PCDOE Practice Test 23 — 15 Questions

Question 1

A company wants to reduce the response time of a globally distributed web application. Which Google Cloud service can cache static content at edge locations to improve performance?

Accepted Answer

Cloud CDN. Cloud CDN (Content Delivery Network) uses Google's globally distributed edge caches to serve static content (e.g., images, CSS, JavaScript) from locations closer to users, reducing latency and offloading origin servers. It integrates with external HTTPS load balancers to automatically cache responses based on cache-control headers, directly addressing the goal of improving response time for a globally distributed web application.

Answer

Cloud DNS

Answer

Cloud NAT

Answer

Cloud Armor

Question 2

A startup runs a mobile app backend on App Engine standard environment. They recently added new features, and the app's response time increased significantly. The team suspects instance startup time is causing cold starts for new users. They have already reduced code size and enabled warmup requests. What is the best next step to improve performance?

Accepted Answer

Increase the number of idle instances using automatic scaling settings. Warmup requests reduce cold starts by initializing the app before live traffic arrives, but they don't eliminate startup latency for new instances. Increasing the number of idle instances via automatic scaling settings ensures that pre-warmed, ready-to-serve instances are always available, so new users never trigger a cold start. This directly addresses the root cause—instance startup time—without changing the environment or adding complexity.

Answer

Migrate to App Engine flexible environment

Answer

Implement a latency-based health check to redirect traffic

Answer

Use Cloud Endpoints to limit traffic and reduce load

Question 3

An incident is declared for a production service running on GKE. The on-call engineer suspects a recent code change may have introduced a memory leak. Which THREE actions should the engineer take to investigate and mitigate?

Accepted Answer

Increase the memory limit for the container as a temporary mitigation. Increasing the memory limit for the container provides a temporary mitigation to prevent the service from being killed by the Out of Memory (OOM) killer while the root cause is investigated. In GKE, the container's memory limit is defined in the pod spec under `resources.limits.memory`, and raising it gives the application more headroom to continue serving requests without immediate termination. This is a standard incident response practice to buy time for deeper analysis, such as reviewing logs and metrics, before applying a permanent fix.

Answer

Scale down the number of replicas to reduce memory pressure

Answer

Roll back the deployment immediately without further investigation

Question 4

A company uses Cloud Build to deploy a microservices application to Google Kubernetes Engine (GKE). They want to integrate Container Analysis to scan images for vulnerabilities before deployment. What is the minimal set of changes needed to achieve this?

Accepted Answer

Enable the Container Analysis API; no changes to the build configuration are needed.. Enabling the Container Analysis API allows Cloud Build to automatically scan container images for vulnerabilities when they are pushed to Container Registry or Artifact Registry. No additional build steps or configuration changes are required. Option B is incorrect because migrating to Artifact Registry is not minimal; Container Analysis works with both registries. Option C is incorrect because Cloud Build already integrates with Container Analysis, so adding a separate scanner is unnecessary. Option D is incorrect because Binary Authorization is a policy enforcement tool that uses scan results but does not perform scanning itself.

Answer

Migrate images from Container Registry to Artifact Registry and enable vulnerability scanning there.

Answer

Add a build step to run a vulnerability scanner CLI tool before pushing the image.

Answer

Enable Binary Authorization to block deployment of vulnerable images.

Question 5

A company uses Spinnaker for continuous delivery across multiple GKE clusters. After a recent infrastructure change, the 'Canary' deployment strategy fails during the 'disable' phase of the old version. The error log shows: 'Unable to disable server group: Not authorized to perform compute.instanceGroups.update.' What is the most likely root cause?

Accepted Answer

The Spinnaker service account lacks the compute.instanceGroups.update permission on the project.. The error 'Unable to disable server group: Not authorized to perform compute.instanceGroups.update' directly indicates an IAM permissions issue. In Spinnaker, the service account used to interact with GCP must have the compute.instanceGroups.update permission to manage instance groups during the disable phase of a canary deployment. Option C correctly identifies that the Spinnaker service account lacks this specific permission on the project.

Answer

The GKE cluster has reached its maximum node quota.

Answer

The Cloud Deploy pipeline is missing the required IAM role for the Spinnaker service account.

Answer

The Kayenta canary analysis service is not configured correctly.

