PCDOE Practice Test 15 — 15 Questions

Question 1

Which THREE of the following are valid considerations when using organization policies to enforce compliance in a DevOps environment?

Accepted Answer

Child-level organization policies can only add more restrictions, not remove restrictions set by a parent.. Option A is correct because organization policies are hierarchical and inherited: a policy set at a parent node (organization or folder) is inherited by all descendants, and child-level policies can only further restrict the effective policy, never loosen or remove a parent's restriction. Option B is correct because list constraints (list policies) let you specify allowed or denied values for a resource attribute, effectively implementing an allowlist or blocklist (for example, restricting which services or locations are permitted). Option E is correct because organization policies can be attached at the organization, folder, or project level in the resource hierarchy, with the most specific applicable policy taking effect. Option C is not a valid consideration: organization policies do not require a service agent to be enabled before use; they are enforced by the Organization Policy Service based on constraints and inheritance. Option D is not valid: IAM conditions control access (who can do what under which conditions) and cannot override or exempt resources from an organization policy constraint.

Answer

An organization policy must be enabled by a service agent before it can be used.

Answer

IAM conditions can be used to override an organization policy for specific resources.

Question 2

You need to monitor a multi-step login flow that involves calling an API, validating a token, and redirecting. Which type of uptime check should you use?

Accepted Answer

Synthetic Monitor (Cloud Functions). A synthetic monitor using Cloud Functions is the correct choice because it can simulate a multi-step login flow by executing custom code that calls an API, validates a token, and performs a redirect. Unlike simple HTTP GET or TCP checks, synthetic monitors can handle stateful interactions and conditional logic, making them ideal for complex transaction monitoring.

Answer

Cloud Endpoint check

Answer

TCP check

Answer

HTTP GET check

Question 3

A DevOps engineer is designing a CI/CD pipeline using Cloud Build. Which TWO configurations are necessary to ensure secure and reliable deployments? (Choose two.)

Accepted Answer

Use manual approval steps for production deployments.. Option A is correct because adding manual approval steps for production deployments (e.g., via Cloud Build approval gates or a release pipeline) prevents unreviewed or accidental changes from reaching production, which is a core control for reliable and secure releases. Option B is correct because storing secrets in Cloud Secret Manager and referencing them in Cloud Build (for example, using the availableSecrets field with secretEnv) avoids hardcoding credentials in build configs or source, keeping sensitive data encrypted and access-controlled. Option C is not necessary for security or reliability; branch filters on triggers only control which commits start a build and do not by themselves enforce secure or dependable deployments. Option D is wrong because pushing artifacts to a public Container Registry exposes images and is a security risk, not a best practice. Option E is wrong because granting the Cloud Build service account the broad Editor role violates least privilege; a narrower set of IAM roles should be used instead.

Answer

Use Cloud Build triggers with branch filters.

Answer

Push all artifacts to a public Container Registry.

Answer

Enable Cloud Build service account with Editor role.

Question 4

You are a DevOps engineer at a retail company that runs a microservices application on Google Kubernetes Engine (GKE). You have deployed the OpenTelemetry Collector as a DaemonSet to collect metrics from all pods. You want to ensure that all metrics are enriched with Kubernetes metadata such as pod name and namespace, so you can filter and group by these dimensions in Cloud Monitoring. What should you do?

Accepted Answer

Configure the OpenTelemetry Collector's k8sattributes processor to extract metadata from the Kubernetes API and add it as resource attributes to all metrics.. The OpenTelemetry Collector's k8sattributes processor is specifically designed to automatically add Kubernetes metadata to telemetry data. By configuring it in the Collector's pipeline, all metrics are enriched with pod name, namespace, and other labels without modifying application code, enabling powerful filtering and grouping in Cloud Monitoring.

Answer

Deploy a separate sidecar container in each pod that scrapes the Kubernetes API and adds metadata to the application's logs.

Answer

Modify each application's code to include pod name and namespace as custom labels on all emitted metrics.

Answer

Use the Cloud Monitoring API to programmatically add labels to metrics after they are ingested, based on pod metadata.

Question 5

An application running on GKE experiences high latency during traffic spikes. The team wants to scale pods based on request latency. Which metric should they use in the HorizontalPodAutoscaler?

Accepted Answer

Custom metric: request latency percentile (e.g., p95). To scale based on request latency, the HorizontalPodAutoscaler (HPA) must use a custom metric that directly reflects the application's response time, such as the p95 latency percentile. CPU or memory utilization are system-level metrics that do not capture the user-perceived performance degradation caused by traffic spikes. Custom metrics like request count correlate with load but not directly with latency, making the p95 latency percentile the correct choice for latency-based autoscaling.

Answer

Custom metric: request count

Answer

Memory utilization

Answer

CPU utilization

Question 6

A team is troubleshooting a slow response time on an App Engine standard environment application. The application uses Cloud SQL as its database. Which TWO actions should the team take to identify the bottleneck?

Accepted Answer

Examine App Engine request logs for latency patterns.. Examining App Engine request logs reveals latency patterns, such as which endpoints or operations are slow, helping to pinpoint whether the bottleneck is in the application code, network, or database. Option C is correct because enabling Cloud SQL slow query logging identifies long-running SQL queries that could be causing database contention or inefficient data retrieval, directly addressing a common performance bottleneck in App Engine applications using Cloud SQL.

Answer

Increase the number of App Engine instances.

Answer

Enable Cloud CDN to cache responses.

Answer

Disable caching to ensure fresh data.

Question 7

A latency-sensitive web application uses Cloud CDN. What configuration change would most directly reduce cache miss rates?

