PCDOE Practice Test 16 — 15 Questions

Question 1

Which THREE actions should be taken when bootstrapping a CI/CD pipeline on Google Cloud? (Select exactly 3)

Accepted Answer

Use Cloud Build with a Dockerfile.. Option B is correct because Cloud Build is Google Cloud's managed CI/CD service that executes build steps, and using a Dockerfile lets the pipeline build a container image reproducibly for later deployment. Option D is correct because the pipeline needs a dedicated service account (with least-privilege IAM roles such as Cloud Build Builder, Artifact Registry Writer, and Cloud Run Developer) so Cloud Build and deployment steps can authenticate and act without using user credentials. Option E is correct because configuring Cloud Build triggers (for example, a GitHub or Cloud Source Repositories push trigger) automates builds on code changes, which is the core of bootstrapping a CI/CD pipeline. Option A is not appropriate because Cloud Source Repositories is a Git source-code hosting service, not a secrets manager; secrets should be stored in Secret Manager and referenced via Cloud Build's availableSecrets. Option C is not one of the three required bootstrap actions here because enabling the Cloud Run API is a deployment-target prerequisite, not a fundamental CI/CD pipeline bootstrap step, and the question asks specifically for bootstrapping actions.

Answer

Store secrets in Cloud Source Repositories.

Answer

Enable the Cloud Run API.

Question 2

A DevOps team wants to ensure that all audit logs from projects across the organization are sent to a central project for analysis. Which approach should they use?

Accepted Answer

Use organization-level log sinks to route audit logs to a central Cloud Storage bucket.. Organization-level log sinks allow you to aggregate audit logs from all projects within an organization into a single destination, such as a Cloud Storage bucket. This approach ensures centralized analysis and compliance without requiring per-project configuration, leveraging the hierarchical nature of Google Cloud resource management.

Answer

Enable VPC Flow Logs in each project.

Answer

Configure each project to export logs to a central BigQuery dataset.

Answer

Use Cloud Logging's default routing.

Question 3

A company's SRE team is designing an incident management process. They want to ensure that alerts are actionable and that on-call engineers are not overwhelmed by false positives. Which approach should they take?

Accepted Answer

Define SLOs and set alert thresholds based on historical error budget consumption. Defining SLOs and setting alert thresholds based on historical error budget consumption ensures alerts are directly tied to user-facing reliability. This approach prevents false positives by only triggering when the error budget is being consumed faster than expected, making alerts actionable and reducing noise for on-call engineers.

Answer

Use only critical severity alerts and rely on manual dashboard review for lower severity

Answer

Create alerting policies for every available metric to ensure nothing is missed

Answer

Set all alert thresholds to 50% above the average value to avoid false positives

Question 4

A build step needs to access a secret stored in Secret Manager. How should the secret be passed to the build step?

Accepted Answer

Use availableSecrets in cloudbuild.yaml. Cloud Build's availableSecrets field allows you to securely access secrets from Secret Manager and inject them as environment variables or volumes.

Answer

Use an environment variable with the secret directly in cloudbuild.yaml

Answer

Use gcloud command inside the build step to fetch the secret

Answer

Use a script to fetch the secret from an encrypted file

Question 5

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

Accepted Answer

Use Cloud Build triggers with regular expressions on branch patterns and restrict access via IAM.. Cloud Build triggers natively support regular expressions on branch patterns, and IAM conditions can restrict which service accounts are allowed to invoke specific triggers. This provides a declarative, auditable, and least-privilege approach without custom code or external services.

Answer

Use Cloud Functions to validate branch names before triggering builds.

Answer

Use Cloud Source Repositories with branch protection rules.

Answer

Store the service account keys in Secret Manager and use them in build steps.

Question 6

A company's Cloud SQL for PostgreSQL instance is experiencing performance degradation. They observe a high number of idle connections and slow transaction commit times. Which combination of actions will most effectively address this issue?

