PCDOE Practice Test 4 — 25 Questions

Question 1

Which tool can be used to capture and analyze latency spikes in a distributed application?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool for capturing and analyzing latency spikes in a distributed application because it provides end-to-end latency tracking by instrumenting requests as they traverse microservices. It collects trace spans with timing data, allowing you to identify bottlenecks and pinpoint the exact service or operation causing the spike.

Answer

Cloud Logging

Answer

Cloud Debugger

Answer

Cloud Monitoring

Question 2

Which service is commonly used for time-series data and real-time analytics?

Accepted Answer

Bigtable. Bigtable is a fully managed, scalable NoSQL database optimized for large analytical and operational workloads, including time-series data and real-time analytics. It provides sub-10ms latency for high-throughput reads and writes, making it ideal for IoT, monitoring, and financial data streams. Its column-oriented storage and automatic sharding support efficient time-based queries and aggregation.

Answer

Cloud SQL

Answer

Firestore

Answer

Cloud Spanner

Question 3

During bootstrapping, a DevOps lead wants to ensure that all projects in the 'dev' folder have a consistent set of VPC firewall rules and network policies. They are considering using a shared VPC or VPC Network Peering. Which approach provides the most control and consistency for DevOps teams while minimizing administrative overhead?

Accepted Answer

Implement a shared VPC with a host project managed by the network team, and allow DevOps teams to use subnets in their service projects.. A shared VPC with a host project managed by the network team provides centralized control over VPC firewall rules and network policies, ensuring consistency across all service projects in the 'dev' folder. This approach minimizes administrative overhead because DevOps teams can create subnets in their service projects without needing to manage network infrastructure, while the network team enforces a uniform security posture.

Answer

Use VPC Service Controls to define perimeters for each project.

Answer

Create a separate VPC in each project and use Cloud VPN to connect them.

Answer

Use VPC Network Peering between all projects to allow connectivity.

Question 4

Which service should be used to monitor the health of HTTP endpoints from multiple locations?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) includes uptime checks that can be configured to probe HTTP endpoints from multiple global locations, measuring latency, availability, and response content. This makes it the correct service for monitoring the health of HTTP endpoints from diverse geographic regions.

Answer

Cloud Trace

Answer

Cloud Logging

Answer

Cloud Debugger

Question 5

A company serves static assets (images, CSS) to global users. Users in distant regions experience slow load times. Which service should they use to optimize delivery?

Accepted Answer

Cloud CDN. Cloud CDN (Content Delivery Network) caches static assets (images, CSS) at edge locations worldwide, reducing latency for distant users by serving content from a nearby point of presence (PoP). This directly addresses slow load times caused by geographic distance, as the origin server is no longer the sole source of delivery.

Answer

Cloud Load Balancing

Answer

Cloud NAT

Answer

Cloud Armor

Question 6

Which THREE are benefits of migrating from Jenkins to Cloud Build?

Accepted Answer

No server maintenance. Cloud Build is a fully managed CI/CD service that runs on Google Cloud's infrastructure, eliminating the need for users to provision, configure, or maintain build servers. Unlike Jenkins, which requires ongoing administration of the Jenkins master and agent nodes, Cloud Build automatically scales resources and handles underlying server maintenance, including OS patches and hardware failures.

Answer

Support for any VCS

Answer

Built-in security scanning

Question 7

A team uses Cloud Build with a trigger on Cloud Source Repository. The build fails intermittently with error 'Failed to pull builder image 'gcr.io/cloud-builders/gcloud'' but sometimes succeeds. What is the most likely cause?

Accepted Answer

Network egress from Cloud Build is throttled due to high concurrency.. The intermittent failure to pull the builder image 'gcr.io/cloud-builders/gcloud' indicates a transient network issue rather than a permanent misconfiguration. Cloud Build uses a shared pool of network resources, and under high concurrency, egress traffic to Container Registry can be throttled, causing pull operations to time out or fail. This explains why the build sometimes succeeds and sometimes fails, as throttling depends on the current load.

Answer

The Cloud Build worker pool is in a different region.

Answer

The builder image is too large.

Answer

The build service account lacks permissions to access Container Registry.

