PCDOE Practice Test 30 — 15 Questions

Question 1

A team is using Cloud Build to build and deploy to multiple environments (dev, staging, prod) using Cloud Deploy. They want to ensure that only builds from the main branch are promoted to prod. How should they configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Cloud Deploy promotion with an approval gate required for the prod target.. Cloud Deploy's approval gate feature allows you to require manual approval before a release is promoted to a specific target, such as prod. By configuring an approval gate on the prod target, you ensure that only builds from the main branch (which can be verified via the release metadata or source) are manually approved for promotion, providing a controlled, auditable gate. This approach directly enforces the branch-based promotion policy without relying on build-time filtering or IAM restrictions.

Answer

Use Cloud Build tags to mark builds from the main branch and filter in Cloud Deploy.

Answer

Set IAM policies on the Container Registry or Artifact Registry to restrict access to the prod image.

Answer

Set the Cloud Build trigger to only run on the main branch.

Question 2

A DevOps engineer is optimizing a Cloud Run service that experiences cold starts. The service is written in Python and uses several large libraries. Which change is most effective to reduce cold start latency?

Accepted Answer

Set a minimum number of instances to keep containers warm.. Setting a minimum number of instances (option B) ensures that a baseline of container instances is always warm and ready to serve requests, eliminating cold starts for those instances. Cold starts occur when a new container must be initialized, including loading large Python libraries, which adds significant latency. By keeping a minimum number of instances running, the service avoids the initialization delay for the first request to each instance.

Answer

Increase the maximum number of concurrent requests per container.

Answer

Set a longer request timeout.

Answer

Increase the CPU allocation for the service.

Question 3

Based on the exhibit, which Cloud Logging query filter will return all logs of this type?

Accepted Answer

severity=ERROR. Cloud Logging uses the `severity=ERROR` syntax to filter logs by exact severity level. The `=` operator performs an exact match on the severity field, which is a standard LogEntry field with predefined values (DEFAULT, DEBUG, INFO, NOTICE, WARNING, ERROR, CRITICAL, ALERT, EMERGENCY). This filter returns all logs where the severity is exactly ERROR, matching the requirement.

Answer

severity>=ERROR

Answer

severity:"ERROR"

Answer

jsonPayload.severity:ERROR

Question 4

Match each Google Cloud deployment strategy to its description.

Accepted Answer

Blue/green deployment: Running two identical environments, only one serves traffic at a time.. Blue/green uses two environments, canary uses a small user subset, rolling updates gradually. Swapping definitions is a common distractor.

Answer

Blue/green deployment: Gradually replacing instances of the current version with the new one.

Answer

Canary deployment: Running two versions side-by-side and routing users based on test groups.

Answer

Rolling deployment: Switching traffic between two separate environments.

Question 5

Match each Google Cloud DevOps capability to its benefit.

Accepted Answer

Cloud Build: Automates build, test, and deployment. Cloud Build automates CI/CD pipelines, and Artifact Registry stores build artifacts. Common confusions involve mixing capabilities like monitoring (Cloud Monitoring) or source code management (Cloud Source Repositories) with other tools.

Answer

Cloud Build: Monitors application performance

Answer

Cloud Deploy: Manages source code repositories

Answer

Cloud Monitoring: Provides continuous delivery pipelines

Question 6

Which TWO actions can reduce tail latency in a microservices architecture deployed on GKE? (Choose 2)

Accepted Answer

Run multiple replicas of each service and use a load balancer with least-request algorithm.. Running multiple replicas and using a load balancer with a least-request algorithm distributes incoming requests to the pod with the fewest active connections, reducing queuing delay and preventing any single replica from becoming a hotspot. This directly lowers tail latency by ensuring that slow or overloaded pods are not overwhelmed, and the load balancer's algorithm minimizes the variance in response times across replicas.

Answer

Use a single large machine type for all services.

Answer

Enable session affinity to keep users on the same pod.

Answer

Increase the batch size for processing requests.

Question 7

A Cloud Deploy pipeline fails during a rollout with: 'FAILED_PRECONDITION: The release is not in a state that can be promoted.' The Cloud Build service account has the IAM roles shown in the exhibit. What is the missing role or permission?

