PCDOE Practice Test 3 — 25 Questions

Question 1

Which TWO tools should be used for real-time incident collaboration and communication?

Accepted Answer

Cloud Monitoring Incident Response (beta).. Cloud Monitoring Incident Response (beta) provides a dedicated interface for real-time incident management, including automated notifications, escalation policies, and a centralized timeline for collaboration. Google Chat with a dedicated incident room enables real-time communication and coordination among incident responders, allowing them to share updates, logs, and runbooks in a structured channel. Together, these tools fulfill the need for both incident orchestration and synchronous collaboration during active incidents.

Answer

Google Meet only.

Answer

Jira.

Answer

Cloud Trace.

Question 2

A team needs to monitor the availability of an HTTPS endpoint that requires a Bearer token in the request header. What is the simplest way to configure this with Cloud Monitoring?

Accepted Answer

Configure the Uptime Check to include a custom header with the Bearer token.. Cloud Monitoring's Uptime Checks natively support custom HTTP headers, including Authorization headers with Bearer tokens. This allows you to directly monitor an authenticated HTTPS endpoint without any additional infrastructure, scripting, or log-based workarounds. It is the simplest and most straightforward configuration for this requirement.

Answer

Deploy a sidecar container that handles the authentication and exposes a plain endpoint.

Answer

Use a synthetic monitor from Cloud Monitoring that handles authentication via a script.

Answer

Export the endpoint logs to Cloud Logging and set up a log-based metric for availability.

Question 3

You are a Site Reliability Engineer (SRE) for an e-commerce platform running on Google Kubernetes Engine (GKE) with a microservices architecture. Your team uses Cloud Monitoring for alerting and Cloud Logging for centralized logs. Recently, during a flash sale event, you observed intermittent latency spikes in the checkout service, causing checkout failures and abandoned carts. The latency spikes last 1-2 seconds and occur roughly every 5-10 minutes during peak traffic. The checkout service runs as a Deployment with 10 replicas, each with resource requests of 500m CPU and 512Mi memory. The service has a Service Level Objective (SLO) of 99.9% of requests completing in under 1 second (p99 latency < 1s). Current p99 latency is 2.1s during peak. You reviewed the Cloud Monitoring dashboard and noticed that CPU utilization across pods is around 60%, memory around 50%, and there are no OOM kills. The logs show occasional 'connection reset by peer' errors in the checkout service logs, but no consistent pattern. You suspect the issue might be related to the database (Cloud SQL) or a downstream dependency. After checking the database, you find that query latency is normal. You also notice that the checkout service makes a synchronous HTTP call to a payment validation service that runs as a separate Deployment with 3 replicas. The payment service's p99 latency is 500ms, but its error rate is below 1%. Your task is to identify the most likely cause of the intermittent latency spikes and propose a remediation. Which action should you take first?

Accepted Answer

Check the garbage collection logs of the checkout service pods to identify if long GC pauses coincide with the latency spikes.. The intermittent latency spikes every 5-10 minutes with no CPU/memory pressure or database issues strongly suggest a periodic process like garbage collection. Java-based services (common in microservices) can experience stop-the-world GC pauses that cause latency spikes of 1-2 seconds, matching the observed pattern. Checking GC logs is the fastest way to confirm this before making architectural changes.

Answer

Increase the number of replicas of the payment validation service to 10 to handle peak load.

Answer

Enable connection pooling and retries with exponential backoff in the checkout service for the HTTP call to the payment service.

Answer

Investigate the checkout service pod restarts due to liveness probe failures, as 'connection reset by peer' indicates pod instability.

Question 4

Which GCP tool provides recommendations for rightsizing Compute Engine VMs?

Accepted Answer

Recommender.. The Recommender tool in GCP uses machine learning to analyze historical usage patterns and provides actionable recommendations, including rightsizing suggestions for Compute Engine VMs. It identifies underutilized VMs and suggests optimal machine types to reduce costs without compromising performance, making it the correct choice for this task.

Answer

Cloud Console Cost Table.

Answer

Cloud Monitoring.

Answer

Cloud Billing Reports.

Question 5

A company deploys a microservices application on Google Kubernetes Engine (GKE). They notice increased latency during peak hours. The application uses a Cloud SQL database for state. The team wants to optimize service performance. What should they do first?

Accepted Answer

Enable Cloud SQL connection pooling.. The primary bottleneck during peak hours for a microservices application using Cloud SQL is often the number of database connections. Connection pooling reuses a fixed set of connections, reducing the overhead of establishing new connections and preventing connection exhaustion, which directly addresses increased latency without requiring architectural changes.

