PCDOE Practice Test 22 — 15 Questions

Question 1

A site reliability engineer is defining SLOs for a microservice application running on Google Kubernetes Engine. The application serves user-facing API requests. Which TWO approaches should the engineer take to effectively monitor the service's performance?

Accepted Answer

Monitor the 99th percentile of request latency directly using Cloud Monitoring custom metrics.. Option C is correct because monitoring the 99th percentile (p99) of request latency directly captures the experience of the slowest 1% of users, which is critical for user-facing APIs where tail latency directly impacts user satisfaction. Cloud Monitoring custom metrics allow the engineer to instrument the application to emit precise latency distributions, enabling accurate SLO tracking rather than relying on averages that mask outliers.

Answer

Monitor average latency because it is most representative of typical user experience.

Answer

Monitor container CPU utilization as a proxy for application latency.

Answer

Use the number of running pods as the primary SLO indicator.

Question 2

Your team uses a canary deployment strategy on Google Kubernetes Engine (GKE). During a rollback, you notice that the rollback caused a brief period of downtime because the previous version's readiness probe was not properly configured. Which of the following best prevents this issue in the future?

Accepted Answer

Ensure that the readiness probe is tested as part of the pre-deployment validation.. Option C is correct because the root cause of the downtime was a misconfigured readiness probe on the previous version. By testing the readiness probe as part of pre-deployment validation, you ensure that the probe correctly reflects the application's ability to serve traffic before it is used in a rollback. This prevents the scenario where a rollback deploys a version that fails its readiness check, causing the service to be removed from the load balancer and resulting in downtime.

Answer

Perform a gradual rollback with a managed instance group.

Answer

Use a blue/green deployment instead.

Answer

Use a Kubernetes Job to run a post-deployment validation.

Question 3

A DevOps engineer notices that the monthly compute cost is higher than expected for a Kubernetes Engine cluster. They want to identify which namespaces or workloads are contributing most to the cost. What should they do?

Accepted Answer

Enable GKE Usage Metering and export to BigQuery.. Option D is correct because GKE Usage Metering exports detailed per-cluster resource consumption data (CPU, memory, storage, and network) to BigQuery, enabling cost attribution by namespace, label, or workload. This is the only option that directly provides granular cost breakdowns for Kubernetes resources, allowing the engineer to identify which namespaces or workloads drive compute costs.

Answer

Enable Logging for all containers and analyze logs.

Answer

Use Cloud Monitoring dashboards with Kubernetes metrics.

Answer

Add labels to nodes and use Cost Table reports.

Question 4

Which THREE actions can help optimize Cloud Storage costs? (Choose three.)

Accepted Answer

Use Nearline or Coldline storage classes for infrequently accessed data.. Option A is correct because Nearline and Coldline storage classes are designed for infrequently accessed data, offering lower storage costs compared to Standard storage. By choosing these classes for data that is accessed less than once a quarter or once a year, you reduce the per-GB storage charge, though you incur higher retrieval and early deletion fees. This directly optimizes costs when access patterns align with the class's intended use.

Answer

Enable versioning on all buckets to protect against accidental deletion.

Answer

Use Standard storage class for all objects to ensure low latency.

Question 5

An organization uses Cloud Deploy with Skaffold to manage progressive delivery on GKE. After a rollout, the new revision shows a higher error rate in Stackdriver, but the Cloud Deploy pipeline did not automatically roll back. What is the most likely cause?

Accepted Answer

The rollout strategy includes a manual approval step before advancing to the next phase.. Option A is correct because Cloud Deploy can wait for manual approval or an external verification job; if the rollout strategy is set to require approval, automatic rollback is not triggered. Option B is incorrect because the rollout doesn't need to complete to trigger a rollback if metrics are monitored. Option C is incorrect because the error rate metric is not part of the pipeline unless a custom verification job is configured. Option D is incorrect because the release configuration doesn't affect automatic rollback behavior.

Answer

The release was created with a '--disable-rollback' flag.

Answer

The Cloud Deploy pipeline does not have a stackdriverMetrics verification job defined to check error rates.

Answer

The rollout has not yet reached 100% traffic, so Cloud Deploy waits for full completion before evaluating health.

Question 6

Which THREE are best practices for securing a CI/CD pipeline on Google Cloud?

Accepted Answer

Use Secret Manager to securely pass credentials to build steps.. Options A, C, and D are correct. Using a private pool avoids exposure to public internet, storing credentials in Secret Manager avoids hardcoding, and using Binary Authorization ensures container integrity. Option B is incorrect - using personal credentials is insecure. Option E is incorrect - running builds on a public pool is less secure.

Answer

Run builds on the publicly hosted pool for better scalability.

Answer

Store service account keys in the source repository for build steps to use.

Question 7

A team uses Spinnaker on GKE for deployment. They notice that deployments are taking too long because of manual judgment gates. They want to automatically approve deployments if the canary analysis passes predefined thresholds. What Spinnaker feature should they use?

Accepted Answer

Automated canary analysis. Option D is correct because Spinnaker's Automated Canary Analysis (ACA) feature allows teams to define canary analysis thresholds and automatically promote or roll back deployments based on the analysis results, eliminating the need for manual judgment gates. This directly addresses the requirement to automatically approve deployments when predefined thresholds are met, without human intervention.