Accepted Answer

Configure statement timeout and use PgBouncer for connection pooling.. The high number of idle connections and slow transaction commit times indicate connection management and resource contention issues. PgBouncer reduces overhead by pooling and reusing database connections, while statement timeout prevents long-running queries from holding locks and consuming resources, directly addressing both symptoms.

Answer

Add a read replica and route read-only queries to it.

Answer

Increase the storage size and enable automatic backup.

Answer

Drop unused indexes and run VACUUM.

Question 7

Which TWO of the following are best practices for managing incident response on Google Cloud?

Accepted Answer

Establish a clear escalation path and ensure that on-call engineers are aware of their roles.. Option B is correct because a well-defined escalation path with clearly communicated on-call responsibilities ensures the right responders are engaged quickly and prevents confusion or delays during an incident. Option E is correct because a documented incident response plan that specifies severity levels, assigned roles, and communication channels provides a consistent, repeatable framework for handling incidents on Google Cloud. Together, these practices align with Google Cloud's recommended approach to incident management, such as using Cloud Monitoring alerting policies and On-Call schedules in Cloud Monitoring/Google Cloud Observability to route alerts to the correct responders. Option A is not a best practice because escalating every incident indiscriminately to an engineering manager creates unnecessary overhead and bypasses proper triage. Option C is not a best practice because relying on a single on-call engineer creates a single point of failure and risks burnout. Option D is not a best practice because using only one notification channel such as email is unreliable for time-sensitive incidents; multiple channels (e.g., push, SMS, phone) improve response times.

Answer

Automatically escalate all incidents to the engineering manager.

Answer

Assign only one engineer to be on call to reduce confusion.

Answer

Use only one notification channel (e.g., email) to keep the team focused.

Question 8

A web application frequently reads the same set of reference data from Cloud SQL. This causes high database load and slow responses. Which design change would most improve performance?

Accepted Answer

Implement caching with Memorystore for Redis. Caching the frequently read reference data in Memorystore for Redis offloads repeated reads from Cloud SQL, dramatically reducing database load and improving response times. Reference data is typically read-heavy and changes infrequently, making it an ideal caching candidate. This is the most direct design change to address the bottleneck.

Answer

Increase Cloud SQL machine size

Answer

Add a read replica

Answer

Use Cloud Spanner for higher throughput

Question 9

A team is bootstrapping a new Google Cloud organization. Which TWO practices are recommended for managing project creation and resource hierarchy? (Choose two.)

Accepted Answer

Create a folder for each department to isolate resources.. Option B is correct because folders provide a grouping layer between the organization and projects, letting you isolate each department's resources and apply IAM policies and organization policies at the department level, which is a core recommended practice for a well-structured resource hierarchy. Option E is correct because organization policies are the mechanism to enforce constraints such as project naming conventions (for example, a custom constraint on resource name patterns) across the entire organization, ensuring consistent governance as new projects are created. Option A is not recommended as stated: while automation service accounts are useful, a single centralized service account with broad project-creation rights is not the recommended pattern versus scoped, least-privilege automation. Option C is wrong because consolidating all development environments into one project defeats isolation, IAM separation, and quota management. Option D is wrong because granting the project creator role to all users by default violates least privilege and can lead to uncontrolled project sprawl.

Answer

Use a centralized service account to create projects via API.

Answer

Use a single project for all development environments.

Answer

Assign project creator role to all users by default.

Question 10

A company is running a stateful workload on Compute Engine and has configured a TCP health check on port 8080. The health check is failing, but the application is running and responding on port 8080 when tested manually from within the instance. What is the most likely cause of the health check failure?

Accepted Answer

The firewall rules are not allowing traffic from the health check probe IP ranges.. The health check probes originate from Google's health check systems, which use specific IP ranges (e.g., 35.191.0.0/16, 130.211.0.0/22). If firewall rules on the instance or VPC do not explicitly allow inbound traffic from these probe IP ranges on port 8080, the health check will fail even though the application is running and responding to manual tests from within the instance. This is the most common cause of health check failures when the application itself is healthy.

Answer

The health check is configured to use port 80 instead of port 8080.

Answer

The instance's DNS resolution is failing, causing the health check to use the wrong IP.