Answer

Implement a caching layer with Memorystore.

Answer

Move the database to Cloud Spanner.

Answer

Increase the number of replicas in the GKE deployment.

Question 6

A DevOps team is migrating their infrastructure to Google Cloud. They have a complex environment with multiple VPC networks, shared services, and separate development and production projects. They want to bootstrap a new organization that supports: (1) centralized network management with shared VPC, (2) separate folders for dev and prod, (3) consistent firewall rules across all projects, (4) a single Cloud NAT for outbound traffic. They have an existing on-premises VPN that must connect to all projects. What is the most efficient approach?

Accepted Answer

Create a host project for Shared VPC, attach all projects as service projects, and configure Cloud NAT and VPN in the host project. Use organization policies to enforce firewall rules.. Shared VPC allows you to create a host project that centrally manages network resources (VPC, subnets, firewall rules, Cloud NAT, VPN) while attaching development and production projects as service projects. This satisfies all requirements: centralized network management, separate folders for dev/prod, consistent firewall rules via organization policies, a single Cloud NAT for outbound traffic, and a single VPN connection to on-premises that routes to all service projects through the host project's VPC.

Answer

Create separate VPCs for each project and peer them all together, then configure Cloud NAT and VPN in each project.

Answer

Use a single project for all environments and rely on VPC subnets and firewall rules to isolate workloads.

Answer

Create a folder for networking and a folder for projects, then use a Cloud VPN appliance from the Marketplace.

Question 7

A company uses a Shared VPC and wants to enforce a set of firewall rules across all projects in a folder. They want these rules to be immutable by project owners. Which approach should they use?

Accepted Answer

Use hierarchical firewall policies at the folder level.. Hierarchical firewall policies allow you to enforce firewall rules at the folder level, which are inherited by all projects within that folder. These policies are immutable by project owners because they are managed at the folder level, not the project or VPC level, and cannot be overridden or deleted by lower-level roles unless explicitly granted permission.

Answer

Use network tags and service accounts to enforce rules.

Answer

Use organization policy constraints to prevent project owners from modifying firewall rules.

Answer

Create firewall rules at the VPC level and assign them to the folder.

Question 8

A company uses Cloud Build for CI/CD. They want to allow Cloud Build to deploy to Cloud Run. What is the minimum IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs permission to create and manage Cloud Run resources, including deploying new revisions. The `roles/run.admin` role provides full control over Cloud Run services, which is the minimum required for deployment. The `roles/cloudbuild.builds.builder` role only allows building and managing Cloud Build triggers, not deploying to Cloud Run.

Answer

roles/cloudbuild.builds.builder

Answer

roles/editor

Answer

roles/run.invoker

Question 9

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the roles/run.admin role.. The Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) requires the roles/run.admin role to deploy to Cloud Run. This role grants permission to create, update, and manage Cloud Run services. Without it, the deployment step fails with a 'Permission denied' error, even though the build itself succeeds.

Answer

The Cloud Run service account lacks the roles/cloudbuild.builds.builder role.

Answer

The trigger is missing the required deployment configuration.

Answer

The cloudbuild.yaml file has an incorrect image tag.

Question 10

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

Accepted Answer

Grant Cloud Build service account access to secrets via IAM.. A is correct because Cloud Build's service account must be granted IAM roles (e.g., roles/secretmanager.secretAccessor) on the Secret Manager secret to allow the pipeline to retrieve the secret value at build time. Without explicit IAM binding, the service account lacks permission to access the secret, causing the build to fail. This follows the principle of least privilege and ensures that only authorized identities can read secrets.

Answer

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Answer

Base64 encode secrets and store them in Cloud Build substitutions.

Question 11

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

Accepted Answer

Use Cloud Build triggers with regular expressions on branch patterns and restrict access via IAM.. Cloud Build triggers natively support regular expressions on branch patterns, and IAM conditions can restrict which service accounts are allowed to invoke specific triggers. This provides a declarative, auditable, and least-privilege approach without custom code or external services.

Answer

Use Cloud Functions to validate branch names before triggering builds.

Answer

Use Cloud Source Repositories with branch protection rules.

Answer

Store the service account keys in Secret Manager and use them in build steps.

Question 12

A team is bootstrapping a new Google Cloud organization. Which TWO practices are recommended for managing project creation and resource hierarchy? (Choose two.)

Accepted Answer

Create a folder for each department to isolate resources.. Creating a folder for each department allows you to isolate resources, apply IAM policies at the folder level, and enforce organizational boundaries. This follows Google Cloud's recommended resource hierarchy best practices for multi-team environments, enabling delegated administration and cost tracking per department.

