PCDOE Practice Test 18 — 15 Questions

Question 1

A Cloud Spanner database is experiencing slow query performance. Which approach should be taken to optimize read performance without compromising consistency?

Accepted Answer

Add secondary indexes and use read-only transactions for read queries. Secondary indexes in Cloud Spanner allow efficient lookup of rows by non-key columns, avoiding full table scans. Read-only transactions provide a consistent snapshot of data without locking, which optimizes read performance while maintaining strong consistency.

Answer

Increase the number of Spanner nodes to boost throughput

Answer

Use interleaved tables to store related rows together

Answer

Migrate the data to Cloud Bigtable for better read performance

Question 2

A company runs a high-traffic web application on GKE. Which three practices can help optimize performance under load? (Select THREE.)

Accepted Answer

Use a global load balancer. A global load balancer (GLB) distributes incoming traffic across multiple GKE clusters and regions using Google's global network infrastructure. It terminates traffic at the edge, reducing latency by routing users to the closest healthy backend, and provides DDoS protection and SSL offloading. This is essential for high-traffic web applications to handle load spikes and improve response times.

Answer

Use a multi-cluster ingress

Answer

Increase the number of nodes to maximum

Question 3

Your company runs a multi-region application on Google Kubernetes Engine. You have implemented Cloud Monitoring dashboards to track cluster resource utilization and application SLIs. After a recent upgrade, you notice that the dashboard shows a sudden drop in CPU utilization for all nodes in one zone, but the application is still serving traffic normally. You suspect a monitoring issue. What should you investigate first?

Accepted Answer

Check if the Kubernetes Metrics Server is running correctly in that zone.. The Kubernetes Metrics Server is responsible for collecting resource metrics from Kubelets and exposing them via the Metrics API, which Cloud Monitoring uses to display CPU utilization. A sudden drop in CPU utilization across all nodes in a single zone, while the application continues to serve traffic normally, strongly indicates that the Metrics Server in that zone has failed or is not reporting metrics, rather than an actual change in workload. Investigating the Metrics Server's health and logs is the correct first step to confirm whether the monitoring pipeline is broken.

Answer

Check if the nodes in that zone have been cordoned.

Answer

Check if the application's resource requests and limits have changed.

Answer

Check if the Cloud Monitoring agent has been updated incorrectly.

Question 4

A company is transferring large datasets from on-premises to Google Cloud using a VPN. They notice high latency due to packet loss. What is the most effective way to improve throughput?

Accepted Answer

Set up Dedicated Interconnect for a more reliable connection.. Dedicated Interconnect provides a direct, private physical connection between on-premises and Google Cloud, bypassing the public internet entirely. This eliminates the packet loss and high latency inherent in VPN tunnels over the internet, offering consistent throughput and lower latency for large dataset transfers.

Answer

Enable compression on the VPN tunnel.

Answer

Increase the number of VPN tunnels and use BGP multipath.

Answer

Use a multi-region GCP endpoint and distribute traffic.

Question 5

You are using Memorystore for Redis as a cache for a high-traffic web application. You observe that cache hit ratio is low, causing high database load. What is the most effective way to improve cache hit ratio?

Accepted Answer

Use the allkeys-lru eviction policy to keep frequently accessed keys.. The allkeys-lru eviction policy is the most effective way to improve cache hit ratio because it automatically evicts the least recently used keys across the entire keyspace when memory is full, retaining the most frequently accessed data. This ensures that the cache always contains the hottest data, directly increasing the likelihood of cache hits without requiring manual intervention or additional resources.

Answer

Increase the instance size to store more data.

Answer

Migrate to Memorystore for Memcached for lower latency.

Answer

Set a longer TTL for all cache entries.

Question 6

Your company runs a multi-region e-commerce platform on Google Kubernetes Engine (GKE) with services in us-central1 and europe-west1. The application uses a global external HTTP(S) load balancer with Cloud CDN for static assets. Recently, users in Asia report that product images take 5-10 seconds to load, while users in the US and Europe experience sub-second load times. You check the Cloud CDN cache hit ratio and see it is 95% globally. You also notice that the images are served from a backend bucket in us-central1. The load balancer uses the default routing configuration. Your team has implemented client-side caching with Cache-Control headers set to public, max-age=3600. What is the most likely cause of the high latency for Asian users?

