PCDOE Practice Test 17 — 15 Questions

Question 1

Arrange the steps to set up a Google Cloud Monitoring alerting policy for a Compute Engine instance.

Accepted Answer

Create notification channel, then define condition, set evaluation parameters, attach the channel, then save.. First create a notification channel, then define the condition, set evaluation parameters, attach the channel, and save.

Answer

Save, then attach the channel, set evaluation parameters, define condition, then create notification channel.

Answer

Define condition, then create notification channel, attach the channel, set evaluation parameters, then save.

Answer

Create notification channel, set evaluation parameters, define condition, attach the channel, then save.

Question 2

Your team uses a canary deployment strategy on Google Kubernetes Engine (GKE). During a rollback, you notice that the rollback caused a brief period of downtime because the previous version's readiness probe was not properly configured. Which of the following best prevents this issue in the future?

Accepted Answer

Ensure that the readiness probe is tested as part of the pre-deployment validation.. The root cause of the downtime was a misconfigured readiness probe on the previous version. By testing the readiness probe as part of pre-deployment validation, you ensure that the probe correctly reflects the application's ability to serve traffic before it is used in a rollback. This prevents the scenario where a rollback deploys a version that fails its readiness check, causing the service to be removed from the load balancer and resulting in downtime.

Answer

Perform a gradual rollback with a managed instance group.

Answer

Use a blue/green deployment instead.

Answer

Use a Kubernetes Job to run a post-deployment validation.

Question 3

Arrange the steps to migrate a monolithic application to microservices on Google Kubernetes Engine.

Accepted Answer

Identify contexts, then containerize, then deploy, then set up communication between microservices, then redirect traffic.. Identify contexts, containerize, deploy, set up communication, redirect traffic.

Answer

Containerize, then identify contexts, then deploy, then set up communication between microservices, then redirect traffic.

Answer

Identify contexts, then deploy, then containerize, then set up communication between microservices, then redirect traffic.

Answer

Identify contexts, then containerize, then set up communication between microservices, then deploy, then redirect traffic.

Question 4

A DevOps team is bootstrapping CI/CD pipelines that need access to API keys stored in Secret Manager. The pipelines run on Cloud Build. What is the best practice for granting access to secrets?

Accepted Answer

Grant the Cloud Build service account roles/secretmanager.secretAccessor on the project containing secrets.. The principle of least privilege dictates that Cloud Build's service account should receive only the specific permission needed to read secrets — roles/secretmanager.secretAccessor — rather than broad admin rights. Granting this role on the project containing the secrets allows Cloud Build to access them during pipeline execution without over-provisioning. This is the standard Google-recommended pattern for CI/CD secret access.

Answer

Use a custom service account with roles/secretmanager.admin and run Cloud Build as that account.

Answer

Store the API keys as build substitutions.

Answer

Use Cloud KMS to encrypt secrets and pass them as environment variables.

Question 5

An organization wants to optimize BigQuery costs. Which three practices should they implement? (Choose three.)

Accepted Answer

Set a maximum bytes billed per query at the project level. Option B is correct because setting a maximum bytes billed per query at the project level enforces a hard cap that causes queries exceeding the limit to fail, preventing runaway scan costs from accidental or inefficient queries. Option C is correct because partitioning (e.g., by ingestion time, DATE, or TIMESTAMP column) and clustering (sorting data by specified columns) prune the data scanned, and BigQuery on-demand pricing is based on bytes processed, so less data scanned directly lowers cost. Option E is correct because authorized views grant access to underlying data without duplicating it into additional datasets or tables, avoiding extra storage charges and redundant data copies. Option A is not correct because storing data in many unpartitioned daily tables increases management overhead and does not reduce bytes scanned, since queries cannot prune data efficiently. Option D is not correct because flat-rate reservations are a capacity commitment that is not universally cheaper; they only make sense for predictable, high-volume workloads, not as a blanket cost-optimization practice for all queries.

Answer

Store data in multiple tables per day without partitioning

Answer

Purchase BigQuery flat-rate reservations for all queries

Question 6

Which TWO deployment strategies are directly supported by Cloud Deploy for GKE?

Accepted Answer

Canary. Options C and E are correct. Cloud Deploy for GKE directly supports canary (C) and blue-green (E) deployment strategies. Option A (Rolling update) is incorrect because rolling updates are managed natively by GKE itself, not as a Cloud Deploy strategy. Option B (A/B testing) is incorrect; A/B testing is a traffic management technique but not a built-in deployment strategy in Cloud Deploy. Option D (Shadow) is incorrect; shadow deployments are not supported by Cloud Deploy.

Answer

Rolling update

Answer

A/B testing

Answer

Shadow

Question 7

Which Google Cloud tool automatically captures and visualizes traces for applications running on App Engine?

Accepted Answer

Cloud Trace. Cloud Trace is the correct Google Cloud tool for automatically capturing and visualizing latency traces from applications running on App Engine. It provides end-to-end latency insights by collecting trace data from distributed systems, enabling you to analyze request performance and identify bottlenecks without manual instrumentation.

Answer

Cloud Debugger

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 8

A DevOps engineer is troubleshooting a Cloud Build failure. The build log shows the error: 'Permission denied for resource projects/my-project/locations/us-central1/repositories/my-repo'. The Cloud Build service account (PROJECT_NUMBER@cloudbuild.gserviceaccount.com) is used. What is the most likely missing role?

Accepted Answer

roles/artifactregistry.writer. The error 'Permission denied for resource projects/my-project/locations/us-central1/repositories/my-repo' indicates that the Cloud Build service account lacks permission to write artifacts to Artifact Registry. The Cloud Build service account needs the `roles/artifactregistry.writer` role to upload build artifacts (e.g., container images) to the repository. Without this role, the build fails at the step that attempts to push artifacts.