Question 8

You manage a production environment with a web service deployed on Compute Engine instances behind a HTTP(S) Load Balancer. The service has a health check configured on the load balancer, probing a health endpoint every 10 seconds. After a recent configuration change, you observe that all instances are marked as unhealthy and traffic is failing. The health check response is 200 OK from the instances, but the load balancer still marks them unhealthy. The health check configuration: protocol: HTTP, port: 80, request path: /health, interval: 10s, timeout: 5s, unhealthy threshold: 2. The instances are running a custom web server. What is the most likely cause?

Accepted Answer

The health check response is coming from a different server (e.g., a reverse proxy) that returns 200 but does not represent the actual service health.. The health check is receiving a 200 OK response from a reverse proxy or intermediary that is not the actual web server, so the load balancer's health check does not reflect the true health of the application. Even though the response is successful, the load balancer marks instances unhealthy because the health check is likely failing to reach the intended health endpoint on the custom web server, or the response is not coming from the service itself. This scenario often occurs when a reverse proxy (e.g., nginx) returns a static 200 for /health without forwarding the request to the backend service, causing the load balancer to see a healthy response but the service to be actually unhealthy.

Answer

The load balancer is misconfigured with an incorrect protocol (HTTPS instead of HTTP).

Answer

The health check port is incorrectly configured as 80 but the service is listening on 8080.

Answer

The health check timeout is greater than the interval, causing overlapping probes.

Question 9

Refer to the exhibit. You are investigating a performance issue where the api-server container is using excessive CPU. You run a Cloud Monitoring API query and receive the JSON configuration shown. However, the query returns no data points. What is the most likely cause?

Accepted Answer

The filter is missing required resource labels such as project_id, location, cluster_name, and namespace_name, causing no time series to match.. The Cloud Monitoring API query for the 'kubernetes.io/container/cpu/core_usage_time' metric type requires mandatory resource labels—specifically 'project_id', 'location', 'cluster_name', and 'namespace_name'—to uniquely identify the time series for a GKE container. Without these labels in the filter, the query cannot match any time series, resulting in no data points returned, even if the metric is actively emitting data.

Answer

The time interval specified is too short and falls outside the data retention period.

Answer

The metric type 'kubernetes.io/container/cpu/core_usage_time' is deprecated and no longer available.

Answer

The aggregation perSeriesAligner 'ALIGN_MEAN' is incompatible with the metric type, which requires 'ALIGN_RATE'.

Question 10

You are a DevOps engineer at a large e-commerce company that runs its production workloads on Google Kubernetes Engine (GKE) in the us-central1 region. The cluster has 500 nodes, each with 8 vCPUs and 32 GB of memory, and uses preemptible VMs for cost savings. Over the past month, the monthly GKE cost has increased by 30% unexpectedly. Upon reviewing the billing reports, you notice a significant spike in Compute Engine costs, specifically for 'Sustained Use Discount' line items, but the total cost is higher than expected. You also observe that the cluster's node utilization is inconsistent, with some nodes running at 90% CPU and memory while others are below 20%. Your team has been deploying stateless microservices and using Cluster Autoscaler with default settings. The application traffic is variable but predictable, with peaks on weekends. You need to reduce the GKE costs without impacting performance. What should you do?

Accepted Answer

Enable node auto-provisioning and migrate baseline workloads to nodes covered by committed use discounts (1-year or 3-year).. Enabling node auto-provisioning allows GKE to automatically select the most cost-effective node configurations for your workloads, reducing waste from over-provisioned nodes. Migrating baseline workloads to nodes covered by committed use discounts (CUDs) locks in lower prices for predictable usage, directly addressing the 30% cost spike caused by inconsistent utilization and unexpected sustained use discount charges. This combination optimizes both variable and steady-state workloads without sacrificing performance.

Answer

Increase the minimum number of nodes in the cluster to 300 and use a larger machine type to reduce the number of pods per node.

Answer

Switch the cluster to a single-zone configuration and reduce the number of nodes to 200 to lower base costs.

Answer

Reduce the number of preemptible VMs to 30% and use only on-demand VMs for the remaining nodes to improve reliability.

