PCDOE Practice Test 21 — 15 Questions

Question 1

A Cloud Run service is experiencing increased cold start latency. The service is written in Python and uses several large dependencies. Which action would most effectively reduce cold start latency?

Accepted Answer

Set a minimum number of instances to keep containers warm.. Setting a minimum number of instances ensures that the Cloud Run service always has a pool of warm containers ready to serve requests, eliminating the cold start penalty. Cold starts in Python are particularly severe due to the time required to import large dependencies (e.g., NumPy, TensorFlow) and initialize the runtime. By keeping containers alive, you bypass the entire initialization phase, directly addressing the root cause of increased latency.

Answer

Set concurrency to 1 to ensure each request gets a dedicated container.

Answer

Increase the CPU allocation to 4 vCPUs.

Answer

Increase memory to 2 GiB.

Question 2

A company wants to set budgets and alerts for a GCP project. Which two steps are required to enable budget notifications via email? (Choose two.)

Accepted Answer

Create a budget alert threshold in the Cloud Console. Options B and C are required. You must create a budget alert threshold in the Cloud Console to define the spending limit, and then add email recipients in the budget configuration to receive notifications. Option A (Enabling the Cloud Billing API) is not a prerequisite for email notifications; it is needed for programmatic access. Options D and E are for programmatic notifications, not email.

Answer

Enable the Cloud Billing API for the project

Answer

Create a Pub/Sub topic and subscribe to it

Answer

Set up a Cloud Function to send emails

Question 3

A team is using Cloud Run for a containerized application. They notice that requests have high latency due to cold starts. Which configuration change would most effectively reduce cold start latency?

Accepted Answer

Set the min-instances parameter to a value > 0. Setting the `min-instances` parameter to a value greater than 0 keeps a baseline number of container instances always warm and ready to serve requests. This eliminates the cold start penalty because the runtime environment, including the container and its dependencies, is already initialized and listening for traffic. Cloud Run will scale down to this minimum count, ensuring that new requests are routed to pre-warmed instances rather than triggering a new container startup.

Answer

Enable concurrent requests

Answer

Increase the function timeout

Answer

Reduce the container image size

Question 4

A team is monitoring a production service on Google Kubernetes Engine (GKE) and notices that a deployment is occasionally returning HTTP 503 errors. The team has set up a ServiceMonitor in Prometheus to scrape metrics from the pods. What is the most likely cause of the intermittent 503 errors?

Accepted Answer

The readiness probes are failing, causing the pods to be removed from the service endpoints.. Intermittent HTTP 503 errors in a GKE deployment typically indicate that the service's endpoints are temporarily unavailable. When a readiness probe fails, Kubernetes removes the pod from the Service's endpoints, causing traffic to be routed to remaining healthy pods. If multiple pods fail their readiness probes simultaneously or in quick succession, the Service may have no available endpoints, resulting in 503 errors for incoming requests.

Answer

The pods are crashing and restarting frequently.

Answer

The Prometheus scrape interval is too long, causing missed metrics.

Answer

The container resource limits are set too low, causing out-of-memory errors.

Question 5

You are designing a monitoring strategy for a cloud-native application. Which THREE components are essential for observability?

Accepted Answer

Metrics. Metrics (A) are essential because they provide quantitative, time-series data about system health and performance, such as CPU utilization, request latency, and error rates. In cloud-native observability, metrics are typically collected via Prometheus or similar systems, enabling trend analysis and threshold-based alerting. Without metrics, you cannot measure the overall state of your application or infrastructure over time.

Answer

Alerts

Answer

Dashboards

Question 6

An organization is using Cloud Source Repositories and wants to enforce that all commits are signed with a verified GPG key. How can they enforce this?

Accepted Answer

Enable the Signed Commits policy in the repository settings.. Cloud Source Repositories provides a built-in 'Signed Commits' policy in the repository settings that, when enabled, rejects any push containing commits that are not signed with a verified GPG key. This policy is enforced server-side at the repository level, ensuring that only signed commits are accepted without requiring external tools or custom scripts.

Answer

Use a branch protection rule in Cloud Source Repositories.

Answer

Use Cloud Functions to validate commits after push.

Answer

Use a pre-receive hook in Cloud Source Repositories.

Question 7

A team deploys a Cloud Function that processes user requests. They notice cold starts cause high latency for the first request after a period of inactivity. What is the most effective way to reduce cold starts?

Accepted Answer

Set the minimum instances to 1. Setting minimum instances to 1 pre-warms a function instance, keeping it idle and ready to serve requests immediately. This eliminates the cold start latency for the first request after inactivity because the runtime environment is already initialized and loaded into memory.

Answer

Use a larger function timeout

Answer

Increase the memory allocation

Answer

Deploy the function in multiple regions

Question 8

A team has configured an uptime check with a 5xx threshold alert. During an incident, the alert fires with severity 'critical'. The team mitigates the issue, but the alert keeps firing for 15 more minutes due to a slow-responding downstream dependency. What should the team do to avoid false alarms in future incidents?

Accepted Answer

Increase the 'duration' field in the alerting policy to require the condition to be true for a longer time before alerting.. Increasing the 'duration' field in the alerting policy ensures that the condition (e.g., 5xx errors) must persist for a longer, defined period before the alert fires. This prevents false alarms from transient issues like a slow-responding downstream dependency that temporarily triggers the threshold but resolves before the alert duration expires. In Google Cloud Monitoring, the duration parameter specifies the minimum time the condition must be true, filtering out short-lived spikes.

Answer

Add a second notification channel to send alerts to a different team.

Answer

Modify the alert condition to check only for 5xx errors and ignore other status codes.

Answer

Decrease the check frequency to every 30 seconds to get faster feedback.

