PCDOE Practice Test 24 — 15 Questions

Question 1

A DevOps engineer notices that a Cloud Build trigger is not firing when commits are pushed to a Cloud Source Repositories repository. The trigger is configured with an invert regex for the branch filter. What could be the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The branch name matches the exclude pattern; the trigger ignores matching branches.. When a Cloud Build trigger is configured with an invert regex for the branch filter, it means the trigger will fire only for branches that do NOT match the specified regex pattern. If the branch name matches the exclude pattern, the trigger ignores commits on that branch, which is why the trigger is not firing. This is the intended behavior of the invert_regex flag in Cloud Build triggers.

Answer

The repository is in a different region.

Answer

The commit was made by a service account.

Answer

The trigger's service account lacks read access to the repository.

Question 2

Your organization is migrating a monolithic application to microservices on Cloud Run. You need to monitor the health of each microservice and aggregate logs and metrics in a central dashboard. You have set up Cloud Monitoring custom dashboards and logs-based metrics. After the initial deployment, you notice that the dashboards show data only for some services, while others appear to have no metrics. You verify that all services are running and emitting logs. What is the most likely cause?

Accepted Answer

The services are running in different GCP projects and you are viewing only one project.. Cloud Monitoring dashboards and logs-based metrics are scoped to a single GCP project. If microservices are deployed across multiple projects, metrics from services in other projects will not appear unless the dashboard is configured to aggregate data from all relevant projects. Since the question states that some services have no metrics while all are running and emitting logs, the most likely cause is that those services reside in different projects.

Answer

The services are not exporting metrics to Cloud Monitoring via the Monitoring API.

Answer

The logs-based metrics are not configured to parse logs from all services.

Answer

The Cloud Monitoring agent is not installed on the Cloud Run instances.

Question 3

A company is bootstrapping a Google Cloud organization for the first time. They want to set up Cloud Identity to manage users and groups. What is the correct order of steps?

Accepted Answer

Sign up for Cloud Identity, create the Google Cloud organization node, add users and groups, then enable Google Cloud services and set up billing.. Cloud Identity is the foundation for managing users and groups in a Google Cloud organization. You must first sign up for Cloud Identity to create the identity realm, then create the organization node (which requires a Cloud Identity account), add users and groups, and finally enable services and set up billing. This order ensures that the organization node is linked to the correct Cloud Identity tenant and that users exist before they are granted access to resources.

Answer

Add users and groups directly in Google Cloud without Cloud Identity.

Answer

Create the organization node first, then sign up for Cloud Identity, then add users.

Answer

Create the organization node, set up billing, then add Cloud Identity.

Question 4

Which TWO of the following are best practices for implementing service monitoring in Google Cloud? (Choose 2)

Accepted Answer

Use Cloud Monitoring uptime checks to verify that services are reachable from external locations.. Cloud Monitoring uptime checks verify that a service is reachable from external locations by sending HTTP, HTTPS, or TCP requests from Google Cloud's global vantage points. This validates external availability and helps detect regional outages or DNS resolution issues, which is a core best practice for service monitoring.

Answer

Set static alert thresholds without considering historical baselines.

Answer

Use the USE method (Utilization, Saturation, Errors) for service-level monitoring.

Answer

Alert on cause-based metrics (e.g., CPU utilization) rather than symptom-based metrics (e.g., latency).

Question 5

Your team receives an alert that the Error Reporting count for a critical service has increased tenfold in the last 10 minutes. You suspect a recent code deployment is the cause. What is the first action you should take?

Accepted Answer

Roll back the deployment to the previous version.. A tenfold increase in error reporting within 10 minutes strongly indicates a recent code deployment introduced a critical bug. The immediate priority is to restore service stability by rolling back the deployment to the previous known-good version, as this directly mitigates the root cause. Delaying the rollback risks further degradation of the service and potential data loss or corruption.

Answer

Disable the alert to reduce noise.

Answer

Increase the instance count to handle the load.

Answer

Open a post-mortem to document the incident.

Question 6

An engineer receives an alert that a service's error rate has exceeded the threshold. To investigate, which log-based metric should the engineer query in Cloud Logging to identify the root cause?

