PCDOE Practice Test 13 — 15 Questions

Question 1

A platform team maintains a containerized service built by Cloud Build. They need to guarantee that every image deployed to GKE is exactly the image that passed their build, with no possibility of a rebuild producing a different artifact. Their builds run in a Cloud Build trigger with a Docker build step. Which configuration should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Push the image and capture its digest (image@sha256:...) as a build substitution, then reference that digest in the deployment manifest.. Referencing the image by its sha256 digest binds the deployment to the exact manifest content produced by the build, because digests are content-addressed and cannot be altered without changing the hash. Capturing the digest as a substitution and using it in the manifest closes the gap between what was built and what runs, which is stronger than tags, allowlists, or version pinning alone.

Answer

Configure the Cloud Build trigger to run with a pinned builder image version and set the Dockerfile FROM base to a fixed version tag.

Answer

Enable Binary Authorization in enforcement mode on the GKE cluster and allow only images from the Artifact Registry repository.

Answer

Tag the image with the Cloud Build $BUILD_ID and configure the deployment to pull that unique tag from Artifact Registry.

Question 2

A gaming company runs a Node.js service on Cloud Run. Their CI/CD pipeline in Cloud Build builds a container image and pushes it to Artifact Registry, but they want to ensure that only images built from the main branch are deployed to production. They also want to automatically roll back if the new revision causes an increase in error rate. What should they do?

Accepted Answer

Set up a Cloud Build trigger with a branch filter for main, and use Cloud Deploy to manage the deployment to Cloud Run with a canary strategy that includes automated rollback based on Cloud Monitoring metrics.. Cloud Deploy provides native canary deployment and automated rollback for Cloud Run, integrating with Cloud Monitoring to detect error rate increases. A Cloud Build trigger with a branch filter ensures only main branch commits trigger the pipeline. Together, they meet the requirements for branch restriction and automated rollback without custom scripting.

Answer

Use Cloud Build to build and push the image, then manually deploy to Cloud Run using the gcloud CLI. Set up a Pub/Sub notification on the Cloud Build topic to trigger a rollback if errors occur.

Answer

Configure Cloud Build to deploy to Cloud Run with the --no-traffic flag, then use Cloud Monitoring alerting to trigger a Cloud Function that rolls back via gcloud run services update-traffic.

Answer

Create a Cloud Build trigger that only fires on the main branch, and configure the Cloud Run service to use gradual traffic migration with health checks. Enable Cloud Monitoring uptime checks to automatically revert traffic.

Question 3

Your company runs a latency-sensitive web application on Compute Engine behind a global external Application Load Balancer. Costs are rising because the backend fleet is consistently underutilized during off-peak hours but must handle sharp traffic spikes. You need to reduce cost while maintaining responsiveness during spikes. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the managed instance group to use autoscaling based on load balancing capacity and set a minimum size that covers baseline traffic.. Load-balancing-capacity autoscaling with a baseline minimum lets the fleet follow traffic, shrinking during off-peak periods and expanding for spikes, while Cloud CDN reduces backend requests by serving cacheable content at the edge. Together they lower cost without sacrificing responsiveness, because capacity is matched to demand and less work reaches the origin.

Answer

Switch the backend instances to Spot VMs to reduce the hourly compute rate.

Answer

Replace the global external Application Load Balancer with a regional external passthrough Network Load Balancer.

Answer

Purchase a one-year committed use discount covering the maximum fleet size observed during spikes.

Question 4

A DevOps engineer manages a Cloud Build pipeline that runs unit tests, builds an image, and deploys to GKE. Builds occasionally succeed even though a subset of integration tests failed, and the engineer discovers the test step exits zero because the test runner writes failures to stderr but exits 0. The engineer wants Cloud Build to fail the build whenever any test fails, without modifying the test runner. Which approach should they take?

Accepted Answer

Add a step that parses the test runner's stderr output with grep for 'FAIL' and exits non-zero if any match is found.. Cloud Build evaluates each step by its container exit code, so a runner that reports failures on stderr but exits zero will always look successful. Adding a step that scans the runner's output and returns a non-zero exit code on detected failures forces the build to fail correctly, without altering the runner and while preserving the pipeline structure.

Answer

Set the test step's allowFailure field to false in the build config so Cloud Build treats any stderr output as a failure.

Answer

Move the test step to a Cloud Build trigger with a build filter that matches failure strings in the build log.

Answer

Wrap the test command in a shell that uses set -e so the script exits immediately when the runner reports a failure.

Question 5

A team is designing a Cloud Build pipeline that must deploy the same built artifact to dev, staging, and prod GKE clusters, where prod requires a human to approve before rollout. They want to minimize duplicated build work and keep environment promotion traceable. Which two practices should they implement? (Choose two.)

