PCDOE Practice Test 26 — 15 Questions

Question 1

You are deploying a new version of a microservice on Google Kubernetes Engine (GKE). You want to monitor the error rate of the service using Cloud Monitoring and automatically roll back if the error rate exceeds 5% for 5 minutes. You have already configured a Cloud Monitoring alerting policy that fires when the error rate condition is met. What should you do to automate the rollback?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud Pub/Sub topic and configure the alerting policy to send notifications to that topic. Then, deploy a Cloud Run service that subscribes to the topic, parses the alert, and triggers a rollback using the Kubernetes API.. The most efficient and automated way to trigger a rollback based on a Cloud Monitoring alert is to route the alert to a Pub/Sub topic and have a subscriber (e.g., Cloud Run service) perform the rollback. This leverages the native integration between Cloud Monitoring alerting policies and Pub/Sub notification channels, enabling event-driven automation without manual steps.

Answer

Use a Kubernetes Horizontal Pod Autoscaler (HPA) that scales down the deployment when the error rate metric exceeds 5%.

Answer

Configure the alerting policy to send an email to the on-call engineer. The engineer will manually roll back the deployment when they receive the alert.

Answer

Create a Cloud Monitoring dashboard that displays the error rate and set up a scheduled Cloud Scheduler job to check the dashboard every 5 minutes and roll back if the error rate is high.

Question 2

Your team is implementing a new monitoring strategy for a critical service on Google Cloud. You want to create an alert that notifies the on-call engineer only when the service's latency is consistently above the SLO threshold for at least 10 minutes, to avoid false positives. Which Cloud Monitoring alerting policy configuration should you use?

Accepted Answer

Create an alerting policy with a condition that triggers when the latency metric exceeds the threshold for a duration of 10 minutes.. Cloud Monitoring alerting policies allow you to specify a duration for which the condition must be met before the alert fires. This is known as the 'for' duration. By setting it to 10 minutes, you ensure that only sustained latency above the threshold triggers an alert, filtering out brief spikes. This directly addresses the need to avoid false positives from transient latency increases.

Answer

Create an alerting policy with a condition that triggers immediately when latency exceeds the threshold, and then use a notification channel with a 10-minute delay.

Answer

Use an uptime check with a 10-minute timeout to monitor the service latency, and configure the check to alert if it times out.

Answer

Create a log-based metric that counts the number of requests exceeding the latency threshold, and set an alert if the count is greater than zero over a 10-minute window.

Question 3

A DevOps platform team is bootstrapping a new Google Cloud organization. They want a single, repeatable definition of folders, projects, IAM bindings, and APIs that they can store in Git and re-apply whenever the org baseline changes. Which approach best meets this requirement?

Accepted Answer

Write Terraform configurations using the google_folder, google_project, google_project_iam_member, and google_project_service resources, and commit them to Git.. The requirement is a declarative, version-controlled definition that can be re-applied to reconcile drift. Terraform resources for folders, projects, IAM members, and service enablement give exactly that: state-backed plan/apply semantics, idempotency, and a Git-stored source of truth. Imperative scripts and inventory exports document or mutate resources but cannot safely reconcile the baseline over time.

Answer

Use the gcloud CLI interactively to create folders and projects, then export the resulting state with gcloud asset export for documentation.

Answer

Define the baseline in a Deployment Manager template and deploy it with gcloud deployment-manager deployments create.

Answer

Create a Cloud Build pipeline that runs gcloud commands from a shell script stored in Cloud Source Repositories.

Question 4

You are an SRE for a large-scale service on Google Cloud. You are implementing a postmortem process after a major incident. According to Google SRE best practices, which two of the following are essential components of a blameless postmortem? (Choose two.)

Accepted Answer

Analyzing the timeline of events and the contributing factors that led to the incident.. Blameless postmortems focus on learning from incidents without punishing individuals. Essential components include a thorough timeline and analysis of contributing factors, and the creation of action items to prevent recurrence. Blame, secrecy, and disciplinary actions undermine the process by discouraging honesty and limiting organizational learning.

Answer

Keeping the postmortem document private to avoid reputational damage.

Answer

Assigning blame to the team that deployed the faulty change to prevent recurrence.

Answer

Identifying the individual responsible for the outage and documenting disciplinary actions.

Question 5

Your team manages a high-traffic API on Google Kubernetes Engine (GKE). You want to reduce latency for users by caching responses at the edge. The API responses are highly dynamic and personalized per user. Which approach should you take?

Accepted Answer

Deploy a Memorystore for Redis instance and cache API responses in the application layer.. For dynamic, personalized API responses, edge caching via Cloud CDN is ineffective because the content varies per user. Instead, caching at the application layer with Memorystore for Redis allows storing per-user data with low latency, reducing backend load and improving response times. Session affinity and CDN with authorization headers do not provide caching benefits for personalized content.

Answer

Use Cloud CDN with cache keys based on the user's session cookie.

Answer

Enable Cloud CDN with a short TTL and vary on the Authorization header.