Accepted Answer

Error log count grouped by service name.. Error log count grouped by service name directly surfaces which specific service is generating the elevated error rate. In Cloud Logging, log-based metrics are user-defined counters extracted from log entries; querying the error log count per service isolates the offending component, enabling root cause identification without mixing in unrelated performance data.

Answer

Request latency histogram.

Answer

CPU utilization of the service instances.

Answer

Network bytes sent per instance.

Question 7

A startup wants to implement infrastructure as code for their Google Cloud environment to ensure reproducibility. They are using Terraform and want to manage state securely. What is the recommended approach?

Accepted Answer

Store Terraform state in a Cloud Storage bucket with object versioning enabled.. Storing Terraform state in a Cloud Storage bucket with object versioning enabled is the recommended approach because it provides a centralized, remote backend that supports state locking (via Cloud Storage's object lease mechanism) and version history for rollback. This ensures consistency across team members and protects against state corruption or accidental deletion, aligning with infrastructure as code best practices for reproducibility.

Answer

Store Terraform state in a file in Cloud Shell home directory.

Answer

Store Terraform state in Cloud Source Repositories as a YAML file.

Answer

Store Terraform state locally on each developer's machine and use git to sync.

Question 8

You need to monitor a multi-step login flow that involves calling an API, validating a token, and redirecting. Which type of uptime check should you use?

Accepted Answer

Synthetic Monitor (Cloud Functions). A synthetic monitor using Cloud Functions is the correct choice because it can simulate a multi-step login flow by executing custom code that calls an API, validates a token, and performs a redirect. Unlike simple HTTP GET or TCP checks, synthetic monitors can handle stateful interactions and conditional logic, making them ideal for complex transaction monitoring.

Answer

Cloud Endpoint check

Answer

TCP check

Answer

HTTP GET check

Question 9

A company runs a large-scale data processing workload on Dataflow. The pipeline processes streaming data from Pub/Sub and writes results to BigQuery. The current monthly Dataflow cost is $50,000, and the company wants to reduce it. They have already optimized the pipeline code and reduced data shuffling. They notice that the Dataflow workers are running at 100% CPU for most of the time, but the job's autoscaling is set to 'throughput-based' and currently uses 20 workers. The job's latency SLAs are tight. They consider switching to 'flexible resource scheduling' (FlexRS) to reduce costs. What should they evaluate before enabling FlexRS?

Accepted Answer

FlexRS is only available for batch pipelines, not streaming.. FlexRS (Flexible Resource Scheduling) is a feature designed for batch Dataflow pipelines that can tolerate longer startup times and preemptible VMs, but it is not available for streaming pipelines. The question states the pipeline is streaming (Dataflow processing streaming data from Pub/Sub), so FlexRS cannot be applied. Option A is incorrect because FlexRS does not use slower disk types; it uses preemptible VMs and slower startup but not disks. Option B is incorrect because while FlexRS does use preemptible VMs, it does not cause data loss; Dataflow handles preemption gracefully, and the pipeline is streaming anyway which is not eligible. Option C is incorrect because FlexRS is not about latency; it's about cost savings via preemption and slower startup, and again it's not for streaming.

Answer

FlexRS reduces costs by using slower disk types, which may impact performance.

Answer

FlexRS requires using preemptible VMs, which may cause data loss.

Answer

FlexRS may increase pipeline latency because it is designed for batch jobs with looser latency requirements.

Question 10

Refer to the exhibit. The Cloud Build fails with a permission error. The Cloud Build service account has roles/cloudbuild.builds.builder and roles/cloudfunctions.developer on the project. What is the missing permission?

Accepted Answer

cloudfunctions.functions.setIamPolicy. The --allow-unauthenticated flag requires the cloudfunctions.functions.setIamPolicy permission to make the function publicly accessible. The roles/cloudfunctions.developer does not include this permission. Option B is wrong because cloudfunctions.functions.get is included in the developer role. Option C is wrong because iam.serviceAccounts.actAs is not needed for this deployment. Option D is wrong because cloudfunctions.functions.sourceCodes.set is part of the developer role.

