PCDOE Practice Test 19 — 15 Questions

Question 1

Which TWO are benefits of using Cloud Build private pools?

Accepted Answer

Dedicated VMs for builds. Cloud Build private pools provide dedicated VMs that are not shared with other Google Cloud projects. This isolation ensures consistent performance and eliminates the 'noisy neighbor' effect that can occur in public pools, where build resources are shared across multiple tenants.

Answer

Lower cost

Answer

No internet access

Answer

Faster builds compared to public pools

Question 2

A team is designing a dashboard for their production environment using Cloud Monitoring. Which three types of information should be included on the dashboard to support incident response? (Choose three.)

Accepted Answer

Resource utilization trends. Resource utilization trends (A) are essential for incident response because they provide historical context, enabling responders to identify anomalies, correlate changes with incidents, and predict capacity issues. Cloud Monitoring's Metrics Explorer and dashboards allow you to plot trends over time, which is critical for root cause analysis during an active incident.

Answer

Real-time user feedback

Answer

Security audit logs

Question 3

A company is setting up a new Google Cloud organization. They want to ensure that all projects inherit common IAM policies. What is the best practice?

Accepted Answer

Apply IAM policies at the organization level.. In Google Cloud, IAM policies are hierarchical: resources inherit policies from their ancestors (organization → folder → project → resource). Applying IAM policies at the organization level ensures every current and future project inherits the common policies automatically, which is the recommended best practice for baseline governance. This avoids per-project drift and simplifies administration.

Answer

Apply IAM policies at the folder level.

Answer

Apply IAM policies at the project level.

Answer

Use multiple organizations to isolate policies.

Question 4

An organization wants to be alerted when the total size of a Cloud Storage bucket exceeds 1 TB. Which metric should they monitor?

Accepted Answer

storage.googleapis.com/storage/total_bytes. The metric `storage.googleapis.com/storage/total_bytes` directly measures the total amount of data stored in a Cloud Storage bucket, including all object data and metadata. Monitoring this metric allows the organization to set an alert threshold at 1 TB (1,099,511,627,776 bytes) to trigger when the bucket exceeds that size. This is the correct metric for tracking storage capacity usage.

Answer

storage.googleapis.com/storage/object_count

Answer

storage.googleapis.com/storage/network_sent_bytes

Answer

storage.googleapis.com/storage/request_count

Question 5

Refer to the exhibit. A payment microservice on GKE logs frequent 'connection closed' errors. The service connects to a backend database. Which approach is most effective to reduce these errors?

Accepted Answer

Implement retry logic with exponential backoff in the service code.. The 'connection closed' errors indicate transient network failures or database server-side connection drops. Implementing retry logic with exponential backoff in the service code is the most effective approach because it allows the microservice to gracefully recover from intermittent failures without overwhelming the database with immediate retries. This pattern is a standard resilience technique for cloud-native applications on GKE, as it handles temporary issues like network blips or database connection pool exhaustion.

Answer

Increase the number of pod replicas to distribute load.

Answer

Adjust the readiness probe to be more aggressive.

Answer

Increase the CPU and memory limits for the container.

Question 6

A DevOps engineer needs to set up a centralized logging solution for multiple projects. They want to store logs in a BigQuery dataset for analysis. What is the best approach?

Accepted Answer

Create an aggregated sink at the organization or folder level to export logs to BigQuery.. An aggregated sink at the organization or folder level allows you to collect logs from all projects within that hierarchy into a single BigQuery dataset in a centralized project. This approach eliminates the need to configure individual sinks per project, reduces administrative overhead, and ensures consistent log routing across the entire organization.

Answer

Use Cloud Logging's export feature to Pub/Sub and then to BigQuery.

Answer

Use the BigQuery Data Transfer Service for logs.

Answer

Create a sink in each project to export logs to the BigQuery dataset.

Question 7

A web application serves static assets (images, CSS, JavaScript) from Compute Engine instances. Users in different geographic regions report slow page loads. Which Google Cloud service can be used to improve performance for these users?

