PCDOE Practice Test 3 — 25 Questions

Question 1

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Option C is correct because hosting shared CI/CD tooling and artifacts (e.g., Cloud Build, Artifact Registry, or Jenkins) in a dedicated project isolates build infrastructure from workload projects, enabling centralized access control, quota management, and auditing while keeping pipelines reusable across the organization. Option D is correct because Organization Policies (e.g., constraints like constraints/iam.disableServiceAccountKeyCreation or constraints/compute.requireShieldedVm) provide guardrails that enforce compliance and security baselines consistently across all projects, which is essential for a scalable DevOps foundation. Option A is wrong because sharing a single service account key across projects violates least privilege, prevents per-project auditability, and creates a single point of compromise; keys should be scoped per workload and preferably replaced with workload identity federation. Option B is wrong because disabling Organization Policies removes the guardrails that prevent insecure or non-compliant configurations, increasing risk rather than enabling safe DevOps. Option E is wrong because a single broadly-permissioned service account used by all projects violates least privilege and blast-radius containment, and Google recommends distinct, narrowly scoped service accounts per project or workload.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 2

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. Option A is correct because a Shared VPC lets a host project centrally manage subnets and firewall rules while service projects from different teams attach to that network, which enforces consistent networking and avoids duplicated VPCs across the organization. Option D is correct because folders let you group projects by team, environment, or business unit and apply IAM policies and Organization Policies hierarchically, so permissions and constraints inherit cleanly to all contained projects. Option B is not a best practice because separate billing accounts per team add administrative overhead and fragment cost visibility; a single billing account with labels and budgets is preferred. Option C is wrong because granting all users the Project Creator role allows anyone to create projects freely, undermining governance and quota control. Option E is not a best practice because APIs should be enabled only where needed to follow least privilege and reduce attack surface, not blanket-enabled in every project.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 3

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Accepted Answer

Enable audit logging and set up log sinks to a centralized logging project.. Option B is correct because enabling Cloud Audit Logs (Admin Activity, Data Access, and System Event logs) and configuring aggregated log sinks to a centralized logging project gives the organization a tamper-resistant, single pane for security monitoring, compliance, and incident response across all projects. Option C is correct because a Shared VPC lets a host project export subnets to service projects, providing centralized network administration, consistent firewall and routing policies, and private connectivity between DevOps projects without complex VPC peering meshes. Option D is correct because a folder hierarchy that mirrors the organizational structure (for example, folders per department, environment, or team) enables inheritance of IAM policies, org policies, and billing controls, which is fundamental to scalable DevOps governance. Option A is not recommended because sharing one project across development, staging, and production removes environment isolation, causing IAM, quota, and blast-radius problems; separate projects per environment are the Google-recommended pattern. Option E is wrong because storing secrets in code repositories exposes credentials to anyone with repo access and to history leaks; secrets should be kept in Secret Manager (or similar) and injected at runtime.

Answer

Use a single project for development, staging, and production to reduce overhead.

Answer

Store secrets directly in code repositories for easy access by CI/CD pipelines.

Question 4

A DevOps team is troubleshooting a web application that shows high latency during peak hours. The application runs on Google Kubernetes Engine (GKE). They want to identify which specific API calls are causing the delay. Which Google Cloud tool should they use?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool because it is a distributed tracing system that captures latency data from applications, allowing you to trace individual API calls and identify which specific endpoints are causing delays. Unlike Cloud Monitoring, which provides aggregate metrics, Cloud Trace provides per-request latency breakdowns, making it ideal for pinpointing slow API calls in a GKE environment.

Answer

Cloud Monitoring

Answer

Cloud Profiler

Answer

Cloud Logging

Question 5

Which TWO options are valid methods to trigger a Cloud Build build when code is pushed to a Cloud Source Repository?

Accepted Answer

Use a Cloud Pub/Sub message sent to the Cloud Build topic to create a build.. Options A and D are correct. Cloud Build triggers can be based on branch or tag push, and can also be triggered via Pub/Sub message. Option B is incorrect - Cloud Build does not directly listen to Cloud Pub/Sub subscriptions without a trigger. Option C is incorrect - builds are not automatically triggered by Cloud Logging. Option E is incorrect - Cloud Scheduler cannot directly trigger a build without a Pub/Sub or HTTP intermediary.

Answer

Have Cloud Logging monitor the repository and create a build via a logs-based metric.

Answer

Set up a Cloud Pub/Sub subscription that forwards events to Cloud Build.

Answer

Configure Cloud Scheduler to call the Cloud Build API periodically.

Question 6

Which THREE are benefits of migrating from Jenkins to Cloud Build?

Accepted Answer

No server maintenance. Cloud Build is a fully managed CI/CD service that runs on Google Cloud's infrastructure, eliminating the need for users to provision, configure, or maintain build servers. Unlike Jenkins, which requires ongoing administration of the Jenkins master and agent nodes, Cloud Build automatically scales resources and handles underlying server maintenance, including OS patches and hardware failures.

