PCDOE Practice Test 21 — 15 Questions

Question 1

Match each cost optimization practice to its description.

Question 2

A Cloud Build pipeline uses the above cloudbuild.yaml. When triggered, the deploy step fails with: 'ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.update' denied on resource.' The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely cause?

Accepted Answer

The nested 'gcloud builds submit' command runs with a different service account that does not have the Cloud Run Admin role.. Option B is correct because when a Cloud Build pipeline uses a nested `gcloud builds submit` command, the nested build runs under the default Compute Engine service account (or a user-specified service account) rather than the top-level Cloud Build service account. Even if the top-level service account has the Cloud Run Admin role, the nested build's service account may lack the `run.services.update` permission, causing the deploy step to fail with PERMISSION_DENIED.

Answer

The substitution variable ${_ENV} is not properly passed to the nested build.

Answer

The 'gcr.io/cloud-builders/gcloud' image does not support the 'gcloud run deploy' command.

Answer

The Cloud Build service account at the top level does not have the 'run.services.update' permission.

Question 3

Which GCP tool provides recommendations for rightsizing Compute Engine VMs?

Accepted Answer

Recommender.. The Recommender tool in GCP uses machine learning to analyze historical usage patterns and provides actionable recommendations, including rightsizing suggestions for Compute Engine VMs. It identifies underutilized VMs and suggests optimal machine types to reduce costs without compromising performance, making it the correct choice for this task.

Answer

Cloud Console Cost Table.

Answer

Cloud Monitoring.

Answer

Cloud Billing Reports.

Question 4

A company is setting up a new Google Cloud organization for DevOps. They want to enforce that all projects have a specific set of VPC Service Controls perimeters. Which approach should they use to ensure these perimeters are automatically applied to all new projects?

Accepted Answer

Define an organization policy with a constraint that requires all projects to be within a perimeter.. Option B is correct because Google Cloud Organization Policies allow you to define and enforce constraints at the organization, folder, or project level. The `constraints/compute.restrictVpcServiceControls` constraint can be set to require all new projects to be within a specific VPC Service Controls perimeter, ensuring automatic enforcement without manual intervention.

Answer

Configure Cloud Shell to run a script that creates a perimeter when a new project is created.

Answer

Use Deployment Manager to deploy a configuration that creates a perimeter for each new project.

Answer

Create a VPC Service Controls perimeter and add the organization node as a member.

Question 5

During the bootstrapping of a Google Cloud organization, the DevOps team wants to implement a policy that prevents the deletion of certain resources, such as Cloud Storage buckets or Cloud SQL instances, unless a specific approval process is followed. Which approach best achieves this goal?

Accepted Answer

Use Resource Manager locks on projects and set up a Cloud Function that triggers on audit logs to require approval before removing the lock.. Option C is correct because Resource Manager locks prevent accidental deletion of critical resources by placing a deletion prevention lock on the project or resource hierarchy. By combining this with a Cloud Function that monitors audit logs for lock removal attempts and requires an approval workflow before the lock is removed, the team enforces a controlled approval process for any deletion, meeting the policy requirement precisely.

Answer

Configure Cloud Source Repositories to require code review for any changes to Terraform configurations that delete resources.

Answer

Implement Binary Authorization to require approvals for any delete commands.

Answer

Use VPC Service Controls to block delete operations on specific services.

Question 6

Which TWO are benefits of using a shared VPC in a Google Cloud organization? (Choose 2)

Accepted Answer

Centralized management of network resources.. Option A is correct because a shared VPC allows network resources (subnets, routes, firewalls) to be defined in a host project and consumed by multiple service projects, enabling centralized management. This reduces administrative overhead by having a single network team control the VPC configuration rather than each project managing its own.

Answer

Eliminates the need for project administrators to have any IAM roles.

Answer

Ensures compliance with organizational policies.

Answer

Automatically enables required APIs in all service projects.

Question 7

You are bootstrapping a Google Cloud organization for a DevOps team. You need to set up a shared VPC host project that will be used by multiple service projects. What is the minimal set of roles required for the DevOps team to create and manage service projects in the host project?

Accepted Answer

Compute Network Admin and Service Project Admin. Option B is correct because the minimal set of roles required for a DevOps team to create and manage service projects in a shared VPC host project is Compute Network Admin (roles/compute.networkAdmin) on the host project and Service Project Admin (roles/compute.xpnAdmin) at the organization or folder level. Compute Network Admin grants permissions to manage networking resources, while Service Project Admin allows attaching service projects to the host project. Without both, the team cannot configure shared VPC networking or associate service projects.

Answer

Project Creator and Service Project Admin

Answer

Compute Shared VPC Admin

Answer

Owner and Service Project Admin

Question 8

Which TWO options are best practices when bootstrapping a Google Cloud organization for DevOps? (Choose 2)

Accepted Answer

Use folders to separate environments (e.g., dev, staging, prod) and apply policies at the folder level.. Option D is correct because using folders to separate environments (e.g., dev, staging, prod) allows you to apply IAM policies and organization policies at the folder level, which are inherited by all projects within that folder. This enforces consistent security controls and resource governance across each environment, a key DevOps practice for managing lifecycle and access boundaries.

Answer

Grant the Owner role to a group of DevOps engineers to manage all projects.

Answer

Store service account keys in the source code repository for ease of use.

Answer

Create a single VPC network for all environments to simplify management.

Question 9

A DevOps team is setting up a Google Cloud organization. They want to centralize logging and monitoring across all projects. What is the recommended approach?

Accepted Answer

Create a dedicated project for logging and monitoring, and configure all other projects to send logs and metrics to that project.. Option B is correct because the recommended approach for centralizing logging and monitoring in a Google Cloud organization is to create a dedicated project that acts as a log sink and metric aggregator. By configuring aggregated sinks at the organization or folder level, all projects automatically forward logs to the dedicated project's Cloud Logging bucket, and metrics can be collected via the Monitoring API. This ensures a single pane of glass for operations without manual per-project setup.

