PCDOE Practice Exam 3 — 20 Questions

Question 1

Your organization is adopting DevOps practices and needs to bootstrap a Google Cloud organization with multiple projects. You want to enforce consistent resource naming conventions and apply common organization policies across all projects. Which two services should you use together to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Organization Policies and Resource Manager folders. To enforce consistent resource naming conventions and common organization policies across all projects, you need Organization Policies (via constraints) and Resource Manager folders. Organization Policies allow you to set rules such as custom naming constraints or disabling external IPs that apply across the entire resource hierarchy. Resource Manager folders help organize projects and can inherit policies. Service Accounts and IAM roles (C) control access but do not enforce naming conventions or policies directly. Therefore, only option D provides the appropriate services to achieve the goal.

Answer

Cloud Shell and Cloud Source Repositories

Answer

Cloud Deployment Manager and Cloud Audit Logs

Answer

Service Accounts and IAM roles

Question 2

Refer to the exhibit. What does this recommendation suggest?

Accepted Answer

Upgrade the instance.. The description explicitly states to upgrade the instance from n1-standard-2 to n1-standard-4, indicating a need for more resources.

Answer

Change the instance to preemptible.

Answer

Delete the instance.

Answer

Downgrade the instance.

Question 3

You are the SRE for a financial services application running on Google Cloud. Users report that certain transactions are taking over 10 seconds, while most complete in under 200ms. You use Cloud Profiler and Cloud Trace. Upon reviewing the profiler data, you see a hotspot in a method that calls a Cloud SQL database with a slow query. You identify the query and create an index to speed it up. However, you cannot deploy the index change immediately due to change management processes. The incident response team needs to mitigate the impact now. Which temporary measure should you take?

Accepted Answer

Implement caching of query results using Cloud Memorystore.. Caching the results of the slow query in Cloud Memorystore (Redis) immediately reduces the load on the Cloud SQL database and eliminates the need to execute the slow query repeatedly. This provides a temporary performance improvement without requiring any database schema changes or deployments, bypassing the change management delay. The hotspot in the profiler indicates the query itself is the bottleneck, and caching avoids that bottleneck entirely for repeated reads.

Answer

Increase the database connection pool size in the application.

Answer

Add a database read replica to offload read queries.

Answer

Scale up the Cloud SQL instance to more vCPUs.

Question 4

Refer to the exhibit. The DevOps team is trying to create a new service account key. The operation fails with a permission error. What is the most likely cause?

Accepted Answer

The organization policy prevents uploading service account keys.. Organization policies can explicitly restrict the creation of service account keys at the organization, folder, or project level. When a key upload fails with a permission error despite the user having the necessary IAM roles, the most likely cause is an organization policy constraint such as `iam.disableServiceAccountKeyUpload` that blocks the operation. This policy overrides any IAM permissions granted to the user.

Answer

The project-level IAM denies the action.

Answer

The service account is disabled.

Answer

The service account lacks the iam.serviceAccountKeys.create permission.

Question 5

Match each Google Cloud tool to its function in incident management.

Accepted Answer

Cloud Logging: Collect and store log data from applications and services.. In incident management, Cloud Logging collects logs, Cloud Monitoring provides metrics and alerts, Error Reporting aggregates errors, and Cloud Trace traces requests. Common confusions include mixing Cloud Logging with monitoring or debugger functions.

Answer

Cloud Logging: Provide visibility into performance and health.

Answer

Cloud Debugger: Store and analyze logs.

Question 6

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Accepted Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Define delivery pipeline → Step 4: Push code → Step 5: Promote. The correct order for setting up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service begins with creating a build configuration file (cloudbuild.yaml) that specifies how to build and test the application. Next, you set a trigger (e.g., on push to a branch) in Cloud Build to automatically start builds. Then, you define a delivery pipeline in Cloud Deploy with targets (e.g., staging, production) and approval gates. After that, you push code to the repository, which triggers the build and, if successful, creates a release in the delivery pipeline. Finally, you promote the release through the stages (e.g., from staging to production) either automatically or after manual approval. This order ensures each prerequisite is in place before the next step, enabling a seamless automated workflow.

Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Push code → Step 4: Define delivery pipeline → Step 5: Promote

Answer

Step 1: Define delivery pipeline → Step 2: Create build config → Step 3: Set trigger → Step 4: Push code → Step 5: Promote

Answer

Step 1: Push code → Step 2: Create build config → Step 3: Set trigger → Step 4: Define delivery pipeline → Step 5: Promote

Question 7

Arrange the steps to troubleshoot a high latency issue on a Google Cloud HTTP(S) Load Balancer.

Accepted Answer

Check health checks, then review load balancer logs, then analyze metrics, then identify the problematic backend, then take corrective action.. Start with health checks, then logs, metrics, identify culprit, and take action.

Answer

Analyze metrics, then review logs, then check health checks, then identify the problematic backend, then take corrective action.

Answer

Check health checks, then identify the problematic backend from logs, then take corrective action, then analyze metrics, then verify.

Answer

Review logs, then analyze metrics, then identify the problematic backend, then take corrective action.