Answer

The health check response timeout is set too low (e.g., 1 second).

Question 11

Refer to the exhibit. A team is troubleshooting a pod crash loop. Based on the exhibit, which infrastructure change should be prioritized to resolve the issue and optimize service performance?

Accepted Answer

Mount a ConfigMap or volume containing the missing file. The exhibit indicates a pod crash loop caused by a missing file, which is a configuration issue rather than a resource or scheduling problem. Mounting a ConfigMap or volume that provides the missing file directly resolves the crash by ensuring the pod has the required configuration at startup. This fix also optimizes service performance by eliminating unnecessary restarts and allowing the pod to serve traffic consistently.

Answer

Increase the pod's CPU request

Answer

Increase the maximum number of pods per node

Answer

Enable pod anti-affinity

Question 12

Order the steps to deploy a new version of a microservice to Google Kubernetes Engine using a rolling update.

Accepted Answer

Update the manifest, then apply the manifest using kubectl apply, then monitor the rollout status, then verify the deployment, then roll back if needed.. The correct sequence for a rolling update in GKE is: update the manifest, apply it with kubectl apply, monitor the rollout status, verify the deployment, and roll back if needed. This ensures the new version is properly deployed and validated before considering it successful, with a safety net for issues.

Answer

Update the manifest, then apply the manifest using kubectl apply, then verify the deployment, then monitor the rollout status, then roll back if needed.

Answer

Apply the manifest using kubectl apply, then update the manifest, then monitor the rollout status, then verify the deployment, then roll back if needed.

Answer

Update the manifest, then monitor the rollout status, then apply the manifest using kubectl apply, then verify the deployment, then roll back if needed.

Question 13

Which THREE are best practices for securing a CI/CD pipeline on Google Cloud?

Accepted Answer

Use Secret Manager to securely pass credentials to build steps.. Options A, B, and E are correct. Using Secret Manager (A) securely passes credentials without hardcoding or storing them in repos. Binary Authorization (B) ensures only signed, trusted container images are deployed, preventing tampering. Cloud Build private pools (E) provide isolated, controlled build environments, reducing exposure. Option C is incorrect because public pools may be less secure and not recommended for sensitive workloads. Option D is incorrect because storing service account keys in source repos is a security risk.

Answer

Run builds on the publicly hosted pool for better scalability.

Answer

Store service account keys in the source repository for build steps to use.

Question 14

A company runs a batch processing pipeline on Dataflow that reads from Pub/Sub and writes to BigQuery. The pipeline is falling behind due to high volume, and messages are backing up in Pub/Sub. Autoscaling is enabled and workers are running but utilization is only 30%. The streaming engine is off. What should the engineer do to increase throughput?

Accepted Answer

Enable Streaming Engine for Dataflow.. B is correct because enabling Streaming Engine offloads the heavy lifting of shuffle and state management from worker VMs to the Dataflow service backend, reducing the per-worker overhead. With only 30% utilization, the bottleneck is not compute capacity but the per-worker throughput limit caused by the streaming pipeline's shuffle and state operations. Streaming Engine allows the existing workers to process more data per second by removing these bottlenecks, directly addressing the Pub/Sub backlog without adding more resources.

Answer

Use a larger machine type for workers.

Answer

Increase the number of worker machines.

Answer

Increase the worker disk size.

Question 15

Order the steps to set up a log-based metric in Cloud Logging for error tracking.

Accepted Answer

Filter logs -> Create metric -> Set alert -> Test -> Verify. The correct sequence to set up a log-based metric in Cloud Logging for error tracking is: first, filter logs to isolate relevant entries; second, create a metric based on that filter; third, set an alert to trigger on metric conditions; fourth, test the alert to ensure it works; and finally, verify the setup. This order ensures each step builds logically on the previous one.

Answer

Create metric -> Filter logs -> Set alert -> Test -> Verify

Answer

Filter logs -> Set alert -> Create metric -> Test -> Verify

Answer

Filter logs -> Create metric -> Test -> Set alert -> Verify