Question 6

A DevOps team wants to optimize resource utilization for their GKE deployment. Which built-in Kubernetes resource can automatically adjust CPU and memory requests based on historical usage?

Accepted Answer

VerticalPodAutoscaler. The VerticalPodAutoscaler (VPA) is the correct choice because it automatically adjusts CPU and memory resource requests (and limits) for pods based on historical usage data, optimizing resource utilization without manual intervention. Unlike the HorizontalPodAutoscaler, which scales the number of pods, the VPA modifies the resource specifications of existing pods to match observed demand.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

PodDisruptionBudget

Question 7

A CI/CD pipeline must deploy to multiple environments (dev, staging, prod) with manual approval required before prod deployment. Which Google Cloud service is best for orchestrating this?

Accepted Answer

Cloud Deploy with promotion. Cloud Deploy is Google Cloud's managed continuous delivery service purpose-built for orchestrating releases across multiple targets (dev, staging, prod) with explicit promotion between them. It natively supports approval gates before a promotion to a protected target like prod, and integrates with Cloud Build for the build stage. This makes it the best fit for the stated requirement of multi-environment deployment with manual prod approval.

Answer

Spinnaker

Answer

Jenkins on GKE

Answer

Cloud Build with manual steps

Question 8

A startup is building a CI/CD pipeline for their Cloud Run service. They use Cloud Build to build a Docker image, push it to Artifact Registry, and then deploy to Cloud Run with the 'gcloud run deploy' command in the build config. The initial deployment works, but subsequent builds fail at the deploy step with a permission error: 'Permission denied to deploy revision to Cloud Run service'. The Cloud Build service account has the Cloud Run Developer role. The developers can manually deploy from their workstations using their own accounts. What is the most likely cause?

Accepted Answer

The Cloud Build service account needs the 'iam.serviceAccounts.actAs' permission on the Cloud Run runtime service account.. The Cloud Build service account needs the 'iam.serviceAccounts.actAs' permission on the Cloud Run runtime service account to deploy a revision that runs as that service account. Even with the Cloud Run Developer role, the actAs permission is required to impersonate the runtime service account during deployment. This is a common IAM requirement in Google Cloud.

Answer

The developers added the '--impersonate-service-account' flag inadvertently in the build config.

Answer

The Cloud Run API is not enabled in the project.

Answer

The Cloud Build service account lacks Artifact Registry read permissions to pull the image.

Question 9

An organization is bootstrapping their Google Cloud environment and wants to implement a shared VPC for DevOps workloads. The network team manages the host project, while DevOps teams have service projects. They need to ensure that DevOps teams can create resources in their service projects that use the shared VPC, but they cannot change the host project's network configuration. Which IAM roles should be granted to the DevOps team's service account on the host project?

Accepted Answer

roles/compute.networkUser. The DevOps team needs to use the shared VPC's resources (e.g., subnets) from their service projects without modifying the host project's network configuration. The `roles/compute.networkUser` role grants permission to use existing networks and subnets in the host project, but not to create, modify, or delete them. This aligns with the principle of least privilege for a shared VPC setup.

Answer

roles/compute.securityViewer

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Question 10

A backend service receives bursts of requests that cause timeouts. The team wants to smooth out the load while ensuring all requests are processed eventually. Which strategy should they use?

Accepted Answer

Use Cloud Tasks to queue incoming requests and process at a controlled rate. Cloud Tasks is designed to decouple request processing by queuing incoming requests and then dispatching them to a target handler at a controlled rate. This allows the backend to process requests smoothly, preventing timeouts during bursts, while ensuring every request is eventually processed through retry and dead-letter mechanisms.

Answer

Implement client-side rate limiting

Answer

Use Cloud Load Balancing with connection draining

Answer

Increase the number of backend instances

Question 11

You are a DevOps engineer tasked with bootstrapping a Google Cloud organization for a company that develops a SaaS product. The company has three teams: Platform, Application, and Data. Each team needs to manage their own projects, but the network should be centrally managed. You decide to use a shared VPC. You create a host project 'shared-vpc-host' and attach three service projects: 'platform-service', 'app-service', and 'data-service'. You grant the Network Admin role to the Platform team for the host project. The Application team needs to deploy Compute Engine instances in their service project, but they should not be able to modify network resources. You grant them the Compute Instance Admin role at the service project level. However, the Application team reports that they cannot create instances because they don't have permission to use the subnets in the shared VPC. What is the most likely missing step?

