PCDOE Practice Test 20 — 15 Questions

Question 1

A multinational corporation has multiple development teams working on microservices deployed to GKE clusters. They want to implement a CI/CD pipeline that ensures every container image is scanned for vulnerabilities, passes unit tests, and gets a security approval before deployment to production. They are using Cloud Build for CI and Cloud Deploy for CD. The current pipeline triggers on code push to any branch. The security team requires that all production deployments be reviewed and approved by the security team. Which set of actions best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Cloud Build triggers only for the main branch. Use Cloud Build to build and push images, then rely on Artifact Registry's automatic Container Analysis scanning. In Cloud Deploy, add a manual approval gate for the production phase.. Configuring Cloud Build triggers only for the main branch reduces unnecessary builds; using Cloud Build to build and push images, then relying on Artifact Registry's automatic Container Analysis scanning, ensures vulnerability scanning occurs after image push. Cloud Deploy's manual approval gate for the production phase satisfies the security team's requirement for review and approval before deployment. Option A is incorrect because Cloud Build's built-in approval feature applies to the build process, not to deployments, and it doesn't integrate with Container Analysis; plus, running all steps in a single step is inefficient. Option B is incorrect because granting editor role to a security team member is not a proper approval mechanism; it would give too many permissions and doesn't enforce a review process. Option D is incorrect because using a Cloud Function triggered by Pub/Sub for approval bypasses proper deployment pipelines and lacks the structured approval workflow provided by Cloud Deploy.

Answer

Run all tests and scans in a single Cloud Build step and use Cloud Build's built-in approval feature to require a reviewer before pushing to Artifact Registry.

Answer

Run vulnerability scans in the Cloud Build step before building the image, and add a security team member to the project as an editor to approve deployments.

Answer

Use Cloud Build to run tests and scans, then have Cloud Build send a notification to a Cloud Pub/Sub topic that triggers a Cloud Function to approve the deployment.

Question 2

A team uses a monorepo with multiple microservices in separate directories. They want to build only the changed service(s) when a push occurs to the repo. How can they achieve this efficiently?

Accepted Answer

Create multiple Cloud Build triggers, each with a different includeFiles filter matching the service directory.. Cloud Build triggers can be configured with includeFiles filters to trigger only when files in a specific directory change, allowing each microservice to build independently. Option A builds all services, which is inefficient for a monorepo with multiple microservices. Option B uses Cloud Functions to invoke Cloud Build, adding unnecessary complexity and overhead. Option D relies on dynamic detection with git diff, which is not a built-in feature of Cloud Build triggers and would require custom scripting.

Answer

Use a single Cloud Build trigger with a Dockerfile build step that builds all services.

Answer

Use Cloud Functions to invoke Cloud Build per changed directory.

Answer

Use a Cloud Build trigger with a build config that dynamically detects changes using git diff.

Question 3

A company's Cloud SQL for PostgreSQL instance is experiencing performance degradation. They observe a high number of idle connections and slow transaction commit times. Which combination of actions will most effectively address this issue?

Accepted Answer

Configure statement timeout and use PgBouncer for connection pooling.. The high number of idle connections and slow transaction commit times indicate connection management and resource contention issues. PgBouncer reduces overhead by pooling and reusing database connections, while statement timeout prevents long-running queries from holding locks and consuming resources, directly addressing both symptoms.

Answer

Add a read replica and route read-only queries to it.

Answer

Increase the storage size and enable automatic backup.

Answer

Drop unused indexes and run VACUUM.

Question 4

A startup runs a batch data processing job every night. The job processes large datasets and takes about 6 hours to complete. The job is designed to handle interruptions gracefully by saving checkpoint files to Cloud Storage every few minutes. The startup wants to minimize compute costs. The current setup uses a managed instance group with 10 n1-standard-4 VMs running for the entire 6-hour window. They are considering using preemptible VMs. However, they are concerned about cost stability and potential preemption. What should they do?

Accepted Answer

Use preemptible VMs for all instances, as the job can resume from checkpoints.. The job is fault-tolerant and can resume from checkpoints, making preemptible VMs suitable and significantly cheaper. Option A is not relevant as sole-tenant nodes do not reduce cost. Option B adds unnecessary complexity and still uses regular VMs. Option D requires a long-term commitment and is more expensive than preemptible VMs.

Answer

Use sole-tenant nodes to improve performance.

Answer

Use a mix of preemptible and regular VMs to ensure at least some progress if preempted.

Answer

Use regular VMs with committed use discounts for a 1-year term.

Question 5

You need to monitor the health of an external HTTP endpoint. Which resource should you create?

Accepted Answer

Uptime check in Cloud Monitoring. To monitor the health of an external HTTP endpoint, you need a service that can reach the endpoint from outside your VPC and provide alerting and visibility. Cloud Monitoring's Uptime Check is specifically designed for this purpose: it verifies that an external HTTP(S) endpoint is reachable and responsive, and can trigger alerting policies based on the results. This is the correct resource because it operates from Google's infrastructure, not from within your project, and directly supports external endpoint monitoring.

Answer

Load balancer with a health probe

Answer

Internal health check in Compute Engine

Answer

Cloud Logging log-based metric

Question 6

Match each CI/CD concept to its definition.

Accepted Answer

Continuous Integration: The practice of frequently merging code changes into a shared repository, verified by automated builds and tests.. Continuous Integration focuses on frequent merging and automated testing; Continuous Delivery extends to staging deployment with manual production release; Continuous Deployment automates production releases. Common confusions arise from mixing these definitions.

Answer

Continuous Integration: The practice of automatically deploying code to production after each change.

Answer

Continuous Delivery: The practice of merging code changes frequently into a shared repository.

