PCDOE Practice Test 22 — 15 Questions

Question 1

A company is running a stateful workload on Compute Engine and has configured a TCP health check on port 8080. The health check is failing, but the application is running and responding on port 8080 when tested manually from within the instance. What is the most likely cause of the health check failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall rules are not allowing traffic from the health check probe IP ranges.. The health check probes originate from Google's health check systems, which use specific IP ranges (e.g., 35.191.0.0/16, 130.211.0.0/22). If firewall rules on the instance or VPC do not explicitly allow inbound traffic from these probe IP ranges on port 8080, the health check will fail even though the application is running and responding to manual tests from within the instance. This is the most common cause of health check failures when the application itself is healthy.

Answer

The health check is configured to use port 80 instead of port 8080.

Answer

The instance's DNS resolution is failing, causing the health check to use the wrong IP.

Answer

The health check response timeout is set too low (e.g., 1 second).

Question 2

A team has deployed a Prometheus server on GKE using the configuration above. They expect Prometheus to scrape metrics from pods with the label 'app: my-app' and the annotation 'prometheus.io/scrape: true' on port 8080. However, no metrics are being collected. What is the most likely cause?

Accepted Answer

The relabel_config for port incorrectly constructs the target address; it should use the annotation value directly without appending ':8080'.. The relabel_config is incorrectly constructing the target address. The configuration likely uses `__meta_kubernetes_annotation_prometheus_io_port` to get the port, but then appends ':8080' statically, overriding the annotation value. If the annotation specifies a different port or is missing, this hardcoded port causes Prometheus to scrape the wrong endpoint or fail entirely. The correct approach is to use the annotation value directly without appending a fixed port, or to use a default port only when the annotation is absent.

Answer

The kubernetes_sd_configs role is set to 'pod' but should be 'endpoints'.

Answer

Prometheus needs to be configured to listen on port 9090 for scraping.

Answer

The keep action for the label 'my-app' is filtering out all pods.

Question 3

In Google's incident management process, which role is responsible for communication with stakeholders and users during an incident?

Accepted Answer

Communications Lead.. In Google's incident management process, the Communications Lead is explicitly responsible for managing all external and internal communications, including updates to stakeholders and users. This role ensures that accurate, timely information is disseminated while the Incident Commander focuses on coordinating the response. The Communications Lead does not engage in technical troubleshooting or operational tasks, which are handled by other roles.

Answer

Incident Commander.

Answer

Technical Lead.

Answer

Operations Lead.

Question 4

During a Cloud Build execution, a step fails due to timeout. What is the first thing to check?

Accepted Answer

Check the build logs for errors. When a Cloud Build step fails due to a timeout, the build logs are the first and most authoritative source of diagnostic information. They contain the exact error messages, exit codes, and step output that reveal why the step exceeded its timeout — for example, a hanging command, a missing dependency, or a resource contention issue. Checking logs before making any configuration changes ensures you address the root cause rather than treating symptoms.

Answer

Check network connectivity

Answer

Increase machine type for the build

Answer

Increase the timeout in cloudbuild.yaml

Question 5

A DevOps engineer receives an alert that the error budget for a critical service has been exhausted. The service runs on Compute Engine behind an HTTP(S) load balancer. The team wants to reduce the impact on users while investigating. What should the engineer do first?

Accepted Answer

Roll back the most recent deployment. Rolling back the most recent deployment is the correct first action because it immediately restores the service to a known stable state, stopping further consumption of the error budget. This aligns with the incident management principle of 'mitigate first, investigate later' — reducing user impact takes priority over root cause analysis. The HTTP(S) load balancer will automatically route traffic to the previous healthy version once the rollback is complete.

