PCDOE Practice Test 1 — 25 Questions

Question 1

Refer to the exhibit. The Cloud Build fails with a permission error. The Cloud Build service account has roles/cloudbuild.builds.builder and roles/cloudfunctions.developer on the project. What is the missing permission?

Accepted Answer

cloudfunctions.functions.setIamPolicy. Option A is correct because the --allow-unauthenticated flag requires the cloudfunctions.functions.setIamPolicy permission to make the function publicly accessible. The roles/cloudfunctions.developer does not include this permission. Option B is wrong because cloudfunctions.functions.get is included in the developer role. Option C is wrong because iam.serviceAccounts.actAs is not needed for this deployment. Option D is wrong because cloudfunctions.functions.sourceCodes.set is part of the developer role.

Answer

cloudfunctions.functions.get

Answer

iam.serviceAccounts.actAs

Answer

cloudfunctions.functions.sourceCodes.set

Question 2

A company is setting up a new Google Cloud organization. They want to ensure that all projects inherit common IAM policies. What is the best practice?

Accepted Answer

Apply IAM policies at the organization level.. Applying policies at the organization level ensures all projects and folders inherit them, providing consistent enforcement and reducing administrative overhead.

Answer

Apply IAM policies at the folder level.

Answer

Apply IAM policies at the project level.

Answer

Use multiple organizations to isolate policies.

Question 3

A DevOps team is bootstrapping CI/CD pipelines that need access to API keys stored in Secret Manager. The pipelines run on Cloud Build. What is the best practice for granting access to secrets?

Accepted Answer

Grant the Cloud Build service account roles/secretmanager.secretAccessor on the project containing secrets.. Option A is correct because granting the Cloud Build service account roles/secretmanager.secretAccessor on the project containing secrets provides fine-grained access. Option B is wrong because storing API keys as build substitutions is insecure and exposed in logs. Option C is wrong because roles/secretmanager.admin grants excessive permissions. Option D is wrong because using Cloud KMS adds complexity without being a best practice for secret access.

Answer

Use a custom service account with roles/secretmanager.admin and run Cloud Build as that account.

Answer

Store the API keys as build substitutions.

Answer

Use Cloud KMS to encrypt secrets and pass them as environment variables.

Question 4

A DevOps team is bootstrapping their Google Cloud organization and wants to enable Infrastructure as Code (IaC) using Terraform. They need a service account that Terraform can use to create and manage resources across multiple projects. What is the best practice for creating and managing this service account?

Accepted Answer

Create a service account in a separate 'admin' project and grant it the required roles on each project via IAM.. Option A is correct because creating a service account in a dedicated 'admin' project and granting it necessary roles across projects is a common pattern. Option B is wrong because the default service account has too many permissions and is not recommended. Option C is wrong because service account keys should be avoided in source control. Option D is wrong because using a user account is not secure for automation.

Answer

Generate a service account key and store it in a Cloud Storage bucket accessible to the team.

Answer

Use a user account with two-factor authentication for Terraform automation.

Answer

Use the Compute Engine default service account from the project where Terraform runs.

Question 5

To securely manage secrets (e.g., API keys) used in Cloud Build pipelines, which service should be used?

Accepted Answer

Secret Manager. Option A is correct because Secret Manager is the recommended service for storing and accessing secrets like API keys. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not designed for secrets, and Cloud KMS is not for direct secret storage.

Answer

Cloud KMS

Answer

Cloud Key Management Service (duplicate)

Answer

Cloud Storage

Question 6

A DevOps engineer needs to set up a centralized logging solution for multiple projects. They want to store logs in a BigQuery dataset for analysis. What is the best approach?

Accepted Answer

Create an aggregated sink at the organization or folder level to export logs to BigQuery.. Option D is correct because an aggregated sink at the organization or folder level allows you to collect logs from all projects within that hierarchy into a single BigQuery dataset in a centralized project. This approach eliminates the need to configure individual sinks per project, reduces administrative overhead, and ensures consistent log routing across the entire organization.

Answer

Use Cloud Logging's export feature to Pub/Sub and then to BigQuery.

Answer

Use the BigQuery Data Transfer Service for logs.

Answer

Create a sink in each project to export logs to the BigQuery dataset.

Question 7

An organization is using Cloud Source Repositories and wants to enforce that all commits are signed with a verified GPG key. How can they enforce this?

Accepted Answer

Enable the Signed Commits policy in the repository settings.. Option C is correct because Cloud Source Repositories provides a built-in 'Signed Commits' policy in the repository settings that, when enabled, rejects any push containing commits that are not signed with a verified GPG key. This policy is enforced server-side at the repository level, ensuring that only signed commits are accepted without requiring external tools or custom scripts.

Answer

Use a branch protection rule in Cloud Source Repositories.

Answer

Use Cloud Functions to validate commits after push.

