PCDOE Practice Test 2 — 25 Questions

Question 1

A company is migrating a batch processing workload to Google Cloud. The workload is CPU-intensive and runs for a few hours each day. Which Compute Engine machine family should they choose to optimize performance and cost?

Accepted Answer

Compute-optimized (C2/C2D). A is correct because the workload is CPU-intensive and runs for a few hours each day, which is a sustained, compute-bound task. Compute-optimized machines (C2/C2D) are designed specifically for high-performance computing (HPC) and batch processing, offering the highest ratio of vCPU to memory and the fastest single-threaded performance on Google Cloud. This minimizes runtime and cost per job compared to general-purpose or burstable families.

Answer

Burstable (T2D)

Answer

GPU-accelerated (A2)

Answer

Memory-optimized (M2)

Question 2

An application on GKE frequently reads the same data from a Cloud Storage bucket. The data changes rarely. Which solution will best improve read performance and reduce costs?

Accepted Answer

Deploy a sidecar container that caches the data in an emptyDir volume.. Deploying a sidecar container with an emptyDir volume caches frequently accessed, rarely changing data locally within the pod. This reduces latency by avoiding repeated network calls to Cloud Storage and eliminates egress and operation costs for those reads. emptyDir volumes are ephemeral and tied to the pod's lifecycle, making them ideal for caching read-heavy, static data without incurring persistent storage costs.

Answer

Configure a Cloud SQL read replica for the data.

Answer

Increase the number of nodes in the cluster.

Answer

Use a StatefulSet with a persistent volume claim to store the data.

Question 3

Refer to the exhibit. After applying the shown firewall rule, users report increased latency to a web application. What is the most likely cause?

Accepted Answer

The rule contains both allow and deny for the same traffic, creating a conflict.. Correct: The rule has both allow and deny with same ports, and the rule is contradictory; the deny overrides because deny rules are evaluated after allow? Actually in VPC firewall rules, allow and deny cannot both be specified in the same rule. This is an invalid combination. The rule may cause unexpected behavior. Option A is wrong because logging alone does not cause latency. Option B is wrong because source range is all. Option D is wrong because priority is not high.

Answer

The rule priority is set to 1000, which is too low.

Answer

The source range covers all IPs, causing excessive traffic.

Answer

The firewall rule has logging enabled, which adds overhead.

Question 4

An application running on App Engine standard environment has high instance startup latency, leading to slow first requests. What is the most effective configuration change to reduce cold starts?

Accepted Answer

Set min_idle_instances to a value greater than 0. Setting min_idle_instances to a value greater than 0 ensures that a baseline number of instances are always running and ready to serve requests, eliminating the need to spin up new instances on the first request. This directly reduces cold start latency because the application does not have to wait for instance initialization, which includes loading dependencies and running startup scripts.

Answer

Use manual scaling instead of automatic scaling

Answer

Use Cloud Endpoints for request authentication

Answer

Increase the memory limit per instance

Question 5

A web application frequently reads the same set of reference data from Cloud SQL. This causes high database load and slow responses. Which design change would most improve performance?

Accepted Answer

Implement caching with Memorystore for Redis. Implementing caching with Memorystore reduces database load by serving repeated reads from memory, which is faster than SQL queries. Increasing machine size or adding read replicas helps but still involves database I/O; Cloud Spanner is overkill for reference data.

Answer

Increase Cloud SQL machine size

Answer

Add a read replica

Answer

Use Cloud Spanner for higher throughput

Question 6

An engineer is using Database Migration Service to migrate a MySQL database to Cloud SQL. They need to set up a source connection profile. Which TWO methods can the engineer use to allow DMS to connect to the source database? (Choose 2 correct answers.)

Accepted Answer

VPC peering for private IP. Option A is correct because VPC peering allows DMS to connect to a source database using private IP addresses without traversing the public internet, which is a secure and recommended method for connectivity within Google Cloud. This method establishes a direct, low-latency connection between the DMS service's VPC and the source database's VPC, provided the IP ranges do not overlap. It is particularly suitable when the source database is hosted in a different VPC or on-premises via a VPN-connected VPC.

Answer

No public endpoint

Answer

Cloud SQL Auth Proxy

Answer

Cloud VPN

Question 7

A Cloud Bigtable instance is configured with asynchronous replication across two regions for disaster recovery. The team needs to ensure that read-after-write consistency is maintained within a region. Which three strategies should they implement? (Choose THREE.)

Accepted Answer

After writing, have the application wait for a confirmation that the write is durable before performing a read.. Option A is correct because in Cloud Bigtable, writes are acknowledged only after they are committed to the tablet server's log and replicated to the underlying Colossus file system. By waiting for this confirmation before performing a read, the application ensures that the read will see the latest write, providing read-after-write consistency within the region.

Answer

Disable replication and use only the primary cluster.

Answer

Use multi-cluster routing to distribute reads across regions.