Answer

Begin a detailed postmortem analysis

Answer

Disable the alerting policy to reduce noise

Answer

Increase the number of instances in the managed instance group

Question 6

You are a DevOps engineer for a SaaS company that provides a REST API. The API is deployed on Google Cloud Run. You have configured Cloud Monitoring alerts for 5xx errors. Recently, you received an alert that the error rate exceeded 5% for 5 minutes. You investigated and found that the errors were HTTP 503 (Service Unavailable) from a specific endpoint. The endpoint calls an internal Cloud SQL database. The database CPU utilization was at 90% during that period. You suspect the database is the bottleneck. Which action should you take to reduce the error rate without over-provisioning?

Accepted Answer

Implement connection pooling and retry logic with exponential backoff in the API service. Implementing connection pooling and retry logic with exponential backoff directly addresses the database bottleneck without over-provisioning. Connection pooling reduces the number of concurrent connections to Cloud SQL, lowering CPU contention, while exponential backoff prevents thundering herd retries that could further overwhelm the database. This approach optimizes existing resources rather than scaling infrastructure.

Answer

Increase the max instances per revision in Cloud Run to handle more concurrent requests

Answer

Reduce the min instances of Cloud Run to decrease load on the database

Answer

Add a Cloud SQL read replica and route read queries to it

Question 7

Refer to the exhibit. After applying the shown firewall rule, users report increased latency to a web application. What is the most likely cause?

Accepted Answer

The rule contains both allow and deny for the same traffic, creating a conflict.. In Google Cloud VPC firewall rules, a single rule cannot specify both allow and deny actions. The rule shown is invalid because it combines both actions for the same traffic, which can lead to undefined behavior. This misconfiguration can cause the firewall to improperly deny traffic that should be allowed, resulting in connectivity issues and increased latency due to retries or timeouts. Option B correctly identifies this conflict. Option A is wrong because priority 1000 is not low (lower number higher priority); logging alone does not cause significant latency. Option C is wrong because a broad source range does not inherently cause latency. Option D is wrong because the rule's priority is not the issue here.

Answer

The rule priority is set to 1000, which is too low.

Answer

The source range covers all IPs, causing excessive traffic.

Answer

The firewall rule has logging enabled, which adds overhead.

Question 8

A batch data processing job on Cloud Dataflow is running slower than expected. Which action will most directly increase throughput?

Accepted Answer

Increase the number of workers in the pipeline. Increasing the number of workers directly increases the parallelism of the pipeline, allowing more data to be processed concurrently. In Cloud Dataflow, throughput is limited by the number of available worker slots; adding workers raises the total processing capacity. This is the most direct action to increase throughput when the pipeline is CPU-bound or I/O-bound and underutilizing existing resources.

Answer

Enable Streaming Engine for the pipeline

Answer

Enable autoscaling

Answer

Use FlexRS pricing model

Question 9

A DevOps engineer needs to verify if a load balancer's health check is behaving normally by examining historical trends. Where should they look?

Accepted Answer

Cloud Monitoring Metrics Explorer. Cloud Monitoring Metrics Explorer is the correct place to examine historical trends of a load balancer's health check because it provides time-series metrics such as `https/backend_request_count`, `https/backend_latencies`, and health check probe success/failure counts. These metrics can be queried over custom time ranges and aggregated to detect anomalies or degradation patterns, which is exactly what the question asks for — verifying historical trends of health check behavior.

Answer

Cloud Logging

Answer

Cloud Console health check page

Answer

Cloud Load Balancing logs

Question 10

Refer to the exhibit. A team is troubleshooting a pod crash loop. Based on the exhibit, which infrastructure change should be prioritized to resolve the issue and optimize service performance?

Accepted Answer

Mount a ConfigMap or volume containing the missing file. The exhibit indicates a pod crash loop caused by a missing file, which is a configuration issue rather than a resource or scheduling problem. Mounting a ConfigMap or volume that provides the missing file directly resolves the crash by ensuring the pod has the required configuration at startup. This fix also optimizes service performance by eliminating unnecessary restarts and allowing the pod to serve traffic consistently.

Answer

Increase the pod's CPU request

Answer

Increase the maximum number of pods per node

Answer

Enable pod anti-affinity

Question 11

During a Cloud Build execution, the step fails with 'Error: could not find a valid 'Dockerfile' in context '.''. The build configuration file is located in a subdirectory called 'build/' and the Dockerfile is in the root of the repository. How should the team fix this?