Accepted Answer

The cache hit ratio is too low for Asian users due to different traffic patterns.. While Cloud CDN has edge caches in Asia (e.g., Tokyo, Mumbai, Singapore), the global cache hit ratio of 95% does not guarantee a high hit ratio for Asian users. If their traffic patterns differ (e.g., first requests for new products), they may experience cache misses, forcing requests to the backend bucket in us-central1, resulting in high latency. Options A and B are not likely: the load balancer uses premium tier by default, and max-age=3600 is reasonable. Option C is incorrect because Cloud CDN does have edge caches in Asia.

Answer

The load balancer is not using premium tier networking, so traffic from Asia takes a longer path.

Answer

Client-side caching with max-age=3600 is too short, causing frequent revalidation.

Answer

Cloud CDN does not have edge caches in Asia, so requests are served from the nearest available edge location, which may be far from users.

Question 7

A large enterprise is bootstrapping a Google Cloud organization with strict security requirements. They need to: (1) enforce multi-factor authentication (MFA) for all users, (2) prevent any new project from using default VPCs, (3) require customer-managed encryption keys (CMEK) for all Cloud Storage buckets, (4) automatically revoke access for offboarded employees within 24 hours. They have an existing Active Directory and plan to use Google Cloud's Identity Platform for SSO. Which combination of Google Cloud services and policies should they implement?

Accepted Answer

Use Identity Platform with MFA enforced in OIDC, apply organization policy 'compute.skipDefaultNetworkCreation' and 'storage.cmekRequired', and use Cloud Audit Logs to detect offboarded users.. It uses Identity Platform with OIDC to enforce MFA via the existing Active Directory SSO, applies the organization policy 'compute.skipDefaultNetworkCreation' to prevent default VPCs, uses 'storage.cmekRequired' to enforce CMEK on Cloud Storage buckets, and leverages Cloud Audit Logs to detect offboarded users by monitoring identity changes, enabling automated revocation within 24 hours. This combination directly addresses all four requirements using native Google Cloud policies and services without custom code.

Answer

Configure MFA via organization policy, use a project creation Cloud Function to disable default VPC and enforce CMEK, and use a Cloud Scheduler job to scan for offboarded users daily.

Answer

Set up a Cloud VPN to Active Directory, use Cloud Run to enforce MFA, apply a custom organization policy for CMEK, and use Cloud Monitoring alerts for offboarding.

Answer

Use Cloud Identity with MFA, apply organization policy for default VPC and CMEK, and use Cloud Functions to deactivate IAM accounts offboarded in HR system via a custom integration.

Question 8

What security checks can be integrated into a Cloud Build CI/CD pipeline? (Select TWO)

Accepted Answer

Container scanning with Artifact Analysis. Options B and E are correct. Container scanning with Artifact Analysis (B) is a native security check in Cloud Build. Static application security testing (SAST) can be added via custom steps (E). Option A (manual code review) is a process, not a tool that can be integrated programmatically. Option C (network penetration testing) is an external activity not typically integrated into CI/CD. Option D (DAST) is for running applications, not during build.

Answer

Manual code review

Answer

Network penetration testing

Answer

Dynamic application security testing (DAST)

Question 9

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Accepted Answer

Enable audit logging and set up log sinks to a centralized logging project.. Audit logging is essential for security and compliance in a DevOps environment. By enabling audit logs and setting up log sinks to a centralized logging project, you ensure that all API calls and administrative actions across the organization are captured in a single, immutable location, which is critical for incident response and forensic analysis.

Answer

Use a single project for development, staging, and production to reduce overhead.

Answer

Store secrets directly in code repositories for easy access by CI/CD pipelines.

Question 10

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

Accepted Answer

Cloud Asset Inventory can be used to discover all resources in the organization.. Cloud Asset Inventory provides a complete view of all resources (e.g., Compute Engine instances, Cloud Storage buckets, IAM policies) across the entire organization, including all folders and projects. This is essential for DevOps bootstrapping to audit, monitor, and manage resources at scale. It uses the Cloud Asset API to export asset metadata and supports real-time feeds for change detection.

Answer

After enabling the cloudresourcemanager.googleapis.com API, organization policies are automatically applied.

Answer

All projects in an organization automatically share a default VPC network.

Answer

Cloud Audit Logs are disabled by default and must be enabled for each service.

Question 11

A company's SRE team is designing an incident management process. They want to ensure that alerts are actionable and that on-call engineers are not overwhelmed by false positives. Which approach should they take?

