PCDOE Practice Test 5 — 25 Questions

Question 1

A Cloud Run service experiences high cold start latency. The team has already set min-instances to 1. Which additional optimization can further reduce cold start impact?

Accepted Answer

Reduce container image size and enable CPU boost during startup. Reducing the container image size decreases the time required to pull and unpack the container on a cold start, and enabling CPU boost during startup temporarily allocates additional CPU resources to accelerate the initialization process. Together, these directly address the root causes of cold start latency by minimizing both the image loading time and the application initialization time, even when min-instances is already set to 1.

Answer

Use HTTP/2 to speed up request handling

Answer

Place the service on Cloud Run for Anthos on GKE

Answer

Increase the container memory limit

Question 2

A DevOps team is analyzing Google Cloud costs and notices that spending on BigQuery has increased significantly. They want to reduce costs without impacting ongoing analytical workloads. Which TWO actions should they take? (Choose two.)

Accepted Answer

Set custom cost controls like query quotas and maximum bytes billed per query.. BigQuery allows you to set custom cost controls such as query quotas (e.g., concurrent queries per project) and maximum bytes billed per query. These controls cap resource usage at the query level, preventing runaway costs while still allowing analytical workloads to run within defined limits. This directly addresses cost spikes without blocking ongoing operations.

Answer

Switch to on-demand pricing to pay only for queries run.

Answer

Enable column-level security to restrict access to sensitive data.

Answer

Delete unused datasets to reduce storage costs.

Question 3

Which THREE strategies can reduce API latency in Apigee?

Accepted Answer

Enable response compression in the API proxy.. Option B is correct because enabling response compression (e.g., gzip via the CompressResponse policy or the compression.* flow variables) shrinks the payload size sent to clients, reducing transfer time and thus perceived API latency. Option C is correct because connection pooling (configured through the TargetEndpoint HTTPTargetConnection properties such as keepalive and max connections, or the TargetServer configuration) reuses TCP/TLS connections to the backend, avoiding repeated handshake and connection-setup overhead on every request. Option D is correct because implementing caching (e.g., the ResponseCache or LookupCache/PopulateCache policies backed by Apigee's cache) serves frequently accessed responses directly from the cache instead of invoking the backend, dramatically cutting round-trip latency. Option A is not correct because disabling TLS termination does not reduce latency in a meaningful, recommended way and would compromise security; TLS termination is a standard, optimized function in Apigee. Option E is not correct because increasing analytics data collection frequency adds processing and messaging overhead and does not reduce request/response latency.

Answer

Disable TLS termination to reduce overhead.

Answer

Increase the analytics data collection frequency.

Question 4

A company is using BigQuery for analytics and wants to control costs. They have many queries that scan large amounts of data. Which approach is most effective in reducing query costs?

Accepted Answer

Partition tables by date and use partition pruning in queries.. Partitioning tables by date and using partition pruning in queries directly reduces the amount of data scanned by BigQuery, which is the primary driver of on-demand query costs. By filtering on the partition column, BigQuery can skip entire partitions that do not match the query criteria, minimizing the bytes processed. This is the most effective cost-control measure because it addresses the root cause of high costs—excessive data scanning—without requiring a pricing model change or additional resource commitments.

Answer

Switch to flat-rate pricing to cap costs.

Answer

Reserve BigQuery slots for dedicated capacity.

Answer

Use clustering to organize data within partitions.

Question 5

A DevOps team wants to automate the deployment of a microservice application to Google Kubernetes Engine (GKE) using Cloud Build. They have a Cloud Build configuration file that builds a container image and deploys it to GKE. However, the deployment step fails with an authorization error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Kubernetes Engine Developer IAM role.. Cloud Build uses a default service account (the Cloud Build service account) to execute build steps, including deploying to GKE. The Kubernetes Engine Developer IAM role (roles/container.developer) grants the necessary permissions to deploy and manage workloads on GKE clusters. Without this role, the Cloud Build service account cannot authenticate to the GKE cluster's Kubernetes API, resulting in an authorization error during the deployment step.

Answer

The user triggering the build does not have IAM permissions to deploy to GKE.

Answer

Cloud Build does not have permission to access the source code repository.

Answer

The Docker image build step failed due to missing dependencies.

