occasionally returning HTTP 503 errors. The team has set up a ServiceMonitor in Prometheus to scrape metrics from the pods. What is the most likely cause of the intermittent 503 errors?

Accepted Answer

The readiness probes are failing, causing the pods to be removed from the service endpoints.. Intermittent HTTP 503 errors in a GKE deployment typically indicate that the service's endpoints are temporarily unavailable. When a readiness probe fails, Kubernetes removes the pod from the Service's endpoints, causing traffic to be routed to remaining healthy pods. If multiple pods fail their readiness probes simultaneously or in quick succession, the Service may have no available endpoints, resulting in 503 errors for incoming requests.

Answer

The pods are crashing and restarting frequently.

Answer

The Prometheus scrape interval is too long, causing missed metrics.

Answer

The container resource limits are set too low, causing out-of-memory errors.

Question 4

An organization wants to implement a CI/CD pipeline that automatically deploys to a staging environment on every push to the main branch, and deploys to production only after a manual approval. They use Cloud Build and Cloud Deploy. What is the best way to configure this?

Accepted Answer

Configure a Cloud Deploy delivery pipeline with a staging target (automatic promotion) and a production target (require approval).. Option A is correct because Cloud Deploy natively supports delivery pipelines with multiple targets, where you can configure automatic promotion to staging and require manual approval for production. This aligns with the requirement for a CI/CD pipeline that deploys to staging on every push to main and to production only after manual approval, using Cloud Build for the build and Cloud Deploy for the deployment orchestration.

Answer

Create a single Cloud Build pipeline that deploys to both staging and production using conditional steps based on branch name.

Answer

Use Cloud Build to deploy to Cloud Run, and configure traffic splitting to gradually shift traffic from staging to production.

Answer

Use Cloud Build triggers with two separate build configs: one for staging (automatic), one for production (manual trigger).

Question 5

Which TWO practices are recommended for implementing CI/CD pipelines on Google Cloud?

Accepted Answer

Use a Dockerfile to define the build process for containerized applications.. Option D is correct because using a Dockerfile to define the build process for containerized applications is a recommended practice in CI/CD pipelines on Google Cloud. It ensures that the application is built consistently across all environments, leveraging Cloud Build's native support for Dockerfiles to produce container images that can be stored in Container Registry or Artifact Registry.

Answer

Store service account keys in the build configuration file for authentication.

Answer

Deploy to production directly after a successful build without any approval gate.

Answer

Create a single build pipeline that handles all microservices to reduce complexity.

Question 6

A cloud operations team is implementing monitoring for a microservices application deployed on Compute Engine. They want to create a custom dashboard in Cloud Monitoring that shows the 99th percentile latency of a specific service over the last hour. Which combination of Cloud Monitoring features should they use?

Accepted Answer

Use a distribution metric with the 99th percentile alignment function in a Metrics Explorer chart.. Option B is correct because Cloud Monitoring's distribution metrics inherently store a histogram of values, allowing percentile calculations like the 99th percentile. By selecting the 99th percentile alignment function in a Metrics Explorer chart, the dashboard directly computes and displays the desired latency threshold from the distribution data over the specified time window.

Answer

Use a gauge metric with the max alignment function in a Metrics Explorer chart.

Answer

Use an uptime check metric and configure the latency percentile in the chart.

Answer

Create a logs-based metric from application logs and use the count alignment.

Question 7

A company uses Cloud Monitoring to track latency for a multi-region web application. The SLO is 99.9% of requests under 500ms over a 30-day rolling window. The error budget has been rapidly depleting over the last week. The operations team wants to understand the impact of recent deployments. Which approach should they use to correlate deployment changes with latency spikes?

Accepted Answer

Create a custom dashboard in Cloud Monitoring that includes latency charts and use annotation markers to indicate deployment times. Option C is correct because Cloud Monitoring supports custom dashboards with annotation markers that can be programmatically or manually added to indicate deployment events. By overlaying these markers on latency charts, the operations team can visually correlate deployment times with latency spikes, enabling direct root-cause analysis without manual log searching or separate tools.

Answer

Use Cloud Logging to search for deployment logs and manually compare with latency metrics

Answer

Use Cloud Trace to analyze latency distributions for each deployment version

Answer

Configure Error Reporting to alert on latency threshold breaches

Question 8

Which TWO metrics should be included in a comprehensive monitoring strategy for a production Kubernetes workload to detect performance degradation and capacity issues?

Accepted Answer

Container CPU utilization. Container CPU utilization (Option B) is a direct indicator of resource pressure and potential performance degradation in a Kubernetes workload. High CPU utilization can lead to throttling, increased request latency, and pod evictions, making it essential for detecting capacity issues. Request latency percentiles (Option E) are the gold standard for measuring user-facing performance degradation, as they reflect the actual experience of end users and can reveal subtle slowdowns before resource metrics show saturation.

Answer

Disk read IOPS per pod

Answer

Number of nodes in the cluster

Answer

Network bytes received per second

Question 9

A company uses Cloud Run for a stateless API service with concurrency set to 80. During a traffic spike, some requests return HTTP 500 errors and latency spikes. Cloud Monitoring shows container CPU utilization at 100% and memory usage at 70%. What is the most likely cause and the best first step?

Accepted Answer

Concurrency per container is too high; reduce concurrency to 10. The correct answer is A because with CPU at 100% and memory at only 70%, the bottleneck is CPU, not memory. Cloud Run containers handle requests concurrently; setting concurrency to 80 means each container processes up to 80 requests simultaneously. When CPU is saturated, requests queue up, causing latency spikes and eventual HTTP 500 errors as the container becomes unresponsive. Reducing concurrency to 10 lowers the per-container request load, allowing each request to complete before CPU saturation occurs.

