PCDOE Practice Test 27 — 15 Questions

Question 1

You manage a GKE cluster running a latency-sensitive service. You notice that the Horizontal Pod Autoscaler (HPA) frequently oscillates between scaling up and down, causing performance degradation during scale-down periods. The HPA is configured with a CPU utilization target of 80%. Which action should you take to stabilize the HPA behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the HPA's --horizontal-pod-autoscaler-downscale-stabilization flag value on the kube-controller-manager.. The downscale stabilization window is the HPA parameter that controls how long the autoscaler waits before scaling down after a decrease in load. Increasing this value makes the HPA less reactive to short-lived dips, reducing oscillation. Other options either do not affect HPA behavior or address unrelated concerns like disruption budgets or resource recommendations.

Answer

Add a Vertical Pod Autoscaler (VPA) in recommendation mode to adjust CPU requests based on actual usage.

Answer

Set the HPA's targetCPUUtilizationPercentage to 50% to provide more headroom for scaling decisions.

Answer

Configure a PodDisruptionBudget with minAvailable set to 80% to ensure enough pods remain during scale-down.

Question 2

You are bootstrapping a Google Cloud organization for DevOps and need to set up a secure foundation for CI/CD pipelines. Which TWO of the following are best practices for managing service accounts used by CI/CD pipelines? (Choose two.)

Accepted Answer

Use Workload Identity Federation to allow CI/CD systems to impersonate service accounts without using long-lived keys.. Best practices for CI/CD service accounts include applying least privilege and avoiding long-lived credentials. Granting minimal necessary roles reduces risk, and using Workload Identity Federation eliminates keys. The other options either violate least privilege or involve less secure practices like key creation.

Answer

Create service account keys and store them in a secret manager for the CI/CD system to retrieve.

Answer

Use a single service account for all CI/CD pipelines across all projects to simplify management.

Answer

Assign the 'Editor' role to the service account to ensure it has all necessary permissions.

Question 3

A retail company is setting up a CI/CD pipeline using Cloud Build. They want to automatically build and test their application whenever a developer pushes a commit to a branch in their GitHub repository. They also want to deploy to a staging environment only when the build and tests pass. Which Cloud Build feature should they use to trigger the build automatically?

Accepted Answer

Cloud Build triggers with a GitHub repository connection. Cloud Build triggers are the native feature for automating builds based on source repository events. By connecting a GitHub repository and creating a trigger for push events to a specific branch, the build starts automatically. This enables continuous integration and can be followed by deployment steps if the build succeeds.

Answer

Pub/Sub topic that receives GitHub webhook events

Answer

Cloud Build's built-in polling mechanism for source repositories

Answer

Cloud Scheduler job that periodically checks for new commits

Question 4

Your company runs a web application on Google Cloud Run. You need to set up an alert that triggers when the 99th percentile request latency exceeds 500 ms for more than 5 minutes. Which Cloud Monitoring alerting policy configuration should you use?

Accepted Answer

Create an alerting policy on the metric run.googleapis.com/request_latencies, use the aligner 'percentile' with value 99, set the threshold to 500 ms, and set the duration to 5 minutes.. For distribution metrics like request latency, you must use an aligner to compute percentiles. The 'percentile' aligner with value 99 calculates the 99th percentile over the alignment period. Setting a threshold of 500 ms and a duration of 5 minutes ensures the alert fires only when the 99th percentile consistently exceeds the threshold, reducing false positives.

Answer

Create an alerting policy on the metric run.googleapis.com/request_latencies, use the aligner 'sum', and set the threshold to 500 ms with a duration of 5 minutes.

Answer

Create an alerting policy on the metric run.googleapis.com/request_count, use the aligner 'rate', and set the threshold to 500 ms with a duration of 5 minutes.

Answer

Create an alerting policy on the metric run.googleapis.com/request_latencies with a filter on percentile=99, a threshold of 500 ms, and a duration of 5 minutes.

Question 5

Your organization is bootstrapping a new Google Cloud environment for DevOps. The security team requires that all CI/CD pipelines authenticate to Google Cloud APIs without long-lived credentials, and that each pipeline's identity be scoped to only the projects it deploys to. You need to configure workload identity federation so that GitLab CI jobs can impersonate a dedicated service account per environment. Which configuration correctly establishes this trust?

Accepted Answer

Create a workload identity pool, add a GitLab OIDC provider with the issuer URI, then grant roles/iam.workloadIdentityUser on the target service account to the principalSet matching the GitLab project path.. Workload identity federation lets external workloads exchange their native OIDC token for a short-lived Google Cloud access token, eliminating exported keys. Binding roles/iam.workloadIdentityUser on a service account to a principalSet filtered by the GitLab project attribute ensures each pipeline can impersonate only its own environment's identity, satisfying both the no-keys and least-privilege requirements.

Answer

Create a service account in each project, export a JSON key, store it as a masked CI variable, and have the pipeline call gcloud auth activate-service-account with the key file.

Answer

Configure an OAuth consent screen, register GitLab as an internal application, and have each pipeline use an OAuth client ID and secret to obtain an access token for the Cloud Resource Manager API.