Accepted Answer

The service account is missing the 'roles/clouddeploy.approver' role, which includes the 'clouddeploy.releases.promote' permission.. The error 'FAILED_PRECONDITION: The release is not in a state that can be promoted' occurs when a Cloud Deploy pipeline attempts to promote a release but the service account lacks the `clouddeploy.releases.promote` permission. This permission is included in the `roles/clouddeploy.approver` role, which is required to trigger a promotion from one target to the next in the pipeline. Without this role, the release cannot be promoted even if other deployment permissions are present.

Answer

The service account is missing the 'roles/clouddeploy.jobRunner' role.

Answer

The service account is missing the 'roles/cloudbuild.builds.builder' role.

Answer

The service account is missing the 'roles/clouddeploy.operator' role.

Question 8

An SRE team needs to define an SLI for a web service's availability SLO of 99.9%. Which metric should they use?

Accepted Answer

Uptime check success rate. An uptime check success rate directly measures the proportion of time the service is reachable and responding, which aligns with the definition of availability for a 99.9% SLO. This metric is typically derived from synthetic probes or health check endpoints (e.g., HTTP 200 responses) and reflects the binary state of the service being up or down, making it the appropriate SLI for availability.

Answer

Error budget

Answer

CPU utilization

Answer

Request latency (p99)

Question 9

An organization has a service that must meet a 99.99% SLO. The service runs on GKE and uses Cloud SQL. The team notices that during a major incident, the error budget is consumed rapidly. They want to implement a mechanism to automatically rollback deployments that cause sustained error budget consumption above a threshold. What is the best approach?

Accepted Answer

Set up a deployment pipeline with Cloud Deploy that includes a predeployment validation step that checks the current error budget burn rate and blocks the release if the burn rate exceeds 10% per hour.. Cloud Deploy provides deployment orchestration with built-in validation steps that can check error budget burn rate before releasing. Predeployment validation allows blocking a release if the burn rate exceeds a threshold (e.g., 10% per hour), preventing further SLO consumption. Option A is wrong because Cloud Scheduler runs on a schedule, not triggered by deployments, and cannot inspect error budget in real time. Option C is wrong because manual approval steps require human intervention and do not automate rollback based on error budget metrics. Option D is wrong because Cloud Build is a CI tool, not a deployment orchestrator; reverting commits does not roll back running deployments, and it lacks the context of error budget burn rate.

Answer

Use Cloud Scheduler to run a script that checks error budget and rolls back if needed.

Answer

Implement a canary deployment strategy with manual approval steps.

Answer

Configure Cloud Build to automatically revert the last commit if error budget is consumed.

Question 10

A development team wants to automatically run unit tests and static code analysis on every push to a Cloud Source Repository, but only run integration tests on merges to the main branch. Which Cloud Build trigger configuration should they use?

Accepted Answer

Create two triggers: one with a branch filter for '^main$' that runs integration tests, and another with a branch filter for '^.*$' that runs unit tests.. Cloud Build triggers allow you to define separate triggers with branch filters to execute different build configurations based on the branch. By creating one trigger with a branch filter of '^main$' for integration tests and another with '^.*$' for unit tests, you ensure unit tests run on every push to any branch, while integration tests run only on merges to main. This approach directly maps the desired behavior without requiring conditional logic or manual intervention.

Answer

Use a single trigger with a substitution variable like '_BRANCH' and set it to 'main' for integration tests.

Answer

Create one trigger with a build config that uses the 'branchName' substitution to conditionally skip integration test steps.

Answer

Configure one trigger with no branch filter and rely on developers to manually trigger integration tests.

Question 11

A DevOps engineer notices that a critical service is down, but no alert has been received. The engineer checks Cloud Monitoring and sees that the alerting policy appears to be correctly configured. What is the most likely cause?

Accepted Answer

The notification channel is misconfigured.. If the notification channel is misconfigured (e.g., invalid webhook URL, incorrect email address, or missing PagerDuty integration key), Cloud Monitoring will correctly detect the incident but fail to deliver the alert. The engineer sees the alerting policy appears correct because the policy itself is valid, but the channel configuration prevents the notification from reaching the recipient.

Answer

The metrics for the service are not being collected.