Accepted Answer

Build the container image once in a trigger, push it to Artifact Registry, and promote the same image digest through each environment.. Promoting a single immutable image digest across environments removes rebuild-induced drift and makes the promotion trail verifiable, while an explicit approval gate before the prod target enforces the human checkpoint without slowing dev and staging. Together they satisfy both the artifact-consistency and approval requirements with minimal duplicated build work.

Answer

Store environment-specific configuration in the container image and rebuild it for each environment to bake in the correct values.

Answer

Run all three environment deployments in a single Cloud Build step to guarantee they execute sequentially.

Answer

Use separate Cloud Build triggers per environment that each rebuild the image from source before deploying.

Question 6

A DevOps team uses Cloud Build to build and test a Java application. They want to speed up builds by caching Maven dependencies between builds. They also want to ensure that the cache is not shared across different branches to avoid conflicts. Which approach should they use?

Accepted Answer

Use a Cloud Storage bucket with a path that includes the branch name, and use the gsutil command to copy the Maven local repository to and from the bucket before and after the build.. To cache Maven dependencies across builds while isolating per branch, you can store the cache in a Cloud Storage bucket with a branch-specific prefix. Before the build, download the cache to the local Maven repository; after the build, upload any changes. This reduces build time by reusing dependencies and prevents cross-branch interference.

Answer

Use a Cloud Storage bucket as a cache and configure the Maven settings to use it as a local repository.

Answer

Use Cloud Build's built-in caching by specifying a volume and mount it to the Maven local repository directory.

Answer

Use a Cloud Storage bucket with a path that includes the branch name, and configure Maven to use it as a remote repository.

Question 7

A DevOps engineer has deployed a new version of a microservice to GKE. They want to be notified in Slack when the service's error rate exceeds 5% for 10 minutes. They have already set up a Slack notification channel in Cloud Monitoring. What should they do next?

Accepted Answer

Create an alerting policy with a condition on the error rate metric, set the threshold to 5%, and configure the notification channel to the Slack channel.. Cloud Monitoring alerting policies allow you to define conditions on metrics with thresholds and durations. By creating a policy on the error rate metric with a 5% threshold and 10-minute duration, and attaching the existing Slack notification channel, the engineer satisfies the requirement. This is the standard, native way to alert on service-level metrics.

Answer

Use Cloud Scheduler to periodically query the error rate and publish a message to a Pub/Sub topic that forwards to Slack.

Answer

Configure an uptime check that fails when the error rate exceeds 5%, and set the Slack channel as the notification target.

Answer

Create a log-based alert that triggers when error logs appear, and send the alert to the Slack channel.

Question 8

A team wants Cloud Build to automatically run a pipeline whenever a developer pushes a commit to a specific branch of a repository hosted in Cloud Source Repositories. They want the build to start without any manual action. Which Cloud Build feature should they configure?

Accepted Answer

A Cloud Build trigger bound to the repository with a branch filter for the target branch.. Cloud Build triggers are the built-in integration that listens for source repository events and starts builds based on branch or tag filters. Binding a trigger to the Cloud Source Repositories repo with the appropriate branch filter yields automatic, immediate builds on push without custom glue code or polling.

Answer

A Pub/Sub topic subscribed to Cloud Source Repositories notifications that calls the Cloud Build API on each message.

Answer

A Cloud Build worker pool configured with a webhook secret so external systems can invoke builds.

Answer

A scheduled Cloud Build trigger that polls the repository every few minutes for new commits.

Question 9

You are deploying a new microservice on Google Kubernetes Engine (GKE). You want to ensure that the service's logs are collected and visible in Cloud Logging without any additional configuration. Which of the following is true?

Accepted Answer

Logs written to stdout/stderr by containers are automatically collected and sent to Cloud Logging.. GKE clusters have logging enabled by default, and the integrated agent collects container logs from stdout and stderr without user intervention. No additional agents, sinks, or sidecars are needed for basic log ingestion into Cloud Logging.

Answer

You must install the Cloud Logging agent as a DaemonSet on each node.

Answer

You need to deploy a sidecar container that runs the logging agent in each pod.

Answer

You must enable the Cloud Logging API and create a log sink to collect the logs.

Question 10

A company uses Cloud Deploy to roll out a service to a GKE cluster. After a canary rollout completes and the new revision is verified, they need to automatically roll back to the previous revision if the service's error rate exceeds a threshold within the first ten minutes, without human intervention. Which approach should they implement?

Accepted Answer

Configure an analysis job in the Cloud Deploy rollout that queries Cloud Monitoring for the error rate and fails the rollout when the threshold is breached.. Analysis jobs are the native Cloud Deploy construct for evaluating metrics during a rollout and failing it when thresholds are breached, which triggers an automatic rollback to the previous good release. This delivers the unattended, metric-driven protection the scenario demands without custom automation or unconditional reverts.

Answer

Set the rollout strategy to canary with a short verification window and rely on the deployment to revert automatically when pods crash.

