PCDOE Practice Exam 2 — 20 Questions

Question 1

A company runs a critical application on Compute Engine instances behind a TCP/UDP Network Load Balancer. They notice intermittent high latency for a subset of users. The application logs show no errors, and instance CPU is below 50%. Which next step is most effective to diagnose the latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze Cloud Monitoring metrics for the load balancer, including backend latency and request counts.. Cloud Monitoring provides detailed metrics for TCP/UDP Network Load Balancers, including backend latency and request counts, which directly help identify whether the latency originates from the load balancer itself or the backend instances. Since instance CPU is below 50% and application logs show no errors, the issue is likely at the network or load balancer level, and these metrics offer the most targeted diagnostic data without changing the architecture.

Answer

Increase the number of instances behind the load balancer.

Answer

Enable VPC Flow Logs and analyze for dropped packets.

Answer

Switch to an HTTP(S) Load Balancer for better visibility.

Question 2

A media streaming service uses Cloud Storage to store video files and serves them via Cloud CDN. Users in Asia report buffering issues. The team notices that the cache hit ratio is low in that region. The origin is a single Cloud Storage bucket in us-central1. Which set of actions would best improve performance for Asian users?

Accepted Answer

Create a new Cloud Storage bucket in an Asian region and use dual-region bucket with Cloud CDN.. Creating a new Cloud Storage bucket in an Asian region and using a dual-region bucket with Cloud CDN reduces latency by serving content from a geographically closer origin, improving cache hit ratios for Asian users. Cloud CDN caches content at edge locations, but if the origin is far away (us-central1), the first miss still incurs high latency. A dual-region bucket provides a local origin for cache misses, significantly reducing round-trip time.

Answer

Use Cloud Load Balancing with Cloud Armor to protect the origin.

Answer

Enable HTTP/2 on Cloud CDN and increase the TTL for video content.

Answer

Configure a custom domain on Cloud CDN with SSL and enable request collapsing.

Question 3

Which Google Cloud service provides a fully managed, private Git repository that integrates with Cloud Build for continuous integration?

Accepted Answer

Cloud Source Repositories. Cloud Source Repositories is the correct answer because it provides fully managed, private Git repositories hosted on Google Cloud. It integrates natively with Cloud Build, enabling automatic triggers for continuous integration (CI) pipelines whenever code is pushed to a repository branch or tag, without requiring external Git hosting.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Container Registry

Question 4

Which TWO of the following are essential elements of a comprehensive incident post-mortem document according to Google's Site Reliability Engineering (SRE) best practices?

Accepted Answer

A timeline of events leading to and during the incident.. A timeline of events is a core element of an incident post-mortem in Google SRE practice, as it provides a chronological reconstruction of the incident's progression, enabling teams to understand the sequence of failures and responses. This timeline is essential for identifying contributing factors and evaluating the effectiveness of mitigation actions, not just the root cause.

Answer

Exact code line numbers and commits that caused the incident.

Answer

A detailed analysis of the root cause only.

Answer

An attribution of blame to the individual or team responsible.

Question 5

Your team is running a high-traffic web application on Google Kubernetes Engine (GKE) and has configured Horizontal Pod Autoscaling (HPA) based on CPU utilization. Recently, the application experienced intermittent latency spikes during traffic bursts. You suspect that the HPA is not scaling quickly enough. Which TWO actions would most effectively improve the autoscaling responsiveness?

Accepted Answer

Configure a custom metric in HPA based on the application's request latency (e.g., p99 latency).. Using a custom metric based on request latency (e.g., p99 latency) allows HPA to react to application performance degradation directly, rather than relying solely on CPU utilization which may lag behind traffic bursts. This provides a more immediate signal for scaling, as latency spikes often precede CPU saturation in web applications. Option D is correct because reducing the --horizontal-pod-autoscaler-upscale-stabilization window (default 5 minutes) to a lower value like 30 seconds decreases the time HPA waits before acting on scale-up recommendations, enabling faster response to sudden load increases.

Answer

Increase the target CPU utilization percentage to 90% so that pods are less likely to be added.

Answer

Set the maxReplicas of the HPA to a value lower than the expected peak traffic to force faster scaling.

Answer

Increase the --horizontal-pod-autoscaler-sync-period flag to 30 seconds and increase the --horizontal-pod-autoscaler-upscale-delay flag to 5 minutes.

Question 6

A GKE cluster node fails, causing pods to be rescheduled. However, some pods remain in 'CrashLoopBackOff' state. After examining logs, you find the application has a dependency on local SSD that was ephemeral. What is the best long-term solution?

Accepted Answer

Use PersistentVolumes with ReadWriteOnce access mode.. The application's dependency on local SSD (ephemeral storage) means that when the node fails, the data is lost, causing the pods to crash. PersistentVolumes (PVs) with ReadWriteOnce (RWO) access mode provide durable, node-independent storage that survives node failures, ensuring pods can be rescheduled on any node and access their data. This is the best long-term solution because it decouples storage from the node lifecycle, preventing CrashLoopBackOff due to missing local data.

Answer

Configure pod anti-affinity.

