PCDOE Practice Test 26 — 15 Questions

Question 1

A company is using Cloud CDN to deliver static content globally. Some users in Asia report slow load times. Which configuration change would most likely improve performance for these users?

Accepted Answer

Use a global external HTTP(S) load balancer with Cloud CDN. Cloud CDN relies on a global external HTTP(S) load balancer to route user requests to the nearest cache node. Without this load balancer, Cloud CDN cannot leverage Google's global network and edge caches, so users in Asia would not be served from a nearby point of presence. Option C correctly identifies that using a global external HTTP(S) load balancer with Cloud CDN enables geographic load balancing and edge caching, directly improving latency for distant users.

Answer

Add an additional CDN origin

Answer

Enable Cloud Armor

Answer

Increase the cache TTL

Question 2

A DevOps engineer is setting up alerting policies for a critical API service. They want to receive an alert if the error rate exceeds 5% for at least 5 minutes, but only during business hours (9 AM to 5 PM). Which approach should they use?

Accepted Answer

Create an alerting policy with a condition that triggers when the error rate is above 5% for 5 minutes, and configure the notification channel to only send notifications during business hours using a webhook receiver that checks time.. It uses a single alerting policy with a condition that triggers when the error rate exceeds 5% for 5 minutes, and then controls notification delivery via a webhook receiver that checks the current time. This approach ensures the alert is evaluated continuously (so the 5-minute window is respected) but only notifications are suppressed outside business hours, which is the most reliable way to meet the requirement without missing alert evaluations or relying on external scheduling.

Answer

Create a log-based metric for errors and use a condition with a threshold, then set the alert policy to only run during business hours using the 'condition' schedule.

Answer

Create two separate alert policies, one for business hours and one for off-hours, each with different thresholds.

Answer

Use Cloud Scheduler to enable and disable the alerting policy at the start and end of business hours.

Question 3

A DevOps team wants to optimize the performance of a Cloud Run service that experiences sporadic traffic. Which TWO strategies should they implement?

Accepted Answer

Reduce container image size and use startup probes. Reducing the container image size decreases the time required to pull and start the container, directly mitigating cold start latency. Startup probes allow Cloud Run to defer sending traffic until the container is ready, preventing premature request failures and improving perceived performance. Together, these optimizations address the root causes of cold starts in a serverless environment.

Answer

Set min-instances to 5 to avoid cold starts

Answer

Use Cloud Run for Anthos on GKE for better performance

Answer

Use Cloud Scheduler to trigger the service periodically

Question 4

Your incident response team uses a follow-the-sun model. An incident occurs during the Asia-Pacific shift, but the escalation path requires sign-off from the US-based team lead. This causes delays. What change should you recommend?

Accepted Answer

Implement a global incident commander role with delegated authority.. A global incident commander with delegated authority can make escalation decisions without waiting for a specific time-zone-based team lead. This role operates across shifts, ensuring that critical incident response actions are not delayed by geographic handoffs. In a follow-the-sun model, this role provides continuous, authoritative decision-making, aligning with ITIL incident management best practices for global teams.

Answer

Use a chatbot for automated responses.

Answer

Increase the number of US team members.

Answer

Schedule the US team lead to work overnight.

Question 5

An organization is setting up a new Google Cloud organization and wants to enforce consistent resource naming conventions and policies across all projects. Which service should they use?

Accepted Answer

Organization Policies. Organization Policies allow you to centrally constrain specific behaviors and enforce consistent naming conventions across all projects in a Google Cloud organization using constraints like `constraints/gcp.resourceLocations` or custom constraints via the `OrganizationPolicy` API. This service is the correct choice because it directly applies hierarchical policy enforcement at the organization, folder, or project level, ensuring resource naming and other governance rules are uniformly applied without requiring per-project configuration.

Answer

VPC Service Controls

Answer

Cloud Run

Answer

Cloud Armor

Question 6

An organization uses Cloud Deploy with Skaffold to manage progressive delivery on GKE. After a rollout, the new revision shows a higher error rate in Stackdriver, but the Cloud Deploy pipeline did not automatically roll back. What is the most likely cause?

Accepted Answer

The Cloud Deploy pipeline does not have a stackdriverMetrics verification job defined to check error rates.. Cloud Deploy relies on verification jobs to evaluate metrics like error rate from Stackdriver. Without a stackdriverMetrics verification job configured in the delivery pipeline, Cloud Deploy has no mechanism to assess the error rate and trigger an automatic rollback. Option A is incorrect because manual approval steps only gate progression between phases; they do not affect automatic rollback decisions within a phase. Option B is incorrect because the '--disable-rollback' flag would prevent rollbacks entirely, but the question describes a scenario where automatic rollback is expected but did not happen; the most likely cause is the absence of the required verification job. Option D is incorrect because Cloud Deploy can evaluate metrics during the rollout, not only after full traffic shift.

