PCDOE Practice Test 4 — 25 Questions

Question 1

Which TWO are best practices for implementing CI/CD on Google Cloud?

Accepted Answer

Use Artifact Registry for storing container images.. Artifact Registry is the recommended service for storing, managing, and securing container images and other artifacts in Google Cloud. It integrates natively with Cloud Build, Cloud Run, and Kubernetes, providing vulnerability scanning and IAM-based access control, which are essential for a secure CI/CD pipeline.

Answer

Use Cloud Run for all services.

Answer

Use Cloud Build for all deployments, including infrastructure changes.

Answer

Use GitHub Actions instead of Cloud Build.

Question 2

Refer to the exhibit. You are reviewing an alert policy for CPU utilization. What is a potential problem with this configuration?

Accepted Answer

The duration is too short, which may cause noise during spikes.. A short duration in a CPU utilization alert policy means the threshold must be breached for only a brief period before triggering an incident. This can cause noise during transient spikes that are not indicative of a sustained problem, leading to false positives and alert fatigue for operations teams.

Answer

The autoClose time is too long.

Answer

The threshold is set too low.

Answer

The combiner should be 'AND'.

Question 3

Which TWO are benefits of using Cloud Build triggers to implement CI/CD pipelines?

Accepted Answer

Start a build automatically when changes are pushed to a repository. Cloud Build triggers can be configured to automatically start a build in response to events such as a push to a repository branch or the creation of a pull request. This event-driven automation is the foundation of a CI/CD pipeline, eliminating the need for manual build initiation and ensuring that every code change is validated immediately.

Answer

Deploy to a specific Google Cloud region based on the trigger

Answer

Support only a single branch per trigger

Answer

Automatically provision infrastructure as part of the build

Question 4

A team uses Cloud Monitoring alerting policies with multiple conditions. They want an incident to fire only when both conditions are met simultaneously. What should they configure?

Accepted Answer

Set the alerting policy combiner to 'AND'. Cloud Monitoring alerting policies support a 'combiner' field that can be set to 'AND' to require that all conditions are met simultaneously before the incident fires. This ensures the alert triggers only when both conditions are true at the same evaluation window, rather than when either condition is met.

Answer

Create two separate alerting policies

Answer

Create a single condition with a ratio metric

Answer

Use a log-based metric condition

Question 5

Arrange the steps to implement a canary deployment for a Cloud Run service.

Accepted Answer

Deploy new revision with 0% traffic, then shift a small percentage of traffic to it, then monitor, then gradually increase traffic, then remove old revision.. In a canary deployment for Cloud Run, the correct sequence ensures minimal risk. First, deploy the new revision with 0% traffic. Then, route a small percentage (e.g., 1%) to it and monitor for errors or performance issues. If successful, gradually increase traffic while monitoring. Once the new revision is fully validated, point 100% traffic to it and remove the old revision. This incremental approach limits blast radius and allows rollback.

Answer

Shift a small percentage of traffic to the new revision, then deploy the new revision, then monitor, then gradually increase traffic, then remove old revision.

Answer

Deploy new revision with 0% traffic, then gradually increase traffic to 100%, then monitor, then remove old revision.

Answer

Deploy new revision with 0% traffic, then shift a small percentage of traffic, then remove old revision, then monitor, then gradually increase traffic.

Question 6

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud Build: Continuous integration/continuous delivery platform. The correct matches are: Cloud Build for CI/CD, Cloud Source Repositories for Git hosting, Cloud Functions for event-driven serverless functions, and Cloud Run for serverless containers. Common confusions include swapping the purposes of Cloud Build and Cloud Source Repositories.

Answer

Cloud Build: Private Git repository hosting

Answer

Cloud Source Repositories: Continuous integration/continuous delivery platform

Question 7

A company needs to monitor custom application metrics from Compute Engine instances. Which TWO methods can be used?

Accepted Answer

Install Cloud Monitoring agent on instances. The Cloud Monitoring agent is specifically designed to collect custom application metrics from Compute Engine instances and send them to Cloud Monitoring. It supports both third-party applications and custom metrics via its built-in integration with collectd and a configuration interface for defining custom metrics. This is the standard, supported method for monitoring custom metrics from VMs.

Answer

Use the deprecated Stackdriver Agent

Answer

Use Cloud Trace

Answer

Install Cloud Logging agent

Question 8

A team is setting up CI/CD for a microservices architecture. They want to ensure each service is independently buildable and deployable. What practices should they adopt? (Select THREE)

Accepted Answer

Use Artifact Registry with separate repositories per service. Option A is correct because Artifact Registry lets you create separate repositories per service, so each microservice's container images and packages are versioned and stored independently, which supports independent build and deploy workflows. Option C is correct because a single monorepo with separate Cloud Build triggers per service (using included files or path filters) allows each service to be built only when its own code changes, preserving independent buildability. Option D is correct because separate source repositories per service give each team full autonomy over its own codebase, release cadence, and pipeline, which is the clearest way to ensure services are independently buildable and deployable. Option B is not correct here because Cloud Deploy's multi-target pipeline is about promoting releases across environments (e.g., dev, staging, prod), not about making each service independently buildable. Option E is not correct because a single Cloud Build config with substitutions to build multiple services couples the services into one build definition, which undermines independent buildability and deployability.

