PCDOE Practice Test 19 — 15 Questions

Question 1

Which TWO are benefits of using Cloud Build triggers to implement CI/CD pipelines?

Accepted Answer

Start a build automatically when changes are pushed to a repository. Cloud Build triggers can be configured to automatically start a build in response to events such as a push to a repository branch or the creation of a pull request. This event-driven automation is the foundation of a CI/CD pipeline, eliminating the need for manual build initiation and ensuring that every code change is validated immediately.

Answer

Deploy to a specific Google Cloud region based on the trigger

Answer

Support only a single branch per trigger

Answer

Automatically provision infrastructure as part of the build

Question 2

An alerting policy for high CPU utilization on a VM is firing even when CPU is not high. The team suspects a misconfiguration. Which two possible issues should they check? (Choose two.)

Accepted Answer

The alert condition is using the average aggregation with a short alignment period.. Using a short alignment period with average aggregation can cause the alert to fire on brief spikes in CPU utilization that do not represent sustained high usage. If the alignment period is too short (e.g., 1 minute), the alerting policy may trigger on transient bursts, even when the overall CPU load is low. This is a common misconfiguration in Google Cloud Monitoring (formerly Stackdriver) where the alignment period and aggregator settings must match the expected workload pattern.

Answer

The threshold is set too low compared to actual CPU usage.

Answer

The alerting policy was created in a different project and not imported.

Answer

The VM is reporting metrics from a custom namespace instead of the standard agent.

Question 3

An organization is implementing SLO-based alerting for a critical service. They want to alert when the service has consumed 50% of its error budget over a 30-day window. Considering best practices for alert sensitivity and noise reduction, which alerting approach should they use?

Accepted Answer

Alert on the burn rate over a 1-hour window with a threshold of 10.. A burn rate of 10 over a 1-hour window indicates that the service is consuming error budget at a rate that would exhaust the entire 30-day budget in 3 days (30 days / 10 = 3 days). Therefore, 50% of the budget would be consumed in 1.5 days, not 1.5 hours. This approach balances sensitivity and noise reduction by using a sufficiently long window (1 hour) to smooth out transient spikes, while the high threshold ensures only significant sustained degradation triggers an alert, aligning with SRE best practices for multi-window, multi-burn-rate alerting.

Answer

Alert on the burn rate over a 5-minute window with a threshold of 0.5.

Answer

Alert on the error budget remaining with a threshold of 50%.

Answer

Alert on the SLI value directly with a threshold of 99.9%.

Question 4

A company is using BigQuery for analytics and wants to control costs. They have many queries that scan large amounts of data. Which approach is most effective in reducing query costs?

Accepted Answer

Partition tables by date and use partition pruning in queries.. Partitioning tables by date and using partition pruning in queries directly reduces the amount of data scanned by BigQuery, which is the primary driver of on-demand query costs. By filtering on the partition column, BigQuery can skip entire partitions that do not match the query criteria, minimizing the bytes processed. This is the most effective cost-control measure because it addresses the root cause of high costs—excessive data scanning—without requiring a pricing model change or additional resource commitments.

Answer

Switch to flat-rate pricing to cap costs.

Answer

Reserve BigQuery slots for dedicated capacity.

Answer

Use clustering to organize data within partitions.

Question 5

A DevOps team is investigating performance issues in their GKE cluster. They want to use Cloud Profiler to identify the bottleneck. Which three steps are required to start profiling? (Select THREE)

Accepted Answer

Configure IAM permissions. A is correct because Cloud Profiler requires the `cloudprofiler.agent` IAM role (or equivalent permissions) on the service account used by the GKE node or application to allow the agent to write profiling data to the Cloud Profiler API. Without this permission, the agent cannot upload profiles, and no data will appear in the console.

Answer

Install a sidecar proxy

Answer

Modify the application code to include profiling endpoints

Question 6

A startup wants to implement Infrastructure as Code (IaC) using Terraform for their Google Cloud environment. They need to manage state files securely. What is the best practice?

Accepted Answer

Store Terraform state in Cloud Storage with uniform bucket-level access using a dedicated bucket.. Storing Terraform state in Cloud Storage with uniform bucket-level access is the best practice because it provides a centralized, durable, and versioned backend that supports state locking via object lease mechanisms. This approach prevents concurrent modifications and ensures consistency across team members, while uniform bucket-level access simplifies IAM management by disabling ACLs and enforcing bucket policies exclusively.

