PCDOE Practice Test 27 — 15 Questions

Question 1

Your application uses Cloud SQL for MySQL and you notice that read replica lag is increasing. Which action would most likely reduce replica lag?

Accepted Answer

Increase the machine type of the replica.. Increasing the machine type of the replica (Option C) directly addresses read replica lag by providing more CPU and memory resources to the replica instance. This allows the replica to apply binary log (binlog) events from the primary faster, reducing the replication lag. Cloud SQL for MySQL uses asynchronous replication, so a replica with insufficient resources cannot keep up with the write throughput of the primary.

Answer

Configure automatic failover to the replica.

Answer

Decrease the memory of the primary instance.

Answer

Promote the replica to a standalone instance.

Question 2

A company is setting up a new Google Cloud organization. They want to apply a consistent set of IAM roles to all projects within a specific department. What is the most efficient method to achieve this?

Accepted Answer

Create a folder for the department and assign roles at the folder level.. Google Cloud IAM supports hierarchical policy inheritance, where roles assigned at the folder level are automatically inherited by all projects within that folder. This eliminates the need for per-project assignments and ensures consistent permissions across the department's projects without manual overhead or scripting.

Answer

Use a script to apply roles to all projects periodically.

Answer

Assign roles directly to each project using the Google Cloud console.

Answer

Use a custom role and assign it to the organization node.

Question 3

A team is monitoring a production service on Google Kubernetes Engine (GKE) and notices that a deployment is occasionally returning HTTP 503 errors. The team has set up a ServiceMonitor in Prometheus to scrape metrics from the pods. What is the most likely cause of the intermittent 503 errors?

Accepted Answer

The readiness probes are failing, causing the pods to be removed from the service endpoints.. Intermittent HTTP 503 errors in a GKE deployment typically indicate that the service's endpoints are temporarily unavailable. When a readiness probe fails, Kubernetes removes the pod from the Service's endpoints, causing traffic to be routed to remaining healthy pods. If multiple pods fail their readiness probes simultaneously or in quick succession, the Service may have no available endpoints, resulting in 503 errors for incoming requests.

Answer

The pods are crashing and restarting frequently.

Answer

The Prometheus scrape interval is too long, causing missed metrics.

Answer

The container resource limits are set too low, causing out-of-memory errors.

Question 4

Which TWO are benefits of using a shared VPC in a Google Cloud organization? (Choose 2)

Accepted Answer

Centralized management of network resources.. A shared VPC allows network resources (subnets, routes, firewalls) to be defined in a host project and consumed by multiple service projects, enabling centralized management. This reduces administrative overhead by having a single network team control the VPC configuration rather than each project managing its own.

Answer

Eliminates the need for project administrators to have any IAM roles.

Answer

Ensures compliance with organizational policies.

Answer

Automatically enables required APIs in all service projects.

Question 5

A company has a stateful application deployed on a GKE cluster with stateful sets using persistent volumes. The application is experiencing higher than expected latency for write operations. The team uses SSDs for persistent disks. Cloud Monitoring shows high disk queue depth on the nodes where the stateful pods are scheduled. Which of the following is the most effective optimization?

Accepted Answer

Enable disk caching on the persistent disks.. Enabling read/write caching on persistent disks reduces write latency by buffering writes to the local instance's SSD before acknowledging them to the application. This directly addresses the high disk queue depth observed in Cloud Monitoring, as caching absorbs bursty write I/O and lowers queue depth. For stateful workloads on GKE with SSDs, disk caching is a standard optimization to improve write performance without changing the underlying disk type.

Answer

Configure a separate node pool with local SSDs for the stateful workloads.

Answer

Increase the number of replicas of the stateful set.

Answer

Use regional persistent disks for higher throughput.

Question 6

A team is optimizing the performance of their application running on Cloud Run. They want to reduce cold starts. Which two actions would help? (Select TWO)

Accepted Answer

Enable min instances. Enabling min instances (option A) keeps a baseline number of container instances always warm and ready to serve requests, eliminating the cold start latency for those instances. This directly reduces the time required to spin up a new container when traffic spikes, as the pre-warmed instances can handle requests immediately.

Answer

Increase the maximum number of container instances

Answer

Increase the CPU limit

Answer

Enable HTTP/2

Question 7

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Hosting shared CI/CD tools and artifacts in a dedicated project follows the principle of resource isolation and centralized management. This approach simplifies access control, cost tracking, and lifecycle management for DevOps pipelines, as the project acts as a single source of truth for build outputs and deployment tools.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 8

A company runs a batch processing pipeline on Dataflow that reads from Pub/Sub and writes to BigQuery. The pipeline is falling behind due to high volume, and messages are backing up in Pub/Sub. Autoscaling is enabled and workers are running but utilization is only 30%. The streaming engine is off. What should the engineer do to increase throughput?

Accepted Answer

Enable Streaming Engine for Dataflow.. B is correct because enabling Streaming Engine offloads the heavy lifting of shuffle and state management from worker VMs to the Dataflow service backend, reducing the per-worker overhead. With only 30% utilization, the bottleneck is not compute capacity but the per-worker throughput limit caused by the streaming pipeline's shuffle and state operations. Streaming Engine allows the existing workers to process more data per second by removing these bottlenecks, directly addressing the Pub/Sub backlog without adding more resources.

Answer

Use a larger machine type for workers.

Answer

Increase the number of worker machines.

Answer

Increase the worker disk size.

