PCDOE Practice Test 2 — 25 Questions

Question 1

A GKE cluster node fails, causing pods to be rescheduled. However, some pods remain in 'CrashLoopBackOff' state. After examining logs, you find the application has a dependency on local SSD that was ephemeral. What is the best long-term solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use PersistentVolumes with ReadWriteOnce access mode.. The application's dependency on local SSD (ephemeral storage) means that when the node fails, the data is lost, causing the pods to crash. PersistentVolumes (PVs) with ReadWriteOnce (RWO) access mode provide durable, node-independent storage that survives node failures, ensuring pods can be rescheduled on any node and access their data. This is the best long-term solution because it decouples storage from the node lifecycle, preventing CrashLoopBackOff due to missing local data.

Answer

Configure pod anti-affinity.

Answer

Increase the node pool size.

Answer

Use a DaemonSet to run the application.

Question 2

A company uses BigQuery on-demand pricing. They want to reduce costs without changing usage patterns. Which THREE strategies are effective? (Choose three.)

Accepted Answer

Use clustered tables.. Partitioning and clustering reduce data scanned per query. Materialized views precompute results to reduce scanned data on repeated queries.

Answer

Use legacy SQL instead of standard SQL.

Answer

Use flat-rate pricing.

Question 3

A team uses Spanner for a global database. They notice increased read latency and high CPU utilization on some nodes. The workload is read-heavy with occasional writes. Which action is most likely to improve performance?

Accepted Answer

Add more nodes to the instance and ensure read requests are distributed evenly.. In a read-heavy Spanner workload with high CPU utilization on some nodes, adding more nodes and ensuring read requests are distributed evenly (Option D) directly addresses the bottleneck by increasing the instance's compute capacity and spreading the load across all nodes. Spanner's architecture uses a shared-nothing design where each node handles a portion of the data and traffic; uneven distribution can cause hot spots. Adding nodes scales out processing power, and ensuring even distribution (e.g., via proper key design or using Spanner's built-in load balancing) reduces latency and CPU spikes on individual nodes.

Answer

Create read-only replicas in each region.

Answer

Split the most frequently read tables into smaller tables.

Answer

Increase the number of nodes in the instance.

Question 4

A team is troubleshooting a slow response time on an App Engine standard environment application. The application uses Cloud SQL as its database. Which TWO actions should the team take to identify the bottleneck?

Accepted Answer

Examine App Engine request logs for latency patterns.. Examining App Engine request logs reveals latency patterns, such as which endpoints or operations are slow, helping to pinpoint whether the bottleneck is in the application code, network, or database. Option C is correct because enabling Cloud SQL slow query logging identifies long-running SQL queries that could be causing database contention or inefficient data retrieval, directly addressing a common performance bottleneck in App Engine applications using Cloud SQL.

Answer

Increase the number of App Engine instances.

Answer

Enable Cloud CDN to cache responses.

Answer

Disable caching to ensure fresh data.

Question 5

A team uses Cloud SQL for PostgreSQL. They receive an alert that the database's CPU utilization is above 95% for the past 30 minutes. Queries are taking longer than usual. They want to investigate without causing further impact. What should they do first?

Accepted Answer

Use Cloud SQL Query Insights to find the most time-consuming queries. Cloud SQL Query Insights is a managed monitoring tool that automatically captures and analyzes query performance metrics, including CPU consumption, latency, and execution plans. In this scenario, it allows the team to identify the specific queries causing high CPU utilization without making any changes to the instance, thus avoiding further impact. This is the first and safest diagnostic step before any remediation.

Answer

Increase the number of vCPUs of the Cloud SQL instance

Answer

Restart the Cloud SQL instance to clear the cache

Answer

Migrate the database to Cloud Spanner

Question 6

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Accepted Answer

Identify time, then Clone, then Verify, then Promote, then Update connections. The correct sequence for recovering a Google Cloud SQL instance from a point-in-time backup is: first, identify the exact point-in-time to recover; second, clone the instance to that time; third, verify the cloned instance's data; fourth, promote the clone to become the primary instance; and fifth, update application connections to use the new primary. This order ensures a consistent and verifiable recovery process.

Answer

Clone, then Identify time, then Verify, then Promote, then Update connections

Answer

Identify time, then Clone, then Promote, then Verify, then Update connections

Answer

Clone, then Identify time, then Promote, then Verify, then Update connections

Question 7

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Organization Policies can enforce that all new projects must have specific labels by using a constraint like `constraints/compute.requireOsLogin` is not for labels, but you can use a custom constraint with the `constraints/gcp.resourceLabels` to require labels on resources. However, for projects themselves, you can use an organization policy with a list constraint to mandate that certain labels are present on all projects, and the policy will block creation of any project that does not comply.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 8

Refer to the exhibit. A DevOps engineer applies this Terraform configuration but gets an error: "Error creating Project: googleapi: Error 403: The caller does not have permission to enable services". What is the most likely cause?