Answer

Use a Cloud SQL database to store state.

Answer

Store state in a Git repository.

Answer

Store state locally on the developer's machine.

Question 7

Which THREE are required steps when setting up a CI/CD pipeline with Cloud Build for the first time? (Choose three.)

Accepted Answer

Enable the Cloud Build API.. The Cloud Build API must be enabled in your Google Cloud project before you can use any Cloud Build features, including triggers and builds. Without enabling the API, Cloud Build services are unavailable, and any attempt to create or run builds will fail with an API not found error.

Answer

Create a custom base image for builds.

Answer

Set up a Cloud Router for network connectivity.

Question 8

A DevOps engineer is trying to create a service account key for a CI/CD pipeline, but receives the error: 'Constraint constraints/iam.disableServiceAccountKeyCreation violated'. What is the most likely cause and solution?

Accepted Answer

The Organization Policy prevents key creation; the engineer needs to request an exception from the security team.. The error 'Constraint constraints/iam.disableServiceAccountKeyCreation violated' indicates that an Organization Policy with the constraint `iam.disableServiceAccountKeyCreation` is enforced at the organization, folder, or project level. This policy explicitly blocks the creation of service account keys, which is why the engineer cannot generate a key for the CI/CD pipeline. The correct solution is to request an exception from the security team, who can either remove the policy or add the engineer's project to an exemption list.

Answer

The Cloud Resource Manager API is disabled; enable it.

Answer

The project does not have billing enabled; enable billing.

Answer

The service account has been deleted; the engineer must recreate it.

Question 9

A DevOps team is bootstrapping a new organization. They want to ensure that all projects created within the organization have a specific set of APIs enabled, such as Compute Engine, Cloud Storage, and Cloud Resource Manager. What is the most efficient way to achieve this?

Accepted Answer

Define an organization policy with a constraint that requires the APIs to be enabled.. Organization Policies with constraints (like `constraints/compute.requireOsLogin` or custom constraints using the Resource Manager API) allow you to enforce API enablement across all projects in the organization. This is the most efficient approach as it is declarative, centrally managed, and automatically applies to new projects without any additional infrastructure or manual intervention.

Answer

Create a Cloud Function that triggers on project creation events and enables the required APIs.

Answer

Use Cloud Foundation Toolkit to deploy a project template that includes API enablement.

Answer

Create a shared VPC and enable the APIs in the host project only.

Question 10

A team is setting up CI/CD for a microservices architecture. They want to ensure each service is independently buildable and deployable. What practices should they adopt? (Select THREE)

Accepted Answer

Use Artifact Registry with separate repositories per service. Options A, C, and D are correct. Option A: Using separate Artifact Registry repositories per service ensures artifact isolation. Option C: Using a single repository (monorepo) with separate Cloud Build triggers per service allows each service to be built independently. Option D: Using separate repositories per service provides clear boundaries and independent build pipelines. Option B is incorrect because Cloud Deploy's multi-target pipeline is for deployment, not builds. Option E is incorrect because using a single build config with substitutions to build multiple services reduces build independence, as a change in one service could affect the others.

Answer

Use Cloud Deploy's multi-target pipeline

Answer

Use Cloud Build's build config with substitutions to build multiple services

Question 11

A mid-size company has multiple Google Cloud projects for different departments. The finance team wants to set up budget alerts to track spending across all projects. They have enabled billing export to BigQuery. The budget should trigger alerts when total cumulative spending exceeds 80% and 100% of the monthly budget of $10,000. The budget must be applied across all projects in the organization. They created a budget at the billing account level with amount $10,000, set alert thresholds at 80% and 100%, and added email recipients. However, after two weeks, spending in one project alone has exceeded $8,000 but no alert was triggered. What is the most likely cause?

Accepted Answer

The budget was scoped to a single project instead of the billing account.. The most likely cause is that the budget was scoped to a single project rather than the entire billing account (Option B). When a budget is scoped to a single project, it only tracks spending for that specific project. Since the high spending of $8,000 occurred in a different project, the budget did not detect it, and no alert was triggered.