Answer

Increase the node pool size.

Answer

Use a DaemonSet to run the application.

Question 7

A company uses BigQuery on-demand pricing. They want to reduce costs without changing usage patterns. Which THREE strategies are effective? (Choose three.)

Accepted Answer

Use clustered tables.. Partitioning and clustering reduce data scanned per query. Materialized views precompute results to reduce scanned data on repeated queries.

Answer

Use legacy SQL instead of standard SQL.

Answer

Use flat-rate pricing.

Question 8

A team uses Spanner for a global database. They notice increased read latency and high CPU utilization on some nodes. The workload is read-heavy with occasional writes. Which action is most likely to improve performance?

Accepted Answer

Add more nodes to the instance and ensure read requests are distributed evenly.. In a read-heavy Spanner workload with high CPU utilization on some nodes, adding more nodes and ensuring read requests are distributed evenly (Option D) directly addresses the bottleneck by increasing the instance's compute capacity and spreading the load across all nodes. Spanner's architecture uses a shared-nothing design where each node handles a portion of the data and traffic; uneven distribution can cause hot spots. Adding nodes scales out processing power, and ensuring even distribution (e.g., via proper key design or using Spanner's built-in load balancing) reduces latency and CPU spikes on individual nodes.

Answer

Create read-only replicas in each region.

Answer

Split the most frequently read tables into smaller tables.

Answer

Increase the number of nodes in the instance.

Question 9

A team is troubleshooting a slow response time on an App Engine standard environment application. The application uses Cloud SQL as its database. Which TWO actions should the team take to identify the bottleneck?

Accepted Answer

Examine App Engine request logs for latency patterns.. Examining App Engine request logs reveals latency patterns, such as which endpoints or operations are slow, helping to pinpoint whether the bottleneck is in the application code, network, or database. Option C is correct because enabling Cloud SQL slow query logging identifies long-running SQL queries that could be causing database contention or inefficient data retrieval, directly addressing a common performance bottleneck in App Engine applications using Cloud SQL.

Answer

Increase the number of App Engine instances.

Answer

Enable Cloud CDN to cache responses.

Answer

Disable caching to ensure fresh data.

Question 10

A team uses Cloud SQL for PostgreSQL. They receive an alert that the database's CPU utilization is above 95% for the past 30 minutes. Queries are taking longer than usual. They want to investigate without causing further impact. What should they do first?

Accepted Answer

Use Cloud SQL Query Insights to find the most time-consuming queries. Cloud SQL Query Insights is a managed monitoring tool that automatically captures and analyzes query performance metrics, including CPU consumption, latency, and execution plans. In this scenario, it allows the team to identify the specific queries causing high CPU utilization without making any changes to the instance, thus avoiding further impact. This is the first and safest diagnostic step before any remediation.

Answer

Increase the number of vCPUs of the Cloud SQL instance

Answer

Restart the Cloud SQL instance to clear the cache

Answer

Migrate the database to Cloud Spanner

Question 11

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Accepted Answer

Identify time, then Clone, then Verify, then Promote, then Update connections. The correct sequence for recovering a Google Cloud SQL instance from a point-in-time backup is: first, identify the exact point-in-time to recover; second, clone the instance to that time; third, verify the cloned instance's data; fourth, promote the clone to become the primary instance; and fifth, update application connections to use the new primary. This order ensures a consistent and verifiable recovery process.

Answer

Clone, then Identify time, then Verify, then Promote, then Update connections

Answer

Identify time, then Clone, then Promote, then Verify, then Update connections

Answer

Clone, then Identify time, then Promote, then Verify, then Update connections

Question 12

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Organization Policies can enforce that all new projects must have specific labels by using a constraint like `constraints/compute.requireOsLogin` is not for labels, but you can use a custom constraint with the `constraints/gcp.resourceLabels` to require labels on resources. However, for projects themselves, you can use an organization policy with a list constraint to mandate that certain labels are present on all projects, and the policy will block creation of any project that does not comply.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 13

Refer to the exhibit. A DevOps engineer applies this Terraform configuration but gets an error: "Error creating Project: googleapi: Error 403: The caller does not have permission to enable services". What is the most likely cause?

Accepted Answer

The service account used by Terraform lacks the Service Usage Admin role on the project.. The error 'The caller does not have permission to enable services' indicates that the identity (service account) used by Terraform to authenticate with the Google Cloud API lacks the required IAM permission to enable Google APIs on the project. The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) grants the necessary permissions, including serviceusage.services.enable and serviceusage.services.list, which are required to enable services like the Compute Engine API during resource creation. Without this role, the API call to enable services fails with a 403 error.

Answer

The org_id is incorrect.

Answer

The organization requires that the Compute Engine API be enabled before project creation.

Answer

The project ID already exists.

Question 14

A DevOps team wants to optimize resource utilization for their GKE deployment. Which built-in Kubernetes resource can automatically adjust CPU and memory requests based on historical usage?

