PCDOE Practice Test 28 — 15 Questions

Question 1

You are monitoring a microservices application deployed on Google Kubernetes Engine (GKE) that uses Cloud Monitoring for observability. You notice that the error rate for a critical service has increased, but the CPU and memory usage remain normal. The service uses gRPC and logs are structured. Which Cloud Monitoring tool should you use first to diagnose the root cause of the increased error rate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Logs Explorer to filter logs by error status codes. Logs Explorer allows you to directly query structured gRPC logs by filtering on error status codes (e.g., gRPC status codes like `UNAVAILABLE`, `INTERNAL`, or `DEADLINE_EXCEEDED`). Since the service uses structured logging, you can quickly isolate the exact error messages and stack traces without needing to pre-configure dashboards or wait for automated grouping. This is the fastest first step to identify the root cause of an increased error rate when CPU and memory are normal, as it points to application-level or dependency issues.

Answer

Service Monitoring to create a custom dashboard

Answer

Error Reporting to automatically group error occurrences

Answer

Metrics Explorer to view error rate and latency charts

Question 2

A company is bootstrapping a Google Cloud organization. They have created a Shared VPC host project. They want to allow a service project's default compute service account to launch instances that use the Shared VPC's subnets. Which IAM role should be granted to that service account at the host project level?

Accepted Answer

roles/compute.networkUser. The `roles/compute.networkUser` role grants a service account the necessary permissions to use the subnets of a Shared VPC host project. Specifically, this role includes the `compute.subnetworks.use` permission, which allows the service account to launch instances in the host project's subnets without granting broader network management rights.

Answer

roles/compute.xpnAdmin

Answer

roles/compute.securityAdmin

Answer

roles/compute.networkAdmin

Question 3

Which THREE steps are typically part of a formal incident postmortem according to Google SRE best practices?

Accepted Answer

Assign action items with deadlines.. Google SRE postmortems emphasize creating actionable follow-ups to prevent recurrence. Assigning action items with deadlines ensures that identified issues are systematically addressed, which is a core principle of blameless postmortems focused on process improvement rather than punishment.

Answer

Identify the person responsible for the incident.

Answer

Implement a solution immediately.

Question 4

When bootstrapping a new Google Cloud organization for DevOps, which set of initial IAM roles should be assigned to the DevOps team to enable them to create and manage projects, folders, and billing accounts?

Accepted Answer

Project Creator, Billing Account User, Organization Policy Administrator. The DevOps team needs the Project Creator role to create new projects, the Billing Account User role to link billing accounts to those projects, and the Organization Policy Administrator role to set organization-wide policies that control resource constraints. These three roles together provide the minimum necessary permissions for bootstrapping a Google Cloud organization without granting excessive administrative privileges.

Answer

Folder Admin, Billing Admin, Security Reviewer

Answer

Org Admin, Project Creator, Billing Admin

Answer

Project Creator, Billing Admin, Folder Admin

Question 5

A developer wants to view logs from all pods in a GKE namespace in real time. Which command-line tool should they use?

Accepted Answer

gcloud logging tail. The `gcloud logging tail` command streams logs in real time from all pods in a GKE namespace, as it directly queries the Cloud Logging API for live log entries. This is the correct tool for real-time log streaming across multiple pods, unlike `kubectl logs` which only shows logs from a single pod or a limited set. The command supports filtering by resource labels, such as `--filter="resource.labels.namespace_name=NAMESPACE"`, to scope the output to a specific namespace.

Answer

gcloud logging read

Answer

Cloud Console Logs Viewer

Answer

kubectl logs --tail=100

Question 6

A DevOps engineer is troubleshooting a production incident where users are getting 502 errors from a Google Cloud HTTP(S) Load Balancer. The backend service is a GKE deployment. Initial checks show the backend pods are healthy and responding. What is the most likely cause?

Accepted Answer

The load balancer's health check is failing on the backend instance group due to mismatch between health check port and backend port.. A 502 error from an HTTP(S) Load Balancer indicates that the load balancer is unable to establish a successful connection to the backend. Even though the backend pods are healthy and responding, the load balancer's health check may be failing because it is configured to check a different port (e.g., the health check port) than the port the backend service is actually serving traffic on (e.g., the backend port). This mismatch causes the load balancer to mark the backend instances as unhealthy, resulting in 502 errors for users.

Answer

The backend pods are out of memory and crashing.

Answer

The IAM permissions for the load balancer service account are misconfigured.

Answer

The backend service has been accidentally deleted by another engineer.

Question 7

A web application serves static assets (images, CSS, JavaScript) from Compute Engine instances. Users in different geographic regions report slow page loads. Which Google Cloud service can be used to improve performance for these users?

Accepted Answer

Cloud CDN. Cloud CDN (Content Delivery Network) caches static assets at Google's globally distributed edge points of presence (PoPs). When users request images, CSS, or JavaScript, the content is served from the nearest edge cache rather than the origin Compute Engine instances, reducing latency and improving page load times for geographically distributed users.

Answer

VPC Network Peering

Answer

Cloud Load Balancing

Answer

Cloud NAT

Question 8

Which THREE actions can help optimize Cloud Storage costs? (Choose three.)

Accepted Answer

Use Nearline or Coldline storage classes for infrequently accessed data.. Nearline and Coldline storage classes are designed for infrequently accessed data, offering lower storage costs compared to Standard storage. By choosing these classes for data that is accessed less than once a quarter or once a year, you reduce the per-GB storage charge, though you incur higher retrieval and early deletion fees. This directly optimizes costs when access patterns align with the class's intended use.