Answer

The rollout strategy includes a manual approval step before advancing to the next phase.

Answer

The release was created with a '--disable-rollback' flag.

Answer

The rollout has not yet reached 100% traffic, so Cloud Deploy waits for full completion before evaluating health.

Question 7

A small startup uses Cloud Functions for their backend and wants to monitor function execution times and error rates. They have enabled Cloud Monitoring and are viewing metrics in the Cloud Console. They notice that the execution time metric for a particular function shows an average of 200ms, but occasionally there are spikes to 5 seconds, which correspond to user-reported slow responses. They want to be alerted when the function exceeds 1 second for any invocation. What is the simplest way to achieve this?

Accepted Answer

Use the built-in Cloud Functions latency metric and create a metric threshold alert for the max value over 1 minute.. Cloud Functions automatically emits a built-in `execution_time` metric (measured in milliseconds) to Cloud Monitoring. By creating a metric threshold alert on the `max` value of this metric over a 1-minute window, you can trigger an alert whenever any single invocation exceeds 1 second, directly matching the requirement to be alerted per invocation spike.

Answer

Create a log-based metric for function duration and set a threshold alert.

Answer

Configure a Cloud Monitoring uptime check for the function URL.

Answer

Use Cloud Error Reporting to capture slow responses.

Question 8

A DevOps team is setting up a Google Cloud organization. They want to centralize logging and monitoring across all projects. What is the recommended approach?

Accepted Answer

Create a dedicated project for logging and monitoring, and configure all other projects to send logs and metrics to that project.. The recommended approach for centralizing logging and monitoring in a Google Cloud organization is to create a dedicated project that acts as a log sink and metric aggregator. By configuring aggregated sinks at the organization or folder level, all projects automatically forward logs to the dedicated project's Cloud Logging bucket, and metrics can be collected via the Monitoring API. This ensures a single pane of glass for operations without manual per-project setup.

Answer

Enable logging and monitoring in each project individually and use the Cloud Console to view them.

Answer

Enable Cloud Audit Logs in the organization and view them from the Organization level.

Answer

Use Stackdriver (now Operations) to aggregate logs from all projects automatically.

Question 9

A company uses Cloud Build with a private pool in a shared VPC to access on-premises resources. Several builds fail intermittently with 'failed to connect to backend' errors when trying to pull from a private npm registry hosted on-premises. The error occurs only during peak hours. What is the most likely cause?

Accepted Answer

The private pool has insufficient worker count or is too small, causing connectivity timeouts.. The intermittent 'failed to connect to backend' errors during peak hours point to resource exhaustion in the private pool. Private pools have a fixed number of workers; when all workers are busy, new builds must wait, and if the queue or connection timeout is exceeded, the build fails. This is a classic capacity issue, not a DNS, certificate, or firewall problem.

Answer

The DNS resolution for the private npm registry is failing due to caching issues.

Answer

The private pool's service account does not have the correct SSL certificates.

Answer

The Cloud NAT IP addresses have been blocked by the on-premises firewall.

Question 10

A company notices increased latency for their web application running on Compute Engine. They suspect a database bottleneck. Which Google Cloud service should they use to identify slow queries?

Accepted Answer

Cloud SQL Query Insights. Cloud SQL Query Insights is the correct choice because it is a Google Cloud managed service specifically designed to identify and analyze database performance issues, including slow queries, in Cloud SQL instances. It provides detailed query performance metrics, execution plans, and recommendations to optimize database queries, directly addressing the bottleneck in a Compute Engine web application.

Answer

Cloud Logging

Answer

Cloud Debugger

Answer

Cloud Trace

Question 11

An e-commerce platform uses Cloud Load Balancing with backend services running on Compute Engine managed instance groups. During Black Friday sales, the application experiences high latency and some 503 errors. The team uses autoscaling based on average CPU utilization, but scaling is too slow—Cloud Monitoring shows CPU rises to 90% before new instances are added. The team needs to reduce latency and eliminate 503 errors. What should they do?