Question 6

A startup runs a batch data processing job every night. The job processes large datasets and takes about 6 hours to complete. The job is designed to handle interruptions gracefully by saving checkpoint files to Cloud Storage every few minutes. The startup wants to minimize compute costs. The current setup uses a managed instance group with 10 n1-standard-4 VMs running for the entire 6-hour window. They are considering using preemptible VMs. However, they are concerned about cost stability and potential preemption. What should they do?

Accepted Answer

Use preemptible VMs for all instances, as the job can resume from checkpoints.. The job is fault-tolerant and can resume from checkpoints, making preemptible VMs suitable and significantly cheaper. Option A is not relevant as sole-tenant nodes do not reduce cost. Option B adds unnecessary complexity and still uses regular VMs. Option D requires a long-term commitment and is more expensive than preemptible VMs.

Answer

Use sole-tenant nodes to improve performance.

Answer

Use a mix of preemptible and regular VMs to ensure at least some progress if preempted.

Answer

Use regular VMs with committed use discounts for a 1-year term.

Question 7

You need to monitor the health of an external HTTP endpoint. Which resource should you create?

Accepted Answer

Uptime check in Cloud Monitoring. To monitor the health of an external HTTP endpoint, you need a service that can reach the endpoint from outside your VPC and provide alerting and visibility. Cloud Monitoring's Uptime Check is specifically designed for this purpose: it verifies that an external HTTP(S) endpoint is reachable and responsive, and can trigger alerting policies based on the results. This is the correct resource because it operates from Google's infrastructure, not from within your project, and directly supports external endpoint monitoring.

Answer

Load balancer with a health probe

Answer

Internal health check in Compute Engine

Answer

Cloud Logging log-based metric

Question 8

Refer to the exhibit. A DevOps engineer applies this Terraform configuration but gets an error: "Error creating Project: googleapi: Error 403: The caller does not have permission to enable services". What is the most likely cause?

Accepted Answer

The service account used by Terraform lacks the Service Usage Admin role on the project.. The error 'The caller does not have permission to enable services' indicates that the identity (service account) used by Terraform to authenticate with the Google Cloud API lacks the required IAM permission to enable Google APIs on the project. The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) grants the necessary permissions, including serviceusage.services.enable and serviceusage.services.list, which are required to enable services like the Compute Engine API during resource creation. Without this role, the API call to enable services fails with a 403 error.

Answer

The org_id is incorrect.

Answer

The organization requires that the Compute Engine API be enabled before project creation.

Answer

The project ID already exists.

Question 9

Which TWO are benefits of using a shared VPC in a Google Cloud organization? (Choose 2)

Accepted Answer

Centralized management of network resources.. Option A is correct because a shared VPC lets the host project's network administrators manage subnets, firewall rules, routes, and other network resources centrally, so all attached service projects consume a single, consistently governed network instead of each maintaining its own VPC. Option D is correct because shared VPC cleanly separates duties: network admins operate in the host project with roles like Compute Network Admin, while project admins in service projects use roles such as Compute Instance Admin to deploy resources without controlling the underlying network. Option B is wrong because service project users still require IAM roles (for example, Compute Instance Admin or predefined Shared VPC roles) to create and use resources in the shared network. Option C is wrong because shared VPC does not by itself guarantee compliance with organizational policies; that is the role of Organization Policy Service constraints and related controls. Option E is wrong because enabling APIs in service projects is not automatic — required APIs such as compute.googleapis.com must be enabled explicitly in each project.

Answer

Eliminates the need for project administrators to have any IAM roles.

Answer

Ensures compliance with organizational policies.

Answer

Automatically enables required APIs in all service projects.

Question 10

A web application experiences high latency during peak hours. Which TWO actions should the team take to optimize performance?

Accepted Answer

Implement autoscaling based on CPU utilization. Option A is correct because implementing autoscaling based on CPU utilization allows the application to dynamically add instances during peak hours, distributing the load and reducing latency caused by resource saturation. Option C is correct because Cloud Memorystore provides a managed in-memory cache (Redis or Memcached) that stores frequently accessed data, reducing database round-trips and significantly lowering response times under high traffic. Option B is not appropriate here because Cloud CDN with a backend bucket is designed for serving static content from Cloud Storage, not for optimizing a dynamic web application's backend latency. Option D is not ideal because vertically scaling instances provides only a fixed capacity increase and does not elastically handle variable peak loads as effectively as autoscaling. Option E is incorrect because reducing backend services simplifies routing but does not address the underlying performance bottleneck causing high latency.

