PCDOE Practice Test 5 — 25 Questions

Question 1

Refer to the exhibit.

```yaml
name: projects/my-project/alertPolicies/12345
displayName: High Error Rate
combiner: OR
conditions:
- conditionThreshold:
    filter: metric.type="logging.googleapis.com/user/myapp/error_count" resource.type="k8s_container"
    aggregations:
    - alignmentPeriod: 60s
      perSeriesAligner: ALIGN_RATE
    duration: 120s
    comparison: COMPARISON_GT
    thresholdValue: 5
    trigger:
      count: 1
```

An engineer notices that this alert fires too frequently during normal operation. Which change would most likely reduce the noise?

Accepted Answer

Increase duration to 300s.. Increasing the duration to 300s means the condition (error rate > 5 per second) must be sustained for a full 5 minutes before the alert fires. This reduces noise by filtering out transient spikes that occur during normal operation, which are shorter than the new duration window. The original 120s duration allowed short-lived bursts to trigger the alert too frequently.

Answer

Change combiner to AND.

Answer

Change perSeriesAligner to ALIGN_MEAN.

Answer

Decrease thresholdValue to 1.

Question 2

A company uses Error Budgets for their service. The SLO is 99.9% availability over a 30-day window. The service has been down for 30 minutes in the current window. What is the remaining error budget?

Accepted Answer

13.2 minutes. The SLO of 99.9% over a 30-day window allows a total error budget of 43.2 minutes (30 days × 24 hours × 60 minutes × 0.001). The service has already consumed 30 minutes of downtime, so the remaining error budget is 43.2 - 30 = 13.2 minutes. Option C is correct because it reflects this precise calculation.

Answer

43.2 minutes

Answer

60 minutes

Answer

30 minutes

Question 3

Refer to the exhibit. A DevOps engineer needs to view the cost report for a project. Which role should be granted at the organization level to allow viewing billing data for all projects in the organization?

Accepted Answer

roles/billing.viewer. Roles/billing.viewer provides read-only access to billing data for all projects in the organization when granted at the organization level. Option A (roles/billing.admin) is too permissive as it allows modifying billing settings. Option B (roles/billing.creator) is used to create billing accounts and does not grant view access to cost reports. Option D (roles/billing.user) is not a valid predefined role for viewing billing data; it only allows linking projects to billing accounts.

Answer

roles/billing.admin

Answer

roles/billing.creator

Answer

roles/billing.user

Question 4

A DevOps engineer is designing a CI/CD pipeline using Cloud Build. Which TWO configurations are necessary to ensure secure and reliable deployments? (Choose two.)

Accepted Answer

Use manual approval steps for production deployments.. Options A and B are correct. Manual approval steps for production deployments ensure that changes are reviewed and authorized before reaching the production environment, which enhances reliability and reduces the risk of faulty deployments. Storing secrets in Cloud Secret Manager provides secure storage and access control for sensitive data like API keys and passwords, which is essential for security.

Answer

Use Cloud Build triggers with branch filters.

Answer

Push all artifacts to a public Container Registry.

Answer

Enable Cloud Build service account with Editor role.

Question 5

A data processing company runs nightly batch jobs that can tolerate interruptions. They want to minimize compute costs. Which compute option should they use?

Accepted Answer

Preemptible VMs. Preemptible VMs (Option B) are the correct choice because they are significantly cheaper than standard VMs and are suitable for fault-tolerant workloads that can tolerate interruptions. Committed use discounts (A) require a 1-year or 3-year commitment but are still more expensive than preemptible VMs and not necessary for interruptible workloads. Standard VMs with sustained use discounts (C) are automatic but still more expensive. Sole-tenant nodes (D) are dedicated hardware and are the most expensive option, typically used for compliance or licensing requirements.

Answer

VMs with committed use discounts

Answer

Standard VMs with sustained use discounts

Answer

Sole-tenant nodes

Question 6

Your team is implementing SLO monitoring. Which TWO tools should they use to create and monitor SLIs?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (option B) is the correct tool for creating and monitoring Service Level Indicators (SLIs) because it allows you to define custom metrics, set up alerting policies, and create dashboards to track the performance of your services. Cloud Logging (option C) is also correct because SLIs often rely on log-based metrics, such as request latency or error counts, which are extracted from log entries using log-based metrics in Cloud Logging. Together, these two tools provide the data ingestion and monitoring capabilities needed to define and observe SLIs.