Accepted Answer

VerticalPodAutoscaler. The VerticalPodAutoscaler (VPA) is the correct choice because it automatically adjusts CPU and memory resource requests (and limits) for pods based on historical usage data, optimizing resource utilization without manual intervention. Unlike the HorizontalPodAutoscaler, which scales the number of pods, the VPA modifies the resource specifications of existing pods to match observed demand.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

PodDisruptionBudget

Question 15

You are an on-call engineer responding to a critical service incident affecting a production application. According to Google's Incident Management best practices, which TWO actions should you take immediately after declaring the incident?

Accepted Answer

Communicate the incident status to stakeholders and affected teams.. Google's Incident Management best practices emphasize that immediately after declaring an incident, the on-call engineer must communicate the incident status to stakeholders and affected teams. This ensures that everyone is aware of the ongoing issue, sets expectations, and prevents redundant troubleshooting. Early communication also helps in coordinating response efforts and reducing confusion during the critical initial phase.

Answer

Notify the incident commander to take over coordination.

Answer

Begin documenting the incident for a postmortem report.

Answer

Roll back the latest deployment to the previous stable version.

Question 16

After deploying a new version of a Cloud Run service, the team notices an increase in 5xx errors. They want to quickly revert to the previous version while minimizing user impact. What is the recommended approach?

Accepted Answer

Use Cloud Run's traffic management to set 100% of traffic to the previous revision.. Cloud Run supports traffic splitting between revisions, allowing you to instantly route 100% of traffic to the previous revision without redeploying. This minimizes user impact because the rollback is immediate and does not require rebuilding or re-pulling container images. Option D is correct because it leverages Cloud Run's built-in traffic management feature for zero-downtime rollbacks.

Answer

Set the minimum number of instances of the new revision to 0.

Answer

Redeploy the previous version from the container registry.

Answer

Modify the ingress settings to restrict traffic to the new revision.

Question 17

An engineer wants to ensure that an alert is escalated if not acknowledged within 5 minutes. Which feature of Cloud Monitoring can achieve this?

Accepted Answer

Notification channel with escalation configuration.. Notification channels in Google Cloud Monitoring can be configured with an escalation policy that defines a sequence of recipients or notification methods to be contacted if an alert is not acknowledged within a specified time. By setting the escalation duration to 5 minutes, the system automatically escalates the alert to the next tier or channel if no acknowledgment is received, directly meeting the engineer's requirement.

Answer

Incident management tool like PagerDuty.

Answer

Using a webhook notification channel.

Answer

Alerting policy with a condition that checks for acknowledgment.

Question 18

A team uses Cloud Build with a Kaniko builder to containerize their application. The build fails with the error: 'failed to push to destination: failed to get credentials: failed to get credential from metadata service: failed to fetch metadata...' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the storage.objectAdmin role on the Container Registry bucket.. The error indicates that Kaniko cannot authenticate to push the built image to Container Registry. Kaniko uses the Cloud Build service account's credentials to authenticate with the registry. By default, the Cloud Build service account has the storage.objectViewer role on the Container Registry bucket, which allows pulling images but not pushing. To push, the service account needs the storage.objectAdmin or storage.objectCreator role on the bucket. Option D correctly identifies this missing permission as the most likely cause.

Answer

Kaniko requires a running Docker daemon in the build step.

Answer

The base image specified in the Dockerfile is not accessible from the build environment.

Answer

The Dockerfile has an invalid instruction causing Kaniko to fail.

Question 19

A DevOps engineer is responsible for cost optimization of GKE clusters. They have identified that many nodes are underutilized. What is the best approach to reduce costs without impacting availability?

Accepted Answer

Enable cluster autoscaler to automatically scale down nodes. Cluster autoscaler automatically scales down nodes when they are underutilized. Option B is manual and not scalable. Option C may cause disruptions. Option D reduces availability.

Answer

Use spot VMs for all node pools

Answer

Delete underutilized nodes manually

Answer

Migrate to a single zone cluster

Question 20

A company runs a CI/CD pipeline using Cloud Build and Cloud Deploy for a web application. The pipeline builds a container image, pushes it to Artifact Registry, and then deploys it to a GKE cluster using Cloud Deploy. Recently, the deployment step started failing with the error: 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry.' The container image is built in the same project as the target cluster. The Cloud Build service account has been granted the roles/cloudbuild.builds.builder and roles/artifactregistry.admin on the project. The DevOps engineer verified that the image exists in Artifact Registry and the path is correct. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Ensure that the Cloud Deploy delivery pipeline references the correct image path, including the project ID and repository.. The error 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry' indicates that the Cloud Deploy delivery pipeline is referencing an image path that does not match the actual location of the image. Even though the image exists in Artifact Registry and the path appears correct, Cloud Deploy validates the image reference (including project ID, repository name, and image tag) against the target project's registry. The engineer must ensure the delivery pipeline YAML or configuration explicitly specifies the correct full image path, including the project ID and repository, so that Cloud Deploy can resolve and verify the image during release creation.

Answer

Reconfigure Cloud Build to store images in a different Artifact Registry repository.

Answer

Grant the Cloud Deploy service account the roles/artifactregistry.reader role on the project.

Answer

Change the Cloud Build service account to include the roles/clouddeploy.jobRunner role.