Question 11

You are a DevOps engineer at a media streaming company. Your application runs on Google Kubernetes Engine (GKE) and serves video content to users worldwide. The application uses a microservices architecture with a frontend service that handles user requests and a backend transcoding service that converts video files. Recently, you noticed that the transcoding service is causing performance bottlenecks during peak hours, leading to increased latency for users. You have enabled Cloud Monitoring and Cloud Trace and observed that the transcoding service's CPU utilization is consistently above 90% during peak times, and the queue of video transcoding tasks is growing. The current deployment has 5 replicas of the transcoding service with no autoscaling. You need to optimize the performance of the transcoding service to reduce latency. Your company has a limited budget and wants to minimize costs. What should you do?

Accepted Answer

Refactor the frontend to push transcoding tasks to a Cloud Pub/Sub topic, and create a separate deployment of workers that subscribe to the topic and perform transcoding. Configure HPA on the worker deployment based on the Pub/Sub subscription backlog.. It decouples the transcoding workload from user-facing requests using Cloud Pub/Sub, allowing the worker deployment to scale independently based on the backlog of tasks. This pattern reduces latency by preventing the frontend from being blocked by transcoding, and HPA on Pub/Sub backlog ensures cost-efficient scaling only when demand increases, aligning with the limited budget.

Answer

Enable Horizontal Pod Autoscaling (HPA) on the transcoding service based on CPU utilization, targeting 70% utilization.

Answer

Upgrade the transcoding service to a larger machine type with more CPU and memory.

Answer

Increase the number of replicas of the transcoding service to 10 and keep it static.

Question 12

A company runs a microservices architecture on GKE with Istio. They want to generate custom request-level metrics for SLO tracking without modifying application code. Which approach is most efficient?

Accepted Answer

Set up Istio telemetry with the Cloud Monitoring adapter. Istio's telemetry v2 can be configured to export custom request-level metrics (e.g., latency, error rate) to Cloud Monitoring via the Cloud Monitoring adapter without modifying application code. This approach leverages Istio's sidecar proxy to capture metrics at the service mesh layer, making it the most efficient and non-invasive method for SLO tracking.

Answer

Write a custom Prometheus exporter deploying in each pod

Answer

Use the Cloud Monitoring agent to scrape metrics from pods

Answer

Enable Stackdriver for GKE (deprecated)

Question 13

You want to send alerts to a Slack channel when a critical error occurs. What should you do?

Accepted Answer

Configure a Slack webhook notification channel in Cloud Monitoring and associate it with an alerting policy. Cloud Monitoring alerting policies can directly send notifications to Slack via a configured webhook notification channel. When a critical error triggers the alerting policy, Cloud Monitoring sends an HTTP POST request to the Slack webhook URL, delivering the alert message to the specified Slack channel. This is the native, event-driven approach without requiring custom code or intermediate services.

Answer

Set up a webhook in Cloud Logging and point it to Slack

Answer

Use Cloud Tasks to schedule a job that queries logs and sends Slack messages

Answer

Create a Cloud Logging export to Pub/Sub and subscribe using a Cloud Function that sends to Slack

Question 14

Which THREE of the following are valid considerations when using organization policies to enforce compliance in a DevOps environment?

Accepted Answer

Child-level organization policies can only add more restrictions, not remove restrictions set by a parent.. Organization policies follow a hierarchical inheritance model where child policies can only impose additional restrictions (i.e., they are more restrictive) than the parent policy. This is enforced by the Google Cloud Resource Manager hierarchy, ensuring that a policy set at the organization level cannot be relaxed by a folder or project policy.

Answer

An organization policy must be enabled by a service agent before it can be used.

Answer

IAM conditions can be used to override an organization policy for specific resources.

Question 15

Your company runs a multi-region application on GKE across us-east1 and europe-west1. The application serves a global user base with a strict SLO of 99.95% availability. Recently, the team noticed that during peak hours, some users in South America experience high latency and intermittent errors. The GKE clusters are monitored via Cloud Monitoring with custom dashboards and alerting policies. The team has set up a single alerting policy that triggers when the global error rate exceeds 0.1%. However, the alert fires only after the issue has persisted for 10 minutes, and by then the customer impact is already significant. You need to improve the detection and response time. Which action should you take first?

Accepted Answer

Create separate alerting policies per region with shorter evaluation periods, and set up a notification channel for the on-call team.. The current single global alerting policy with a 10-minute evaluation period introduces a significant delay in detecting regional issues. By creating separate alerting policies per region with shorter evaluation periods, you can detect and respond to regional anomalies (like high latency in South America) much faster, directly improving the detection time for the multi-region application and reducing customer impact.