Answer

Use GKE Ingress with a backend service that has session affinity enabled.

Question 6

An SRE team is setting up an alerting policy in Cloud Monitoring for a critical service. They want to be notified when the service's error rate exceeds 1% for at least 5 minutes. They also want to avoid alerting on transient spikes. Which alerting policy configuration should they use?

Accepted Answer

Create an alerting policy with a condition that triggers when the error rate metric exceeds 1% for a duration of 5 minutes, using a rolling window.. An effective alerting policy should balance sensitivity and specificity. The scenario requires alerting when the error rate exceeds 1% for at least 5 minutes, which implies a duration condition. Configuring the policy to trigger only when the condition persists for 5 minutes using a rolling window filters out transient spikes and ensures the alert is actionable, reducing noise while still detecting sustained issues promptly.

Answer

Create an alerting policy that triggers immediately when the error rate metric exceeds 1%, without any duration.

Answer

Create an alerting policy that triggers when the error rate metric exceeds 1% for 1 minute, using a 1-minute alignment period.

Answer

Create an alerting policy that triggers when the error rate metric exceeds 1% for 10 minutes, using a 10-minute alignment period.

Question 7

An SRE team is defining a Service Level Objective (SLO) for a new public API. The product owner wants to ensure the SLO reflects user happiness while allowing for planned maintenance. Which approach should the SRE team take?

Accepted Answer

Define the SLO as the percentage of successful HTTP responses (status codes < 500) over a 28-day rolling window, and exclude maintenance windows from the calculation.. The correct approach is to define an SLO based on user-perceived success, such as successful HTTP responses, over a rolling window. Excluding maintenance windows prevents planned downtime from eroding the error budget, which is a common SRE practice. The other options either use unrealistic targets, measure the wrong signal, or focus on internal operational metrics rather than user experience.

Answer

Define the SLO as the number of incidents per month, with a target of zero incidents, and measure it using the incident tracking system.

Answer

Define the SLO as the average latency of all requests over a 7-day window, and exclude requests that return errors from the latency calculation.

Answer

Define the SLO as 100% uptime for all requests, measured over a calendar month, and include all maintenance windows in the calculation.

Question 8

A company runs a GKE cluster with a mix of latency-sensitive and batch workloads. They want to ensure that latency-sensitive pods are prioritized during resource contention. Which approach should they take?

Accepted Answer

Assign higher priority to latency-sensitive pods using PriorityClasses and enable preemption.. PriorityClasses with preemption allow you to assign higher priority to latency-sensitive pods. When resources are insufficient, the scheduler can evict lower-priority pods to accommodate higher-priority ones. This ensures that critical, latency-sensitive workloads are prioritized during contention, maintaining their performance.

Answer

Use node affinity to schedule latency-sensitive pods on dedicated nodes.

Answer

Configure taints and tolerations to reserve nodes for latency-sensitive pods.

Answer

Set higher CPU and memory requests for latency-sensitive pods to ensure they get scheduled.

Question 9

During bootstrapping, a DevOps lead must ensure that no member of the engineering group can disable or delete the organization's central audit log sinks or modify the log bucket retention. Engineers hold broad roles such as roles/editor on several projects. Which control should be implemented to protect the logging infrastructure?

Accepted Answer

Enable a log bucket with a locked retention policy and use an organization policy or IAM deny policy to prevent modification of the logging resources by the engineering group.. Protecting central logging requires both immutability and explicit denial. A locked retention policy prevents deletion or shortening of retention, while an IAM deny policy overrides allow roles and blocks specific principals from updating sinks or buckets, closing the gap left by broad editor grants.

Answer

Move the central logging project into a separate folder and grant engineers roles/viewer on that folder to limit their access.

Answer

Grant engineers roles/logging.admin only at the project level and remove it at the organization level, so they cannot change organization sinks.

Answer

Create a custom role that excludes logging permissions and assign it to all engineers, replacing their existing roles.

Question 10

Your team runs a Java microservice on GKE. The service's p99 latency is high, and you suspect that long GC pauses are the cause. You want to identify the specific heap allocation patterns causing the pauses without restarting the running pods. Which approach should you take?

Accepted Answer

Enable Cloud Profiler with the Heap profile type for the service, then inspect the flame graph to identify the allocation hot spots.. Cloud Profiler's heap profile type is designed to collect allocation data from live Java services with minimal overhead, showing which functions allocate the most memory. This directly identifies the allocation hot spots that drive GC pauses, enabling targeted code fixes without restarting pods. Other tools either pause the JVM, lack allocation detail, or only show symptoms.

Answer

Configure a liveness probe with a longer timeout and increase the pod's memory limit to reduce GC frequency.

Answer

Run a jmap -histo:live command against each pod to capture a heap histogram, then compare the object counts across pods.

Answer

Enable Cloud Trace on the service and analyze the span durations for the slowest requests to pinpoint the GC pauses.

