PCDOE Practice Exam 3 — 20 Questions

Question 1

An e-commerce platform is using Cloud Load Balancing with a backend service that has a custom health check. The health check is failing intermittently, causing traffic to be routed away from healthy instances. The team has enabled Cloud Logging and wants to diagnose the issue. Which log view should they examine to see the health check probe results?

Accepted Answer

Load balancer logs (type: 'loadbalancing.googleapis.com'). Load balancer logs (type: 'loadbalancing.googleapis.com') contain detailed records of health check probes, including the probe source IP, target instance, response code, and latency. This is the exact log view that captures health check probe results, enabling the team to identify intermittent failures by correlating probe timestamps with instance health status changes.

Answer

VPC flow logs

Answer

Cloud Audit Logs (Admin Activity)

Answer

Instance serial port output logs

Question 2

When bootstrapping a Google Cloud organization for DevOps, which THREE steps are essential to set up a secure CI/CD foundation using Cloud Build?

Accepted Answer

Create a Cloud Source Repository for each application's code.. Creating a Cloud Source Repository for each application's code is essential because it provides a dedicated, version-controlled repository that integrates natively with Cloud Build triggers. This ensures that each application has its own isolated codebase, enabling precise CI/CD pipelines without cross-application interference.

Answer

Disable default service accounts in all projects.

Answer

Configure VPC Service Controls for all projects.

Question 3

Refer to the exhibit. The output shows three folders created directly under the organization node. Which gcloud command was most likely executed to produce this output?

Accepted Answer

gcloud resource-manager folders list --organization=123456789012. Option A is correct because the `gcloud resource-manager folders list --organization=123456789012` command lists all folders directly under the specified organization node. The output shows three folders (e.g., folder1, folder2, folder3) at the top level, which matches the behavior of listing folders with the organization ID as the parent. This command is specifically designed to retrieve immediate child folders of an organization, not nested folders.

Answer

gcloud organizations list

Answer

gcloud projects list --filter='parent.id:123456789012'

Answer

gcloud resource-manager folders list --folder=123456789012

Question 4

Which TWO are valid methods to manage service account keys securely? (Select exactly 2)

Accepted Answer

Automate key rotation using a Cloud Function.. Option B is correct because automating key rotation with a Cloud Function ensures service account keys are rotated on a schedule without manual intervention, reducing the risk of key exposure. This aligns with Google Cloud's best practices for key management, as it enforces rotation policies programmatically and can integrate with Secret Manager to securely store and version keys.

Answer

Rotate keys manually every 90 days.

Answer

Embed keys in application code.

Answer

Store keys in Cloud Storage with public access.

Question 5

Refer to the exhibit. A DevOps engineer tries to create a project but gets this error. What is the most likely cause?

Accepted Answer

The organization has an organizational policy that restricts project creation.. The error message indicates that project creation is blocked by an organizational policy. In Google Cloud, organization policies (e.g., constraints/compute.restrictNonCcmlProjects) can be set at the organization or folder level to restrict project creation. This is a common control for governance and cost management, and it overrides individual user permissions.

Answer

The project ID already exists.

Answer

The user's billing account is not linked.

Answer

The user does not have the Project Creator role.

Question 6

Which THREE steps are typically part of a formal incident postmortem according to Google SRE best practices?

Accepted Answer

Assign action items with deadlines.. Option B is correct because Google SRE postmortems emphasize creating actionable follow-ups to prevent recurrence. Assigning action items with deadlines ensures that identified issues are systematically addressed, which is a core principle of blameless postmortems focused on process improvement rather than punishment.

Answer

Identify the person responsible for the incident.

Answer

Implement a solution immediately.

Question 7

A company uses Error Budgets for their service. The SLO is 99.9% availability over a 30-day window. The service has been down for 30 minutes in the current window. What is the remaining error budget?

Accepted Answer

13.2 minutes. The SLO of 99.9% over a 30-day window allows a total error budget of 43.2 minutes (30 days × 24 hours × 60 minutes × 0.001). The service has already consumed 30 minutes of downtime, so the remaining error budget is 43.2 - 30 = 13.2 minutes. Option C is correct because it reflects this precise calculation.

Answer

43.2 minutes

Answer

60 minutes

Answer

30 minutes

Question 8

A team has configured an uptime check with a 5xx threshold alert. During an incident, the alert fires with severity 'critical'. The team mitigates the issue, but the alert keeps firing for 15 more minutes due to a slow-responding downstream dependency. What should the team do to avoid false alarms in future incidents?