Answer

Add a dashboard that shows latency by region and set up a log-based metric for error counting.

Answer

Reduce the alerting policy's duration to 1 minute and increase the threshold to 0.5% to reduce noise.

Answer

Implement a canary deployment strategy to roll back changes quickly.

Question 16

Match each monitoring concept to its purpose.

Accepted Answer

Latency: Time taken to serve a request. The four golden signals are Latency, Traffic, Errors, and Saturation. Correct matches are A, B, C, D. Common confusions swap Error and Traffic definitions.

Answer

Latency: Rate of failed requests

Answer

Errors: Demand placed on the system

Question 17

Which THREE are recommended practices for setting up alerting on Google Cloud?

Accepted Answer

Set alert thresholds with a buffer (e.g., below SLO). Setting alert thresholds with a buffer below the SLO (e.g., alert at 99.9% when SLO is 99.99%) provides early warning before the SLO is breached. This proactive approach allows time for investigation and remediation, preventing actual SLO violations and ensuring service reliability targets are met.

Answer

Use multiple conditions with OR combiner to cover all scenarios

Answer

Use a single alerting policy for all services

Question 18

During a post-incident review, the team discovers that a misconfiguration in Cloud Armor caused legitimate traffic to be blocked, leading to a outage. The misconfiguration was introduced by a junior engineer who had overly permissive IAM roles. What is the best way to prevent similar incidents in the future?

Accepted Answer

Use Organization Policy constraints to restrict allowed IP ranges and rules in Cloud Armor security policies.. Enforcing guardrails with Organization Policies can prevent misconfigurations at scale. Option A is wrong because removing the engineer's access is punitive but doesn't prevent others. Option B is wrong because peer reviews reduce human error but are not automated. Option C is wrong because Cloud Armor logs help detection but not prevention.

Answer

Enforce a mandatory peer review for all Cloud Armor configuration changes.

Answer

Revoke the junior engineer's access to Cloud Armor and grant read-only access.

Answer

Enable Cloud Armor security policy logs and create alerting for blocked traffic spikes.

Question 19

A large enterprise manages costs across multiple GCP projects using a shared billing account. They want to apply a 10% discount on all committed use discounts (CUDs) to specific departments based on resource labels. How should they allocate the CUD savings?

Accepted Answer

Enable 'CUD cost attribution' in the billing account settings to automatically distribute savings based on project labels. The 'CUD cost attribution' feature in the billing account settings automatically distributes committed use discount (CUD) savings based on project labels, allowing departments to receive their share of the discount without manual effort. Option A is incorrect because 'Cost Attribution' is a feature for custom cost allocation using tags, not for CUD savings. Option C is possible using BigQuery, but it is not a built-in automated feature like CUD cost attribution. Option D is incorrect because manual calculation and journal entries are error-prone and not recommended for automated discount allocation.

Answer

Use the Cloud Billing report's 'Cost Attribution' feature to assign CUD savings based on labels

Answer

Use the Cloud Billing cost table in BigQuery with the CUD cost data and allocate using custom queries

Answer

Manually calculate CUD savings and distribute via journal entries

Question 20

A large enterprise is migrating to Google Cloud and wants to bootstrap their organization for DevOps. They have multiple business units, each needing their own folder with projects. Security requires that all projects in the 'prod' folder must have a specific set of organization policies enforced, such as restricting service account key creation. They also want to allow individual teams to create project-level policies as long as they don't conflict with the organization policies. Which approach ensures this while minimizing administrative overhead?

Accepted Answer

Set the required organization policies on the 'prod' folder and allow teams to set additional policies at the project level as long as they don't conflict.. Google Cloud Organization Policies can be set at the folder level, allowing the 'prod' folder to inherit constraints like `iam.disableServiceAccountKeyCreation` across all its projects. Teams can then add additional project-level policies that are more restrictive, as long as they do not conflict with the inherited folder-level policies, which is enforced by the policy hierarchy. This minimizes administrative overhead by centralizing mandatory controls at the folder level while delegating flexibility to teams.

Answer

Set organization policies at the organization level and use IAM conditions to apply them only to the prod folder.

Answer

Create custom roles containing the required constraints and assign them to the team's IAM members.

Answer

Place all production workloads in a single project and use VPC Service Controls for security.