Question 11

A startup runs a stateless web API on a managed instance group of Compute Engine VMs behind an external HTTP(S) load balancer. Traffic is predictable during business hours but drops to near zero at night. The team wants to reduce VM cost without changing the API code or breaking the load balancer health checks. What should they do?

Accepted Answer

Enable the managed instance group autoscaler with a CPU utilization target and set the minimum number of instances to a small non-zero value.. Autoscaling with a CPU target shrinks the managed instance group when night traffic falls and expands it when business hours resume. Keeping a minimum of one or two instances ensures the load balancer always has a healthy backend, so the API remains reachable. This matches capacity to demand without code changes and avoids the availability risk of preemptible VMs or a zero-instance schedule.

Answer

Change the load balancer to a network load balancer and enable connection draining on the backend service.

Answer

Create a schedule that scales the managed instance group to zero VMs at night and back to the normal size in the morning.

Answer

Replace the managed instance group with preemptible VMs and keep the same fixed instance count.

Question 12

You are responsible for a Cloud Run service that processes payments. You need to create an alert that fires when the service returns more than 5% HTTP 5xx errors over a 15-minute window. Which Cloud Monitoring metric and alerting condition should you use?

Accepted Answer

run.googleapis.com/request_count with a filter on response_code_class=5xx, and alert on the ratio of 5xx to total requests.. To alert on a percentage of 5xx errors, you need to use the request_count metric filtered by response code class and compute a ratio against total requests. Cloud Monitoring allows ratio-based alerting conditions, which can trigger when the ratio exceeds 5% over a 15-minute window.

Answer

run.googleapis.com/request_count with a filter on response_code_class=5xx, and alert on the count exceeding 5.

Answer

run.googleapis.com/request_count with a filter on response_code=500, and alert on the sum of requests.

Answer

run.googleapis.com/request_latencies with a filter on response_code_class=5xx, and alert on the 95th percentile latency.

Question 13

A DevOps team is bootstrapping a Google Cloud organization and must give their CI/CD system the ability to deploy resources into many projects without storing any downloadable credentials. Which two mechanisms support this requirement? (Choose two.)

Accepted Answer

Use service account impersonation, where the pipeline identity calls the IAM Credentials API to obtain short-lived tokens for a target deployment service account.. Keyless deployment requires credentials that are minted on demand and never stored. Workload Identity Federation exchanges an external OIDC token for short-lived Google Cloud credentials, and service account impersonation via the IAM Credentials API issues short-lived tokens for a target service account. Both avoid downloadable keys, and both scale across projects when the target identity holds roles at the folder or organization level.

Answer

Create a service account key in JSON format and store it as a secret in Secret Manager, then mount it into the pipeline.

Answer

Attach a user-managed service account to the Cloud Build worker pool and let builds use the metadata server for credentials.

Answer

Enable Domain-Wide Delegation on the deployment service account so it can act on behalf of any user in the organization.

Question 14

Your team runs a GKE Standard cluster hosting a checkout service. You need to build an SLO for the service's availability that counts only requests returning HTTP 5xx as bad, ignoring 4xx, and you want Cloud Monitoring to compute the ratio automatically from the service's existing telemetry. Which approach should you take?

Accepted Answer

Define an SLO in Cloud Monitoring with a request-based SLI filtered to response codes, selecting the 5xx class as the bad-service filter.. A request-based SLI in Cloud Monitoring is purpose-built for this: it derives good and bad request counts from service telemetry and lets you filter which response classes count as failures, so 4xx traffic is excluded from the bad count. Because the SLI is part of an SLO resource, Cloud Monitoring also generates error-budget and burn-rate metrics that can drive alerting policies.

Answer

Deploy the OpenTelemetry Collector with a metrics transform processor that rewrites 4xx status codes to 200 before export.

Answer

Create a logs-based metric counting 5xx entries, then build a custom dashboard ratio chart and an alerting policy on it.

Answer

Create an uptime check against the checkout endpoint and set the SLO target from the uptime check success ratio.

Question 15

A company runs a batch processing job on a Compute Engine managed instance group (MIG) that processes a nightly queue. The job typically takes 3 hours to complete, and the company wants to minimize cost while ensuring the job finishes reliably. The MIG is configured with a single instance type and no autoscaling. What should the company do to reduce cost for this workload?

Accepted Answer

Schedule the MIG to scale down to zero instances when the job is not running and scale up before the job starts using an instance schedule.. The workload runs predictably for only 3 hours each night. The most effective cost optimization is to eliminate charges during the idle 21 hours. Using an instance schedule to stop instances when not in use and start them before the job begins directly addresses this. Preemptible VMs introduce reliability risk, CUDs are for steady usage, and autoscaling does not eliminate idle costs.

Answer

Enable autoscaling on the MIG based on CPU utilization and set the minimum size to 1 and maximum size to 10.

Answer

Use a committed use discount (CUD) for the instance type used by the MIG for a 1-year term.

Answer

Configure the MIG to use preemptible VMs and set the instance template to automatically restart on preemption.