Answer

Enable the IAM Credentials API, create one service account in the organization's bootstrap project, and grant all CI jobs roles/iam.serviceAccountTokenCreator on that shared account.

Question 6

You are an SRE for a service running on Google Kubernetes Engine (GKE). You want to implement a canary deployment strategy to reduce risk when releasing a new version. You have deployed a canary version alongside the stable version. Which approach should you use to route a small percentage of traffic to the canary and monitor its performance before full rollout?

Accepted Answer

Use Istio to configure a VirtualService with weighted routing, sending 5% of traffic to the canary and 95% to the stable version.. The correct approach is to use Istio's VirtualService with weighted routing to send a small percentage of traffic to the canary. This allows you to monitor the canary's performance and gradually increase traffic if it is healthy. Istio provides the necessary traffic management and observability. Other options do not provide controlled traffic splitting or are not designed for canary deployments.

Answer

Use a Horizontal Pod Autoscaler to scale the canary based on CPU usage, thereby controlling traffic.

Answer

Use a NetworkPolicy to allow only a subset of source IPs to reach the canary.

Answer

Use Kubernetes Service with session affinity to direct a fixed set of users to the canary.

Question 7

A financial services company runs a latency-sensitive service on GKE. The SRE team uses Cloud Monitoring to track a service-level objective for request latency and has a budget of 99.9% availability. During a recent incident, the team could not tell whether slow requests came from the application or from a saturated node. They want to reduce mean time to resolution and avoid over-provisioning nodes just to have headroom for diagnosis. Which practice should they adopt?

Accepted Answer

Instrument the service with OpenTelemetry traces and correlate them with Cloud Monitoring metrics for the GKE nodes and pods.. OpenTelemetry traces expose the internal timing of each request, and correlating those traces with Cloud Monitoring node and pod metrics shows whether latency comes from application code or from resource contention. That evidence shortens diagnosis without adding idle nodes. Lowering the SLO or adding capacity changes the target or the cost, and profiling alone does not provide the cross-layer view needed during an active incident.

Answer

Lower the SLO target to 99.0% so the error budget is larger and incidents are less likely to trigger an alert.

Answer

Increase the node pool size by 50% so there is always spare capacity during incidents, and keep the current monitoring dashboards.

Answer

Enable Cloud Profiler on the service and review CPU profiles only during post-incident reviews.

Question 8

Your team manages a Cloud Build pipeline that builds a container image and pushes it to Artifact Registry. The build steps run in a private pool that has no external IP addresses, and the build consistently fails at the push step with a message indicating it cannot reach the registry endpoint. You have verified that the private pool is correctly configured and attached to the VPC network. What should you do to allow the build to push images to Artifact Registry?

Accepted Answer

Enable Private Google Access on the subnet used by the private pool.. Private pools without external IPs require Private Google Access to reach Google APIs such as Artifact Registry. Enabling it on the subnet allows the build to push images without exposing the build environment to the internet. IAM roles and NAT gateways do not solve the underlying network connectivity problem, and switching to a public pool would violate the security intent of using a private pool.

Answer

Change the build to use a public pool instead of the private pool.

Answer

Add the Artifact Registry service agent to the Cloud Build service account with the Artifact Registry Writer role.

Answer

Configure the private pool to use a NAT gateway for outbound internet access.

Question 9

A financial services company runs a microservices application on GKE. They use Cloud Monitoring to track performance. During peak hours, the frontend service experiences high latency, and the backend service shows increased error rates. You need to identify the root cause efficiently. Which approach should you take?

Accepted Answer

Use Cloud Trace to analyze the latency distribution across microservices and identify the bottleneck.. Cloud Trace provides end-to-end latency tracing across microservices, allowing you to see the exact path of requests and identify where delays occur. It is the most efficient tool for diagnosing performance bottlenecks in distributed applications, especially during peak load when multiple services interact.

Answer

Set up an uptime check for the frontend service and configure alerting policies for error rates.

Answer

Enable Cloud Profiler on all services to collect CPU and heap profiles.

Answer

Create a custom dashboard in Cloud Monitoring that displays CPU and memory usage for all pods.

Question 10

Your team runs a Go-based API on Google Kubernetes Engine (GKE). You want Cloud Monitoring to collect application-level metrics such as request count and error rate directly from the application, without deploying a separate Prometheus server. The application already exposes metrics in Prometheus format on /metrics. What should you do?

Accepted Answer

Enable Managed Service for Prometheus on the cluster and use PodMonitoring to scrape the /metrics endpoint.. Managed Service for Prometheus is Google Cloud's fully managed, Prometheus-compatible monitoring solution for GKE. It scrapes metrics from PodMonitoring resources that target specific pods and endpoints, then stores them in Cloud Monitoring. This eliminates the need to run and maintain a separate Prometheus server, while still leveraging the application's existing /metrics endpoint. The other options either require additional components or do not directly collect Prometheus metrics.

Answer

Configure the Cloud Monitoring agent on each node to parse the application logs and extract metrics using regex.