Accepted Answer

Enable cache static content and set appropriate cache modes. Enabling cache static content and setting appropriate cache modes directly reduces cache miss rates by ensuring that more requests are served from the Cloud CDN cache rather than forwarded to the origin. This configuration allows the CDN to store and serve static assets (e.g., images, CSS, JavaScript) based on cache keys and TTLs, minimizing the number of cache misses for eligible content.

Answer

Enable Cloud Armor to filter malicious traffic

Answer

Use signed URLs to restrict access

Answer

Set TTL to 0 to ensure content is always fresh

Question 8

A team wants to implement multi-cluster monitoring for GKE using Managed Service for Prometheus. Which configuration is required?

Accepted Answer

Enable Managed Service for Prometheus in each cluster and configure a single Cloud Monitoring workspace to collect metrics from all clusters. Managed Service for Prometheus is a Google Cloud-managed, multi-cluster monitoring solution. To collect metrics from multiple GKE clusters, you must enable the service in each cluster individually and then configure a single Cloud Monitoring workspace to aggregate the data. This ensures each cluster runs its own collection pipeline, while the workspace provides a unified view across all clusters.

Answer

Enable Managed Service for Prometheus in one cluster and have other clusters forward metrics to it

Answer

Use Cloud Monitoring agent on nodes in each cluster

Answer

Set up a separate workspace per cluster

Question 9

A batch data processing job on Cloud Dataflow is running slower than expected. Which action will most directly increase throughput?

Accepted Answer

Increase the number of workers in the pipeline. Increasing the number of workers directly increases the parallelism of the pipeline, allowing more data to be processed concurrently. In Cloud Dataflow, throughput is limited by the number of available worker slots; adding workers raises the total processing capacity. This is the most direct action to increase throughput when the pipeline is CPU-bound or I/O-bound and underutilizing existing resources.

Answer

Enable Streaming Engine for the pipeline

Answer

Enable autoscaling

Answer

Use FlexRS pricing model

Question 10

A team is experiencing increased latency in their microservices application after a new deployment. They suspect a specific service is the bottleneck. Which tool should they use to identify the slowest service in the request path?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool because it provides end-to-end latency analysis by capturing trace spans from each microservice in a request path. It aggregates and visualizes the time spent in each service, allowing you to pinpoint the slowest service causing the bottleneck. This directly addresses the need to identify the specific service responsible for increased latency after a deployment.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 11

A Cloud Deploy pipeline fails during a rollout with: 'FAILED_PRECONDITION: The release is not in a state that can be promoted.' The Cloud Build service account has the IAM roles shown in the exhibit. What is the missing role or permission?

Accepted Answer

The service account is missing the 'roles/clouddeploy.approver' role, which includes the 'clouddeploy.releases.promote' permission.. The error 'FAILED_PRECONDITION: The release is not in a state that can be promoted' occurs when a Cloud Deploy pipeline attempts to promote a release but the service account lacks the `clouddeploy.releases.promote` permission. This permission is included in the `roles/clouddeploy.approver` role, which is required to trigger a promotion from one target to the next in the pipeline. Without this role, the release cannot be promoted even if other deployment permissions are present.

Answer

The service account is missing the 'roles/clouddeploy.jobRunner' role.

Answer

The service account is missing the 'roles/cloudbuild.builds.builder' role.

Answer

The service account is missing the 'roles/clouddeploy.operator' role.

Question 12

Which tool can be used to capture and analyze latency spikes in a distributed application?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool for capturing and analyzing latency spikes in a distributed application because it provides end-to-end latency tracking by instrumenting requests as they traverse microservices. It collects trace spans with timing data, allowing you to identify bottlenecks and pinpoint the exact service or operation causing the spike.

Answer

Cloud Logging

Answer

Cloud Debugger

Answer

Cloud Monitoring

Question 13

An SRE team needs to define an SLI for a web service's availability SLO of 99.9%. Which metric should they use?

Accepted Answer

Uptime check success rate. An uptime check success rate directly measures the proportion of time the service is reachable and responding, which aligns with the definition of availability for a 99.9% SLO. This metric is typically derived from synthetic probes or health check endpoints (e.g., HTTP 200 responses) and reflects the binary state of the service being up or down, making it the appropriate SLI for availability.

Answer

Error budget

Answer

CPU utilization

Answer

Request latency (p99)

Question 14

What is the effect of the 'timeshiftDuration' of '3600s' in the dashboard widget?

Accepted Answer

The chart compares current data to data from 1 hour ago. The 'timeshiftDuration' parameter in a dashboard widget shifts the time range of the comparison data relative to the primary time range. Setting 'timeshiftDuration' to '3600s' means the chart compares the current data (within the selected time range) against data from exactly 1 hour (3600 seconds) earlier. This is commonly used for offset comparisons, such as week-over-week or hour-over-hour analysis, and does not alter the primary data range or aggregation.

Answer

The chart shows data from the last 1 hour

Answer

The metric is aggregated over 1 hour

Answer

The dashboard updates every hour

Question 15

Refer to the exhibit. The build fails with error: 'invalid tag format' for the image. What is the issue?

Accepted Answer

The substitution $SHORT_SHA is not defined and the tag becomes empty.. The error 'invalid tag format' occurs because the substitution $SHORT_SHA is not defined in the Cloud Build trigger or build configuration. When the substitution is not defined, it resolves to an empty string, resulting in an image tag that is either empty or malformed (e.g., 'gcr.io/project/image:'), which violates the tag format requirements.

Answer

The project ID substitution is not present.

Answer

The build step must explicitly push the image.

Answer

The image name must include a tag.