Accepted Answer

Increase the 'duration' field in the alerting policy to require the condition to be true for a longer time before alerting.. Option B is correct because increasing the 'duration' field in the alerting policy ensures that the condition (e.g., 5xx errors) must persist for a longer, defined period before the alert fires. This prevents false alarms from transient issues like a slow-responding downstream dependency that temporarily triggers the threshold but resolves before the alert duration expires. In Google Cloud Monitoring, the duration parameter specifies the minimum time the condition must be true, filtering out short-lived spikes.

Answer

Add a second notification channel to send alerts to a different team.

Answer

Modify the alert condition to check only for 5xx errors and ignore other status codes.

Answer

Decrease the check frequency to every 30 seconds to get faster feedback.

Question 9

Which TWO of the following are best practices for managing incident response on Google Cloud?

Accepted Answer

Establish a clear escalation path and ensure that on-call engineers are aware of their roles.. Option B is correct because a clear escalation path with defined roles ensures that on-call engineers know exactly whom to contact for different severity levels, reducing response time and preventing miscommunication. Google Cloud's operations suite (formerly Stackdriver) supports structured escalation policies through alerting channels and notification routing, making this a foundational best practice for incident management.

Answer

Automatically escalate all incidents to the engineering manager.

Answer

Assign only one engineer to be on call to reduce confusion.

Answer

Use only one notification channel (e.g., email) to keep the team focused.

Question 10

An engineer wants to ensure that an alert is escalated if not acknowledged within 5 minutes. Which feature of Cloud Monitoring can achieve this?

Accepted Answer

Notification channel with escalation configuration.. Notification channels in Google Cloud Monitoring can be configured with an escalation policy that defines a sequence of recipients or notification methods to be contacted if an alert is not acknowledged within a specified time. By setting the escalation duration to 5 minutes, the system automatically escalates the alert to the next tier or channel if no acknowledgment is received, directly meeting the engineer's requirement.

Answer

Incident management tool like PagerDuty.

Answer

Using a webhook notification channel.

Answer

Alerting policy with a condition that checks for acknowledgment.

Question 11

A company wants to reduce costs associated with Cloud Monitoring. They have many custom metrics and high ingestion rates. Which cost optimization strategy is most effective?

Accepted Answer

Delete all unused custom metrics and reduce labels.. Option D is correct because deleting unused custom metrics and reducing labels directly reduces the volume of data ingested and stored, which is the primary cost driver in Cloud Monitoring (formerly Stackdriver). Custom metrics incur charges per data point ingested, and each unique label combination creates additional time series, multiplying costs. This strategy eliminates waste without sacrificing necessary monitoring fidelity.

Answer

Use log-based metrics instead of custom metrics.

Answer

Aggregate metrics into buckets and export to BigQuery for analysis.

Answer

Reduce the sampling rate of all custom metrics to 1 minute.

Question 12

Refer to the exhibit. What is the effect of the metricRelabelings section in this ServiceMonitor?

Accepted Answer

It drops all metrics whose name starts with 'container_'.. The `metricRelabelings` section in a ServiceMonitor uses Prometheus relabeling rules to modify or filter metrics before ingestion. The `action: drop` directive, combined with a `regex: 'container_.*'` pattern matching the metric name, causes all metrics whose names start with 'container_' to be dropped (i.e., not scraped). This is a common pattern to exclude unwanted metrics and reduce cardinality.

Answer

It adds a label called 'container_' to all metrics.

Answer

It only keeps metrics whose name starts with 'container_'.

Answer

It renames all metrics with the prefix 'container_' to remove the prefix.

Question 13

A team is designing a dashboard for their production environment using Cloud Monitoring. Which three types of information should be included on the dashboard to support incident response? (Choose three.)

Accepted Answer

Resource utilization trends. Resource utilization trends (A) are essential for incident response because they provide historical context, enabling responders to identify anomalies, correlate changes with incidents, and predict capacity issues. Cloud Monitoring's Metrics Explorer and dashboards allow you to plot trends over time, which is critical for root cause analysis during an active incident.

Answer

Real-time user feedback

Answer

Security audit logs

Question 14

A team wants to monitor a Google Cloud Run service for application crashes. Which Google Cloud tool automatically captures and notifies on application errors?

