PCDOE Practice Test 14 — 15 Questions

Question 1

A team has configured an uptime check with a 5xx threshold alert. During an incident, the alert fires with severity 'critical'. The team mitigates the issue, but the alert keeps firing for 15 more minutes due to a slow-responding downstream dependency. What should the team do to avoid false alarms in future incidents?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the 'duration' field in the alerting policy to require the condition to be true for a longer time before alerting.. Increasing the 'duration' field in the alerting policy ensures that the condition (e.g., 5xx errors) must persist for a longer, defined period before the alert fires. This prevents false alarms from transient issues like a slow-responding downstream dependency that temporarily triggers the threshold but resolves before the alert duration expires. In Google Cloud Monitoring, the duration parameter specifies the minimum time the condition must be true, filtering out short-lived spikes.

Answer

Add a second notification channel to send alerts to a different team.

Answer

Modify the alert condition to check only for 5xx errors and ignore other status codes.

Answer

Decrease the check frequency to every 30 seconds to get faster feedback.

Question 2

Which THREE actions should be taken to ensure compliance with the principle of least privilege when bootstrapping a Google Cloud organization? (Choose 3)

Accepted Answer

Use service accounts for automated processes and grant them the minimum required roles.. Service accounts are the recommended identity for automated processes in Google Cloud, and granting them only the minimum required roles directly implements the principle of least privilege. This prevents over-permissioning and reduces the attack surface for automated workflows.

Answer

Assign the Owner role at the organization level to a small group of administrators.

Answer

Use primitive roles (Owner, Editor, Viewer) to simplify management.

Question 3

Refer to the exhibit. A Cloud Build pipeline using this configuration fails on the third step with a permission error. The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely missing permission?

Accepted Answer

iam.serviceAccounts.actAs on the Cloud Run runtime service account. The Cloud Build pipeline fails on the third step with a permission error because the Cloud Build service account, despite having the 'Cloud Run Admin' role, lacks the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account. This permission is required for Cloud Build to impersonate the runtime service account when deploying to Cloud Run, as the deployment step needs to act on behalf of that service account to create or update the service.

Answer

run.routes.invoke

Answer

storage.objects.list on the artifact bucket

Answer

resourcemanager.projects.get

Question 4

A company uses Cloud Deploy to manage rollouts to GKE. They need to implement a deployment strategy where a new version receives 10% of traffic for 30 minutes, then automatically rolls forward to 100% if no issues are detected. Which THREE Cloud Deploy features are required? (Choose three.)

Accepted Answer

A canary deployment strategy with a 10% phase.. A canary deployment strategy in Cloud Deploy allows you to define phases that gradually shift traffic to a new revision. A 10% phase is the first step in this strategy, ensuring only a small subset of users experience the new version initially, which aligns with the requirement to start with 10% traffic.

Answer

A manual approval gate before the 100% phase.

Answer

An Istio VirtualService configuration for traffic splitting.

Question 5

A service is deployed on Cloud Run. You need to monitor memory usage per revision. How can you create an alert?

Accepted Answer

Configure Cloud Run to send metrics to Cloud Monitoring and create an alert in Cloud Monitoring. Cloud Run automatically exports built-in metrics, including memory usage per revision, to Cloud Monitoring without any additional configuration. By creating an alerting policy in Cloud Monitoring based on the `run.googleapis.com/container/memory/utilizations` metric, you can monitor memory usage per revision directly. Option B correctly identifies this native integration, making it the most efficient and reliable approach.

Answer

Deploy a sidecar container that collects memory metrics and pushes to Cloud Monitoring

Answer

Use Cloud Console and navigate to Cloud Run services to set an alert directly

Answer

Use Cloud Logging to parse container logs for memory usage

Question 6

Your company has recently migrated to Google Cloud and has set up an organization with three folders: Development, Staging, and Production. Each folder contains multiple projects. The DevOps team has established a centralized CI/CD pipeline using Cloud Build and Artifact Registry in a tools project under the Development folder. They want to ensure that only images built by the CI/CD pipeline are allowed to be deployed to the Production environment. They have configured Binary Authorization with a policy that requires attestations from the Cloud Build service account. However, a developer accidentally pushes a container image directly from their local machine to Artifact Registry using their personal IAM permissions, and then deploys that image to a Production project by bypassing the CI/CD pipeline. How can you prevent this from happening in the future?

Accepted Answer

Remove the Artifact Registry Writer role from all developers and only grant it to the Cloud Build service account.. The root cause of the bypass is that developers have the Artifact Registry Writer (roles/artifactregistry.writer) IAM role, which allows them to push images directly. By removing this role from all developers and granting it exclusively to the Cloud Build service account, you enforce that only the CI/CD pipeline can write to the registry. Binary Authorization then requires attestations from that same service account, ensuring that only pipeline-built images can be deployed to Production.

Answer

Enable Cloud Audit Logs for Artifact Registry and set up alerts to detect unauthorized pushes.

Answer

Create a VPC Service Controls perimeter around Artifact Registry to restrict access.

Answer

Configure a Cloud Function to automatically delete images pushed outside of Cloud Build.

Question 7

Which Google Cloud tool automatically captures and visualizes traces for applications running on App Engine?

Accepted Answer

Cloud Trace. Cloud Trace is the correct Google Cloud tool for automatically capturing and visualizing latency traces from applications running on App Engine. It provides end-to-end latency insights by collecting trace data from distributed systems, enabling you to analyze request performance and identify bottlenecks without manual instrumentation.

Answer

Cloud Debugger

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 8

Your team wants to create a dashboard that shows request latency broken down by API version. Which approach is most efficient?