Answer

Use a centralized service account to create projects via API.

Answer

Use a single project for all development environments.

Answer

Assign project creator role to all users by default.

Question 13

A Cloud Build pipeline that deploys a container to Cloud Run fails with the error: `Missing required permission run.routes.invoke`. The Cloud Build service account has the 'Cloud Run Invoker' role. Which TWO additional steps should be taken?

Accepted Answer

Ensure the service account has the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account.. The Cloud Build service account needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account (the service account that Cloud Run uses to run the container). Without this permission, Cloud Build cannot impersonate the runtime service account to deploy the container, even if it has the Cloud Run Invoker role. The `run.routes.invoke` error occurs because the deployment process requires the ability to invoke the route, which is tied to the runtime service account's permissions.

Answer

Enable the Cloud Run API in the project.

Answer

Use a different service account for deployment.

Answer

Add the `run.routes.invoke` permission to a custom role.

Question 14

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. A shared VPC allows multiple projects to share a common VPC network, enabling centralized control of networking resources, firewall rules, and IP addressing. This is a best practice for multi-team organizations because it reduces administrative overhead, ensures consistent network policies, and simplifies connectivity between projects without requiring complex peering or VPN setups.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 15

A company uses Cloud Build and wants to trigger builds only from the master branch. Which configuration is required?

Accepted Answer

Set the branch filter to 'master' in the trigger.. Cloud Build triggers allow you to specify a branch filter using a regex pattern. Setting the filter to 'master' ensures that only pushes or pull requests targeting the master branch initiate the build. This is the native, supported method for branch-based triggering without additional overhead.

Answer

Create separate triggers for each branch.

Answer

Use a custom Cloud Build step to check the branch name.

Answer

Use a Cloud Function to call Cloud Build for master only.

Question 16

You are investigating a slow increase in latency for a service running on Compute Engine. You have Cloud Monitoring and Cloud Logging set up. Which tool would best help you identify the cause of the latency?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data from distributed applications by tracing requests as they propagate through services. It provides detailed latency distributions and per-span breakdowns, allowing you to pinpoint which component or operation is causing the slowdown. For a Compute Engine service with Cloud Monitoring and Logging already in place, Cloud Trace is the most direct tool to analyze request-level latency.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Debugger

Question 17

A team is experiencing increased latency in their microservices application after a new deployment. They suspect a specific service is the bottleneck. Which tool should they use to identify the slowest service in the request path?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool because it provides end-to-end latency analysis by capturing trace spans from each microservice in a request path. It aggregates and visualizes the time spent in each service, allowing you to pinpoint the slowest service causing the bottleneck. This directly addresses the need to identify the specific service responsible for increased latency after a deployment.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 18

To securely manage secrets (e.g., API keys) used in Cloud Build pipelines, which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the recommended service for storing and accessing secrets like API keys. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not designed for secrets, and Cloud KMS is not for direct secret storage.

Answer

Cloud KMS

Answer

Cloud Key Management Service (duplicate)

Answer

Cloud Storage

Question 19

A company has an application that experiences intermittent errors. They want to be notified immediately when the error rate exceeds 1% of total requests. What should they implement?

Accepted Answer

Create a log-based metric counting error logs and set an alerting policy in Cloud Monitoring. The requirement is to be notified when the error rate exceeds 1% of total requests, which requires a metric that counts error logs relative to total requests. A log-based metric in Cloud Logging can filter for error log entries (e.g., status codes 5xx), and an alerting policy in Cloud Monitoring can trigger when the ratio of error logs to total requests surpasses 1%. This directly addresses the intermittent error rate condition with precise threshold-based alerting.

Answer

Create an uptime check pointing to the application endpoint

Answer

Use Cloud Trace to analyze latency and set an alert on trace spans

Answer

Create a dashboard showing error count over time

Question 20

Which TWO options are valid methods to create a custom metric descriptor in Cloud Monitoring?

Accepted Answer

Using the gcloud commands: gcloud monitoring metrics create. The `gcloud monitoring metrics create` command directly invokes the Cloud Monitoring API to create a custom metric descriptor. Option E is correct because the Cloud Monitoring API's `CreateMetricDescriptor` method is the programmatic way to define a custom metric, specifying its type, unit, and labels. Both methods result in a new metric descriptor being registered in the project's metric store.

Answer

Creating a log-based metric

Answer

Using Terraform resource google_monitoring_metric_descriptor

Answer

Deploying a Prometheus exporter with the Ops Agent