Answer

Support for any VCS

Answer

Built-in security scanning

Question 7

A team is implementing a CI/CD pipeline for a Kubernetes application. They want to use canary deployments with traffic splitting. Which tool or service is best suited for this?

Accepted Answer

Cloud Deploy with Skaffold. Cloud Deploy with Skaffold is best suited for canary deployments with traffic splitting because Cloud Deploy provides built-in support for progressive delivery strategies, including canary and blue-green deployments, and integrates with Skaffold to manage Kubernetes manifests and traffic routing via service mesh or ingress controllers. Skaffold handles the build and deploy stages, while Cloud Deploy orchestrates the rollout with automated traffic splitting and promotion/rollback logic, making it the only option that directly addresses the requirement.

Answer

Cloud Run

Answer

Cloud Build

Answer

Anthos Config Management

Question 8

A team notices that a Cloud Run service occasionally has high latency. They suspect a memory leak or excessive CPU usage. Which tool should they use to identify the bottleneck during those periods?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and memory usage data from your Cloud Run service, allowing you to identify which functions or code paths are consuming excessive resources during high-latency periods. Unlike monitoring or logging, Profiler provides a flame graph that pinpoints the exact bottleneck (e.g., a memory leak or CPU spike) at the function level, which is essential for diagnosing performance issues in a serverless environment.

Answer

Cloud Trace

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 9

A large stateful service running on Compute Engine experiences variable performance due to CPU throttling from noisy neighbors. Which solution provides the most consistent performance?

Accepted Answer

Use sole-tenant nodes to isolate the VMs. Sole-tenant nodes ensure that your VMs are the only ones running on the underlying physical server, eliminating resource contention from other tenants (noisy neighbors). This provides consistent CPU performance because the vCPUs are not oversubscribed and the full physical core capacity is dedicated to your instances.

Answer

Enable live migration for the VMs

Answer

Use preemptible VMs for stateful workloads

Answer

Purchase committed use discounts for lower cost

Question 10

Which service should be used to monitor the health of HTTP endpoints from multiple locations?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) includes uptime checks that can be configured to probe HTTP endpoints from multiple global locations, measuring latency, availability, and response content. This makes it the correct service for monitoring the health of HTTP endpoints from diverse geographic regions.

Answer

Cloud Trace

Answer

Cloud Logging

Answer

Cloud Debugger

Question 11

Refer to the exhibit. A DevOps engineer observes that a GKE cluster's node performance is degraded during high I/O workloads. Based on the exhibit, which change would most likely improve disk I/O performance?

Accepted Answer

Change diskType to pd-ssd. The exhibit shows a GKE node pool using the default pd-standard disk type, which is backed by HDDs and has lower IOPS and throughput compared to SSDs. Changing diskType to pd-ssd directly improves disk I/O performance by providing higher IOPS and lower latency, which is critical for high I/O workloads.

Answer

Change machineType to n2-standard-4

Answer

Change imageType to UBUNTU

Answer

Change serviceAccount to a custom one

Question 12

Which TWO practices are recommended for implementing CI/CD pipelines on Google Cloud?

Accepted Answer

Use a Dockerfile to define the build process for containerized applications.. Option D is correct because using a Dockerfile to define the build process is the standard, reproducible way to build containerized applications in a CI/CD pipeline, and Cloud Build natively supports Dockerfile-based builds (e.g., via the docker builder or `gcloud builds submit`), ensuring consistent images across environments. Option E is correct because Cloud Build substitutions (user-defined variables like `${_ENV}` or built-in ones like `$PROJECT_ID`) let you parameterize a single build configuration (cloudbuild.yaml) so the same pipeline can target dev, staging, and prod with different values, avoiding duplicated configs. Option A is wrong because storing service account keys in the build configuration file exposes long-lived credentials in source control; the recommended practice is Workload Identity Federation or attaching a user-managed service account to the build, not embedding keys. Option B is wrong because deploying straight to production after a successful build skips approval gates and progressive delivery, which is not a recommended CI/CD practice for production safety. Option C is wrong because a single monolithic pipeline for all microservices reduces isolation and blast radius control; per-service pipelines (or at least independent triggers) are recommended so services can build, test, and deploy independently.

Answer

Store service account keys in the build configuration file for authentication.

Answer

Deploy to production directly after a successful build without any approval gate.

Answer

Create a single build pipeline that handles all microservices to reduce complexity.

Question 13

A DevOps team is setting up a CI/CD pipeline using Cloud Build. They want the Cloud Build service account to have permission to deploy to Cloud Run within a specific project. Which IAM role should be granted to the Cloud Build service account?

Accepted Answer

roles/run.admin. The Cloud Build service account needs the `roles/run.admin` role to deploy services to Cloud Run. This role grants full control over Cloud Run resources, including creating, updating, and deleting services, which is required for a CI/CD pipeline to perform deployments. Without this role, the service account would lack the necessary permissions to modify Cloud Run configurations.