Question 9

During bootstrapping, a DevOps lead wants to ensure that all projects in the 'dev' folder have a consistent set of VPC firewall rules and network policies. They are considering using a shared VPC or VPC Network Peering. Which approach provides the most control and consistency for DevOps teams while minimizing administrative overhead?

Accepted Answer

Implement a shared VPC with a host project managed by the network team, and allow DevOps teams to use subnets in their service projects.. A shared VPC with a host project managed by the network team provides centralized control over VPC firewall rules and network policies, ensuring consistency across all service projects in the 'dev' folder. This approach minimizes administrative overhead because DevOps teams can create subnets in their service projects without needing to manage network infrastructure, while the network team enforces a uniform security posture.

Answer

Use VPC Service Controls to define perimeters for each project.

Answer

Create a separate VPC in each project and use Cloud VPN to connect them.

Answer

Use VPC Network Peering between all projects to allow connectivity.

Question 10

Which tool is recommended for managing the initial setup of a Google Cloud organization, including creating folders, projects, and IAM policies in an automated and repeatable manner?

Accepted Answer

Terraform. Terraform is the recommended tool for bootstrapping a Google Cloud organization because it is declarative, idempotent, and supports infrastructure-as-code (IaC) for creating folders, projects, and IAM policies in an automated and repeatable manner. Unlike Google Cloud's Deployment Manager, Terraform is cloud-agnostic and has a mature provider (hashicorp/google) that directly manages organization-level resources such as google_folder, google_project, and google_organization_iam_member. This aligns with DevOps best practices for version-controlled, reproducible infrastructure provisioning.

Answer

Deployment Manager

Answer

Cloud Console

Answer

gcloud command line

Question 11

A large enterprise is migrating to Google Cloud and wants to bootstrap their organization for DevOps. They have multiple business units, each needing their own folder with projects. Security requires that all projects in the 'prod' folder must have a specific set of organization policies enforced, such as restricting service account key creation. They also want to allow individual teams to create project-level policies as long as they don't conflict with the organization policies. Which approach ensures this while minimizing administrative overhead?

Accepted Answer

Set the required organization policies on the 'prod' folder and allow teams to set additional policies at the project level as long as they don't conflict.. Google Cloud Organization Policies can be set at the folder level, allowing the 'prod' folder to inherit constraints like `iam.disableServiceAccountKeyCreation` across all its projects. Teams can then add additional project-level policies that are more restrictive, as long as they do not conflict with the inherited folder-level policies, which is enforced by the policy hierarchy. This minimizes administrative overhead by centralizing mandatory controls at the folder level while delegating flexibility to teams.

Answer

Set organization policies at the organization level and use IAM conditions to apply them only to the prod folder.

Answer

Create custom roles containing the required constraints and assign them to the team's IAM members.

Answer

Place all production workloads in a single project and use VPC Service Controls for security.

Question 12

A company is bootstrapping a Google Cloud organization. They have created a Shared VPC host project. They want to allow a service project's default compute service account to launch instances that use the Shared VPC's subnets. Which IAM role should be granted to that service account at the host project level?

Accepted Answer

roles/compute.networkUser. The `roles/compute.networkUser` role grants a service account the necessary permissions to use the subnets of a Shared VPC host project. Specifically, this role includes the `compute.subnetworks.use` permission, which allows the service account to launch instances in the host project's subnets without granting broader network management rights.

Answer

roles/compute.xpnAdmin

Answer

roles/compute.securityAdmin

Answer

roles/compute.networkAdmin

Question 13

A large enterprise is designing a centralized DevOps platform across multiple business units. They want to use a shared CI/CD pipeline that deploys to projects in different folders. Which approach ensures secure, auditable deployments while minimizing IAM administration?

Accepted Answer

Use a cross-project service account in the CI/CD project with required roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM.. A cross-project service account in the CI/CD project, granted the necessary roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM, allows the shared pipeline to deploy resources across folders without duplicating service accounts. This centralizes IAM administration, ensures auditability through a single identity, and follows the principle of least privilege by granting only required roles on target projects.

Answer

Use Cloud Build triggers directly in each target project with separate code repositories.

Answer

Grant the Cloud Build Editor role to all developers across projects to allow them to create pipelines.

Answer

Create a separate service account in each target project with the Cloud Build service agent role, and use impersonation from the CI/CD project.

Question 14

Refer to the exhibit. A Cloud Build pipeline using this configuration fails on the third step with a permission error. The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely missing permission?

Accepted Answer

iam.serviceAccounts.actAs on the Cloud Run runtime service account. The Cloud Build pipeline fails on the third step with a permission error because the Cloud Build service account, despite having the 'Cloud Run Admin' role, lacks the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account. This permission is required for Cloud Build to impersonate the runtime service account when deploying to Cloud Run, as the deployment step needs to act on behalf of that service account to create or update the service.

Answer

run.routes.invoke

Answer

storage.objects.list on the artifact bucket

Answer

resourcemanager.projects.get

Question 15

After a recent deployment, the mean latency of a user-facing service increased from 200ms to 500ms. The engineer uses Cloud Trace to analyze traces. Which trace characteristic should the engineer focus on to identify the bottleneck?

Accepted Answer

Distribution of span latencies across services.. The engineer should focus on the distribution of span latencies across services (Option B) because Cloud Trace captures the latency of each span in a distributed trace. By examining the histogram or distribution of span latencies, the engineer can identify which specific service or component is contributing the most to the overall increase from 200ms to 500ms, pinpointing the bottleneck. This approach aligns with the principle of distributed tracing, where the critical path is determined by the slowest span in the trace.

Answer

Timestamps of the trace ID.

Answer

Error count per span.

Answer

Total number of spans in the trace.