Question 9

Which THREE of the following are best practices for securing a CI/CD pipeline using Cloud Build? (Choose 3.)

Accepted Answer

Configure Cloud Build triggers to run only from protected branches (e.g., main, release).. Restricting Cloud Build triggers to protected branches (e.g., main, release) prevents unauthorized or untested code changes from initiating builds, which is a fundamental security control for CI/CD pipelines. This ensures that only code that has passed review and is merged into stable branches can trigger automated builds, reducing the risk of malicious or erroneous code being deployed.

Answer

Grant the Cloud Build service account the Storage Admin role for the project to allow pushing images.

Answer

Disable build cache to ensure fresh builds and avoid using potentially compromised cached layers.

Question 10

A DevOps engineer is reviewing GCP costs and notices high network egress charges. Which two actions can help reduce network egress costs? (Choose two.)

Accepted Answer

Use Cloud CDN to cache content closer to users. Correct answers are C and D. Using Cloud CDN reduces egress by caching content at edge locations, minimizing data transferred from origin. Keeping resources in the same region avoids inter-region egress charges. Option A (preemptible VMs) reduces compute costs, not network egress. Option B (single zone) does not reduce egress; resources in the same zone still incur egress if they communicate across regions. Option E (external load balancers with global access) can increase egress by routing traffic globally.

Answer

Use preemptible VMs

Answer

Migrate all workloads to a single zone

Answer

Use external load balancers with global access

Question 11

A DevOps team is troubleshooting a web application that shows high latency during peak hours. The application runs on Google Kubernetes Engine (GKE). They want to identify which specific API calls are causing the delay. Which Google Cloud tool should they use?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool because it is a distributed tracing system that captures latency data from applications, allowing you to trace individual API calls and identify which specific endpoints are causing delays. Unlike Cloud Monitoring, which provides aggregate metrics, Cloud Trace provides per-request latency breakdowns, making it ideal for pinpointing slow API calls in a GKE environment.

Answer

Cloud Monitoring

Answer

Cloud Profiler

Answer

Cloud Logging

Question 12

A DevOps team wants to automate the deployment of a microservice application to Google Kubernetes Engine (GKE) using Cloud Build. They have a Cloud Build configuration file that builds a container image and deploys it to GKE. However, the deployment step fails with an authorization error. What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Kubernetes Engine Developer IAM role.. Cloud Build uses a default service account (the Cloud Build service account) to execute build steps, including deploying to GKE. The Kubernetes Engine Developer IAM role (roles/container.developer) grants the necessary permissions to deploy and manage workloads on GKE clusters. Without this role, the Cloud Build service account cannot authenticate to the GKE cluster's Kubernetes API, resulting in an authorization error during the deployment step.

Answer

The user triggering the build does not have IAM permissions to deploy to GKE.

Answer

Cloud Build does not have permission to access the source code repository.

Answer

The Docker image build step failed due to missing dependencies.

Question 13

Your SLO for availability is 99.9% over a 30-day window. You want an alert that fires when the error budget burn rate is high, leaving less than 5% of the error budget remaining in the next 6 hours. What type of alerting policy should you configure?

Accepted Answer

A burn rate alert based on the forecasted consumption.. A burn rate alert based on forecasted consumption directly monitors the rate at which the error budget is being consumed and triggers when the projected remaining budget falls below 5% within the next 6 hours. This aligns with Google SRE best practices for proactive error budget management, using a multi-window, multi-burn-rate approach to detect rapid consumption before the budget is exhausted.

Answer

A custom log-based metric.

Answer

A static threshold alert based on the error rate.

Answer

An exponential decay alert.

Question 14

A multinational corporation is bootstrapping their Google Cloud organization. They have multiple business units in different countries, each with its own compliance requirements (e.g., data residency, encryption keys). The organization structure must support: (1) each business unit as a separate folder with its own admin; (2) projects within each folder must have a label 'bu-<businessunit>'; (3) all resources must be created in regions allowed by the business unit; (4) audit logging must be centralized. They have 200 existing projects and 10,000 VMs. The team wants to use Google Cloud's native tools to enforce these policies without third-party software. What is the most effective first step?

Accepted Answer

Create folders for each business unit, move all projects into corresponding folders using a script, and apply organization policies for allowed regions and labeling.. It establishes a folder hierarchy that mirrors the business units, enabling hierarchical inheritance of organization policies. By moving existing projects into the correct folders and applying organization policies for allowed regions and labeling at the folder level, each business unit's compliance requirements are enforced natively without third-party tools. This approach also supports centralized audit logging by enabling audit logs at the organization level, which aggregate logs from all folders and projects.

Answer

Apply organization policies at the root level to restrict regions and labeling, and ignore folders.

Answer

Use a single folder for all projects and rely on IAM roles to enforce compliance per business unit.

Answer

Create a separate Cloud Function for each business unit to monitor resources and enforce compliance.

Question 15

An organization uses Cloud Armor to protect their web application. After enabling the service, they notice increased latency on some requests. Which Cloud Armor feature is most likely causing this?

Accepted Answer

Geo-based access control. Geo-based access control (D) is the most likely cause of increased latency because it requires Cloud Armor to perform a GeoIP lookup on every request to determine the geographic origin. This lookup adds processing overhead, especially if the organization has a large or complex set of geo-based rules, which can introduce measurable delay.

Answer

Rate limiting

Answer

IP blacklist/whitelist

Answer

Pre-configured WAF rules