Answer

Automated rollback

Answer

Policy engine with OPA

Answer

Pipeline expressions

Question 8

A company uses Cloud Build with a custom service account that has minimal permissions. The build needs to deploy to Cloud Run. After configuring the service account with roles/run.admin, the build fails with 'Permission denied' on gcloud run deploy. What is the most likely cause?

Accepted Answer

The build service account lacks roles/iam.serviceAccountUser on the Cloud Run runtime service account.. Option B is correct because deploying to Cloud Run requires the iam.serviceAccountUser role on the runtime service account to impersonate it. Option A is not relevant. Option C is a different error. Option D is not required.

Answer

The Cloud Run service account is not set.

Answer

Cloud Build requires the roles/cloudbuild.serviceAgent role.

Answer

The build configuration file has syntax errors.

Question 9

A company uses Cloud Source Repositories and wants automatic builds on pull requests to the main branch. Which Cloud Build trigger type should they configure?

Accepted Answer

Pull request (any). A pull request trigger in Cloud Build allows you to run builds automatically when a pull request is opened, synchronized, or updated.

Answer

Pull request (comment)

Answer

Push to a branch

Answer

Tag push

Question 10

A team implements canary deployments using Cloud Deploy and deploys to GKE. They want to automatically roll back if the canary release's error rate exceeds 5% within 10 minutes. Which approach should they use?

Accepted Answer

Set up Cloud Deploy with a rollout strategy that uses Cloud Monitoring metrics to automatically rollback.. Option C is correct because Cloud Deploy supports integration with Cloud Monitoring for automated rollback on metric thresholds. Option A is incorrect - manual rollback doesn't meet the automatic requirement. Option B is incorrect - GKE rolling update is not canary. Option D is incorrect - Spinnaker is not native to GCP and not automatically integrated with Cloud Deploy.

Answer

Deploy using Spinnaker on GKE with a canary pipeline that includes an automated rollback step.

Answer

Configure a Cloud Build step to monitor the canary and rollback if needed.

Answer

Use a GKE rolling update strategy within the deployment manifest.

Question 11

Which TWO deployment strategies are directly supported by Cloud Deploy for GKE?

Accepted Answer

Canary. Options B and D are correct. Cloud Deploy supports canary and blue-green deployment strategies for GKE. Option A is incorrect - rolling update is managed by GKE directly, not Cloud Deploy as a strategy. Option C is incorrect - shadow deployments are not supported. Option E is incorrect - A/B testing is not a built-in strategy.

Answer

Rolling update

Answer

A/B testing

Answer

Shadow

Question 12

A company uses Cloud Build to compile a Java application. The build takes 15 minutes due to dependency downloads. They want to cache the Maven dependencies to speed up subsequent builds. What is the best approach?

Accepted Answer

Use Cloud Build's built-in caching mechanism by specifying volumes.. Option B is correct because Cloud Build supports volumes that can be used to cache directories between builds. Option A is possible but less integrated. Option C is not for Maven specificly. Option D is not a native Cloud Build feature.

Answer

Use a Cloud Storage bucket to store the .m2 directory and restore it at the start of the build.

Answer

Use a Docker layer caching with a custom image that includes dependencies.

Answer

Use Cloud Build's 'cache' configuration to persist directories.

Question 13

A team is setting up CI/CD for a microservices architecture. They want to ensure each service is independently buildable and deployable. What practices should they adopt? (Select THREE)

Accepted Answer

Use Artifact Registry with separate repositories per service. Options A, B, and E are correct. Separate repositories (A) or separate triggers with includeFiles (B) ensure independent builds. Separate Artifact Registry repositories (E) ensure artifact isolation. Option C builds multiple services in one config, reducing independence. Option D is about deployment targets, not builds.

Answer

Use Cloud Deploy's multi-target pipeline

Answer

Use Cloud Build's build config with substitutions to build multiple services

Question 14

A company uses Cloud Deploy for continuous delivery to GKE. They have a delivery pipeline with a rollout strategy: canary (25% for 30m) then full. The canary rollout fails because the new revision's health check errors. The team wants to automatically rollback the canary and notify. What native GCP feature can achieve this?

Accepted Answer

Configure a Cloud Deploy rollout strategy with an automated rollback policy.. Option A is correct because Cloud Deploy supports automated rollback via the rollbackPolicy in the delivery pipeline. Option B is incorrect because Cloud Build triggers are not designed for rollback automation. Option C is incorrect because post-deploy hooks are not for rollbacks. Option D is incorrect because it requires custom scripting and is not as native as Cloud Deploy's feature.

Answer

Configure Cloud Monitoring alerting policy on deployment errors that triggers a Cloud Function to rollback.

Answer

Set up a Cloud Build trigger that detects deployment failure and runs a rollback.

Answer

Use a Cloud Deploy rollout strategy with a post-deploy hook that calls Cloud Run jobs to revert.

Question 15

What security checks can be integrated into a Cloud Build CI/CD pipeline? (Select TWO)

Accepted Answer

Container scanning with Artifact Analysis. Options A and B are correct. Container scanning with Artifact Analysis (A) is native. SAST can be added via custom steps (B). Option C (network penetration) is external. Option D (manual code review) is a process, not a tool. Option E (DAST) is for running apps.

Answer

Manual code review

Answer

Network penetration testing

Answer

Dynamic application security testing (DAST)