Question 8

A company has a Cloud SQL for MySQL instance with automated backups enabled. They need to restore the database to a specific timestamp from 2 days ago. The backup retention is set to 7 days. How should they perform this restore?

Accepted Answer

Use gcloud sql instances clone with the --point-in-time flag and the desired timestamp. Option C is correct because Cloud SQL for MySQL supports point-in-time recovery (PITR), which allows you to restore a database to a specific timestamp within the backup retention period (here, 7 days). The `gcloud sql instances clone` command with the `--point-in-time` flag creates a new instance that reflects the database state at the exact requested timestamp, leveraging the transaction logs retained by automated backups.

Answer

Export the database and import it into a new instance

Answer

Create an on-demand backup and restore from that backup

Answer

Use gcloud sql instances restore-backup with the backup ID from 2 days ago

Question 9

Which TWO metrics from Cloud Monitoring would best indicate that a GKE workload is experiencing CPU throttling due to a resource quota? (Choose 2)

Accepted Answer

container/cpu/throttled_time. Option B is correct because `container/cpu/throttled_time` directly measures the cumulative time a container's CPU usage was throttled due to exceeding its assigned CPU quota (CFS quota). Option D is correct because `container/cpu/usage_time` shows the actual CPU time used by the container; when compared against the quota limit, a high usage_time relative to the quota indicates that throttling is likely occurring. Together, these two metrics confirm both the occurrence and the cause of CPU throttling.

Answer

node/cpu/usage_time

Answer

container/memory/usage_bytes

Answer

container/accelerator/duty_cycle

Question 10

You are designing a globally distributed application using Cloud Spanner. The application has a write-heavy workload. You notice that write latency increases as the number of nodes increases. What is the most likely cause?

Accepted Answer

The workload has many cross-node transactions due to split rows.. Option B is correct because in Cloud Spanner, write-heavy workloads with many cross-node transactions cause increased write latency as nodes are added. This occurs because Spanner splits rows across nodes, and transactions that span multiple splits require two-phase commit (2PC) coordination between nodes, which adds network overhead and latency. Adding more nodes increases the likelihood that a transaction touches multiple splits, exacerbating the coordination cost.

Answer

The instance is using a multi-region configuration with too many read-only replicas.

Answer

The application is using stale reads for write transactions.

Answer

The number of splits is too low, causing hotspots.

Question 11

Which THREE factors should you consider when designing a Cloud Run service for optimal performance under unpredictable traffic patterns? (Choose 3)

Accepted Answer

Set a minimum number of instances to reduce cold starts.. Option B is correct because setting a minimum number of instances ensures that Cloud Run always keeps a baseline of warm instances ready to serve requests. This eliminates cold starts for the first requests during traffic spikes, which is critical for unpredictable traffic patterns where latency spikes from cold starts would degrade user experience.

Answer

Use HTTP/2 for faster connection reuse.

Answer

Configure VPC egress through Cloud NAT for lower latency.

Question 12

Your organization requires that all new Google Cloud projects are automatically configured with a common set of VPC networks and subnets, and that these networks must be created before any resources are deployed. What is the best approach to enforce this requirement across the organization?

Accepted Answer

Use Organization Policies with a custom constraint to enforce that all projects must have a specific VPC network configuration.. Organization Policies with custom constraints allow you to enforce that all new projects automatically include specific VPC networks and subnets before any resources are deployed. This is the only approach that provides mandatory, organization-wide enforcement at the project creation level, ensuring compliance without relying on manual templates or post-creation configuration.

Answer

Create a Cloud Deployment Manager template and share it with all project owners.

Answer

Set up VPC Network Peering between all projects to enforce network connectivity.

Answer

Configure a shared VPC host project and attach all new service projects to it.

Question 13

A development team wants to automatically run unit tests and static code analysis on every push to a Cloud Source Repository, but only run integration tests on merges to the main branch. Which Cloud Build trigger configuration should they use?

Accepted Answer

Create two triggers: one with a branch filter for '^main$' that runs integration tests, and another with a branch filter for '^.*$' that runs unit tests.. Option C is correct because Cloud Build triggers allow you to define separate triggers with branch filters to execute different build configurations based on the branch. By creating one trigger with a branch filter of '^main$' for integration tests and another with '^.*$' for unit tests, you ensure unit tests run on every push to any branch, while integration tests run only on merges to main. This approach directly maps the desired behavior without requiring conditional logic or manual intervention.

Answer

Use a single trigger with a substitution variable like '_BRANCH' and set it to 'main' for integration tests.

Answer

Create one trigger with a build config that uses the 'branchName' substitution to conditionally skip integration test steps.

Answer

Configure one trigger with no branch filter and rely on developers to manually trigger integration tests.

Question 14

An organization uses Cloud Build with a private pool to build container images that require access to on-premises Artifactory. After moving to a new VPC, builds fail with 'Connection refused' when fetching dependencies. What is the best step to troubleshoot?