Answer

roles/run.invoker

Answer

roles/cloudbuild.builds.editor

Answer

roles/iam.serviceAccountUser

Question 14

A startup is bootstrapping a Google Cloud organization for DevOps. They need to create a project for their CI/CD tooling and a separate project for logging and monitoring. What is the recommended way to structure the resource hierarchy?

Accepted Answer

Create a folder called 'DevOps' and place both projects inside it, sharing a billing account.. The recommended Google Cloud resource hierarchy for DevOps bootstrapping is to create a folder (e.g., 'DevOps') under the organization node and place both projects inside it. This structure allows centralized policy inheritance (e.g., IAM, org policies) and shared billing via a single billing account, while maintaining logical separation between CI/CD and logging/monitoring workloads. It aligns with Google's best practices for multi-project isolation without unnecessary organizational complexity.

Answer

Create a single project for all workloads and use labels to differentiate environments.

Answer

Create both projects directly under the organization node, with separate billing accounts.

Answer

Create a separate organization for each project to ensure isolation.

Question 15

A team uses Cloud Load Balancing with backend NEGs. Users report intermittent high latency. How should they diagnose the root cause effectively?

Accepted Answer

Use Cloud Trace to analyze per-request latency spans. Cloud Trace provides end-to-end latency analysis by capturing per-request spans as they traverse the load balancer, backend NEGs, and other services. This allows you to pinpoint exactly which hop (e.g., load balancer processing, backend queuing, or application code) is causing the intermittent high latency, rather than relying on aggregate metrics or caching assumptions.

Answer

Increase the number of backend instances immediately

Answer

Enable Cloud Monitoring latency histogram for the load balancer

Answer

Check Cloud CDN cache hit ratio

Question 16

An application running on App Engine standard environment has high instance startup latency, leading to slow first requests. What is the most effective configuration change to reduce cold starts?

Accepted Answer

Set min_idle_instances to a value greater than 0. Setting min_idle_instances to a value greater than 0 ensures that a baseline number of instances are always running and ready to serve requests, eliminating the need to spin up new instances on the first request. This directly reduces cold start latency because the application does not have to wait for instance initialization, which includes loading dependencies and running startup scripts.

Answer

Use manual scaling instead of automatic scaling

Answer

Use Cloud Endpoints for request authentication

Answer

Increase the memory limit per instance

Question 17

A team deploys a microservice on Google Kubernetes Engine (GKE) that processes user uploads. The service latency has increased over time. Monitoring shows that CPU utilization is low, but memory usage is high and garbage collection (GC) pauses are frequent. Which action is most likely to reduce latency?

Accepted Answer

Increase the memory limit and requests for the container.. Frequent GC pauses and high memory usage with low CPU indicate the JVM heap is too small, causing the garbage collector to run more often. Increasing the memory limit and requests gives the JVM more headroom to reduce GC frequency, directly lowering latency. This is a classic JVM tuning scenario in containerized environments like GKE.

Answer

Scale out the deployment by increasing the number of replicas.

Answer

Reduce the number of replicas to concentrate load.

Answer

Increase the CPU limit to allow faster processing.

Question 18

A company has a steady-state workload of 100 vCPUs running 24/7. They want to get the maximum discount possible without long-term commitment. What discount should they expect?

Accepted Answer

Sustained use discount of up to 30%. The correct answer is C: Sustained use discount of up to 30%. For steady-state workloads that run continuously, Google Compute Engine automatically applies sustained use discounts, and the maximum discount for instances running the full month is 30% (for N1 machine types). Because the company wants maximum discount without any long-term commitment, this automatic discount is exactly what they should expect. Option A is wrong because committed use discounts require a 1- or 3-year commitment, which the company explicitly wants to avoid. Option B is incorrect because the sustained use discount maximum is 30%, not 20%. Option D is wrong because sustained use discounts apply automatically to eligible steady-state usage.

Answer

Committed use discount of up to 57%

Answer

Sustained use discount of up to 20%

Answer

No discount available

Question 19

Which storage class provides the lowest cost for data accessed less than once a year?

Accepted Answer

Archive. Archive storage class is the correct answer because it is specifically designed for long-term data retention where access is extremely infrequent, such as less than once a year. It offers the lowest storage cost among Google Cloud Storage classes, but with higher retrieval costs and a minimum storage duration of 365 days, making it ideal for data that is rarely accessed.

Answer

Nearline

Answer

Standard

Answer

Coldline

Question 20

Which Google Cloud service provides a fully managed, private Git repository that integrates with Cloud Build for continuous integration?

Accepted Answer

Cloud Source Repositories. Cloud Source Repositories is the correct answer because it provides fully managed, private Git repositories hosted on Google Cloud. It integrates natively with Cloud Build, enabling automatic triggers for continuous integration (CI) pipelines whenever code is pushed to a repository branch or tag, without requiring external Git hosting.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Container Registry