Question 8

Arrange the steps to set up a Google Cloud Monitoring alerting policy for a Compute Engine instance.

Accepted Answer

Create notification channel, then define condition, set evaluation parameters, attach the channel, then save.. First create a notification channel, then define the condition, set evaluation parameters, attach the channel, and save.

Answer

Save, then attach the channel, set evaluation parameters, define condition, then create notification channel.

Answer

Define condition, then create notification channel, attach the channel, set evaluation parameters, then save.

Answer

Create notification channel, set evaluation parameters, define condition, attach the channel, then save.

Question 9

Match each Kubernetes resource to its role in a DevOps pipeline.

Accepted Answer

Pod: Smallest deployable unit, runs containers.. Key Kubernetes objects for application management. Pod runs containers, Deployment manages replicas and updates, Service provides stable networking, ConfigMap stores non-sensitive configuration, and Ingress controls external HTTP access.

Answer

Pod: Provides stable IP and DNS for a set of pods.

Answer

Deployment: Stores configuration data as key-value pairs.

Answer

ConfigMap: Manages external HTTP access to services.

Question 10

A Cloud Build pipeline uses the above cloudbuild.yaml. When triggered, the deploy step fails with: 'ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.update' denied on resource.' The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely cause?

Accepted Answer

The nested 'gcloud builds submit' command runs with a different service account that does not have the Cloud Run Admin role.. When a Cloud Build pipeline uses a nested `gcloud builds submit` command, the nested build runs under the default Compute Engine service account (or a user-specified service account) rather than the top-level Cloud Build service account. Even if the top-level service account has the Cloud Run Admin role, the nested build's service account may lack the `run.services.update` permission, causing the deploy step to fail with PERMISSION_DENIED.

Answer

The substitution variable ${_ENV} is not properly passed to the nested build.

Answer

The 'gcr.io/cloud-builders/gcloud' image does not support the 'gcloud run deploy' command.

Answer

The Cloud Build service account at the top level does not have the 'run.services.update' permission.

Question 11

Which TWO tools should be used for real-time incident collaboration and communication?

Accepted Answer

Cloud Monitoring Incident Response (beta).. Cloud Monitoring Incident Response (beta) provides a dedicated interface for real-time incident management, including automated notifications, escalation policies, and a centralized timeline for collaboration. Google Chat with a dedicated incident room enables real-time communication and coordination among incident responders, allowing them to share updates, logs, and runbooks in a structured channel. Together, these tools fulfill the need for both incident orchestration and synchronous collaboration during active incidents.

Answer

Google Meet only.

Answer

Jira.

Answer

Cloud Trace.

Question 12

A team needs to monitor the availability of an HTTPS endpoint that requires a Bearer token in the request header. What is the simplest way to configure this with Cloud Monitoring?

Accepted Answer

Configure the Uptime Check to include a custom header with the Bearer token.. Cloud Monitoring's Uptime Checks natively support custom HTTP headers, including Authorization headers with Bearer tokens. This allows you to directly monitor an authenticated HTTPS endpoint without any additional infrastructure, scripting, or log-based workarounds. It is the simplest and most straightforward configuration for this requirement.

Answer

Deploy a sidecar container that handles the authentication and exposes a plain endpoint.

Answer

Use a synthetic monitor from Cloud Monitoring that handles authentication via a script.

Answer

Export the endpoint logs to Cloud Logging and set up a log-based metric for availability.

Question 13

You are a Site Reliability Engineer (SRE) for an e-commerce platform running on Google Kubernetes Engine (GKE) with a microservices architecture. Your team uses Cloud Monitoring for alerting and Cloud Logging for centralized logs. Recently, during a flash sale event, you observed intermittent latency spikes in the checkout service, causing checkout failures and abandoned carts. The latency spikes last 1-2 seconds and occur roughly every 5-10 minutes during peak traffic. The checkout service runs as a Deployment with 10 replicas, each with resource requests of 500m CPU and 512Mi memory. The service has a Service Level Objective (SLO) of 99.9% of requests completing in under 1 second (p99 latency < 1s). Current p99 latency is 2.1s during peak. You reviewed the Cloud Monitoring dashboard and noticed that CPU utilization across pods is around 60%, memory around 50%, and there are no OOM kills. The logs show occasional 'connection reset by peer' errors in the checkout service logs, but no consistent pattern. You suspect the issue might be related to the database (Cloud SQL) or a downstream dependency. After checking the database, you find that query latency is normal. You also notice that the checkout service makes a synchronous HTTP call to a payment validation service that runs as a separate Deployment with 3 replicas. The payment service's p99 latency is 500ms, but its error rate is below 1%. Your task is to identify the most likely cause of the intermittent latency spikes and propose a remediation. Which action should you take first?

Accepted Answer

Check the garbage collection logs of the checkout service pods to identify if long GC pauses coincide with the latency spikes.. The intermittent latency spikes every 5-10 minutes with no CPU/memory pressure or database issues strongly suggest a periodic process like garbage collection. Java-based services (common in microservices) can experience stop-the-world GC pauses that cause latency spikes of 1-2 seconds, matching the observed pattern. Checking GC logs is the fastest way to confirm this before making architectural changes.