Accepted Answer

Cloud CDN. Cloud CDN (Content Delivery Network) caches static assets at Google's globally distributed edge points of presence (PoPs). When users request images, CSS, or JavaScript, the content is served from the nearest edge cache rather than the origin Compute Engine instances, reducing latency and improving page load times for geographically distributed users.

Answer

VPC Network Peering

Answer

Cloud Load Balancing

Answer

Cloud NAT

Question 8

A company notices increased latency for their web application running on Compute Engine. They suspect a database bottleneck. Which Google Cloud service should they use to identify slow queries?

Accepted Answer

Cloud SQL Query Insights. Cloud SQL Query Insights is the correct choice because it is a Google Cloud managed service specifically designed to identify and analyze database performance issues, including slow queries, in Cloud SQL instances. It provides detailed query performance metrics, execution plans, and recommendations to optimize database queries, directly addressing the bottleneck in a Compute Engine web application.

Answer

Cloud Logging

Answer

Cloud Debugger

Answer

Cloud Trace

Question 9

A team wants to monitor the latency of a microservice deployed on GKE. Which Google Cloud tool should they use to collect custom metrics?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct tool because it allows you to collect, visualize, and alert on custom metrics via the Monitoring API or the `custom.googleapis.com` metric namespace. For a microservice on GKE, you can instrument your application with the OpenTelemetry SDK or the Cloud Monitoring client library to push custom latency metrics directly into Cloud Monitoring, where they can be queried and used in dashboards or alerting policies.

Answer

Cloud Logging

Answer

Cloud Trace

Answer

Error Reporting

Question 10

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

Accepted Answer

Grant Cloud Build service account access to secrets via IAM.. Option E is correct because Google Cloud Secret Manager is the recommended managed service for storing, versioning, and accessing secrets, and Cloud Build and Spinnaker can retrieve secrets from it at runtime instead of hardcoding them. Option A is correct because the Cloud Build service account must be granted the appropriate IAM roles (e.g., roles/secretmanager.secretAccessor) on the specific secret so the build can access it under least privilege. Option D is correct because regularly rotating secrets in Secret Manager limits the blast radius of a leaked credential and can be automated via rotation schedules and versions. Option B is not the recommended approach because Cloud KMS encrypting secrets manually before storing them in Cloud Storage adds operational overhead and lacks Secret Manager's versioning, auditing, and access controls. Option C is not secure because Base64 encoding is not encryption, and Cloud Build substitutions are visible in build logs and configuration, exposing the secrets.

Answer

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Answer

Base64 encode secrets and store them in Cloud Build substitutions.

Question 11

A DevOps team is investigating performance issues in their GKE cluster. They want to use Cloud Profiler to identify the bottleneck. Which three steps are required to start profiling? (Select THREE)

Accepted Answer

Configure IAM permissions. Option A is correct because the identity running the workload (the GKE node's service account or Workload Identity principal) must have the Cloud Profiler Agent role (roles/cloudprofiler.agent) or equivalent cloudprofiler.profiles.create permission to write profile data. Option B is correct because Cloud Profiler requires the profiling agent library to be linked into the application container — for Go, Java, Node.js, and Python it is added as a dependency, and for other languages a specific agent binary must be deployed — so the agent must be present in the workload. Option C is correct because the Cloud Profiler API (cloudprofiler.googleapis.com) must be enabled in the project before profiles can be ingested and viewed. Option D is not required: Cloud Profiler does not rely on a sidecar proxy; the agent runs in-process and sends profiles directly to the Cloud Profiler backend. Option E is not required: no custom profiling endpoints need to be added to the application code; the agent libraries collect and export profiles automatically once initialized.

Answer

Install a sidecar proxy

Answer

Modify the application code to include profiling endpoints

Question 12

Which TWO of the following are essential elements of a comprehensive incident post-mortem document according to Google's Site Reliability Engineering (SRE) best practices?