Answer

Use Cloud Deploy's multi-target pipeline

Answer

Use Cloud Build's build config with substitutions to build multiple services

Question 9

Which TWO of the following are required steps to set up a shared VPC for DevOps teams?

Accepted Answer

Attach the service projects to the host project.. Option D is correct because setting up Shared VPC begins at the organization level by designating a host project and enabling Shared VPC on it, which makes that project the central network owner. Option A is correct because after the host project is enabled, the DevOps service projects must be attached to the host project so their resources can use the host project's subnets. Option B is wrong because Shared VPC does not use VPC peering; the service projects consume subnets from the host project's VPC rather than creating their own peered VPC. Option C is wrong because Cloud Interconnect is a dedicated hybrid connectivity service to on-premises networks, not a mechanism for linking host and service projects. Option E is wrong because the Shared VPC Admin role (roles/compute.xpnAdmin) is granted to the administrators who manage Shared VPC at the host or organization level, not to the service project team, which typically receives roles such as Compute Network User on specific subnets.

Answer

Create a new VPC in the service project and peer it with the host project.

Answer

Configure Cloud Interconnect between the host and service projects.

Answer

Grant the Shared VPC Admin role (roles/compute.xpnAdmin) to the service project team.

Question 10

Refer to the exhibit. A team uses this cloudbuild.yaml to deploy a service to Cloud Run. They notice that the deployment fails intermittently with a 'permission denied' error. Which is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the `roles/run.admin` or `roles/run.developer` role. The Cloud Build service account (default or custom) must have the `roles/run.admin` or `roles/run.developer` IAM role to execute `gcloud run deploy`. Without these roles, the deployment fails with a 'permission denied' error because the service account lacks the `run.services.create` and `run.services.update` permissions required to deploy or update a Cloud Run service. The intermittent nature suggests the service account may have been granted the role after some failures, or the error only surfaces when the service account's cached credentials expire.

Answer

The image tag $SHORT_SHA is invalid because it contains a variable

Answer

The region in the gcloud run deploy command does not match the region where Cloud Run is enabled

Answer

The Cloud Build service account does not have permission to push images to Artifact Registry

Question 11

A team uses a monorepo with multiple microservices in separate directories. They want to build only the changed service(s) when a push occurs to the repo. How can they achieve this efficiently?

Accepted Answer

Create multiple Cloud Build triggers, each with a different includeFiles filter matching the service directory.. Cloud Build triggers can be configured with includeFiles filters to trigger only when files in a specific directory change, allowing each microservice to build independently. Option A builds all services, which is inefficient for a monorepo with multiple microservices. Option B uses Cloud Functions to invoke Cloud Build, adding unnecessary complexity and overhead. Option D relies on dynamic detection with git diff, which is not a built-in feature of Cloud Build triggers and would require custom scripting.

Answer

Use a single Cloud Build trigger with a Dockerfile build step that builds all services.

Answer

Use Cloud Functions to invoke Cloud Build per changed directory.

Answer

Use a Cloud Build trigger with a build config that dynamically detects changes using git diff.

Question 12

A company uses Cloud Storage to store archival data. They want to minimize storage costs while maintaining availability. Which storage class should they use?

Accepted Answer

Archive storage class.. The Archive storage class is the correct choice because it offers the lowest storage cost for archival data that is accessed less than once per year, with a 365-day minimum storage duration and retrieval costs that are higher than other classes. This aligns with the requirement to minimize storage costs while maintaining availability, as Archive data is still available for retrieval (though with a longer latency) and is replicated for durability.

Answer

Nearline storage class.

Answer

Standard storage class.

Answer

Coldline storage class.

Question 13

A company uses BigQuery for analytics. They notice high costs due to queries scanning large amounts of data. They want to reduce costs without sacrificing performance for urgent queries. Which approach is most cost-effective?

Accepted Answer

Partition and cluster tables, and use BI Engine for acceleration. Partitioning and clustering tables reduces the amount of data scanned by queries, and BI Engine provides an in-memory acceleration layer for fast, interactive queries. Together, they reduce costs by minimizing bytes processed while maintaining performance for urgent queries.

Answer

Use flat-rate pricing with reservations

Answer

Use on-demand pricing with query caching

Answer

Use materialized views and limit query jobs to interactive priority

Question 14

What is the primary benefit of using preemptible VMs?

Accepted Answer

Lower cost.. Preemptible VMs are Compute Engine instances that last a maximum of 24 hours and can be terminated at any time by Google. They offer a significantly lower price—up to 60-91% discount compared to standard VMs—making them ideal for batch jobs and fault-tolerant workloads where cost savings are the primary benefit.

Answer

Higher reliability.

Answer

Faster performance.

Answer

Better security.

Question 15

A team wants to monitor a Google Cloud Run service for application crashes. Which Google Cloud tool automatically captures and notifies on application errors?