Answer

Add a post-deploy hook that sleeps ten minutes and then runs kubectl rollout undo on the GKE deployment.

Answer

Create a Cloud Monitoring alerting policy that sends a notification to a Pub/Sub topic consumed by a Cloud Function that runs gcloud deploy rollouts rollback.

Question 11

A media company streams logs from its on-premises data center to Cloud Logging. The logs are retained for 30 days in the default _Default bucket, and the team is paying for storage and for log-based metrics that count every ingested line. Only 5% of the log lines are ever queried, but all of them are sent to Logging. The team wants to reduce Logging cost while keeping the ability to investigate incidents for 30 days. What should they do?

Accepted Answer

Create exclusion filters on the _Default bucket to drop low-value log lines, and route the remaining high-value logs to a user-defined bucket with a 30-day retention period.. Exclusion filters in Cloud Logging prevent unwanted entries from being ingested at all, which is the most effective way to cut both ingestion and storage charges. Sending the retained high-value logs to a user-defined bucket with 30-day retention preserves the incident investigation window. Reducing retention or disabling metrics either breaks the requirement or produces only marginal savings compared to dropping the unqueried 95%.

Answer

Change the log router sink to send all logs to a Cloud Storage bucket and query them with BigQuery instead of Logging.

Answer

Reduce the _Default bucket retention period to 7 days and rely on the log-based metrics for incident investigation.

Answer

Disable the log-based metrics and continue ingesting all log lines into the _Default bucket for 30 days.

Question 12

A company runs a development environment on Google Cloud that consists of several Compute Engine instances. Developers use these instances only during business hours (9 AM to 5 PM, Monday to Friday) and they are idle otherwise. The company wants to reduce costs for this environment. What is the most cost-effective solution?

Accepted Answer

Create a schedule using Cloud Scheduler to stop instances at 5 PM and start them at 9 AM on weekdays.. The instances are only needed during business hours. Automating start and stop with Cloud Scheduler eliminates charges during idle nights and weekends. Preemptible VMs risk interruption, CUDs are for 24/7 workloads, and consolidation does not address idle time. The scheduled approach is simple and effective.

Answer

Purchase a committed use discount (CUD) for the instances for a 1-year term.

Answer

Convert the instances to preemptible VMs to reduce hourly cost.

Answer

Move the development environment to a single larger instance to consolidate workloads.

Question 13

A team wants to implement a CI/CD pipeline for a new application on Google Cloud. They need to automatically build and test code changes pushed to a GitHub repository, and then deploy to a staging environment. They want minimal configuration and integration with Google Cloud services. Which Google Cloud service should they use to set up the pipeline?

Accepted Answer

Cloud Build triggers. Cloud Build triggers are designed to automatically start builds in response to events like pushing to a GitHub repository. You can define a build config that includes steps for building, testing, and deploying. This provides a fully managed CI/CD pipeline with minimal configuration and deep integration with Google Cloud services.

Answer

Cloud Scheduler with Cloud Functions

Answer

Artifact Registry with Pub/Sub notifications

Answer

Cloud Deploy

Question 14

You are designing alerting policies for a microservice architecture. Which TWO metrics are most suitable for triggering a page to the on-call engineer?

Accepted Answer

Latency P99 exceeding the SLO target for 5 minutes.. Option A is correct because a sustained P99 latency breach of the SLO target for 5 minutes directly indicates user-facing degradation of the service, which is exactly the kind of symptom-based condition that warrants paging an on-call engineer. Option B is correct because a 10x error budget burn rate over 1 hour is a multi-window, multi-burn-rate SLO alerting signal that predicts imminent SLO exhaustion and is designed to page when reliability is being consumed at an unsustainable pace. Option C is not suitable because requests per second is a throughput indicator that varies naturally with traffic and does not by itself indicate user-impacting failure. Option D is not suitable because 50% CPU utilization is a normal operating level and is a cause-based resource metric rather than a symptom of user-visible problems. Option E is not suitable because a memory usage trend is a slow-moving capacity signal, not an acute condition that justifies waking an on-call engineer.

Answer

Number of requests per second.

Answer

CPU utilization at 50%.

Answer

Memory usage trend.

Question 15

A DevOps team is using Cloud Build to implement a CI/CD pipeline for a microservices application. They want to optimize build times and ensure reliable deployments. Which TWO practices should they implement? (Choose two.)

Accepted Answer

Use Kaniko cache to speed up Docker image builds.. Storing artifacts in Artifact Registry with vulnerability scanning ensures that only secure images are deployed, enhancing reliability. Using Kaniko cache speeds up Docker image builds by reusing layers, reducing build times. Together, these practices optimize the CI/CD pipeline for microservices.

Answer

Use Cloud Build private pools to ensure builds run in a dedicated network.

Answer

Use a single Cloud Build trigger for all microservices to reduce configuration overhead.

Answer

Run all tests in a single build step to minimize the number of steps.