Answer

cloudfunctions.functions.get

Answer

iam.serviceAccounts.actAs

Answer

cloudfunctions.functions.sourceCodes.set

Question 11

A company uses Cloud Build to deploy applications and wants to ensure that builds from forked repositories cannot access sensitive environment variables. What is the best practice?

Accepted Answer

Use Cloud Build's 'encrypted variables' and mark them as 'not available for pull requests from forks'.. Cloud Build allows you to mark encrypted variables as 'not available for pull requests from forks', which prevents forked PRs from accessing sensitive environment variables. This is the most direct and secure method to protect secrets in CI/CD pipelines involving external contributions.

Answer

Disable builds from forks entirely.

Answer

Use Cloud Build's 'substitutions' instead of environment variables.

Answer

Use Cloud Build's 'secrets' manager instead of environment variables.

Question 12

A DevOps team is setting up a Google Cloud organization and wants to ensure that all billing alerts are centrally managed. What should they do?

Accepted Answer

Set up billing alerts at the organization level using Cloud Billing.. Setting up billing alerts at the organization level using Cloud Billing (Option D) is correct because it allows centralized management of billing thresholds, notifications, and budget policies across all projects within the organization. This approach leverages the Cloud Billing budget feature, which can be configured at the billing account level to send alerts to Pub/Sub topics or email recipients, ensuring consistent oversight without per-project configuration.

Answer

Use Cloud Monitoring to create custom metrics for billing.

Answer

Set up billing alerts individually for each project.

Answer

Create a project dedicated to billing and manage alerts there.

Question 13

Which THREE of the following are recommended practices for writing effective post-mortem documents?

Accepted Answer

Focus on the root cause and contributing factors.. Effective post-mortem documents must focus on root cause analysis and contributing factors to identify systemic issues rather than individual errors. This aligns with the Site Reliability Engineering (SRE) principle of blameless post-mortems, which prioritize learning and process improvement over punishment. By analyzing the technical chain of events—such as a misconfigured load balancer or a cascading failure due to missing circuit breakers—teams can implement lasting fixes.

Answer

Assign blame to the responsible engineer.

Answer

Keep the document brief to save time.

Question 14

Refer to the exhibit. The team observes that some requests are fast while others are slow. Both requests have identical payload and response. What is the most likely cause of the latency difference?

Accepted Answer

The fast request hit a cached response. The fast request hit a cached response, meaning the reverse proxy or CDN served the response from its cache without forwarding the request to the origin server. This eliminates the round-trip time to the backend and the processing time on the origin, resulting in significantly lower latency. Since both requests have identical payloads and responses, caching is the most plausible explanation for the observed difference.

Answer

The slow request had a larger response size

Answer

The fast request used a different load balancer

Answer

The slow request used a different HTTP method

Question 15

You are a DevOps engineer tasked with bootstrapping a Google Cloud organization for a company that develops a SaaS product. The company has three teams: Platform, Application, and Data. Each team needs to manage their own projects, but the network should be centrally managed. You decide to use a shared VPC. You create a host project 'shared-vpc-host' and attach three service projects: 'platform-service', 'app-service', and 'data-service'. You grant the Network Admin role to the Platform team for the host project. The Application team needs to deploy Compute Engine instances in their service project, but they should not be able to modify network resources. You grant them the Compute Instance Admin role at the service project level. However, the Application team reports that they cannot create instances because they don't have permission to use the subnets in the shared VPC. What is the most likely missing step?

Accepted Answer

Grant the Application team the Compute Network User role on the host project or the specific subnets.. The Application team needs the Compute Network User role (roles/compute.networkUser) on the host project or the specific subnets to use the shared VPC subnets. This role allows them to attach instances to existing subnets without granting permission to modify network resources. Granting it at the service project level (Option B) is insufficient because the subnet permissions are inherited from the host project in a shared VPC setup.

Answer

Grant the Application team the Compute Network Admin role on the host project.

Answer

Grant the Application team the Compute Network User role on the service project.

Answer

Grant the Application team the roles/compute.subnetUser on the subnet.