Answer

Maximum instances limit is too low; increase from 10 to 100

Answer

Min idle instances is too low; set min idle to 5 to reduce cold starts

Answer

Memory limit is too low; increase memory from 256 MiB to 512 MiB

Question 10

An incident is declared for a production service running on GKE. The on-call engineer suspects a recent code change may have introduced a memory leak. Which THREE actions should the engineer take to investigate and mitigate?

Accepted Answer

Increase the memory limit for the container as a temporary mitigation. Option A is correct because increasing the memory limit for the container provides a temporary mitigation to prevent the service from being killed by the Out of Memory (OOM) killer while the root cause is investigated. In GKE, the container's memory limit is defined in the pod spec under `resources.limits.memory`, and raising it gives the application more headroom to continue serving requests without immediate termination. This is a standard incident response practice to buy time for deeper analysis, such as reviewing logs and metrics, before applying a permanent fix.

Answer

Scale down the number of replicas to reduce memory pressure

Answer

Roll back the deployment immediately without further investigation

Question 11

A DevOps team wants to automate the deployment of a microservice application to Google Kubernetes Engine (GKE) using Cloud Build. They have a Cloud Build configuration file that builds a container image and deploys it to GKE. However, the deployment step fails with an authorization error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Kubernetes Engine Developer IAM role.. Cloud Build uses a default service account (the Cloud Build service account) to execute build steps, including deploying to GKE. The Kubernetes Engine Developer IAM role (roles/container.developer) grants the necessary permissions to deploy and manage workloads on GKE clusters. Without this role, the Cloud Build service account cannot authenticate to the GKE cluster's Kubernetes API, resulting in an authorization error during the deployment step.

Answer

The user triggering the build does not have IAM permissions to deploy to GKE.

Answer

Cloud Build does not have permission to access the source code repository.

Answer

The Docker image build step failed due to missing dependencies.

Question 12

Which TWO are benefits of using Cloud Build triggers to implement CI/CD pipelines?

Accepted Answer

Start a build automatically when changes are pushed to a repository. Option A is correct because Cloud Build triggers can be configured to automatically start a build in response to events such as a push to a repository branch or the creation of a pull request. This event-driven automation is the foundation of a CI/CD pipeline, eliminating the need for manual build initiation and ensuring that every code change is validated immediately.

Answer

Deploy to a specific Google Cloud region based on the trigger

Answer

Support only a single branch per trigger

Answer

Automatically provision infrastructure as part of the build

Question 13

Refer to the exhibit. You are investigating a performance issue where the api-server container is using excessive CPU. You run a Cloud Monitoring API query and receive the JSON configuration shown. However, the query returns no data points. What is the most likely cause?

Accepted Answer

The filter is missing required resource labels such as project_id, location, cluster_name, and namespace_name, causing no time series to match.. Option C is correct because the Cloud Monitoring API query for the 'kubernetes.io/container/cpu/core_usage_time' metric type requires mandatory resource labels—specifically 'project_id', 'location', 'cluster_name', and 'namespace_name'—to uniquely identify the time series for a GKE container. Without these labels in the filter, the query cannot match any time series, resulting in no data points returned, even if the metric is actively emitting data.

Answer

The time interval specified is too short and falls outside the data retention period.

Answer

The metric type 'kubernetes.io/container/cpu/core_usage_time' is deprecated and no longer available.

Answer

The aggregation perSeriesAligner 'ALIGN_MEAN' is incompatible with the metric type, which requires 'ALIGN_RATE'.

Question 14

Your team is using Cloud Monitoring to track the health of a distributed microservices application. You notice that the error rate for the checkout service has increased significantly, but no alerts are firing. The SLO for checkout is 99.9% availability over a 28-day rolling window. You inspect the alerting policy and find it uses a time series aggregation with a 1-minute alignment period and a condition that triggers when the ratio of errors to total requests exceeds 0.001 for 5 consecutive minutes. What is the most likely reason the alert is not firing?

Accepted Answer

The alert condition requires 5 consecutive minutes of breach, but the error rate spikes are intermittent and not sustained.. The alert condition requires the error ratio to exceed 0.001 for 5 consecutive 1-minute alignment periods. If the error rate spikes are intermittent—lasting only a minute or two before returning to normal—the condition of 5 consecutive minutes of breach is never met, so the alert remains silent. This is a classic case where the alerting policy's duration setting is too long relative to the bursty nature of the errors.

Answer

The error budget has been exhausted, so the alert is suppressed.

Answer

The SLO window is too long, and the alert condition uses a different measurement period.

Answer

The ratio threshold is too high because the total request count is low.

Question 15

You created the above alert policy to detect high CPU utilization in your GKE cluster. However, you are receiving too many false positive alerts. What is the most likely reason?

Accepted Answer

The crossSeriesReducer is set to REDUCE_SUM, which sums CPU across containers, so a namespace with many containers can trigger the alert even if each container uses less than 80%.. Option B is correct because the crossSeriesReducer set to REDUCE_SUM aggregates CPU utilization across all containers in a namespace. This means that even if each container uses only 20% CPU, a namespace with five containers would show a total of 100%, triggering the alert when the threshold is 0.8 (80%). This causes false positives because the alert fires on the sum, not on individual container utilization.

Answer

The threshold value of 0.8 is too low; it should be 0.9 for production.

Answer

The duration of 300 seconds (5 minutes) is too short; it should be longer to avoid transient spikes.

Answer

The filter does not specify a specific namespace, causing alerts from all namespaces.