Answer

Enable Cloud CDN with the origin as the backend bucket

Answer

Increase the size of the instances serving the application

Answer

Reduce the number of backend services to simplify routing

Question 11

Which GCP tool provides recommendations for rightsizing Compute Engine VMs?

Accepted Answer

Recommender.. The Recommender tool in GCP uses machine learning to analyze historical usage patterns and provides actionable recommendations, including rightsizing suggestions for Compute Engine VMs. It identifies underutilized VMs and suggests optimal machine types to reduce costs without compromising performance, making it the correct choice for this task.

Answer

Cloud Console Cost Table.

Answer

Cloud Monitoring.

Answer

Cloud Billing Reports.

Question 12

An organization uses Cloud CDN with an HTTP(S) Load Balancer to serve static content. They observe that cache hit ratio is lower than expected. The content is immutable and has long Cache-Control headers. What is the most likely cause?

Accepted Answer

The requests include unique query parameters like session IDs.. When Cloud CDN serves content with long Cache-Control headers but unique query parameters (like session IDs) are appended to each request, the cache treats each URL as a distinct object. This causes cache misses because the load balancer forwards requests with different query strings to the origin, preventing the CDN from serving cached responses. The correct answer is A because this behavior directly undermines cache efficiency despite proper cache headers.

Answer

The Cache-Control max-age is set too short.

Answer

The load balancer is configured with SSL termination.

Answer

The content is served using signed URLs with expiration.

Question 13

A DevOps team needs to ensure that all service accounts in the organization cannot be used to create external IP addresses on VM instances. They want to enforce this across all projects, including future ones. What should they do?

Accepted Answer

Create an organization policy constraint for compute.vmExternalIpAccess and set it to deny all.. The compute.vmExternalIpAccess organization policy constraint is designed to control whether external IPs can be assigned to VM instances. Setting it to deny all at the organization level ensures that no service account or user can create VMs with external IPs, regardless of their IAM permissions, and it applies to all current and future projects.

Answer

Grant the roles/compute.networkAdmin role only to trusted users, and remove it from service accounts.

Answer

Enable VPC Service Controls and create a perimeter around all projects to block external IPs.

Answer

Use a custom IAM role that excludes the compute.instances.create permission for all service accounts.

Question 14

A DevOps team is setting up a new Google Cloud organization. They want to ensure that all projects created under the 'production' folder automatically inherit a set of IAM policies that grant the security team the Security Reviewer role. What is the most efficient way to achieve this?

Accepted Answer

Grant the Security Reviewer role to the security team on the 'production' folder.. IAM policies are inherited down the resource hierarchy. Granting a role at the folder level ensures all current and future projects within that folder inherit the role. This is the most efficient and least error-prone method, and it adheres to least privilege by scoping to the production folder only.

Answer

Use an organization policy to enforce that all projects in 'production' have the Security Reviewer role.

Answer

Create a script that runs periodically to grant the role on each new project in the 'production' folder.

Answer

Grant the Security Reviewer role to the security team at the organization level.

Question 15

A team wants to receive a notification when their monthly spending exceeds 80% of the budget. Which GCP feature should they configure?

Accepted Answer

Budget alert with threshold rule at 0.8.. GCP Budgets allow you to set a budget amount and configure alert thresholds expressed as a fraction of the budget (e.g., 0.8 for 80%). When actual or forecasted spend crosses the threshold, Budget Alert notifications are sent via email or Pub/Sub, enabling the team to react before the budget is exceeded.

Answer

Committed use discounts.

Answer

Cloud Storage bucket for cost exports.

Answer

Cloud Monitoring cost insights dashboard.

Question 16

Your team runs a service on GKE and wants to implement SLO-based alerting. The SLO is 99.9% availability measured over a 30-day rolling window via a request-based SLI. You configure a burn-rate alert with a 1-hour window and a burn rate threshold of 14.4. During a partial outage where the service is unavailable for 5 minutes in every hour, the alert does not fire. What is the most likely reason?

Accepted Answer

The SLI is computed as a ratio of good requests to total requests, and the 5-minute outages may not produce enough bad requests to exceed the burn rate threshold in the 1-hour window.. The alert does not fire because the burn rate over the 1-hour window remains below 14.4. With a request-based SLI, short outages that affect a small percentage of requests may not consume error budget fast enough to exceed the threshold. The threshold itself is appropriate for fast-burn detection; the issue is the mismatch between the outage pattern and the alert condition. To catch such patterns, consider a multi-window alert or a lower threshold for slower burns.

