PCDOE Practice Test 23 — 15 Questions

Question 1

Order the steps to configure a VPC Network Peering between two projects.

Accepted Answer

Create VPC networks in both projects, then configure firewall rules to allow traffic between the VPCs, then create a peering connection from Project A to Project B, then create a peering connection from Project B to Project A, then verify the peering connection.. The correct sequence for configuring VPC Network Peering is to first create the VPC networks in both projects, then configure firewall rules to allow traffic, then create the peering connection in both directions (from Project A to Project B and from Project B to Project A), and finally verify connectivity. Common mistakes include performing steps out of order or omitting the reverse peering.

Answer

Create VPC networks in both projects, then create peering from A to B, then create peering from B to A, then configure firewall rules, then verify.

Answer

Create VPC networks in both projects, then create peering from A to B, then configure firewall rules, then verify.

Answer

Configure firewall rules, then create VPC networks in both projects, then create peering from A to B, then create peering from B to A, then verify.

Question 2

A company wants to implement a DevOps culture in their new Google Cloud organization. Which THREE practices align with Google's DevOps principles? (Choose three.)

Accepted Answer

Monitor systems with telemetry and logs.. Google's DevOps principles emphasize observability through telemetry and logs to gain insight into system behavior, enabling data-driven decisions and rapid troubleshooting. In Google Cloud, this aligns with services like Cloud Monitoring and Cloud Logging, which collect metrics and logs from resources such as Compute Engine instances and GKE clusters, supporting the 'monitor and improve' feedback loop central to DevOps.

Answer

Use a monolithic architecture to simplify deployments.

Answer

Centralize all operations in a single team.

Question 3

Order the steps to deploy a new version of a microservice to Google Kubernetes Engine using a rolling update.

Accepted Answer

Update the manifest, then apply the manifest using kubectl apply, then monitor the rollout status, then verify the deployment, then roll back if needed.. The correct sequence for a rolling update in GKE is: update the manifest, apply it with kubectl apply, monitor the rollout status, verify the deployment, and roll back if needed. This ensures the new version is properly deployed and validated before considering it successful, with a safety net for issues.

Answer

Update the manifest, then apply the manifest using kubectl apply, then verify the deployment, then monitor the rollout status, then roll back if needed.

Answer

Apply the manifest using kubectl apply, then update the manifest, then monitor the rollout status, then verify the deployment, then roll back if needed.

Answer

Update the manifest, then monitor the rollout status, then apply the manifest using kubectl apply, then verify the deployment, then roll back if needed.

Question 4

During an incident, a DevOps engineer needs to temporarily increase the capacity of a Google Kubernetes Engine (GKE) cluster to handle the traffic surge. Which approach minimizes manual intervention and follows Google best practices?

Accepted Answer

Enable cluster autoscaler and update the horizontal pod autoscaler to scale faster.. Enabling the cluster autoscaler automatically adjusts the number of nodes in the node pool based on resource demands, while updating the horizontal pod autoscaler (HPA) to scale faster (e.g., reducing the stabilization window or increasing the target CPU utilization threshold) allows pods to replicate more quickly. This combination minimizes manual intervention by automating both pod-level and node-level scaling, aligning with Google's best practices for handling traffic surges in GKE.

Answer

Manually add a node pool with larger machines via the Google Cloud Console.

Answer

Create a new node pool and migrate pods using kubectl drain.

Answer

Scale the existing node pool by increasing the maximum node count in the cluster.

Question 5

A small team is setting up a Google Cloud organization for their DevOps pipeline. They have zero existing projects. Their planned architecture uses Cloud Build for CI/CD, Cloud Source Repositories for code, and Artifact Registry for images. They want to ensure that developers can only deploy to the production environment after code review and approval. They also want to automatically trigger builds on commits to the main branch. Which of the following is the most efficient way to implement this?

Accepted Answer

Create separate Cloud Build triggers for development and production, and use manual approval steps in the production trigger.. It uses separate Cloud Build triggers for development and production, allowing the production trigger to include a manual approval step. This enforces that code review and approval occur before deployment to production, while the development trigger can automatically build on commits to the main branch. Cloud Build's approval gates are the native way to require human sign-off before executing a build, aligning with the requirement for controlled production deployments.

Answer

Use a single trigger and a build step that checks for a label in the commit to decide if deployment is allowed.

Answer

Use a Cloud Function to deploy code after a Pub/Sub message from a code review tool.

Answer

Set up a Cloud Build trigger on the main branch without any approval, and rely on code review outside Google Cloud.