Accepted Answer

Use Cloud Monitoring Metrics Explorer to query the latency metric, group by API version, and save the chart as a dashboard. Cloud Monitoring Metrics Explorer allows you to directly query the latency metric (e.g., `request_latencies`) and group by the `version` label, then save the resulting chart as a dashboard widget. This is the most efficient approach because it requires no data export, no custom code, and no additional services — the metric is already available in Cloud Monitoring if your API is instrumented with the appropriate label.

Answer

Write a custom application to output metrics to a file and send to Cloud Monitoring

Answer

Export Cloud Logging logs to BigQuery and create a dashboard in Data Studio

Answer

Enable Cloud Trace and create a dashboard based on trace data

Question 9

Order the steps to set up a log-based metric in Cloud Logging for error tracking.

Accepted Answer

Filter logs -> Create metric -> Set alert -> Test -> Verify. The correct sequence to set up a log-based metric in Cloud Logging for error tracking is: first, filter logs to isolate relevant entries; second, create a metric based on that filter; third, set an alert to trigger on metric conditions; fourth, test the alert to ensure it works; and finally, verify the setup. This order ensures each step builds logically on the previous one.

Answer

Create metric -> Filter logs -> Set alert -> Test -> Verify

Answer

Filter logs -> Set alert -> Create metric -> Test -> Verify

Answer

Filter logs -> Create metric -> Test -> Set alert -> Verify

Question 10

Which TWO Organization Policy constraints are commonly used to enhance security in a DevOps environment?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint prevents the creation of long-lived service account keys, which are a common security risk in DevOps pipelines. By enforcing this constraint, you force the use of short-lived credentials (e.g., workload identity federation or OAuth 2.0 access tokens) instead of static JSON keys that could be leaked or misused.

Answer

constraints/cloudbuild.enableBuildManager

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/appengine.disableCodeDownload

Question 11

During bootstrapping, a DevOps engineer wants to ensure that all new projects automatically have a set of APIs enabled, such as Cloud Resource Manager API and Cloud Billing API. They also want to enforce that certain APIs cannot be disabled accidentally. What is the most efficient way to achieve this?

Accepted Answer

Use a custom Cloud Function that runs every time a project is created and enables the APIs.. Google Cloud provides event-driven capabilities through Cloud Functions that can be triggered by project creation events (via Cloud Audit Logs or Eventarc). By deploying a Cloud Function that listens for new projects and enables the desired APIs (e.g., Cloud Resource Manager API, Cloud Billing API), the DevOps engineer can automate API enablement without manual intervention. This is the most efficient and reliable approach for automatically enabling APIs on new projects.

Option C is incorrect because organization policies enforce constraints (e.g., 'serviceuser.services') that restrict which APIs can be disabled, but they cannot automatically enable APIs. Organization policies are used to prevent disabling of APIs, not to enable them proactively.

Answer

Grant the roles/serviceusage.serviceUsageAdmin role to the DevOps team and have them manually enable APIs when creating projects.

Answer

Use organization policies to define the constraints 'compute.requireOsLogin' and 'serviceuser.services' to restrict/enable APIs.

Answer

Create a folder with a 'Required APIs' setting that applies to all child projects.

Question 12

A company is bootstrapping their Google Cloud organization with multiple departments. Each department has several projects. They want to apply different IAM policies and organization policies per department. What is the recommended way to structure the resource hierarchy?

Accepted Answer

Create a folder for each department, then place projects under that folder.. Folders in the Google Cloud resource hierarchy allow you to group projects under a common node and apply both IAM policies and organization policies (e.g., constraints from the Organization Policy Service) at the folder level. This enables each department to have its own administrative boundary and policy inheritance, while still being under a single organization for centralized billing and auditing.

Answer

Use multiple organizations, one per department.

Answer

Use organization-level IAM for all departments.

Answer

Create a project for each department, then use labels to separate.

Question 13

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Accepted Answer

secretmanager.versions.access. The custom role assigned to the Cloud Build service account lacks the `secretmanager.versions.access` permission, which is required to access the payload of a secret version in Secret Manager. Without this permission, any attempt to read the secret value during a build step will fail with a permission denied error, even if the service account has other roles on the project.

Answer

cloudbuild.builds.update

Answer

run.services.get

Answer

iam.serviceAccounts.actAs

Question 14

An application running on App Engine is throwing exceptions. The DevOps team wants to be notified when a new type of exception appears. Which Cloud Monitoring feature should they use?

Accepted Answer

Error Reporting. Error Reporting is the correct choice because it is a Cloud Monitoring feature specifically designed to count, analyze, and increase the severity of exceptions in application logs. It automatically groups exceptions by type and can trigger notifications when a new type of exception (one not seen before) appears, which directly meets the DevOps team's requirement.

Answer

Uptime Checks

Answer

Custom alerts

Answer

Logs-based metrics

Question 15

Which TWO metrics from Cloud Monitoring would best indicate that a GKE workload is experiencing CPU throttling due to a resource quota? (Choose 2)

Accepted Answer

container/cpu/throttled_time. `container/cpu/throttled_time` directly measures the cumulative time a container's CPU usage was throttled due to exceeding its assigned CPU quota (CFS quota). Option D is correct because `container/cpu/usage_time` shows the actual CPU time used by the container; when compared against the quota limit, a high usage_time relative to the quota indicates that throttling is likely occurring. Together, these two metrics confirm both the occurrence and the cause of CPU throttling.

Answer

node/cpu/usage_time

Answer

container/memory/usage_bytes

Answer

container/accelerator/duty_cycle