Answer

roles/artifactregistry.reader

Answer

roles/artifactregistry.admin

Answer

roles/cloudbuild.builds.builder

Question 9

A DevOps engineer is troubleshooting a production incident where users are getting 502 errors from a Google Cloud HTTP(S) Load Balancer. The backend service is a GKE deployment. Initial checks show the backend pods are healthy and responding. What is the most likely cause?

Accepted Answer

The load balancer's health check is failing on the backend instance group due to mismatch between health check port and backend port.. A 502 error from an HTTP(S) Load Balancer indicates that the load balancer is unable to establish a successful connection to the backend. Even though the backend pods are healthy and responding, the load balancer's health check may be failing because it is configured to check a different port (e.g., the health check port) than the port the backend service is actually serving traffic on (e.g., the backend port). This mismatch causes the load balancer to mark the backend instances as unhealthy, resulting in 502 errors for users.

Answer

The backend pods are out of memory and crashing.

Answer

The IAM permissions for the load balancer service account are misconfigured.

Answer

The backend service has been accidentally deleted by another engineer.

Question 10

A team is running a stateful application on Compute Engine VMs. They notice that the application performance degrades over time as the disk fills up. They want to proactively alert before performance degrades. Which metric should they monitor?

Accepted Answer

Disk usage percentage. Disk usage percentage is the correct metric because the application performance degrades as the disk fills up, which is a capacity issue. Monitoring disk usage percentage allows the team to set an alert threshold (e.g., 80% or 90%) to proactively take action (e.g., clean up logs or resize disks) before the disk becomes full and causes performance degradation. This directly addresses the root cause described in the scenario.

Answer

Disk read/write latency

Answer

Network sent bytes

Answer

CPU utilization

Question 11

A DevOps engineer is optimizing a Cloud Run service that experiences cold starts. The service is written in Python and uses several large libraries. Which change is most effective to reduce cold start latency?

Accepted Answer

Set a minimum number of instances to keep containers warm.. Setting a minimum number of instances (option B) ensures that a baseline of container instances is always warm and ready to serve requests, eliminating cold starts for those instances. Cold starts occur when a new container must be initialized, including loading large Python libraries, which adds significant latency. By keeping a minimum number of instances running, the service avoids the initialization delay for the first request to each instance.

Answer

Increase the maximum number of concurrent requests per container.

Answer

Set a longer request timeout.

Answer

Increase the CPU allocation for the service.

Question 12

Refer to the exhibit. If the error rate spikes to 2% for only 2 minutes, why does the alert not fire?

Accepted Answer

The duration of 300s requires the condition to be met for 5 minutes.. The alert condition requires the error rate to exceed 1% for a duration of 300 seconds (5 minutes). A spike lasting only 2 minutes does not meet the minimum duration requirement, so the alert remains in a 'pending' state and never fires. In Google Cloud Monitoring, the duration parameter defines how long the condition must be continuously true before the alert transitions from pending to firing.

Answer

The notification rate limit prevents the alert from firing.

Answer

The threshold value of 1% is too high.

Answer

The alignment period of 60s is too short.

Question 13

Refer to the exhibit. A Cloud Function (2nd gen) is timing out. The function's timeout is set to 60 seconds. The function queries a Cloud SQL database. What is the most likely cause and the best action?

Accepted Answer

Add indexes to the database tables queried by the function. The most likely cause of the timeout is that the database queries are slow due to missing indexes, causing the function to wait longer than its 60-second timeout for results. Adding indexes to the queried columns reduces query execution time, resolving the timeout without changing the function's configuration. This aligns with best practices for optimizing Cloud SQL queries in serverless environments.

Answer

Reduce the function's allocated memory to decrease cold start time

Answer

Increase the function timeout to 120 seconds

Answer

Increase the Cloud SQL max connections setting

Question 14

A team is using Cloud Monitoring to track the performance of a microservices application. They set up an uptime check for each service, but they notice that some checks are failing intermittently without actual service degradation. What is the most likely cause?

Accepted Answer

The timeout setting is too short for the service's typical latency.. Intermittent uptime check failures without actual service degradation are often caused by the check timeout being too short for the service's typical latency. If the service occasionally takes longer to respond than the configured timeout, the check will fail even though the service is healthy. Adjusting the timeout to accommodate normal latency spikes resolves false positives.

Answer

The services are behind a load balancer that occasionally returns 503 during scaling.

Answer

Uptime checks are deployed in a single region, causing false positives.

Answer

The project's quota for uptime checks has been exceeded.

Question 15

Which THREE actions should be taken to ensure compliance with the principle of least privilege when bootstrapping a Google Cloud organization? (Choose 3)

Accepted Answer

Use service accounts for automated processes and grant them the minimum required roles.. Option A is correct because service accounts are the recommended identity type for automated processes, and granting them only the minimum required roles directly enforces least privilege by avoiding broad, human-oriented permissions. Option B is correct because custom roles let you define an exact permission set, so identities receive only the specific permissions they need rather than the broader set bundled into predefined roles. Option C is correct because granting roles at the project level (or lower, such as folder or resource level) scopes permissions to the smallest necessary blast radius instead of granting organization-wide access. Option D is not correct because assigning the Owner role at the organization level grants extensive, broad permissions that violate least privilege, even if limited to a small group. Option E is not correct because primitive roles (Owner, Editor, Viewer) are coarse-grained and include far more permissions than most identities require, contradicting least privilege.

Answer

Assign the Owner role at the organization level to a small group of administrators.

Answer

Use primitive roles (Owner, Editor, Viewer) to simplify management.