Option A is incorrect because budgets at the organization level are not applicable for billing account budgets; budgets must be at the billing account level to cover all projects. Option C is incorrect because budget thresholds are set as percentages of the budget amount ($10,000), not as percentages of current spending. Option D is incorrect because the budget amount does not include credits or discounts; if it did, the actual spending might be higher than the budget amount, but that would not prevent alerts from triggering when the threshold is reached.

Answer

The budget was set at the organization level, not billing account.

Answer

The budget thresholds were set as percentage of current spending not cumulative.

Answer

The budget amount includes credits or discounts.

Question 12

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.. Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.

Answer

Use a user account for the CI/CD pipeline and assign it the necessary roles.

Answer

Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.

Answer

Generate a single service account key and securely distribute it to the CI/CD system.

Question 13

A company has purchased Compute Engine committed use discounts (CUD) for 1 year for vCPU and memory. After 3 months, they need to upgrade some VMs to a larger machine type. What happens to the CUD coverage?

Accepted Answer

The CUD continues to apply to the original resource, and any additional usage is charged at on-demand rates. Committed Use Discounts (CUDs) apply to resource usage (vCPU, memory) rather than specific machine types. When upgrading to a larger machine type, the original committed resources are still used; any additional usage beyond the committed amount is charged at on-demand rates. Option A is incorrect because CUDs are not automatically adjusted. Option C is incorrect because CUDs do cover upgrades as long as the resource types match. Option D is incorrect because CUDs are not voided or refunded.

Answer

The CUD is automatically adjusted to cover the new machine type

Answer

The CUD applies only to the specific machine types in the commitment, so upgrades are not covered

Answer

The CUD is voided and a refund is issued

Question 14

Your company runs a microservices application on Google Kubernetes Engine (GKE) with shared Istio service mesh across multiple namespaces. You use Cloud Monitoring and Cloud Logging for observability. At 10:30 AM, you receive an alert that the checkout service is returning high 5xx errors (over 20%) and latency is above 5 seconds. The incident response team is assembled, and you are the incident commander. The team suspects a recent deployment (v2.1) to the checkout service at 10:00 AM. The deployment was a minor configuration update. The team is divided: some want to immediately roll back, others want to analyze traces. You have access to the GCP console. What should you do first to ensure a swift and effective incident response?

Accepted Answer

Review the deployment history of the checkout service alongside Cloud Monitoring metrics and logs to identify the exact time and nature of the change.. Reviewing the deployment history alongside Cloud Monitoring metrics and Cloud Logging logs directly correlates the onset of errors and latency with the v2.1 deployment at 10:00 AM. This evidence-based approach confirms the deployment as the likely root cause before taking any action, preventing unnecessary rollback (Option C) or premature escalation (Option D). Option B, while helpful for error details, does not provide the temporal correlation with the deployment change. Therefore, option A enables a swift and effective incident response by grounding decisions in observed data.

Answer

Check the Error Reporting dashboard to view aggregated error logs and stack traces for the checkout service.

Answer

Immediately roll back the checkout service to the previous version and monitor if errors decrease.

Answer

Declare the incident, assign roles, and start a postmortem document.

Question 15

A DevOps team wants to implement a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They need to ensure that each service is built, tested, and deployed independently with minimal manual intervention. Which TWO practices should they implement?

Accepted Answer

Use Cloud Deploy to manage progressive delivery (e.g., canary, blue/green) to GKE clusters.. Uses Cloud Deploy to manage progressive delivery (canary, blue/green) to GKE, enabling safe and gradual rollouts. Option D uses Cloud Build triggers to build and test each service independently on pull request, ensuring isolation and minimal manual intervention. Option B is not correct because Cloud Source Repositories is just a source control repository; it does not directly enable CI/CD independence. Option C is wrong because a monolithic repository with simultaneous deployment contradicts microservices independence. Option E is not best practice as a single config file with conditional steps becomes complex and hard to maintain.

Answer

Use Cloud Source Repositories integrated with Cloud Build for version control and triggering builds.

Answer

Use a monolithic repository and deploy all services simultaneously to ensure consistency.

Answer

Use a single Cloud Build configuration file for all services with conditional steps to handle different services.