PCDOE Practice Test 24 — 15 Questions

Question 1

Refer to the exhibit. A budget alert has fired for project dev-123 indicating that the cost has exceeded the budget of $1000. What should the team do next to investigate the cost overrun?

Accepted Answer

Open a BigQuery query on the billing export table, filtering by project 'dev-123' and service.. The correct option is B: opening a BigQuery query on the billing export table, filtering by project 'dev-123' and service. This is the right next step because the detailed billing export provides granular, line-item cost data (by project, service, SKU, and labels) that lets the team pinpoint exactly which services in dev-123 drove the overrun. Option A is wrong because disabling all APIs is a disruptive, non-investigative action that could break workloads without identifying the cause. Option C is wrong because an automated shutdown Cloud Function is a remediation control, not an investigation step, and could cause outages. Option D is wrong because the Cloud Console billing cost table gives only high-level aggregate costs, not the per-service breakdown needed to diagnose the overrun. Option E is wrong because creating a lower-threshold budget only changes alerting and does nothing to investigate the existing cost overrun.

Answer

Disable all APIs in project dev-123 immediately.

Answer

Set up a Cloud Function to automatically shut down resources when the budget is exceeded.

Answer

View the billing account's cost table in the Cloud Console.

Answer

Create a new budget with a lower threshold to get alerted earlier.

Question 2

You are an SRE at a fintech company using Google Cloud. A recent incident caused a 45-minute outage of a payment processing service. The postmortem team is analyzing the incident and wants to ensure that the action items are effective. According to Google SRE best practices, which two of the following are key characteristics of effective postmortem action items? (Choose two.)

Accepted Answer

They are assigned to specific individuals with clear deadlines.. Effective postmortem action items are specific, assigned to owners with deadlines, and address both prevention and detection. Blamelessness is fundamental, and action items should not be vague. They are created for any incident that provides learning opportunities, not only when the error budget is exceeded. These characteristics ensure that the postmortem leads to real improvements in reliability.

Answer

They are only created for incidents that exceed the error budget.

Answer

They focus on blaming the individual who caused the outage.

Answer

They are kept vague to allow flexibility in implementation.

Question 3

Your organization has 40 projects, and each project's DevOps team has its own Cloud Build triggers. You need to grant every CI/CD service account in the organization the ability to deploy to a shared GKE cluster in the shared-services project, but you want to avoid adding 40 individual IAM bindings. Which approach should you use?

Accepted Answer

Create a Google group containing all CI/CD service accounts, then grant roles/container.developer to that group on the shared-services project.. Google Groups are the canonical way to manage IAM at scale in Google Cloud. Because service accounts can be group members, one IAM binding on the shared-services project grants cluster access to every current and future CI/CD identity. This keeps the number of policy bindings constant as the organization grows, unlike per-service-account bindings.

Answer

Create a single shared service account in the shared-services project and distribute its JSON key to all 40 CI/CD pipelines.

Answer

Grant the roles/container.developer role to each CI/CD service account directly on the GKE cluster resource.

Answer

Grant roles/container.developer to allAuthenticatedUsers on the shared-services project.

Question 4

Your team runs a critical service on Google Cloud. You have defined an SLO of 99.9% availability over a 30-day rolling window. The error budget is currently 50% consumed. A new feature is ready to deploy, but the team is unsure if they should proceed. According to Google SRE principles, what should they do?

Accepted Answer

Proceed with the deployment because the error budget is not exhausted.. Google SRE uses error budgets to balance reliability and innovation. When budget remains, teams can proceed with releases, as the budget explicitly permits risk. The correct action is to deploy while monitoring the budget, and halt if it is exhausted. Freezing at 50% or demanding zero risk contradicts the purpose of error budgets.

Answer

Increase the SLO to 99.99% to provide more buffer before deploying.

Answer

Freeze all deployments until the error budget is fully replenished.

Answer

Deploy only if the new feature has zero risk of causing errors.

Question 5

You are an SRE for a microservices-based application on Google Kubernetes Engine (GKE). You want to implement a monitoring strategy that reduces alert fatigue and focuses on user-impacting issues. Which approach aligns with Google SRE best practices?

Accepted Answer

Create alerts based on SLO burn rates and high-level service health metrics.. SRE best practices emphasize alerting on symptoms that directly affect users, such as SLO violations. Burn rate alerts measure how quickly the error budget is being consumed, providing a clear signal of user impact. This approach reduces alert fatigue by filtering out non-critical events and focusing on what matters most: keeping the service reliable from the user's perspective.

Answer

Set up alerts for each deployment event to track changes.

Answer

Alert on CPU and memory utilization thresholds for each microservice.

Answer

Alert on every error log entry to ensure no issue is missed.

Question 6

A DevOps team is bootstrapping organization-level logging for their new Google Cloud organization. They need all Admin Activity audit logs from every project aggregated into a single BigQuery dataset owned by the central logging project, and they want new projects to be covered automatically. What should they do?