Question 7

Order the steps to respond to a Google Cloud security incident involving a compromised service account key.

Accepted Answer

Revoke key, then rotate key, then audit logs, then assess impact, then update policies.. The correct order for responding to a compromised service account key is: first revoke the key to stop unauthorized use, then rotate (reissue) a new key to restore legitimate access, then audit logs to understand the scope, then assess the impact on resources, and finally update security policies to prevent future incidents. This sequence balances containment, recovery, investigation, and improvement.

Answer

Audit logs, then revoke key, then rotate key, then assess impact, then update policies.

Answer

Rotate key, then revoke key, then audit logs, then assess impact, then update policies.

Answer

Revoke key, then audit logs, then rotate key, then assess impact, then update policies.

Question 8

Match each Cloud Monitoring metric type to its description.

Accepted Answer

Gauge: A metric that measures a value at a specific point in time.. The correct matches are: Gauge measures a point-in-time value, Cumulative measures accumulated value over time, and Delta measures rate of change. Common confusions include swapping definitions between gauge and cumulative, or misunderstanding delta as cumulative.

Answer

Gauge: A metric that measures an accumulated value over time.

Answer

Cumulative: A metric that measures a value at a specific point in time.

Answer

Delta: A metric that measures an accumulated value over time.

Question 9

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud Build: Continuous integration/continuous delivery platform. The correct matches are: Cloud Build for CI/CD, Cloud Source Repositories for Git hosting, Cloud Functions for event-driven serverless functions, and Cloud Run for serverless containers. Common confusions include swapping the purposes of Cloud Build and Cloud Source Repositories.

Answer

Cloud Build: Private Git repository hosting

Answer

Cloud Source Repositories: Continuous integration/continuous delivery platform

Question 10

During a Cloud Build pipeline, a build step fails because the Docker image tag already exists in Container Registry. The team wants to avoid overwriting tags. What is the best practice to resolve this?

Accepted Answer

Use the commit SHA as the image tag in the build step.. Using the commit SHA as the image tag guarantees uniqueness because each commit produces a distinct SHA. This prevents tag collisions in Container Registry without overwriting, as the SHA is immutable for that commit. It also provides traceability back to the exact source code version that produced the image.

Answer

Specify the :latest tag and always push to that tag.

Answer

Add a step to pull the image before building to ensure it's present.

Answer

Configure the build to retry on failure with a backoff.

Question 11

A company wants to ensure that all projects in the organization have Cloud Resource Manager API enabled. What is the most efficient method?

Accepted Answer

Set an organization policy to require the API.. Organization policies allow you to enforce constraints across all projects in the organization, ensuring the Cloud Resource Manager API is enabled automatically and cannot be disabled. This is the most efficient method as it requires no manual intervention or scripting, and it leverages the native Google Cloud policy framework to enforce compliance at scale.

Answer

Use a Cloud Scheduler job to enable the API in new projects.

Answer

Enable the API manually in each project.

Answer

Use a Terraform script that iterates over all projects.

Question 12

A company needs to monitor custom application metrics from Compute Engine instances. Which TWO methods can be used?

Accepted Answer

Install Cloud Monitoring agent on instances. The Cloud Monitoring agent is specifically designed to collect custom application metrics from Compute Engine instances and send them to Cloud Monitoring. It supports both third-party applications and custom metrics via its built-in integration with collectd and a configuration interface for defining custom metrics. This is the standard, supported method for monitoring custom metrics from VMs.

Answer

Use the deprecated Stackdriver Agent

Answer

Use Cloud Trace

Answer

Install Cloud Logging agent

Question 13

A DevOps engineer runs the command above and gets the output shown. What does this output indicate?

Accepted Answer

An application running on the instance encountered a connection timeout to a backend service.. The output shows a 'Connection timed out' error when attempting to reach a backend service. This indicates that the application on the instance is unable to establish a TCP connection to the specified IP and port, typically due to network issues, firewall rules, or the backend service being down. The error is specific to application-level connectivity, not disk space or authentication.

Answer

The instance's disk is full, causing write errors.

Answer

The instance failed to authenticate with the metadata server.

Answer

A health check probe failed to reach the instance.

Question 14

A data engineering team runs frequent aggregation queries on a large BigQuery table. Query performance is slow and costs are high. Which optimization technique would best improve performance and reduce cost?

Accepted Answer

Use materialized views for pre-aggregated results. Materialized views pre-compute and store the results of frequent aggregation queries, allowing BigQuery to serve subsequent queries directly from the cached results rather than scanning the entire base table. This drastically reduces the amount of data processed, lowering both query latency and cost (since BigQuery charges by bytes processed). For repeated aggregation patterns, this is the most effective optimization.

Answer

Convert to non-partitioned table

Answer

Use clustering on the partition key

Answer

Increase the number of slots in the reservation

Question 15

A startup is bootstrapping a Google Cloud organization for DevOps. They need to create a project for their CI/CD tooling and a separate project for logging and monitoring. What is the recommended way to structure the resource hierarchy?

Accepted Answer

Create a folder called 'DevOps' and place both projects inside it, sharing a billing account.. The recommended Google Cloud resource hierarchy for DevOps bootstrapping is to create a folder (e.g., 'DevOps') under the organization node and place both projects inside it. This structure allows centralized policy inheritance (e.g., IAM, org policies) and shared billing via a single billing account, while maintaining logical separation between CI/CD and logging/monitoring workloads. It aligns with Google's best practices for multi-project isolation without unnecessary organizational complexity.

Answer

Create a single project for all workloads and use labels to differentiate environments.

Answer

Create both projects directly under the organization node, with separate billing accounts.

Answer

Create a separate organization for each project to ensure isolation.