Question 6

A company uses Cloud Build with a custom service account that has minimal permissions. The build needs to deploy to Cloud Run. After configuring the service account with roles/run.admin, the build fails with 'Permission denied' on gcloud run deploy. What is the most likely cause?

Accepted Answer

The build service account lacks roles/iam.serviceAccountUser on the Cloud Run runtime service account.. When a Cloud Build service account with only roles/run.admin attempts to deploy to Cloud Run, it must also have the iam.serviceAccountUser role on the Cloud Run runtime service account to impersonate it. Without this, gcloud run deploy fails with 'Permission denied'. Option B is incorrect because an unset Cloud Run service account would result in a different error, typically about an unspecified service account, not a permission denied. Option C is incorrect because roles/cloudbuild.serviceAgent is not required for deploying to Cloud Run; it's a broader role. Option D is unlikely because syntax errors would produce a build configuration parsing error, not a runtime permission denied.

Answer

The Cloud Run service account is not set.

Answer

Cloud Build requires the roles/cloudbuild.serviceAgent role.

Answer

The build configuration file has syntax errors.

Question 7

A fintech company deploys a critical payment service on GKE using Cloud Deploy with a canary deployment strategy. They want to automatically roll back if the canary release causes an increase in error rates over 1%. They have set up Cloud Monitoring to expose a custom metric 'error_rate' from the service. They want Cloud Deploy to evaluate this metric during the canary phase and roll back if the threshold is exceeded. What is the minimal configuration needed?

Accepted Answer

In the Skaffold configuration, define a 'verify' section with a 'stackdriverMetrics' verification job that queries the 'error_rate' metric and sets a threshold. In Cloud Deploy, ensure the rollout strategy is 'canary' and no manual approval is required.. Cloud Deploy supports 'canaryDeployment' with phases and requires a verification job that queries Stackdriver metrics. Defining a 'stackdriverMetrics' verification job in the Skaffold configuration achieves this. Option B is incorrect because the rollout strategy 'strategy' is not a top-level field; it's part of the pipeline. Option C is incorrect because Cloud Deploy does not inherently know the metrics; a verification job must be defined. Option D is incorrect because additional phases are not needed and don't enable metric evaluation.

Answer

Install the Cloud Operations agent on the GKE nodes and configure Cloud Deploy to read the 'error_rate' metric from Cloud Monitoring by default.

Answer

Set the Cloud Deploy pipeline's 'strategy' field to 'canary' and set 'autoRollback: true' on the release.

Answer

Create a Cloud Deploy rollout with multiple phases and add a 'stackdriverMetrics' job to the 'postDeploy' phase.

Question 8

You are the DevOps engineer for a large e-commerce platform running on Google Kubernetes Engine (GKE). During a flash sale, you observe that the payments service is experiencing high latency and intermittent errors. The service is deployed with HorizontalPodAutoscaler (HPA) based on CPU utilization. You need to quickly diagnose and mitigate the issue. Which TWO actions should you take?

Accepted Answer

Use Cloud Monitoring to examine the payments service's request latency and error rate metrics, and create a custom dashboard for real-time monitoring.. Cloud Monitoring provides the necessary observability to diagnose the root cause of high latency and intermittent errors by examining request latency and error rate metrics. Creating a custom dashboard enables real-time monitoring, allowing you to correlate performance degradation with traffic spikes during the flash sale. This is the first step in incident management: observe before acting.

Answer

Check the GKE node's network performance using VPC Flow Logs and increase the node pool size.

Answer

Modify the HPA to use memory utilization instead of CPU, as memory is more indicative of the service's performance.

Answer

Configure a custom metric in Cloud Monitoring for the payments service's request queue depth and use it for HPA.

Question 9

Which THREE are best practices for securing a CI/CD pipeline on Google Cloud?

Accepted Answer

Use Secret Manager to securely pass credentials to build steps.. Options A, B, and E are correct. Using Secret Manager (A) securely passes credentials without hardcoding or storing them in repos. Binary Authorization (B) ensures only signed, trusted container images are deployed, preventing tampering. Cloud Build private pools (E) provide isolated, controlled build environments, reducing exposure. Option C is incorrect because public pools may be less secure and not recommended for sensitive workloads. Option D is incorrect because storing service account keys in source repos is a security risk.

Answer

Run builds on the publicly hosted pool for better scalability.

Answer

Store service account keys in the source repository for build steps to use.

Question 10

Which THREE of the following are valid techniques for mitigating a denial-of-service (DoS) attack against a Google Cloud HTTP(S) Load Balancer?