Accepted Answer

Change the autoscaling metric to 'requests per second' and set a lower target value. Switching the autoscaling metric from average CPU utilization to 'requests per second' (RPS) with a lower target value allows the autoscaler to react more quickly to traffic spikes. CPU utilization is a lagging indicator that rises only after requests have already been queued and processed, whereas RPS directly reflects incoming load. By setting a lower target RPS, the autoscaler can add instances before the backend becomes saturated, reducing latency and eliminating 503 errors.

Answer

Use HTTP load balancing with a larger backend timeout

Answer

Enable Cloud CDN for all dynamic content

Answer

Increase the cooldown period for the autoscaling policy

Question 12

A DevOps team is setting up a new Google Cloud organization. They want to enforce that all projects have a specific set of labels, and that Cloud Logging is enabled. They have written a custom Organization Policy constraint to enforce the labels. However, they are unsure how to enforce Cloud Logging. Which of the following approaches should they use?

Accepted Answer

Create a custom Organization Policy constraint that checks if Cloud Logging is enabled.. There is no built-in Organization Policy constraint that enforces Cloud Logging for all projects. The constraint `constraints/gcp.resourceAuditLoggingExemption` only prevents exemptions from audit logging, not all Cloud Logging. Therefore, the team must create a custom Organization Policy constraint to check whether Cloud Logging is enabled, as this is the only way to meet their requirement using Organization Policies.

Answer

Disable the ability to turn off Cloud Logging by using the Organization Policy 'compute.disableCloudLogging'.

Answer

Use the built-in Organization Policy constraint 'constraints/gcp.resourceAuditLoggingExemption' to enforce audit logging.

Answer

Set a project-level default for Cloud Logging using Organization Policies.

Question 13

A company is implementing CI/CD for a microservices application on Google Kubernetes Engine (GKE). The team wants to ensure that each service can be built and deployed independently without affecting other services. They also need to enforce that only successfully tested builds are deployed to production. Which CI/CD approach should they use?

Accepted Answer

Create separate Cloud Build triggers per microservice, each building a container image, and use Cloud Deploy to manage canary deployments to GKE with automated promotion after tests pass.. It uses separate Cloud Build triggers per microservice to enable independent builds, and Cloud Deploy with canary deployments and automated promotion after tests pass ensures that only successfully tested builds reach production. This approach aligns with the requirements of independent service deployment and gated promotion to production on GKE.

Answer

Use Cloud Build to build all services and deploy to Cloud Run, then use traffic splitting to promote new versions.

Answer

Create a single Cloud Build trigger that builds all services and deploys to a staging cluster, then manually promote to production.

Answer

Use Spinnaker with a single pipeline that builds all services, and configure manual judgment gates for production promotion.

Question 14

A company is bootstrapping their organization using Terraform and wants to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which of the following is the best practice for securing the state file?

Accepted Answer

Use a bucket with a CMEK key and grant roles/storage.objectAdmin to the Terraform service account.. Using a CMEK (Customer-Managed Encryption Key) ensures the state file is encrypted at rest with a key controlled by the organization, and granting roles/storage.objectAdmin to the Terraform service account provides the necessary read, write, and delete permissions on objects. This combination meets the security requirements for a bootstrapping scenario where the state file contains sensitive infrastructure configuration and must be protected from unauthorized access while allowing Terraform to manage it.

Answer

Use a bucket with fine-grained access and grant roles/storage.objectCreator to the Terraform service account.

Answer

Use a bucket with object versioning and enable VPC Service Controls.

Answer

Use a bucket with uniform access and grant roles/storage.objectViewer to the Terraform service account.

Question 15

Your team is using Cloud Monitoring to track the health of a distributed microservices application. You notice that the error rate for the checkout service has increased significantly, but no alerts are firing. The SLO for checkout is 99.9% availability over a 28-day rolling window. You inspect the alerting policy and find it uses a time series aggregation with a 1-minute alignment period and a condition that triggers when the ratio of errors to total requests exceeds 0.001 for 5 consecutive minutes. What is the most likely reason the alert is not firing?

Accepted Answer

The alert condition requires 5 consecutive minutes of breach, but the error rate spikes are intermittent and not sustained.. The alert condition requires the error ratio to exceed 0.001 for 5 consecutive 1-minute alignment periods. If the error rate spikes are intermittent—lasting only a minute or two before returning to normal—the condition of 5 consecutive minutes of breach is never met, so the alert remains silent. This is a classic case where the alerting policy's duration setting is too long relative to the bursty nature of the errors.

Answer

The error budget has been exhausted, so the alert is suppressed.

Answer

The SLO window is too long, and the alert condition uses a different measurement period.

Answer

The ratio threshold is too high because the total request count is low.