Answer

Error Reporting

Answer

Cloud Trace

Answer

Cloud Profiler

Question 7

A company is bootstrapping a new Google Cloud organization. They want to ensure that all projects are created under specific folders and that certain IAM roles are automatically granted to a group for new projects. What is the most efficient approach?

Accepted Answer

Use a Cloud Function triggered by project creation events to apply IAM roles.. It leverages a Cloud Function that listens to the `google.cloud.resourcemanager.project.v1.created` event via Eventarc, enabling automated, event-driven application of IAM roles to new projects without manual intervention or polling. This approach is the most efficient for bootstrapping because it ensures that every newly created project automatically inherits the required IAM bindings, regardless of how the project was created (e.g., via Console, gcloud, or API).

Answer

Use folder-level IAM roles to grant permissions to projects.

Answer

Use Terraform to create projects and assign IAM roles.

Answer

Use organization policies to restrict project creation to specific folders.

Question 8

A microservices application on GKE with Istio service mesh experienced performance degradation after a recent update. Which optimization technique is most effective for improving inter-service communication performance?

Accepted Answer

Enable gRPC for inter-service communication. GRPC uses HTTP/2 as its transport protocol, which enables multiplexed streams over a single TCP connection, reducing latency and improving throughput for inter-service communication. In a GKE environment with Istio, gRPC also leverages Istio's native support for HTTP/2-based traffic, allowing efficient load balancing and connection reuse. This directly addresses performance degradation caused by chatty or high-frequency service calls.

Answer

Increase Istio sidecar resource limits

Answer

Implement request collapsing to merge identical requests

Answer

Use Istio traffic mirroring to offload requests

Question 9

An e-commerce company uses Cloud SQL for MySQL to support their online store. The database has a 500GB dataset. They notice that monthly costs have increased significantly. On reviewing the billing export to BigQuery, they see that the highest cost is from 'Cloud SQL - Storage' and 'Cloud SQL - Backups'. They currently have automated backups enabled with a retention of 7 days. They also take manual backups before every deployment, which are stored for 30 days. They want to reduce backup storage costs without compromising disaster recovery. What should they do?

Accepted Answer

Export backups to Cloud Storage and delete old ones from Cloud SQL.. Exporting backups to Cloud Storage and then deleting from Cloud SQL reduces storage costs since Cloud Storage has cheaper classes. Option A reduces retention but may risk data loss. Option B still retains many backups. Option C (PITR) requires binary logs, which also incur storage costs.

Answer

Reduce automated backup retention to 2 days and keep manual backups as is.

Answer

Reduce manual backup retention to 7 days and increase automated backup retention to 14 days.

Answer

Use Cloud SQL's point-in-time recovery (PITR) feature instead of manual backups.

Question 10

A company has multiple projects under an organization. They want to allocate costs to different departments based on project labels. They have applied labels to all resources, but the cost reports show 'Unlabeled' for many resources. What is the most likely cause?

Accepted Answer

Labels were applied after the billing period.. Labels applied after the billing period do not apply to historical data; they only appear in future billing reports.

Answer

Labels are not propagated to billing export.

Answer

The billing export is not configured.

Answer

The project uses a different billing account.

Question 11

Which THREE factors should you consider when designing a Cloud Run service for optimal performance under unpredictable traffic patterns? (Choose 3)

Accepted Answer

Set a minimum number of instances to reduce cold starts.. Setting a minimum number of instances ensures that Cloud Run always keeps a baseline of warm instances ready to serve requests. This eliminates cold starts for the first requests during traffic spikes, which is critical for unpredictable traffic patterns where latency spikes from cold starts would degrade user experience.

Answer

Use HTTP/2 for faster connection reuse.

Answer

Configure VPC egress through Cloud NAT for lower latency.

Question 12

A company runs a multi-region web application on Google Kubernetes Engine (GKE) using Cloud Load Balancing and Cloud Armor. They use Cloud Monitoring to track user-facing latency. Recently, they noticed that the p99 latency has increased from 200ms to 2s during peak hours, but only for users in the US region. The team suspects a specific backend service in us-central1 is causing the spike. They have set up a dashboard showing latency by region, but the latency metric is aggregated globally, not broken down by region. What should they do to pinpoint the issue?