Accepted Answer

Grant the Application team the Compute Network User role on the host project or the specific subnets.. The Application team needs the Compute Network User role (roles/compute.networkUser) on the host project or the specific subnets to use the shared VPC subnets. This role allows them to attach instances to existing subnets without granting permission to modify network resources. Granting it at the service project level (Option B) is insufficient because the subnet permissions are inherited from the host project in a shared VPC setup.

Answer

Grant the Application team the Compute Network Admin role on the host project.

Answer

Grant the Application team the Compute Network User role on the service project.

Answer

Grant the Application team the roles/compute.subnetUser on the subnet.

Question 12

A gaming company runs a real-time multiplayer server on GKE. They want to minimize latency between players worldwide. Which approach should they use?

Accepted Answer

Use a multi-cluster setup with clusters in multiple regions and use a global load balancer. A multi-cluster setup with clusters in multiple regions, fronted by a global load balancer, minimizes latency by placing game servers physically closer to players worldwide. The global load balancer uses Anycast IP and Google Front Ends (GFEs) to route traffic to the nearest healthy backend cluster, reducing round-trip time (RTT). This approach is specifically designed for real-time multiplayer workloads that require low latency across geographic regions.

Answer

Increase the number of nodes in the cluster

Answer

Use a single regional cluster

Answer

Use Cloud Functions

Question 13

A company is setting up a new Google Cloud organization. They want to apply a consistent set of IAM roles to all projects within a specific department. What is the most efficient method to achieve this?

Accepted Answer

Create a folder for the department and assign roles at the folder level.. Google Cloud IAM supports hierarchical policy inheritance, where roles assigned at the folder level are automatically inherited by all projects within that folder. This eliminates the need for per-project assignments and ensures consistent permissions across the department's projects without manual overhead or scripting.

Answer

Use a script to apply roles to all projects periodically.

Answer

Assign roles directly to each project using the Google Cloud console.

Answer

Use a custom role and assign it to the organization node.

Question 14

Your team receives an alert that the Error Reporting count for a critical service has increased tenfold in the last 10 minutes. You suspect a recent code deployment is the cause. What is the first action you should take?

Accepted Answer

Roll back the deployment to the previous version.. A tenfold increase in error reporting within 10 minutes strongly indicates a recent code deployment introduced a critical bug. The immediate priority is to restore service stability by rolling back the deployment to the previous known-good version, as this directly mitigates the root cause. Delaying the rollback risks further degradation of the service and potential data loss or corruption.

Answer

Disable the alert to reduce noise.

Answer

Increase the instance count to handle the load.

Answer

Open a post-mortem to document the incident.

Question 15

You are a DevOps engineer for a startup bootstrapping their Google Cloud organization. They have a single project for all environments (dev, test, prod) and a flat resource hierarchy. Recently, a developer accidentally deleted a production Cloud Storage bucket, causing data loss. The team wants to prevent this in the future with minimal disruption. They also want to enforce that all new projects follow a naming convention like 'company-environment-xxx'. The CTO wants a solution using native Google Cloud services without third-party tools. What should you do?

Accepted Answer

Create folders for each environment, move existing resources into folders, and apply an organization policy to enforce the naming convention on project creation.. Creating folders for each environment (dev, test, prod) and moving existing resources into them establishes a hierarchical resource structure that allows organization policies to be applied at the folder level. The organization policy constraint `constraints/resourcemanager.allowedProjectCreation` can enforce the naming convention on project creation, and IAM roles can be scoped to folders to restrict bucket deletion (e.g., using `roles/storage.objectAdmin` instead of `roles/storage.admin`). This solution uses native Google Cloud services (Resource Manager, Organization Policies, IAM) with minimal disruption by not requiring code changes or third-party tools.

Answer

Implement a Cloud Function that renames projects not following the convention and deletes buckets not in a folder.

Answer

Grant all users the Project Creator role but restrict bucket deletion with IAM.

Answer

Use Google Cloud Deployment Manager to create projects with predefined templates.