Answer

Enable logging and monitoring in each project individually and use the Cloud Console to view them.

Answer

Enable Cloud Audit Logs in the organization and view them from the Organization level.

Answer

Use Stackdriver (now Operations) to aggregate logs from all projects automatically.

Question 10

Match each Cloud Monitoring metric type to its description.

Question 11

A startup is building a CI/CD pipeline for their Cloud Run service. They use Cloud Build to build a Docker image, push it to Artifact Registry, and then deploy to Cloud Run with the 'gcloud run deploy' command in the build config. The initial deployment works, but subsequent builds fail at the deploy step with a permission error: 'Permission denied to deploy revision to Cloud Run service'. The Cloud Build service account has the Cloud Run Developer role. The developers can manually deploy from their workstations using their own accounts. What is the most likely cause?

Accepted Answer

The Cloud Build service account needs the 'iam.serviceAccounts.actAs' permission on the Cloud Run runtime service account.. Option D is correct: Cloud Run requires the service account to have the 'iam.serviceAccounts.actAs' permission on the runtime service account used by Cloud Run (the compute engine default service account or a custom one). The Cloud Run Developer role alone does not include this. Option A is incorrect because the error is permission-related, not API enablement. Option B is incorrect because Artifact Registry permissions are for pushing images, not deploying. Option C is incorrect because Cloud Build uses its own service account, not user credentials.

Answer

The developers added the '--impersonate-service-account' flag inadvertently in the build config.

Answer

The Cloud Run API is not enabled in the project.

Answer

The Cloud Build service account lacks Artifact Registry read permissions to pull the image.

Question 12

A DevOps team wants to implement a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They need to ensure that each service is built, tested, and deployed independently with minimal manual intervention. Which TWO practices should they implement?

Accepted Answer

Use Cloud Deploy to manage progressive delivery (e.g., canary, blue/green) to GKE clusters.. Option B uses Cloud Build triggers to automatically build and test each service on pull request, enabling independent CI. Option C uses Cloud Deploy for progressive delivery, facilitating safe deployments. Option A is not best practice as a single config becomes complex. Option D opposes microservices independence. Option E focuses on source control, not CI/CD.

Answer

Use Cloud Source Repositories integrated with Cloud Build for version control and triggering builds.

Answer

Use a monolithic repository and deploy all services simultaneously to ensure consistency.

Answer

Use a single Cloud Build configuration file for all services with conditional steps to handle different services.

Question 13

Refer to the exhibit. A DevOps engineer is debugging a Cloud Build pipeline that fails after the second step. The error indicates that the docker push fails with a permission denied error. The service account used by Cloud Build has the roles/storage.objectAdmin role on the project. What is the most likely cause of the failure?

Accepted Answer

The Cloud Build service account needs the roles/artifactregistry.writer role.. The service account has storage.objectAdmin which grants access to Cloud Storage, not Artifact Registry. Pushing to Artifact Registry requires the roles/artifactregistry.writer (or admin) role. Option A is too vague. Option D is already performed in the first step. Option B is less likely as the path appears correct. Option C correctly identifies the missing role.

Answer

The docker push command uses an incorrect repository path.

Answer

The service account does not have permission to push to Artifact Registry.

Answer

The gcloud auth configure-docker step must be run for Artifact Registry.

Question 14

Refer to the exhibit. A budget alert has fired for project dev-123 indicating that the cost has exceeded the budget of $1000. What should the team do next to investigate the cost overrun?

Accepted Answer

Open a BigQuery query on the billing export table, filtering by project 'dev-123' and service.. The most effective first step is to query the billing export data in BigQuery, which provides detailed cost breakdowns by project, service, and labels. Option B is the recommended approach for granular analysis. Viewing the billing account page (A) gives a high-level view but not the necessary detail. Creating a new budget (C) does not address the root cause. Disabling APIs (D) is too drastic without understanding the cause. Setting up automatic shutdown (E) is a reaction that should follow investigation.

Answer

Disable all APIs in project dev-123 immediately.

Answer

Set up a Cloud Function to automatically shut down resources when the budget is exceeded.

Answer

View the billing account's cost table in the Cloud Console.

Answer

Create a new budget with a lower threshold to get alerted earlier.

Question 15

Your company runs a microservices application on Google Kubernetes Engine (GKE) with shared Istio service mesh across multiple namespaces. You use Cloud Monitoring and Cloud Logging for observability. At 10:30 AM, you receive an alert that the checkout service is returning high 5xx errors (over 20%) and latency is above 5 seconds. The incident response team is assembled, and you are the incident commander. The team suspects a recent deployment (v2.1) to the checkout service at 10:00 AM. The deployment was a minor configuration update. The team is divided: some want to immediately roll back, others want to analyze traces. You have access to the GCP console. What should you do first to ensure a swift and effective incident response?

Accepted Answer

Review the deployment history of the checkout service alongside Cloud Monitoring metrics and logs to identify the exact time and nature of the change.. Option D is correct because comparing the deployment changes with monitoring metrics helps correlate the incident with the deployment, providing evidence to guide next steps. Option A is premature without confirming the rollback will fix the issue and acknowledging potential side effects. Option B is useful but might not pinpoint the root cause as quickly as comparing metrics. Option C is a good practice but not the first action; you need to understand the impact first.

Answer

Check the Error Reporting dashboard to view aggregated error logs and stack traces for the checkout service.

Answer

Immediately roll back the checkout service to the previous version and monitor if errors decrease.

Answer

Declare the incident, assign roles, and start a postmortem document.