Accepted Answer

Create a custom log-based metric that extracts latency per region from application logs.. Creating a custom log-based metric that extracts latency per region from application logs allows you to break down the globally aggregated latency metric into per-region slices. This directly addresses the need to isolate the us-central1 backend service's impact on p99 latency during US peak hours, without requiring additional infrastructure or third-party tools.

Answer

Deploy a sidecar proxy in each pod to collect detailed latency data and export it to a third-party tool.

Answer

Use Cloud Monitoring's 'Service Monitoring' to set up a service SLO and create a burn-rate alert.

Answer

Use the GKE Dashboard to view per-pod latency metrics.

Question 13

Your company runs a stateless web application on Google Kubernetes Engine (GKE). You have configured Cloud Monitoring to track request latency and set up an alert when p95 latency exceeds 500ms for 5 minutes. Recently, the alert has been firing frequently during peak hours. You examine the metrics and see that p95 latency spikes to 600ms for short periods. The application's SLO is 99.9% availability with a latency threshold of 1 second. What should you do to reduce alert noise without compromising the SLO?

Accepted Answer

Implement a multi-window burn-rate alerting approach.. The best approach is to implement a multi-window burn-rate alerting strategy, which is less sensitive to short spikes and directly tracks error budget consumption, aligning with the SLO.

Answer

Disable the alert during peak hours.

Answer

Increase the alert threshold to 1 second to match the SLO.

Answer

Change the alert to use a longer evaluation window, e.g., 30 minutes.

Question 14

A Cloud Build pipeline fails with 'Permission denied' when trying to pull a Docker image from Artifact Registry in the same project. The Cloud Build service account has the Artifact Registry Reader role. What additional configuration is likely missing?

Accepted Answer

The Artifact Registry repository has a VPC-SC perimeter blocking access.. The Cloud Build service account has the Artifact Registry Reader role, which grants permission to read (pull) images. However, if the Artifact Registry repository is inside a VPC Service Controls (VPC-SC) perimeter, the service account must also be explicitly added to the perimeter's allowed identities or the request must originate from within the perimeter. Without this, VPC-SC blocks all API calls from outside the perimeter, resulting in a 'Permission denied' error despite valid IAM roles.

Answer

Cloud Build needs to be enabled in the Artifact Registry region.

Answer

The Docker image tag is incorrect.

Answer

The service account needs the Artifact Registry Writer role as well.

Question 15

Your company is bootstrapping a Google Cloud organization for DevOps. The organization consists of three folders: Dev, Staging, and Prod. Each folder contains multiple projects for different microservices. You have been tasked with setting up a centralized CI/CD pipeline using Cloud Build and Cloud Deploy. The pipeline must deploy to multiple environments in sequence: Dev → Staging → Prod. Each environment requires approval from a different approver group. You have set up Cloud Deploy delivery pipelines with targets pointing to each environment. However, during testing, you notice that after a successful deployment to Dev, the pipeline automatically proceeds to Staging without waiting for approval. What is the most likely cause and solution?

Accepted Answer

Cause: The targets in Staging and Prod are missing the `require_approval` attribute set to `true`. Solution: Add `require_approval: true` to the Staging and Prod target definitions.. Cloud Deploy requires explicit `require_approval: true` on each target to enforce manual approval gates. Without this attribute, the pipeline treats the target as automatically approved and proceeds to the next target in the promotion sequence. The behavior described—automatic progression after Dev—indicates that Staging and Prod targets lack this flag, causing the pipeline to skip the approval step.

Answer

Cause: The delivery pipeline is defined with a single target instead of multiple targets. Solution: Create separate delivery pipelines for each environment.

Answer

Cause: The delivery pipeline has a single promotion sequence that includes all targets. Solution: Remove Staging and Prod from the pipeline and create separate pipelines.

Answer

Cause: The Cloud Deploy service account lacks the `clouddeploy.approver` role on Staging and Prod projects. Solution: Grant the role to the service account.

Question 16

Which GCP service is used to store build artifacts such as Docker images?