Answer

Use a pre-receive hook in Cloud Source Repositories.

Question 8

A DevOps engineer notices that developers are accidentally deleting Cloud Storage buckets. The organization wants to prevent accidental deletion while still allowing developers to manage bucket objects. What is the best practice?

Accepted Answer

Set a bucket retention policy with deletion lock.. A bucket retention policy with a deletion lock prevents the deletion of the bucket itself, even by users with owner permissions, while still allowing developers to manage objects within the bucket. This is the only option that directly enforces a hard, irreversible lock on bucket deletion, meeting the requirement to prevent accidental deletion without restricting object management.

Answer

Enable Cloud Audit Logging and set up alerts on bucket deletion.

Answer

Set a bucket IAM policy denying storage.objects.delete for developers.

Answer

Use an organization policy to disable bucket deletion across the org.

Question 9

Your Cloud SQL for MySQL instance is running low on storage. You need to increase the storage size without downtime. What should you do?

Accepted Answer

Edit the instance and increase the storage size; it will be applied online.. Option D is correct because Cloud SQL for MySQL supports online storage increases. When you edit the instance and increase the storage allocation, the operation is applied without requiring a restart or causing downtime. The underlying infrastructure uses live migration and dynamic volume expansion to make the additional capacity available immediately while the instance continues serving traffic.

Answer

You cannot increase storage online; you must create a new instance.

Answer

Create a clone of the instance with larger storage and switch traffic.

Answer

Enable automatic storage increase and it will happen automatically.

Question 10

A DevOps engineer is designing a CI/CD pipeline using Cloud Build. Which TWO configurations are necessary to ensure secure and reliable deployments? (Choose two.)

Accepted Answer

Use manual approval steps for production deployments.. Options C and E are correct. Secret Manager provides security, and manual approval ensures reliability.

Answer

Use Cloud Build triggers with branch filters.

Answer

Push all artifacts to a public Container Registry.

Answer

Enable Cloud Build service account with Editor role.

Question 11

A developer is building an application that uses Firestore (in Datastore mode). The application needs to query data across two properties: 'status' and 'timestamp', with an equality filter on 'status' and a range filter on 'timestamp'. Which three steps are required to support this query efficiently? (Choose THREE.)

Accepted Answer

Ensure that single-field indexes exist for both 'status' and 'timestamp'. Option A is correct because Firestore (in Datastore mode) requires single-field indexes to be defined for each property used in a query, even when a composite index is also present. Without a single-field index on 'status' and 'timestamp', the query engine cannot efficiently evaluate the equality and range filters, leading to full table scans or query failures.

Answer

Enable automatic composite index creation in Firestore settings

Answer

Create an index exemption for the 'timestamp' field

Question 12

An organization is migrating from Teradata to BigQuery. They have 20 TB of data, complex BTEQ scripts, and require near-zero downtime. Which THREE components should be part of their migration plan? (Choose THREE.)

Accepted Answer

Schema Conversion Tool (SCTS). Schema Conversion Tool (SCTS) is correct because it automates the conversion of Teradata-specific DDL, BTEQ scripts, and stored procedures into BigQuery-compatible SQL. This is critical for migrating 20 TB of data and complex BTEQ scripts without manual rewriting, reducing errors and accelerating the migration timeline.

Answer

Cloud SQL Auth Proxy

Answer

Database Migration Service (DMS)

Question 13

A team is migrating a self-managed PostgreSQL database to AlloyDB using DMS. They need to set up the source connection profile. The source database is in a different VPC network, and the team wants to avoid exposing it to the internet. Which connectivity option should they use?

Accepted Answer

VPC peering. VPC peering is the correct connectivity option because it allows private IP connectivity between two VPC networks without exposing the source database to the internet. DMS can use VPC peering to connect to a source PostgreSQL database in a different VPC, as long as the CIDR ranges do not overlap and the necessary firewall rules allow traffic on port 5432. This meets the requirement of avoiding internet exposure while enabling secure, low-latency replication.

Answer

Direct peering

Answer

Cloud SQL Auth Proxy

Answer

IP allowlisting for public IP

Question 14

You are designing alerting policies for a microservice architecture. Which TWO metrics are most suitable for triggering a page to the on-call engineer?

Accepted Answer

Latency P99 exceeding the SLO target for 5 minutes.. Error budget burn rate and high latency (P99 breaching SLO) directly indicate customer-facing issues and require immediate attention. CPU and request count are less critical.

Answer

Number of requests per second.

Answer

CPU utilization at 50%.

Answer

Memory usage trend.

Question 15

An organization has a service that must meet a 99.99% SLO. The service runs on GKE and uses Cloud SQL. The team notices that during a major incident, the error budget is consumed rapidly. They want to implement a mechanism to automatically rollback deployments that cause sustained error budget consumption above a threshold. What is the best approach?