Answer

The burn rate threshold of 14.4 is too high; it should be set to 1.0 to detect any outage.

Answer

The alerting policy is misconfigured because it lacks a notification channel; without a notification channel, the alert never fires.

Answer

The rolling window is 30 days, but the burn rate alert should use a 30-day window to match the SLO; using 1 hour causes the alert to miss short outages.

Question 17

You are the SRE for a critical API service on Google Cloud. The service has an SLO of 99.95% availability. During a recent incident, the service was unavailable for 10 minutes. After the incident, you need to calculate the error budget consumed. Assuming a 30-day month, how much of the error budget was consumed?

Accepted Answer

About 46.3%. The error budget is the allowed downtime derived from the SLO. For 99.95% availability over 30 days, the budget is 21.6 minutes. The incident consumed 10 minutes, which is 10/21.6 ≈ 46.3% of the budget. This calculation is essential for tracking error budget consumption and making decisions about releases and reliability work.

Answer

About 23.1%

Answer

About 100%

Answer

About 2.8%

Question 18

A DevOps engineer is trying to create a service account key for a CI/CD pipeline, but receives the error: 'Constraint constraints/iam.disableServiceAccountKeyCreation violated'. What is the most likely cause and solution?

Accepted Answer

The Organization Policy prevents key creation; the engineer needs to request an exception from the security team.. The error 'Constraint constraints/iam.disableServiceAccountKeyCreation violated' indicates that an Organization Policy with the constraint `iam.disableServiceAccountKeyCreation` is enforced at the organization, folder, or project level. This policy explicitly blocks the creation of service account keys, which is why the engineer cannot generate a key for the CI/CD pipeline. The correct solution is to request an exception from the security team, who can either remove the policy or add the engineer's project to an exemption list.

Answer

The Cloud Resource Manager API is disabled; enable it.

Answer

The project does not have billing enabled; enable billing.

Answer

The service account has been deleted; the engineer must recreate it.

Question 19

You are implementing a canary deployment for a new version of a microservice on Google Kubernetes Engine (GKE). You want to automatically roll back if the canary's error rate exceeds the baseline by 2% for 5 minutes. Which approach best achieves this?

Accepted Answer

Use Cloud Monitoring to create an alert on the canary's error rate, and configure the alert to trigger a Cloud Function that rolls back the deployment.. Automated canary analysis requires monitoring error rates and triggering rollback when thresholds are breached. Cloud Monitoring can compare canary and baseline metrics, and with alerting to a Cloud Function, you can automate rollback. Kubernetes probes and Istio alone don't provide this logic. Manual rollback is not automatic.

Answer

Use Istio to route traffic to the canary, and rely on its built-in automatic rollback feature when errors exceed a threshold.

Answer

Use kubectl rollout undo to manually revert if errors are observed.

Answer

Configure a Kubernetes readiness probe that fails when errors occur, causing the canary pods to be restarted.

Question 20

Your team manages a high-traffic e-commerce API on Google Cloud. The SRE team wants to proactively detect performance regressions before they impact users. They decide to implement a canary deployment strategy. Which of the following best describes how to use Cloud Monitoring to automatically halt the canary rollout if the error rate exceeds a threshold?

Accepted Answer

Use Cloud Deploy with a canary deployment strategy and configure a deployment verification job that queries a Cloud Monitoring metric for error rate and fails the rollout if the threshold is exceeded.. Cloud Deploy provides native canary deployment support with verification jobs that can query Cloud Monitoring metrics. When the verification job detects that the error rate exceeds the defined threshold, it fails, which automatically stops the rollout and prevents further exposure. This integrates directly with the deployment pipeline, enabling safe, automated canary analysis without custom scripting or indirect triggers.

Answer

Define an SLO with a rolling window and use Cloud Monitoring alerting policies to trigger a Cloud Build pipeline that rolls back the canary when the error rate exceeds the threshold.

Answer

Create a log-based metric for HTTP 5xx errors and configure a log sink to Pub/Sub that triggers a Cloud Function to roll back the deployment.

Answer

Configure a Kubernetes Horizontal Pod Autoscaler to scale down the canary deployment if the error rate increases, effectively removing the canary from service.