Accepted Answer

Container Registry. Both Container Registry (option C) and Artifact Registry (option D) are GCP services that can store Docker images. Artifact Registry is the recommended service, but Container Registry is still functional. Option A, Cloud Storage, is for object storage, not specifically for container images. Option B lists both services but is not a specific service name, so it is not the correct answer.

Answer

Cloud Storage

Answer

Both Container Registry and Artifact Registry

Question 17

You are a DevOps engineer for a large e-commerce platform running on Google Kubernetes Engine (GKE). The platform consists of 15 microservices, each with its own code repository. Your team uses Cloud Build for CI and Cloud Deploy for CD. Recently, the deployment to production has been failing intermittently because the new version of the 'payment' service is not compatible with the current version of the 'order' service. This causes a production outage every few weeks. The team wants to implement a strategy to catch such incompatibilities before promoting to production, without slowing down development velocity. Currently, the pipeline builds each service independently, runs unit tests, deploys to a shared staging environment, runs integration tests, and then promotes to production after manual approval. What should you do?

Accepted Answer

Implement canary deployments in staging: deploy the new payment service alongside the current version, route a percentage of test traffic to the new version, and run integration tests before promoting. If tests pass, promote to production.. It introduces canary deployments in the staging environment, allowing the new payment service to be tested with a subset of realistic traffic alongside the current order service. This catches incompatibilities early by running integration tests against the canary, without blocking the pipeline or slowing development velocity. Cloud Deploy supports canary deployment strategies natively, making this a practical and automated solution.

Answer

Define strict version compatibility matrices between services and enforce them in the pipeline by locking versions.

Answer

Add a manual testing phase after staging deployment where QA engineers manually test the integration before production promotion.

Answer

Combine all microservice builds into a single pipeline that builds and tests all services together before deploying to staging.

Question 18

An organization wants to implement a CI/CD pipeline that automatically deploys to a staging environment on every push to the main branch, and deploys to production only after a manual approval. They use Cloud Build and Cloud Deploy. What is the best way to configure this?

Accepted Answer

Configure a Cloud Deploy delivery pipeline with a staging target (automatic promotion) and a production target (require approval).. Cloud Deploy natively supports delivery pipelines with multiple targets, where you can configure automatic promotion to staging and require manual approval for production. This aligns with the requirement for a CI/CD pipeline that deploys to staging on every push to main and to production only after manual approval, using Cloud Build for the build and Cloud Deploy for the deployment orchestration.

Answer

Create a single Cloud Build pipeline that deploys to both staging and production using conditional steps based on branch name.

Answer

Use Cloud Build to deploy to Cloud Run, and configure traffic splitting to gradually shift traffic from staging to production.

Answer

Use Cloud Build triggers with two separate build configs: one for staging (automatic), one for production (manual trigger).

Question 19

A DevOps team is bootstrapping their Google Cloud organization and wants to enable Infrastructure as Code (IaC) using Terraform. They need a service account that Terraform can use to create and manage resources across multiple projects. What is the best practice for creating and managing this service account?

Accepted Answer

Create a service account in a separate 'admin' project and grant it the required roles on each project via IAM.. Creating a service account in a dedicated 'admin' project and granting it necessary roles across projects is a common pattern. Option B is wrong because the default service account has too many permissions and is not recommended. Option C is wrong because service account keys should be avoided in source control. Option D is wrong because using a user account is not secure for automation.

Answer

Generate a service account key and store it in a Cloud Storage bucket accessible to the team.

Answer

Use a user account with two-factor authentication for Terraform automation.

Answer

Use the Compute Engine default service account from the project where Terraform runs.

Question 20

A team notices that a Cloud Run service occasionally has high latency. They suspect a memory leak or excessive CPU usage. Which tool should they use to identify the bottleneck during those periods?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and memory usage data from your Cloud Run service, allowing you to identify which functions or code paths are consuming excessive resources during high-latency periods. Unlike monitoring or logging, Profiler provides a flame graph that pinpoints the exact bottleneck (e.g., a memory leak or CPU spike) at the function level, which is essential for diagnosing performance issues in a serverless environment.

Answer

Cloud Trace

Answer

Cloud Monitoring

Answer

Cloud Logging