Answer

Enable versioning on all buckets to protect against accidental deletion.

Answer

Use Standard storage class for all objects to ensure low latency.

Question 9

Which service provides built-in dashboards for Google Cloud services?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (option D) provides built-in dashboards for Google Cloud services, offering pre-configured visualizations of metrics, logs, and alerts without requiring manual setup. These dashboards aggregate data from services like Compute Engine, Cloud SQL, and Kubernetes Engine, enabling real-time monitoring of resource utilization and performance. This aligns with the PCDOE domain of implementing service monitoring strategies by providing out-of-the-box observability.

Answer

Cloud Shell

Answer

Cloud Console

Answer

Cloud Logging

Question 10

Refer to the exhibit. A GKE pod is repeatedly crashing with the error shown. The deployment has resource requests of 512 MiB memory and limits of 1 GiB. What is the most likely cause and the best remediation?

Accepted Answer

The Java heap size exceeds the container memory limit; reduce the JVM heap size or increase the container memory limit. The error indicates an OutOfMemoryError (OOM) in the Java application, which occurs when the JVM heap size exceeds the container's memory limit. Since the deployment has a memory limit of 1 GiB, if the JVM is configured with a heap size larger than this limit (or if the heap plus other memory usage exceeds it), the container will be killed by Kubernetes. Reducing the JVM heap size or increasing the container memory limit directly resolves the mismatch.

Answer

The node is under memory pressure; add more nodes to the cluster

Answer

The container needs more CPU; increase CPU request and limit

Answer

The application has a memory leak; refactor the DataProcessor class

Question 11

You are designing SLO monitoring for a high-traffic e-commerce platform. Which three best practices should you follow? (Choose three.)

Accepted Answer

Use multiple SLOs for different critical user journeys.. Using multiple SLOs for different critical user journeys (e.g., checkout, product search, login) allows you to tailor reliability targets to the specific performance and availability needs of each workflow. This granularity prevents a single, coarse SLO from masking issues that affect only a subset of users, enabling more precise monitoring and faster incident response.

Answer

Use a single global SLO for all customer segments.

Answer

Set the SLO to 100% to ensure maximum reliability.

Question 12

A company wants to receive notifications when their Google Cloud costs exceed $5000 in a month. They have set a budget alert at the billing account level. What is the minimum configuration required to ensure they get alerted?

Accepted Answer

Set budget amount to $5000 and alert threshold at 100% and configure a Pub/Sub topic for notifications.. It sets the budget amount to $5000, an alert threshold at 100%, and importantly configures a Pub/Sub topic for notifications. Without a notification channel (Pub/Sub or email), alerts are not delivered. Option B lacks a notification channel. Option C includes unnecessary thresholds and still has no notification. Option D incorrectly scopes to a single project, which is not required and could miss costs from other projects under the billing account.

Answer

Set budget amount to $5000 and alert threshold at 100%.

Answer

Set budget amount to $5000 and alert threshold at 50% and 100%.

Answer

Set budget amount to $5000 and alert threshold at 100% and ensure the budget is scoped to a single project.

Question 13

A company is bootstrapping a Google Cloud organization with multiple projects. They want to enable consistent security and compliance across all projects. Which two organization policies should they consider? (Choose TWO.)

Accepted Answer

Restrict domain of users to the company domain.. The 'Restrict domain of users to the company domain' organization policy (constraints/iam.allowedPolicyMemberDomains) ensures that only identities from the specified Google Workspace or Cloud Identity domain can be added as members in IAM policies across all projects. This prevents external users from gaining access, enforcing a consistent security boundary from the outset of bootstrapping.

Answer

Require all service accounts to have a unique naming convention.

Answer

Enforce that all projects have a Cloud Storage bucket.

Answer

Allow all projects to use any external IPs.

Question 14

A DevOps team is bootstrapping CI/CD pipelines that need access to API keys stored in Secret Manager. The pipelines run on Cloud Build. What is the best practice for granting access to secrets?

Accepted Answer

Grant the Cloud Build service account roles/secretmanager.secretAccessor on the project containing secrets.. Granting the Cloud Build service account the roles/secretmanager.secretAccessor role on the project containing secrets follows the principle of least privilege. Option A is wrong because using a custom service account with roles/secretmanager.admin grants excessive permissions. Option B is wrong because storing API keys as build substitutions is insecure and exposes them in logs. Option D is wrong because Cloud KMS is used for encryption, not as a best practice for secret access.

Answer

Use a custom service account with roles/secretmanager.admin and run Cloud Build as that account.

Answer

Store the API keys as build substitutions.

Answer

Use Cloud KMS to encrypt secrets and pass them as environment variables.

Question 15

A team uses Cloud Load Balancing with backend NEGs. Users report intermittent high latency. How should they diagnose the root cause effectively?

Accepted Answer

Use Cloud Trace to analyze per-request latency spans. Cloud Trace provides end-to-end latency analysis by capturing per-request spans as they traverse the load balancer, backend NEGs, and other services. This allows you to pinpoint exactly which hop (e.g., load balancer processing, backend queuing, or application code) is causing the intermittent high latency, rather than relying on aggregate metrics or caching assumptions.

Answer

Increase the number of backend instances immediately

Answer

Enable Cloud Monitoring latency histogram for the load balancer

Answer

Check Cloud CDN cache hit ratio