Accepted Answer

A timeline of events leading to and during the incident.. Option B is correct because Google SRE post-mortems require a clear, factual timeline of events leading up to and during the incident, which establishes the sequence of triggers, detection, and response. Option E is correct because a comprehensive post-mortem must produce action items with assigned owners and deadlines, ensuring follow-through on preventive and mitigating improvements. Option A is not essential; while specific commits or code lines may appear in the analysis, the post-mortem focuses on systemic causes rather than exact line numbers. Option C is too narrow, since Google SRE emphasizes root cause analysis alongside contributing factors, impact, detection, and response, not root cause alone. Option D is explicitly contrary to Google SRE blameless post-mortem culture, which forbids attributing blame to individuals or teams.

Answer

Exact code line numbers and commits that caused the incident.

Answer

A detailed analysis of the root cause only.

Answer

An attribution of blame to the individual or team responsible.

Question 13

A multinational corporation is bootstrapping their Google Cloud organization. They have multiple business units in different countries, each with its own compliance requirements (e.g., data residency, encryption keys). The organization structure must support: (1) each business unit as a separate folder with its own admin; (2) projects within each folder must have a label 'bu-<businessunit>'; (3) all resources must be created in regions allowed by the business unit; (4) audit logging must be centralized. They have 200 existing projects and 10,000 VMs. The team wants to use Google Cloud's native tools to enforce these policies without third-party software. What is the most effective first step?

Accepted Answer

Create folders for each business unit, move all projects into corresponding folders using a script, and apply organization policies for allowed regions and labeling.. It establishes a folder hierarchy that mirrors the business units, enabling hierarchical inheritance of organization policies. By moving existing projects into the correct folders and applying organization policies for allowed regions and labeling at the folder level, each business unit's compliance requirements are enforced natively without third-party tools. This approach also supports centralized audit logging by enabling audit logs at the organization level, which aggregate logs from all folders and projects.

Answer

Apply organization policies at the root level to restrict regions and labeling, and ignore folders.

Answer

Use a single folder for all projects and rely on IAM roles to enforce compliance per business unit.

Answer

Create a separate Cloud Function for each business unit to monitor resources and enforce compliance.

Question 14

A team is optimizing the performance of their application running on Cloud Run. They want to reduce cold starts. Which two actions would help? (Select TWO)

Accepted Answer

Enable min instances. Option A (Enable min instances) is correct because setting a minimum instance count keeps warm container instances running even when there is no traffic, so requests are served without the latency of spinning up a new container, directly reducing cold starts. Option D (Use a custom container base image with reduced size) is correct because a smaller image pulls and initializes faster, shortening the time Cloud Run needs to start a new instance and thereby reducing cold-start duration. Option B (Increase the maximum number of container instances) only affects scaling ceiling under load and does not prevent cold starts for new instances. Option C (Increase the CPU limit) may speed up execution but does not eliminate the cold-start initialization delay and can even increase cost without addressing instance startup. Option E (Enable HTTP/2) improves transport efficiency for requests but has no effect on container startup or cold-start latency.

Answer

Increase the maximum number of container instances

Answer

Increase the CPU limit

Answer

Enable HTTP/2

Question 15

A team is running a stateful application on Compute Engine with high disk I/O. They want to optimize disk performance. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use SSD persistent disk for data. Option C is correct because SSD persistent disks deliver significantly higher IOPS and lower latency than standard persistent disks, which directly addresses the high disk I/O requirement of the stateful application. Option D is correct because local SSDs provide the highest IOPS and lowest latency of any Compute Engine disk option, making them ideal for temporary, high-throughput data such as caches or scratch space. Option A is incorrect because standard persistent disks are HDD-backed and offer much lower IOPS, which would worsen performance for an I/O-intensive workload. Option B is incorrect because disk encryption is a security feature and does not improve disk I/O performance. Option E is incorrect because increasing disk size can raise IOPS and throughput limits on persistent disks, but it is not one of the two best actions for optimizing performance compared to choosing SSD persistent disks and local SSDs.

Answer

Use standard persistent disk for cost savings

Answer

Enable disk encryption

Answer

Increase disk size