Accepted Answer

The service account used by Terraform lacks the Service Usage Admin role on the project.. The error 'The caller does not have permission to enable services' indicates that the identity (service account) used by Terraform to authenticate with the Google Cloud API lacks the required IAM permission to enable Google APIs on the project. The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) grants the necessary permissions, including serviceusage.services.enable and serviceusage.services.list, which are required to enable services like the Compute Engine API during resource creation. Without this role, the API call to enable services fails with a 403 error.

Answer

The org_id is incorrect.

Answer

The organization requires that the Compute Engine API be enabled before project creation.

Answer

The project ID already exists.

Question 9

A DevOps team wants to optimize resource utilization for their GKE deployment. Which built-in Kubernetes resource can automatically adjust CPU and memory requests based on historical usage?

Accepted Answer

VerticalPodAutoscaler. The VerticalPodAutoscaler (VPA) is the correct choice because it automatically adjusts CPU and memory resource requests (and limits) for pods based on historical usage data, optimizing resource utilization without manual intervention. Unlike the HorizontalPodAutoscaler, which scales the number of pods, the VPA modifies the resource specifications of existing pods to match observed demand.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

PodDisruptionBudget

Question 10

You are an on-call engineer responding to a critical service incident affecting a production application. According to Google's Incident Management best practices, which TWO actions should you take immediately after declaring the incident?

Accepted Answer

Communicate the incident status to stakeholders and affected teams.. Google's Incident Management best practices emphasize that immediately after declaring an incident, the on-call engineer must communicate the incident status to stakeholders and affected teams. This ensures that everyone is aware of the ongoing issue, sets expectations, and prevents redundant troubleshooting. Early communication also helps in coordinating response efforts and reducing confusion during the critical initial phase.

Answer

Notify the incident commander to take over coordination.

Answer

Begin documenting the incident for a postmortem report.

Answer

Roll back the latest deployment to the previous stable version.

Question 11

After deploying a new version of a Cloud Run service, the team notices an increase in 5xx errors. They want to quickly revert to the previous version while minimizing user impact. What is the recommended approach?

Accepted Answer

Use Cloud Run's traffic management to set 100% of traffic to the previous revision.. Cloud Run supports traffic splitting between revisions, allowing you to instantly route 100% of traffic to the previous revision without redeploying. This minimizes user impact because the rollback is immediate and does not require rebuilding or re-pulling container images. Option D is correct because it leverages Cloud Run's built-in traffic management feature for zero-downtime rollbacks.

Answer

Set the minimum number of instances of the new revision to 0.

Answer

Redeploy the previous version from the container registry.

Answer

Modify the ingress settings to restrict traffic to the new revision.

Question 12

An engineer wants to ensure that an alert is escalated if not acknowledged within 5 minutes. Which feature of Cloud Monitoring can achieve this?

Accepted Answer

Notification channel with escalation configuration.. Notification channels in Google Cloud Monitoring can be configured with an escalation policy that defines a sequence of recipients or notification methods to be contacted if an alert is not acknowledged within a specified time. By setting the escalation duration to 5 minutes, the system automatically escalates the alert to the next tier or channel if no acknowledgment is received, directly meeting the engineer's requirement.

Answer

Incident management tool like PagerDuty.

Answer

Using a webhook notification channel.

Answer

Alerting policy with a condition that checks for acknowledgment.

Question 13

A team uses Cloud Build with a Kaniko builder to containerize their application. The build fails with the error: 'failed to push to destination: failed to get credentials: failed to get credential from metadata service: failed to fetch metadata...' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the storage.objectAdmin role on the Container Registry bucket.. The error indicates that Kaniko cannot authenticate to push the built image to Container Registry. Kaniko uses the Cloud Build service account's credentials to authenticate with the registry. By default, the Cloud Build service account has the storage.objectViewer role on the Container Registry bucket, which allows pulling images but not pushing. To push, the service account needs the storage.objectAdmin or storage.objectCreator role on the bucket. Option D correctly identifies this missing permission as the most likely cause.

Answer

Kaniko requires a running Docker daemon in the build step.

Answer

The base image specified in the Dockerfile is not accessible from the build environment.

Answer

The Dockerfile has an invalid instruction causing Kaniko to fail.

Question 14

A DevOps engineer is responsible for cost optimization of GKE clusters. They have identified that many nodes are underutilized. What is the best approach to reduce costs without impacting availability?

Accepted Answer

Enable cluster autoscaler to automatically scale down nodes. Cluster autoscaler automatically scales down nodes when they are underutilized. Option B is manual and not scalable. Option C may cause disruptions. Option D reduces availability.