Accepted Answer

Specify the 'dir' field in the build step to point to the root.. The Cloud Build step's `dir` field explicitly sets the working directory for the step. By specifying `dir: '.'` (or the repository root), Cloud Build will look for the Dockerfile in the root context, even though the build configuration file (`cloudbuild.yaml`) resides in the `build/` subdirectory. This ensures the Docker build context points to the correct location where the Dockerfile exists.

Answer

Create a symbolic link.

Answer

Move the Cloud Build configuration file to the root.

Answer

Use the 'substitutions' to change context.

Question 12

A startup is bootstrapping their Google Cloud organization with the following constraints: they have a small team of 10 developers, each with varying levels of expertise. They want a simple setup that allows developers to experiment in their own projects but prevents them from deleting production resources. They also want to enforce a budget limit on each project to avoid unexpected costs. The team has no prior Google Cloud experience and wants minimal operational overhead. Which of the following approaches best meets their needs?

Accepted Answer

Create a folder for production and a folder for development, assign developers Editor on dev projects and Viewer on prod, set budget alerts on both folders.. It establishes a clear separation of concerns using folders: a production folder with Viewer access (preventing deletion) and a development folder with Editor access (allowing experimentation). Budget alerts at the folder level enforce cost controls across all projects within each folder, minimizing operational overhead while meeting all constraints.

Answer

Use a single project with VPC Service Controls to isolate resources.

Answer

Create a single project for all developers, use budget alerts, and give everyone Owner role.

Answer

Create a project per developer, give them Owner role, and set a budget on each project.

Question 13

A developer wants to trigger a Cloud Build execution whenever a pull request is created against the main branch in Cloud Source Repositories. Which Cloud Build trigger configuration should be used?

Accepted Answer

Event: pull request on branch ^main$. Cloud Build triggers can be configured to respond to pull request events on a specific branch using the 'pull request' event type and the branch regex `^main$`. Option B is for push events on the main branch, not pull requests. Option C is for tags, not branches. Option D is for manual invocation, which does not automatically trigger on pull requests.

Answer

Event: push on branch ^main$

Answer

Event: push on tag

Answer

Event: manual invocation

Question 14

A team is implementing a CI/CD pipeline for a Kubernetes application. They want to use canary deployments with traffic splitting. Which tool or service is best suited for this?

Accepted Answer

Cloud Deploy with Skaffold. Cloud Deploy with Skaffold is best suited for canary deployments with traffic splitting because Cloud Deploy provides built-in support for progressive delivery strategies, including canary and blue-green deployments, and integrates with Skaffold to manage Kubernetes manifests and traffic routing via service mesh or ingress controllers. Skaffold handles the build and deploy stages, while Cloud Deploy orchestrates the rollout with automated traffic splitting and promotion/rollback logic, making it the only option that directly addresses the requirement.

Answer

Cloud Run

Answer

Cloud Build

Answer

Anthos Config Management

Question 15

During the bootstrapping of a Google Cloud organization, the DevOps team wants to implement a policy that prevents the deletion of certain resources, such as Cloud Storage buckets or Cloud SQL instances, unless a specific approval process is followed. Which approach best achieves this goal?

Accepted Answer

Use Resource Manager locks on projects and set up a Cloud Function that triggers on audit logs to require approval before removing the lock.. Resource Manager locks prevent accidental deletion of critical resources by placing a deletion prevention lock on the project or resource hierarchy. By combining this with a Cloud Function that monitors audit logs for lock removal attempts and requires an approval workflow before the lock is removed, the team enforces a controlled approval process for any deletion, meeting the policy requirement precisely.

Answer

Configure Cloud Source Repositories to require code review for any changes to Terraform configurations that delete resources.

Answer

Implement Binary Authorization to require approvals for any delete commands.

Answer

Use VPC Service Controls to block delete operations on specific services.