Accepted Answer

Enable autoscaling on the backend services to handle increased load.. Enabling autoscaling on backend services allows the load balancer to dynamically add more backend instances in response to increased traffic, helping to absorb a DoS attack by scaling out capacity. This is a valid mitigation technique as it leverages Google Cloud's managed scaling to maintain service availability under load.

Answer

Increase the number of backend instances to absorb traffic.

Answer

Modify VPC firewall rules to block all traffic from the source IP.

Question 11

A company is bootstrapping a new Google Cloud organization for DevOps. They want to separate development, staging, and production environments using folders. Which folder structure follows Google-recommended best practices?

Accepted Answer

Create folders under the Organization node: Development, Staging, Production. Place all projects in the appropriate folder.. Google Cloud best practices recommend creating top-level folders under the Organization node for each environment (Development, Staging, Production) to enforce consistent policy inheritance and resource isolation. This structure allows you to apply organization policies and IAM roles at the environment level, ensuring that production resources are strictly separated from development and staging resources, which is critical for compliance and security.

Answer

Create a single folder called 'Environments' with subfolders Dev, Staging, Prod, and place projects in the subfolders.

Answer

Create a folder for each team, then subfolders for environments (e.g., Team1/Dev, Team1/Prod).

Answer

Use labels on projects to denote environment (e.g., env=dev) instead of folders.

Question 12

A team is running a stateful application on Compute Engine with high disk I/O. They want to optimize disk performance. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use SSD persistent disk for data. SSD persistent disks provide higher IOPS and lower latency than standard persistent disks, making them suitable for high disk I/O workloads. Option D is correct because local SSDs offer even higher performance by attaching directly to the host VM, but their data is ephemeral, making them ideal for temporary data like caches or scratch space.

Answer

Use standard persistent disk for cost savings

Answer

Enable disk encryption

Answer

Increase disk size

Question 13

A DevOps engineer is setting up a Cloud Build trigger that builds a container image and deploys it to Cloud Run. The build fails with a permission error when trying to access resources in a different project. The engineer has created a service account in the project where Cloud Build runs and granted it roles/run.admin and roles/storage.objectViewer on the target project. What is the most likely cause of the failure?

Accepted Answer

The Cloud Build service account lacks the iam.serviceAccounts.actAs permission on the Cloud Run runtime service account.. The error occurs because Cloud Build needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account to impersonate it when deploying the container. Even though the custom service account has `roles/run.admin` and `roles/storage.objectViewer` on the target project, without the `actAs` permission, Cloud Build cannot assume the runtime service account's identity to push the image and deploy the revision. This permission is typically granted via `roles/iam.serviceAccountUser` on the runtime service account itself.

Answer

The service account has been deleted or disabled.

Answer

Cloud Build’s default compute engine service account is being used instead of the custom one.

Answer

The service account must be created in the target project instead of the source project.

Question 14

A DevOps engineer notices that developers are accidentally deleting Cloud Storage buckets. The organization wants to prevent accidental deletion while still allowing developers to manage bucket objects. What is the best practice?

Accepted Answer

Set a bucket retention policy with deletion lock.. A bucket retention policy with a deletion lock prevents the deletion of the bucket itself, even by users with owner permissions, while still allowing developers to manage objects within the bucket. This is the only option that directly enforces a hard, irreversible lock on bucket deletion, meeting the requirement to prevent accidental deletion without restricting object management.

Answer

Enable Cloud Audit Logging and set up alerts on bucket deletion.

Answer

Set a bucket IAM policy denying storage.objects.delete for developers.

Answer

Use an organization policy to disable bucket deletion across the org.

Question 15

An organization is bootstrapping its Google Cloud environment and needs to establish a secure CI/CD pipeline that deploys infrastructure using Terraform. The pipeline must run in a dedicated project, and Terraform state must be stored in a Cloud Storage bucket. What is the most secure way to grant the CI/CD service account the minimal permissions required to manage the state bucket?

Accepted Answer

Grant the service account the Storage Object Admin role on the specific Cloud Storage bucket.. Granting the Storage Object Admin role (roles/storage.objectAdmin) on the specific Cloud Storage bucket follows the principle of least privilege. This allows the CI/CD service account to manage objects (including Terraform state files) within that bucket without granting broader permissions to other buckets or project-level storage operations. The pipeline runs in a dedicated project, but the state bucket itself is the resource that needs access control, making a resource-level role assignment the most secure approach.

Answer

Grant the service account the Storage Object Admin role on the service account itself.

Answer

Grant the service account the Storage Object Admin role at the project level.

Answer

Grant the service account the Storage Admin role at the project level.