Accepted Answer

Create an aggregated log sink at the organization level with a BigQuery dataset destination in the central logging project, and grant the sink's writer identity roles/bigquery.dataEditor on that dataset.. An organization-level aggregated sink captures log entries from all current and future projects and folders, which satisfies automatic coverage for new projects. Routing the sink to a BigQuery dataset and granting the sink's writer identity the needed dataset role is the supported, low-maintenance way to centralize Admin Activity logs for querying.

Answer

Create a project-level log sink in each existing project pointing to a shared BigQuery dataset, and add a Cloud Scheduler job that recreates sinks for new projects.

Answer

Create an organization-level log sink to a Cloud Storage bucket, then use a BigQuery external table over the bucket to query logs from all projects.

Answer

Enable the BigQuery Data Transfer Service to pull Cloud Logging entries into a dataset on a schedule, and scope the transfer to the organization.

Question 7

You are an SRE for a payment processing service on Google Cloud. The service's SLO for latency is that 99% of requests must complete within 200ms. You are setting up an alerting policy in Cloud Monitoring to detect when the service is at risk of violating this SLO. Which metric should you use as the basis for the alert?

Accepted Answer

The 99th percentile latency over a 5-minute window.. The SLO is defined as 99% of requests under 200ms, which corresponds to the 99th percentile latency. Alerting on this percentile over a short window provides a direct signal of SLO violation risk. Other metrics like average, median, or maximum do not accurately capture the tail behavior that the SLO targets, and may lead to missed violations or false alerts.

Answer

The maximum latency observed in the last 5 minutes.

Answer

The average latency over a 1-hour window.

Answer

The 50th percentile latency over a 5-minute window.

Question 8

You are the SRE for a video streaming service running on Google Kubernetes Engine (GKE). The service's SLO is 99.9% availability over a 30-day window, and the error budget is currently 50% consumed. A new feature is ready for deployment, but it carries a risk of increasing the error rate. According to Google SRE practices, what should you do?

Accepted Answer

Proceed with a canary deployment and monitor the error budget impact.. The error budget provides a quantitative measure of acceptable unreliability. With 50% remaining, the team can still take risks, but they should do so cautiously. A canary deployment limits the impact of potential errors, allowing the team to monitor and react. This balances the need to innovate with the need to maintain reliability, a core SRE practice.

Answer

Deploy the feature immediately because the error budget is not exhausted.

Answer

Halt all deployments until the error budget is fully replenished.

Answer

Roll back the previous deployment to free up error budget.

Question 9

A platform team is bootstrapping a new Google Cloud organization. Security requires that no service account key can ever be created in any project, including future projects, and that the restriction cannot be removed by project-level administrators. Which configuration meets these requirements?

Accepted Answer

Set an organization policy with the constraints/iam.disableServiceAccountKeyCreation constraint enforced at the organization node.. Organization policies are preventive controls applied across the resource hierarchy. Enforcing constraints/iam.disableServiceAccountKeyCreation at the organization node blocks key creation in all current and future projects, and project administrators cannot weaken an inherited constraint. This is the standard approach for enforcing keyless authentication across an enterprise.

Answer

Enable the Cloud Asset Inventory API and schedule a recurring export to detect newly created service account keys.

Answer

Create an IAM deny policy on each project that denies iam.serviceAccountKeys.create for all principals.

Answer

Remove the roles/iam.serviceAccountKeyAdmin role from all principals in the organization.

Question 10

A DevOps team is using Cloud Monitoring to monitor a fleet of VMs. They want to create a dashboard that shows the 95th percentile of disk read latency across all VMs, but they notice that the metric `compute.googleapis.com/instance/disk/read_latency` is not available as a distribution. What is the most likely reason?

Accepted Answer

The metric is a gauge, not a distribution, so percentile aggregations are not supported directly; you must use a different metric or create a custom one.. Percentile aggregations are only supported for distribution-valued metrics. The `compute.googleapis.com/instance/disk/read_latency` metric is a gauge, which reports a single value per sample. Therefore, you cannot compute percentiles directly from it. To obtain percentiles, you would need a metric with a distribution value type, which might require custom instrumentation or using a different metric that captures latency as a distribution.

Answer

The metric requires the Ops Agent to be installed, and without it, only gauge values are collected.

Answer

The metric is only available for instances with local SSDs, not for persistent disks.

Answer

The metric is only available in the `us-central1` region and must be enabled separately.

Question 11

You are an SRE for a global gaming platform that uses Google Kubernetes Engine (GKE). The platform experiences a sudden spike in traffic during a new game launch. Your team wants to ensure that the service remains available and that the error budget is not exhausted. You have defined an SLO of 99.9% availability over a 30-day window. Which of the following actions should you take first to align with SRE best practices?