Accepted Answer

Set up a deployment pipeline with Cloud Deploy that includes a predeployment validation step that checks the current error budget burn rate and blocks the release if the burn rate exceeds 10% per hour.. Option A is correct because using Cloud Deploy or Spinnaker with automated rollback based on error budget burn rate is the recommended pattern. Option B is wrong because Cloud Build is CI, not deployment orchestration. Option C is wrong because canary deployments reduce blast radius but don't auto-rollback. Option D is wrong because manual rollback via Cloud Console is not automated.

Answer

Use Cloud Scheduler to run a script that checks error budget and rolls back if needed.

Answer

Implement a canary deployment strategy with manual approval steps.

Answer

Configure Cloud Build to automatically revert the last commit if error budget is consumed.

Question 16

During a post-incident review, the team discovers that a misconfiguration in Cloud Armor caused legitimate traffic to be blocked, leading to a outage. The misconfiguration was introduced by a junior engineer who had overly permissive IAM roles. What is the best way to prevent similar incidents in the future?

Accepted Answer

Use Organization Policy constraints to restrict allowed IP ranges and rules in Cloud Armor security policies.. Option D is correct because enforcing guardrails with Organization Policies can prevent misconfigurations at scale. Option A is wrong because removing the engineer's access is punitive but doesn't prevent others. Option B is wrong because peer reviews reduce human error but are not automated. Option C is wrong because Cloud Armor logs help detection but not prevention.

Answer

Enforce a mandatory peer review for all Cloud Armor configuration changes.

Answer

Revoke the junior engineer's access to Cloud Armor and grant read-only access.

Answer

Enable Cloud Armor security policy logs and create alerting for blocked traffic spikes.

Question 17

During a canary deployment of a new version of a microservice, the engineer notices increased error rates in the canary instances. What is the best immediate action?

Accepted Answer

Perform a rollback of the canary to the previous version.. When error rates increase in a canary, the safest immediate action is to roll back the canary to prevent further impact on users. Pausing and investigating is reasonable but allows continued errors. Scaling up the canary would worsen the issue. Continuing the rollout would be irresponsible.

Answer

Continue the rollout to see if errors stabilize.

Answer

Scale up the canary instances to handle load.

Answer

Pause the rollout and investigate the errors.

Question 18

A team is migrating an on-premises Oracle database to Cloud SQL for PostgreSQL using DMS. They have completed the schema conversion using Ora2Pg and are now setting up continuous migration. The source database is behind a firewall. Which connectivity method should they use for the source connection profile if they cannot use public IP?

Accepted Answer

Configure a VPN or Dedicated Interconnect with VPC. Since the source Oracle database is behind a firewall and cannot use a public IP, a VPN or Dedicated Interconnect with VPC provides a private, encrypted connection between the on-premises network and Google Cloud. This allows Database Migration Service (DMS) to reach the source database securely without exposing it to the public internet. DMS supports connectivity via these private network paths when public IP is not an option.

Answer

VPC peering

Answer

Cloud SQL Auth Proxy

Answer

IP allowlisting

Question 19

An SRE team created the above logs-based metric. They expect it to count the number of HTTP 500 errors per instance. However, the metric shows no data. What is the most likely cause?

Accepted Answer

The log entries might not have the 'status' field in jsonPayload; it could be in a different location or format.. Option B is correct because the most likely reason for a logs-based metric showing no data is that the log entries do not contain the expected 'status' field in jsonPayload, or it is located in a different field (e.g., httpRequest.status) or formatted as a string instead of an integer. Cloud Logging metrics rely on exact field paths defined in the metric descriptor; if the field is missing or misnamed, no data points are generated.

Answer

The metric kind is DELTA but should be CUMULATIVE.

Answer

The metric name does not follow the required naming convention.

Answer

The labelExtractors must use regex instead of JSON path.

Question 20

A team wants to implement multi-cluster monitoring for GKE using Managed Service for Prometheus. Which configuration is required?

Accepted Answer

Enable Managed Service for Prometheus in each cluster and configure a single Cloud Monitoring workspace to collect metrics from all clusters. Managed Service for Prometheus is a Google Cloud-managed, multi-cluster monitoring solution. To collect metrics from multiple GKE clusters, you must enable the service in each cluster individually and then configure a single Cloud Monitoring workspace to aggregate the data. This ensures each cluster runs its own collection pipeline, while the workspace provides a unified view across all clusters.

Answer

Enable Managed Service for Prometheus in one cluster and have other clusters forward metrics to it

Answer

Use Cloud Monitoring agent on nodes in each cluster

Answer

Set up a separate workspace per cluster

PCDOE Practice Test 1 — 25 Questions

Exhibit

PCDOE Practice Test 1 — 25 Questions

Exhibit