Accepted Answer

Define SLOs and set alert thresholds based on historical error budget consumption. Defining SLOs and setting alert thresholds based on historical error budget consumption ensures alerts are directly tied to user-facing reliability. This approach prevents false positives by only triggering when the error budget is being consumed faster than expected, making alerts actionable and reducing noise for on-call engineers.

Answer

Use only critical severity alerts and rely on manual dashboard review for lower severity

Answer

Create alerting policies for every available metric to ensure nothing is missed

Answer

Set all alert thresholds to 50% above the average value to avoid false positives

Question 12

A financial services company runs a real-time trading application on GKE with 10 microservices. The application uses Cloud Spanner as the database. Recently, the team noticed increased latency during peak trading hours. Cloud Monitoring shows high CPU utilization on the Spanner nodes (averaging 80%) and increased locking contention. The team has already added secondary indexes and tuned queries. The application's latency budget is 50ms for writes and 20ms for reads. The team must reduce latency while maintaining strong consistency and meeting the budget. What should they do?

Accepted Answer

Increase the number of Spanner nodes to reduce contention and CPU load. Increasing the number of Spanner nodes directly addresses the root cause: high CPU utilization (80%) and locking contention. More nodes distribute the read/write load, reducing per-node CPU and contention, which lowers latency. This maintains strong consistency and meets the 50ms write / 20ms read budget without architectural changes.

Answer

Change the application to use eventual consistency for read operations

Answer

Migrate the database to Cloud Bigtable for higher throughput

Answer

Implement a write buffer using Cloud Pub/Sub and batch writes to Spanner

Question 13

Which FOUR of the following are valid approaches to monitor a custom application metric in Cloud Monitoring? (Choose 4)

Accepted Answer

Install the Stackdriver Monitoring agent on a Windows VM and configure custom metric collection in the agent configuration file.. All four options (A, B, C, E) are valid approaches for monitoring custom application metrics in Cloud Monitoring. Option A is valid because the legacy Stackdriver Monitoring agent on Windows supports custom metric collection via the generic task plugin. Option B is valid: the Cloud Monitoring API allows writing custom metric data directly via `projects.timeSeries.create`. Option C is valid: logs-based metrics can extract metric values from application logs. Option E is valid: the OpenTelemetry Collector with the Google Cloud Monitoring exporter can send custom metrics.

Answer

Use the built-in JMX plugin in the Cloud Monitoring agent to collect Java application metrics.

Question 14

A DevOps team is analyzing Google Cloud costs and notices that spending on BigQuery has increased significantly. They want to reduce costs without impacting ongoing analytical workloads. Which TWO actions should they take? (Choose two.)

Accepted Answer

Set custom cost controls like query quotas and maximum bytes billed per query.. BigQuery allows you to set custom cost controls such as query quotas (e.g., concurrent queries per project) and maximum bytes billed per query. These controls cap resource usage at the query level, preventing runaway costs while still allowing analytical workloads to run within defined limits. This directly addresses cost spikes without blocking ongoing operations.

Answer

Switch to on-demand pricing to pay only for queries run.

Answer

Enable column-level security to restrict access to sensitive data.

Answer

Delete unused datasets to reduce storage costs.

Question 15

A multinational company runs an application on Google Cloud with an SLO of 99.99% monthly availability. They use a multi-region deployment with Cloud Load Balancing and Cloud Spanner. During a regional outage in us-central1, traffic fails over to us-east1. However, the incident response team is not alerted because the error budget burn rate remained below the alert threshold. What should the team change to ensure timely alerting for such regional failures?

Accepted Answer

Create a custom dashboard and alert for regional unavailability using Cloud Monitoring metrics like load_balancing/backend_request_count and region health checks.. The incident response team is not alerted due to the error budget burn rate remaining below the threshold, even though a regional outage occurred. By creating a custom dashboard and alert for regional unavailability using Cloud Monitoring metrics like `load_balancing/backend_request_count` and region health checks, the team can directly monitor the health of each region and trigger alerts immediately when a region becomes unhealthy, bypassing the error budget burn rate logic that only triggers when the overall SLO is at risk.

Answer

Shorten the SLO compliance window from 30 days to 7 days.

Answer

Change the SLO to 99.9% to allow more error budget.

Answer

Reduce the error budget burn rate alert threshold from 10% to 5% per hour.