Accepted Answer

Check the current error budget burn rate and, if it is high, freeze non-critical changes and focus on reliability improvements.. According to SRE principles, the error budget is a key decision-making tool. When the burn rate is high, it indicates that the service is consuming the budget quickly, and the team should prioritize reliability over new features. Checking the burn rate first informs whether to take action such as scaling or freezing changes. This approach ensures that reliability is maintained without unnecessarily halting all work or ignoring the budget.

Answer

Immediately scale up the GKE cluster nodes and pods to handle the traffic, regardless of the error budget.

Answer

Increase the SLO target to 99.99% to ensure higher reliability during the launch.

Answer

Disable the SLO monitoring to prevent alerts from firing during the traffic spike, then scale the cluster.

Question 12

You are configuring a Cloud Build trigger that builds a Docker image and pushes it to Artifact Registry. The trigger is set to run on pushes to the 'main' branch. You want to ensure that the image is tagged with the Git commit SHA and also with 'latest' only when the build is successful. Which configuration should you use in the build steps?

Accepted Answer

Use a build step to build and push the SHA-tagged image, then add a subsequent step that runs only if all previous steps succeeded, which tags the SHA image as 'latest' and pushes it.. To ensure latest is only pushed on a successful build, you must separate the tagging and pushing of latest into a step that runs only if all previous steps succeeded. Building and pushing the SHA-tagged image first, then conditionally retagging and pushing latest, achieves this. Other options either push latest unconditionally or rely on non-existent automatic tagging features.

Answer

Use the 'docker build' command with '-t us-central1-docker.pkg.dev/my-project/my-repo/my-image:$SHORT_SHA' and then 'docker push' that tag, followed by a separate step to tag and push 'latest'.

Answer

Use Cloud Build's built-in substitution to automatically tag the image with 'latest' on successful builds.

Answer

Use a single step that runs 'docker build -t us-central1-docker.pkg.dev/my-project/my-repo/my-image:$SHORT_SHA -t us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest .' and then 'docker push' both tags.

Question 13

An SRE team is conducting a postmortem for a recent outage. They want to follow Google SRE best practices for blameless postmortems. Which two actions should they take? (Choose two.)

Accepted Answer

Document the incident timeline, impact, and action items in a shared postmortem document.. Blameless postmortems focus on learning from incidents without assigning blame. Two key actions are identifying systemic causes and documenting the incident thoroughly. These practices encourage transparency, help prevent recurrence by addressing root causes, and share knowledge across the organization. They align with Google SRE principles of continuous improvement and psychological safety.

Answer

Immediately implement punitive measures for the team responsible for the outage.

Answer

Keep the postmortem findings confidential to avoid reputational damage.

Answer

Assign blame to the engineer who deployed the faulty change to ensure accountability.

Question 14

You are an SRE for a microservices-based application on Google Cloud. The team wants to reduce toil by automating the deployment and rollback of services. They decide to implement a canary release strategy. Which Google Cloud tool or feature is most suitable for automating canary deployments with automatic rollback based on SLO violations?

Accepted Answer

Cloud Deploy with canary deployment strategy and automated rollback based on Cloud Monitoring metrics.. Cloud Deploy is a Google Cloud service designed to automate deployments to GKE, Cloud Run, and Anthos. It supports canary deployment strategies and can be configured to automatically roll back if certain metrics, such as error rate or latency, exceed thresholds defined in Cloud Monitoring. This makes it the most suitable tool for automating canary releases with automatic rollback based on SLO violations, reducing toil and improving reliability.

Answer

Cloud Build with a custom script that deploys to a canary and manually checks metrics before promoting.

Answer

GKE with Istio service mesh and Flagger for canary deployments and automated rollback.

Answer

Terraform with a canary module and a CI/CD pipeline that triggers rollback via Cloud Functions.

Question 15

You are deploying a new microservice on Google Kubernetes Engine and want to ensure that a specific alert fires only when the service's 95th percentile latency exceeds 200 ms for 10 minutes. You have already instrumented the service to emit custom metrics to Cloud Monitoring. What is the simplest way to create this alert?

Accepted Answer

Create a Cloud Monitoring alerting policy with a condition on the custom latency metric, using a 95th percentile aggregation and a threshold of 200 ms for 10 minutes.. Cloud Monitoring alerting policies natively support conditions on custom metrics with percentile aggregations and duration windows. By selecting the 95th percentile of the latency metric, setting a threshold of 200 ms, and configuring a 10-minute duration, you implement the alert exactly as required. This is the simplest approach because the metrics are already in Cloud Monitoring and no additional components are needed.

Answer

Create a log-based alert that scans application logs for latency values above 200 ms and fires when more than a few entries appear.

Answer

Configure a Prometheus Alertmanager rule that queries the custom metric and sends alerts to a webhook.

Answer

Use a Cloud Monitoring uptime check with a custom header that measures latency and set a threshold of 200 ms.