Answer

Increase the number of replicas of the payment validation service to 10 to handle peak load.

Answer

Enable connection pooling and retries with exponential backoff in the checkout service for the HTTP call to the payment service.

Answer

Investigate the checkout service pod restarts due to liveness probe failures, as 'connection reset by peer' indicates pod instability.

Question 14

Which GCP tool provides recommendations for rightsizing Compute Engine VMs?

Accepted Answer

Recommender.. The Recommender tool in GCP uses machine learning to analyze historical usage patterns and provides actionable recommendations, including rightsizing suggestions for Compute Engine VMs. It identifies underutilized VMs and suggests optimal machine types to reduce costs without compromising performance, making it the correct choice for this task.

Answer

Cloud Console Cost Table.

Answer

Cloud Monitoring.

Answer

Cloud Billing Reports.

Question 15

A company deploys a microservices application on Google Kubernetes Engine (GKE). They notice increased latency during peak hours. The application uses a Cloud SQL database for state. The team wants to optimize service performance. What should they do first?

Accepted Answer

Enable Cloud SQL connection pooling.. The primary bottleneck during peak hours for a microservices application using Cloud SQL is often the number of database connections. Connection pooling reuses a fixed set of connections, reducing the overhead of establishing new connections and preventing connection exhaustion, which directly addresses increased latency without requiring architectural changes.

Answer

Implement a caching layer with Memorystore.

Answer

Move the database to Cloud Spanner.

Answer

Increase the number of replicas in the GKE deployment.

Question 16

A DevOps team is migrating their infrastructure to Google Cloud. They have a complex environment with multiple VPC networks, shared services, and separate development and production projects. They want to bootstrap a new organization that supports: (1) centralized network management with shared VPC, (2) separate folders for dev and prod, (3) consistent firewall rules across all projects, (4) a single Cloud NAT for outbound traffic. They have an existing on-premises VPN that must connect to all projects. What is the most efficient approach?

Accepted Answer

Create a host project for Shared VPC, attach all projects as service projects, and configure Cloud NAT and VPN in the host project. Use organization policies to enforce firewall rules.. Shared VPC allows you to create a host project that centrally manages network resources (VPC, subnets, firewall rules, Cloud NAT, VPN) while attaching development and production projects as service projects. This satisfies all requirements: centralized network management, separate folders for dev/prod, consistent firewall rules via organization policies, a single Cloud NAT for outbound traffic, and a single VPN connection to on-premises that routes to all service projects through the host project's VPC.

Answer

Create separate VPCs for each project and peer them all together, then configure Cloud NAT and VPN in each project.

Answer

Use a single project for all environments and rely on VPC subnets and firewall rules to isolate workloads.

Answer

Create a folder for networking and a folder for projects, then use a Cloud VPN appliance from the Marketplace.

Question 17

A company uses a Shared VPC and wants to enforce a set of firewall rules across all projects in a folder. They want these rules to be immutable by project owners. Which approach should they use?

Accepted Answer

Use hierarchical firewall policies at the folder level.. Hierarchical firewall policies allow you to enforce firewall rules at the folder level, which are inherited by all projects within that folder. These policies are immutable by project owners because they are managed at the folder level, not the project or VPC level, and cannot be overridden or deleted by lower-level roles unless explicitly granted permission.

Answer

Use network tags and service accounts to enforce rules.

Answer

Use organization policy constraints to prevent project owners from modifying firewall rules.

Answer

Create firewall rules at the VPC level and assign them to the folder.

Question 18

A company uses Cloud Build for CI/CD. They want to allow Cloud Build to deploy to Cloud Run. What is the minimum IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs permission to create and manage Cloud Run resources, including deploying new revisions. The `roles/run.admin` role provides full control over Cloud Run services, which is the minimum required for deployment. The `roles/cloudbuild.builds.builder` role only allows building and managing Cloud Build triggers, not deploying to Cloud Run.

Answer

roles/cloudbuild.builds.builder

Answer

roles/editor

Answer

roles/run.invoker

Question 19

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the roles/run.admin role.. The Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) requires the roles/run.admin role to deploy to Cloud Run. This role grants permission to create, update, and manage Cloud Run services. Without it, the deployment step fails with a 'Permission denied' error, even though the build itself succeeds.

Answer

The Cloud Run service account lacks the roles/cloudbuild.builds.builder role.

Answer

The trigger is missing the required deployment configuration.

Answer

The cloudbuild.yaml file has an incorrect image tag.

Question 20

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

Accepted Answer

Grant Cloud Build service account access to secrets via IAM.. A is correct because Cloud Build's service account must be granted IAM roles (e.g., roles/secretmanager.secretAccessor) on the Secret Manager secret to allow the pipeline to retrieve the secret value at build time. Without explicit IAM binding, the service account lacks permission to access the secret, causing the build to fail. This follows the principle of least privilege and ensures that only authorized identities can read secrets.

Answer

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Answer

Base64 encode secrets and store them in Cloud Build substitutions.