Accepted Answer

Error Reporting. Error Reporting (D) is the correct answer because it is a Google Cloud service specifically designed to automatically capture, aggregate, and notify on application errors, including crashes in Cloud Run services. It ingests error events from Cloud Logging and provides real-time alerts and dashboards, making it the dedicated tool for this use case.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

Cloud Console

Question 16

A company is bootstrapping a Google Cloud organization for DevOps. Which TWO practices should be implemented to ensure secure and efficient management of infrastructure as code (IaC) pipelines?

Accepted Answer

Use a dedicated project for CI/CD pipelines that houses Cloud Build triggers and Cloud Source Repositories.. Option B is correct because a dedicated CI/CD project isolates build infrastructure, Cloud Build triggers, and Cloud Source Repositories from workload projects, limiting the blast radius of compromised pipeline credentials and enabling centralized audit logging and IAM control over the deployment toolchain. Option D is correct because least-privilege service accounts scoped per environment (for example, distinct Terraform service accounts for dev, staging, and prod) enforce separation of duties and prevent human users from bypassing IaC by making direct production changes, which is a core Google Cloud security best practice. Option A is wrong because storing API keys in Terraform configuration files exposes secrets in version control and state files; secrets should be kept in Secret Manager and referenced dynamically. Option C is wrong because a single project collapses IAM, quota, and billing boundaries across environments, so a misconfiguration or compromised credential can affect production. Option E is wrong because requiring security-team approval for every change creates a bottleneck that undermines DevOps efficiency; approval gates should be risk-based and automated where possible.

Answer

Store infrastructure secrets (e.g., API keys) directly in Terraform configuration files for simplicity.

Answer

Use a single project to host all development, staging, and production environments to reduce complexity.

Answer

Require manual approval from a security team for every infrastructure change.

Question 17

Your team is using Cloud Monitoring to track the health of a distributed microservices application. You notice that the error rate for the checkout service has increased significantly, but no alerts are firing. The SLO for checkout is 99.9% availability over a 28-day rolling window. You inspect the alerting policy and find it uses a time series aggregation with a 1-minute alignment period and a condition that triggers when the ratio of errors to total requests exceeds 0.001 for 5 consecutive minutes. What is the most likely reason the alert is not firing?

Accepted Answer

The alert condition requires 5 consecutive minutes of breach, but the error rate spikes are intermittent and not sustained.. The alert condition requires the error ratio to exceed 0.001 for 5 consecutive 1-minute alignment periods. If the error rate spikes are intermittent—lasting only a minute or two before returning to normal—the condition of 5 consecutive minutes of breach is never met, so the alert remains silent. This is a classic case where the alerting policy's duration setting is too long relative to the bursty nature of the errors.

Answer

The error budget has been exhausted, so the alert is suppressed.

Answer

The SLO window is too long, and the alert condition uses a different measurement period.

Answer

The ratio threshold is too high because the total request count is low.

Question 18

A service experiences increased latency and HTTP 503 errors. The engineer finds that the backend managed instance group (MIG) is at max instances and CPU utilization is 90%. Which TWO actions should the engineer take to restore the service quickly?

Accepted Answer

Enable autoscaling based on HTTP load balancing utilization. Enabling autoscaling based on HTTP load balancing utilization allows the MIG to scale out based on the actual request load, which directly addresses the 503 errors caused by the backend being at max capacity. This metric is more responsive to traffic spikes than CPU utilization alone, as it reflects the frontend load balancer's view of backend capacity.

Answer

Increase the autoscaling target CPU utilization to 95%

Answer

Reduce the autoscaling target CPU utilization to 50%

Answer

Reduce the number of instances to avoid resource contention

Question 19

You are the DevOps engineer for a large e-commerce platform running on Google Kubernetes Engine (GKE). During a flash sale, you observe that the payments service is experiencing high latency and intermittent errors. The service is deployed with HorizontalPodAutoscaler (HPA) based on CPU utilization. You need to quickly diagnose and mitigate the issue. Which TWO actions should you take?

Accepted Answer

Use Cloud Monitoring to examine the payments service's request latency and error rate metrics, and create a custom dashboard for real-time monitoring.. Cloud Monitoring provides the necessary observability to diagnose the root cause of high latency and intermittent errors by examining request latency and error rate metrics. Creating a custom dashboard enables real-time monitoring, allowing you to correlate performance degradation with traffic spikes during the flash sale. This is the first step in incident management: observe before acting.

Answer

Check the GKE node's network performance using VPC Flow Logs and increase the node pool size.

Answer

Modify the HPA to use memory utilization instead of CPU, as memory is more indicative of the service's performance.

Answer

Configure a custom metric in Cloud Monitoring for the payments service's request queue depth and use it for HPA.

Question 20

You are investigating a slow increase in latency for a service running on Compute Engine. You have Cloud Monitoring and Cloud Logging set up. Which tool would best help you identify the cause of the latency?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data from distributed applications by tracing requests as they propagate through services. It provides detailed latency distributions and per-span breakdowns, allowing you to pinpoint which component or operation is causing the slowdown. For a Compute Engine service with Cloud Monitoring and Logging already in place, Cloud Trace is the most direct tool to analyze request-level latency.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Debugger