Answer

Use spot VMs for all node pools

Answer

Delete underutilized nodes manually

Answer

Migrate to a single zone cluster

Question 15

A company runs a CI/CD pipeline using Cloud Build and Cloud Deploy for a web application. The pipeline builds a container image, pushes it to Artifact Registry, and then deploys it to a GKE cluster using Cloud Deploy. Recently, the deployment step started failing with the error: 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry.' The container image is built in the same project as the target cluster. The Cloud Build service account has been granted the roles/cloudbuild.builds.builder and roles/artifactregistry.admin on the project. The DevOps engineer verified that the image exists in Artifact Registry and the path is correct. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Ensure that the Cloud Deploy delivery pipeline references the correct image path, including the project ID and repository.. The error 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry' indicates that the Cloud Deploy delivery pipeline is referencing an image path that does not match the actual location of the image. Even though the image exists in Artifact Registry and the path appears correct, Cloud Deploy validates the image reference (including project ID, repository name, and image tag) against the target project's registry. The engineer must ensure the delivery pipeline YAML or configuration explicitly specifies the correct full image path, including the project ID and repository, so that Cloud Deploy can resolve and verify the image during release creation.

Answer

Reconfigure Cloud Build to store images in a different Artifact Registry repository.

Answer

Grant the Cloud Deploy service account the roles/artifactregistry.reader role on the project.

Answer

Change the Cloud Build service account to include the roles/clouddeploy.jobRunner role.

Question 16

Your organization is adopting DevOps practices and needs to bootstrap a Google Cloud organization with multiple projects. You want to enforce consistent resource naming conventions and apply common organization policies across all projects. Which two services should you use together to achieve this?

Accepted Answer

Organization Policies and Resource Manager folders. To enforce consistent resource naming conventions and common organization policies across all projects, you need Organization Policies (via constraints) and Resource Manager folders. Organization Policies allow you to set rules such as custom naming constraints or disabling external IPs that apply across the entire resource hierarchy. Resource Manager folders help organize projects and can inherit policies. Service Accounts and IAM roles (C) control access but do not enforce naming conventions or policies directly. Therefore, only option D provides the appropriate services to achieve the goal.

Answer

Cloud Shell and Cloud Source Repositories

Answer

Cloud Deployment Manager and Cloud Audit Logs

Answer

Service Accounts and IAM roles

Question 17

Refer to the exhibit. What does this recommendation suggest?

Accepted Answer

Upgrade the instance.. The description explicitly states to upgrade the instance from n1-standard-2 to n1-standard-4, indicating a need for more resources.

Answer

Change the instance to preemptible.

Answer

Delete the instance.

Answer

Downgrade the instance.

Question 18

You are the SRE for a financial services application running on Google Cloud. Users report that certain transactions are taking over 10 seconds, while most complete in under 200ms. You use Cloud Profiler and Cloud Trace. Upon reviewing the profiler data, you see a hotspot in a method that calls a Cloud SQL database with a slow query. You identify the query and create an index to speed it up. However, you cannot deploy the index change immediately due to change management processes. The incident response team needs to mitigate the impact now. Which temporary measure should you take?

Accepted Answer

Implement caching of query results using Cloud Memorystore.. Caching the results of the slow query in Cloud Memorystore (Redis) immediately reduces the load on the Cloud SQL database and eliminates the need to execute the slow query repeatedly. This provides a temporary performance improvement without requiring any database schema changes or deployments, bypassing the change management delay. The hotspot in the profiler indicates the query itself is the bottleneck, and caching avoids that bottleneck entirely for repeated reads.

Answer

Increase the database connection pool size in the application.

Answer

Add a database read replica to offload read queries.

Answer

Scale up the Cloud SQL instance to more vCPUs.

Question 19

Refer to the exhibit. The DevOps team is trying to create a new service account key. The operation fails with a permission error. What is the most likely cause?

Accepted Answer

The organization policy prevents uploading service account keys.. Organization policies can explicitly restrict the creation of service account keys at the organization, folder, or project level. When a key upload fails with a permission error despite the user having the necessary IAM roles, the most likely cause is an organization policy constraint such as `iam.disableServiceAccountKeyUpload` that blocks the operation. This policy overrides any IAM permissions granted to the user.

Answer

The project-level IAM denies the action.

Answer

The service account is disabled.

Answer

The service account lacks the iam.serviceAccountKeys.create permission.

Question 20

Match each Google Cloud tool to its function in incident management.

Accepted Answer

Cloud Logging: Collect and store log data from applications and services.. In incident management, Cloud Logging collects logs, Cloud Monitoring provides metrics and alerts, Error Reporting aggregates errors, and Cloud Trace traces requests. Common confusions include mixing Cloud Logging with monitoring or debugger functions.

Answer

Cloud Logging: Provide visibility into performance and health.

Answer

Cloud Debugger: Store and analyze logs.