Accepted Answer

Error Reporting. Error Reporting (D) is the correct answer because it is a Google Cloud service specifically designed to automatically capture, aggregate, and notify on application errors, including crashes in Cloud Run services. It ingests error events from Cloud Logging and provides real-time alerts and dashboards, making it the dedicated tool for this use case.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

Cloud Console

Question 15

An SRE team needs to define an SLI for a web service's availability SLO of 99.9%. Which metric should they use?

Accepted Answer

Uptime check success rate. Option D is correct because an uptime check success rate directly measures the proportion of time the service is reachable and responding, which aligns with the definition of availability for a 99.9% SLO. This metric is typically derived from synthetic probes or health check endpoints (e.g., HTTP 200 responses) and reflects the binary state of the service being up or down, making it the appropriate SLI for availability.

Answer

Error budget

Answer

CPU utilization

Answer

Request latency (p99)

Question 16

You want to send alerts to a Slack channel when a critical error occurs. What should you do?

Accepted Answer

Configure a Slack webhook notification channel in Cloud Monitoring and associate it with an alerting policy. Option D is correct because Cloud Monitoring alerting policies can directly send notifications to Slack via a configured webhook notification channel. When a critical error triggers the alerting policy, Cloud Monitoring sends an HTTP POST request to the Slack webhook URL, delivering the alert message to the specified Slack channel. This is the native, event-driven approach without requiring custom code or intermediate services.

Answer

Set up a webhook in Cloud Logging and point it to Slack

Answer

Use Cloud Tasks to schedule a job that queries logs and sends Slack messages

Answer

Create a Cloud Logging export to Pub/Sub and subscribe using a Cloud Function that sends to Slack

Question 17

Your team is implementing SLO monitoring. Which TWO tools should they use to create and monitor SLIs?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (option B) is the correct tool for creating and monitoring Service Level Indicators (SLIs) because it allows you to define custom metrics, set up alerting policies, and create dashboards to track the performance of your services. Cloud Logging (option C) is also correct because SLIs often rely on log-based metrics, such as request latency or error counts, which are extracted from log entries using log-based metrics in Cloud Logging. Together, these two tools provide the data ingestion and monitoring capabilities needed to define and observe SLIs.

Answer

Error Reporting

Answer

Cloud Trace

Answer

Cloud Profiler

Question 18

You are designing a monitoring strategy for a cloud-native application. Which THREE components are essential for observability?

Accepted Answer

Metrics. Metrics (A) are essential because they provide quantitative, time-series data about system health and performance, such as CPU utilization, request latency, and error rates. In cloud-native observability, metrics are typically collected via Prometheus or similar systems, enabling trend analysis and threshold-based alerting. Without metrics, you cannot measure the overall state of your application or infrastructure over time.

Answer

Alerts

Answer

Dashboards

Question 19

Based on the exhibit, what does the duration of 300s mean in this alerting policy?

Accepted Answer

The alert fires if CPU utilization is above 80% for at least 5 consecutive minutes.. In the PagerDuty alerting policy shown in the exhibit, the duration of 300s (5 minutes) defines the minimum period during which the CPU utilization must continuously exceed the 80% threshold before the alert fires. This prevents transient spikes from triggering unnecessary alerts. Option A correctly states that the alert fires only if CPU utilization is above 80% for at least 5 consecutive minutes, matching the policy's configuration.

Answer

The alert fires after 300 seconds of sustained CPU utilization above 80% with a count of 1.

Answer

The alert fires if CPU utilization averaged over 5 minutes exceeds 80%.

Answer

The alert fires if CPU utilization is above 80% for any 5-minute window in the last hour.

Question 20

An organization is implementing SLO-based alerting for a critical service. They want to alert when the service has consumed 50% of its error budget over a 30-day window. Considering best practices for alert sensitivity and noise reduction, which alerting approach should they use?

Accepted Answer

Alert on the burn rate over a 1-hour window with a threshold of 10.. Option A is correct because alerting on a burn rate of 10 over a 1-hour window directly indicates that the service is consuming error budget at a rate that would exhaust the entire 30-day budget in 3 days (since 30 days / 10 = 3 days). This approach balances sensitivity and noise reduction by using a sufficiently long window (1 hour) to smooth out transient spikes, while the high threshold ensures only significant sustained degradation triggers an alert, aligning with SRE best practices for multi-window, multi-burn-rate alerting.

Answer

Alert on the burn rate over a 5-minute window with a threshold of 0.5.

Answer

Alert on the error budget remaining with a threshold of 50%.

Answer

Alert on the SLI value directly with a threshold of 99.9%.