Accepted Answer

Verify that VPC Network Peering is established between the Cloud Build private pool's service producer VPC and the customer VPC, and that routes to on-premises are present.. The error 'Connection refused' indicates that the Cloud Build private pool's worker VMs cannot reach the on-premises Artifactory server. Private pools are deployed in a Google-managed service producer VPC that must be connected to the customer VPC via VPC Network Peering. Without this peering and the correct routes to the on-premises network (e.g., via Cloud VPN or Dedicated Interconnect), traffic from the private pool is dropped, causing the connection refusal.

Answer

Verify that the Cloud Build service account has the dns.networks.bindPrivateZone permission.

Answer

Check that the Cloud Build service account has the storage.objectViewer role on the Artifactory bucket.

Answer

Ensure that Cloud NAT is configured in the private pool's VPC.

Question 15

An e-commerce platform is using Cloud Load Balancing with a backend service that has a custom health check. The health check is failing intermittently, causing traffic to be routed away from healthy instances. The team has enabled Cloud Logging and wants to diagnose the issue. Which log view should they examine to see the health check probe results?

Accepted Answer

Load balancer logs (type: 'loadbalancing.googleapis.com'). Load balancer logs (type: 'loadbalancing.googleapis.com') contain detailed records of health check probes, including the probe source IP, target instance, response code, and latency. This is the exact log view that captures health check probe results, enabling the team to identify intermittent failures by correlating probe timestamps with instance health status changes.

Answer

VPC flow logs

Answer

Cloud Audit Logs (Admin Activity)

Answer

Instance serial port output logs

Question 16

An organization is using Cloud SQL for MySQL with automated backups enabled. They need to restore a backup to a new instance in a different region for testing. The backup is stored in the same region as the source. How can they achieve this with minimal operational overhead?

Accepted Answer

Restore the backup to a new instance in the same region, then use export/import to move data to the target region.. Option D is correct because Cloud SQL backups are region-specific and cannot be restored directly to a different region. The minimal-operational-overhead approach is to restore the backup to a new instance in the same region, then use the export/import feature (e.g., SQL dump or CSV) to move the data to the target region. This avoids the complexity and cost of maintaining a cross-region read replica, while still achieving the goal with built-in tools.

Answer

Use gcloud sql backups restore with the --restore-instance flag pointing to a new instance in the target region.

Answer

Create a cross-region read replica from the source, then promote it in the target region.

Answer

Restore the backup directly to a new instance in the target region using the Cloud Console.

Question 17

A company uses Firestore in Datastore mode. They need to create a composite index for a query that filters on two properties. The query is already running and returning an error that an index is required. What is the correct way to create this index?

Accepted Answer

Create the index using the gcloud datastore indexes create command with a YAML file.. Option A is correct because in Firestore (Datastore mode), composite indexes must be explicitly created before they can be used by queries that filter on multiple properties. The `gcloud datastore indexes create` command with a YAML file is the standard method to define and deploy these indexes, as the Datastore mode does not automatically create composite indexes from query patterns.

Answer

Modify the query to use a single filter to avoid needing a composite index.

Answer

Enable the 'auto-index' feature in the Datastore console.

Answer

The index will be created automatically based on the query pattern.

Question 18

When bootstrapping a Google Cloud organization for DevOps, which THREE steps are essential to set up a secure CI/CD foundation using Cloud Build?

Accepted Answer

Create a Cloud Source Repository for each application's code.. Creating a Cloud Source Repository for each application's code is essential because it provides a dedicated, version-controlled repository that integrates natively with Cloud Build triggers. This ensures that each application has its own isolated codebase, enabling precise CI/CD pipelines without cross-application interference.

Answer

Disable default service accounts in all projects.

Answer

Configure VPC Service Controls for all projects.

Question 19

Refer to the exhibit. The output shows three folders created directly under the organization node. Which gcloud command was most likely executed to produce this output?

Accepted Answer

gcloud resource-manager folders list --organization=123456789012. Option A is correct because the `gcloud resource-manager folders list --organization=123456789012` command lists all folders directly under the specified organization node. The output shows three folders (e.g., folder1, folder2, folder3) at the top level, which matches the behavior of listing folders with the organization ID as the parent. This command is specifically designed to retrieve immediate child folders of an organization, not nested folders.

Answer

gcloud organizations list

Answer

gcloud projects list --filter='parent.id:123456789012'

Answer

gcloud resource-manager folders list --folder=123456789012

Question 20

Which TWO are valid methods to manage service account keys securely? (Select exactly 2)

Accepted Answer

Automate key rotation using a Cloud Function.. Option B is correct because automating key rotation with a Cloud Function ensures service account keys are rotated on a schedule without manual intervention, reducing the risk of key exposure. This aligns with Google Cloud's best practices for key management, as it enforces rotation policies programmatically and can integrate with Secret Manager to securely store and version keys.

Answer

Rotate keys manually every 90 days.

Answer

Embed keys in application code.

Answer

Store keys in Cloud Storage with public access.