Answer

Deploy the OpenTelemetry Collector as a sidecar and configure it to scrape the /metrics endpoint, then use the googlecloud exporter.

Answer

Use the Cloud Monitoring API to push custom metrics from the application code at regular intervals.

Question 11

Your team runs a latency-sensitive API on Google Kubernetes Engine (GKE). You want Cloud Monitoring to alert you when the 99th percentile of request latency exceeds 500 ms for a sustained period. You have already instrumented the application to emit the custom metric `custom.googleapis.com/api/latency` with a distribution value type. Which alerting policy configuration should you use?

Accepted Answer

Create an alerting policy with a condition that uses the metric `custom.googleapis.com/api/latency` and set the threshold to 500 ms, aggregating with the 99th percentile.. The application emits a distribution-valued custom metric, which supports percentile aggregations in Cloud Monitoring. To alert on tail latency, the condition must use that metric and apply a 99th percentile aggregation with a 500 ms threshold. This directly monitors the SLO without relying on averages or external probes.

Answer

Use Cloud Trace to analyze latency spans and create an alert when any span duration exceeds 500 ms.

Answer

Create an uptime check that measures response time from multiple regions and alert if the average response time exceeds 500 ms.

Answer

Create a log-based metric on the API's request logs and alert when the average latency field exceeds 500 ms.

Question 12

A DevOps team is bootstrapping a new Google Cloud organization. They want to enforce that all VMs created in the organization must have OS Login enabled and cannot have external IP addresses. They also want to ensure that these policies are applied to all current and future projects. What should they do?

Accepted Answer

Create organization policies for constraints/compute.requireOsLogin and constraints/compute.vmExternalIpAccess at the organization level.. Organization policies are the correct tool to enforce these constraints. The predefined constraints constraints/compute.requireOsLogin and constraints/compute.vmExternalIpAccess address the requirements. Applying them at the organization level ensures they are inherited by all projects and folders, including future ones. This is the most efficient and preventive method.

Answer

Use a custom constraint with a condition to enforce OS Login and external IP restrictions.

Answer

Create a Cloud Function that triggers on VM creation and enables OS Login and removes external IPs.

Answer

Apply the constraints/compute.requireOsLogin and constraints/compute.vmExternalIpAccess policies at the folder level for each folder.

Question 13

A DevOps team manages a GKE cluster that runs a stateful application with persistent volumes. They observe that during scaling events, new pods take a long time to become ready, impacting performance. Which two actions should they take to optimize pod startup time? (Choose two.)

Accepted Answer

Pre-pull container images on nodes using a DaemonSet to reduce image pull time.. Pre-pulling container images with a DaemonSet eliminates image download time during pod startup, and using high-performance PersistentVolumes reduces I/O latency during application initialization. Both actions directly target common bottlenecks in stateful pod startup, leading to faster readiness and improved scaling performance.

Answer

Use a StatefulSet with a headless Service to ensure stable network identities and ordered deployment.

Answer

Increase the CPU and memory requests for the pods to ensure they are scheduled quickly.

Answer

Configure readiness probes with appropriate initialDelaySeconds and periodSeconds to avoid premature traffic.

Question 14

A company runs a GKE cluster with a single node pool of n1-standard-4 nodes. The operations team notices that many nodes are underutilized, with average CPU and memory usage below 20%. They want to reduce cost without changing the application architecture. What should they do?

Accepted Answer

Enable cluster autoscaling with a lower minimum node count, and set pod resource requests so the scheduler can pack pods efficiently.. Cluster autoscaling is the primary tool for right-sizing a GKE node pool. When pods have accurate resource requests, the scheduler can pack them onto fewer nodes, and the autoscaler removes idle nodes. Lowering the minimum node count reduces baseline cost. The other options either do not change node count, rely on manual guesswork, or address pod count rather than node utilization.

Answer

Change the node pool machine type to n1-highmem-8 and reduce the number of nodes by half.

Answer

Enable node auto-repair and node auto-upgrade on the node pool.

Answer

Configure a horizontal pod autoscaler for all deployments and leave the node pool unchanged.

Question 15

You manage a Google Cloud project with several services. Finance wants to be notified when the project's spend is projected to exceed a monthly threshold, and they want to see which services contribute most to the cost. Which combination of Cloud Billing features should you configure?

Accepted Answer

Create a budget with a specified amount, enable email alert rules at percentages such as 50, 90, and 100 percent, and use the Cloud Billing cost table grouped by service.. Cloud Billing budgets support alert thresholds based on actual and forecast spend, which notifies finance before the monthly threshold is exceeded. The Cloud Billing cost table can be grouped by service to reveal which services drive cost, providing the visibility finance requested. Together these built-in features meet the requirement without custom data pipelines.

Answer

Enable the Cloud Billing Budget API and create a Pub/Sub topic, then rely on Cloud Monitoring dashboards grouped by service.

Answer

Set a project-level quota cap on each service and configure Cloud Monitoring to notify when quotas are approached.

Answer

Export billing data to BigQuery and build a custom report, then configure a Cloud Monitoring alert on the exported table.