Answer

The incident was created but automatically closed.

Answer

The SLO is defined too loosely, so the error budget is not exhausted.

Question 12

A company has multiple projects in an organization. They want to set a budget of $5000 per month on a specific project and receive notifications when spending reaches 50% and 90%. What should they do?

Accepted Answer

Create a budget at the project level with alert thresholds of 50% and 90%. Budgets can be created at the project level with alert thresholds, allowing you to set a $5000 budget on a specific project and receive notifications at 50% and 90%. Option A is incorrect because while the Cloud Billing API can be used to monitor spending and send custom alerts, it is more complex and not the recommended or simplest approach for this requirement. Option B is incorrect because a budget at the organization level would apply to all projects, not just the specific project. Option C is incorrect because although a Pub/Sub topic and cloud function could be configured to check spending daily, it is overengineering; the built-in budget alerts are simpler and more appropriate.

Answer

Use the Cloud Billing API to monitor spending and send custom alerts

Answer

Create a budget at the organization level with alert thresholds of 50% and 90%

Answer

Configure a Pub/Sub topic and set up a cloud function to check spending daily

Question 13

Your application runs in two GCP regions. A regional outage occurs in the primary region. You have a Cloud Load Balancer with a failover backend. However, the failover did not trigger because the health check passed on a stale connection. What is the best solution?

Accepted Answer

Use a global load balancer with HTTP health checks based on application health.. A global load balancer with HTTP health checks can probe the actual application endpoint (e.g., /healthz) to verify end-to-end functionality, not just TCP connectivity. This prevents the stale connection issue where a TCP health check passes on an existing but broken session, ensuring failover triggers only when the application is genuinely unhealthy.

Answer

Use a passive health check.

Answer

Configure a custom health check that checks the database.

Answer

Use TCP health checks with a shorter interval.

Question 14

A team uses Cloud Build to deploy a Cloud Run service. The build fails with: 'ERROR: (gcloud.run.services.update) PERMISSION_DENIED: Permission 'run.services.update' denied on resource.' The Cloud Build service account has the Cloud Run Admin role. What is missing?

Accepted Answer

The build config must use the Cloud Run deployer step instead of the gcloud command.. The error occurs because using the gcloud command directly in a Cloud Build step does not automatically handle IAM permissions as the Cloud Run deployer step does. Although the Cloud Build service account has the Cloud Run Admin role, the gcloud command may fail due to missing resource-level permissions or because it uses a different service account context. The Cloud Run deployer step is designed to properly authenticate and apply the necessary permissions for deploying to Cloud Run.

Answer

The Cloud Build service account should have the Owner role on the project.

Answer

The Cloud Run service must be deployed in the same region as the build.

Answer

The Cloud Build service account needs the 'run.services.update' permission or the Cloud Run Admin role.

Question 15

Your company runs a microservices application on a private GKE cluster with Workload Identity enabled. Services communicate via gRPC and HTTP. After a recent update to the payment service, users report intermittent 503 errors and 2-second latency spikes during peak hours (10 AM - 12 PM). Cloud Monitoring shows the payment service's CPU utilization averages 60%, but memory spikes to 90% during errors. The existing alert on HTTP 503 responses fires only after 5 consecutive errors over 5 minutes, but the errors are sporadic. You need to diagnose and resolve the issue. What should you do?

Accepted Answer

Enable detailed logging and metrics for the payment service in Cloud Logging and Cloud Monitoring. Analyze logs around the error timestamps to identify memory consumption patterns, and lower the alert threshold for 503 errors to trigger on 2 errors within 1 minute. Also, set up a custom alert on memory usage exceeding 85%.. The issue requires a two-pronged approach: first, enable detailed logging and metrics to diagnose the root cause (memory spikes during peak hours), and second, adjust alerting thresholds to catch sporadic 503 errors earlier (2 errors in 1 minute) and add a proactive memory usage alert at 85%. This aligns with the PCDOE incident management process of first gathering data before making changes, and ensures you can correlate memory pressure with gRPC/HTTP errors in a GKE environment with Workload Identity.

Answer

Increase the memory limits for the payment service containers and set a memory request equal to the limit. Then restart the pods to clear any memory leaks.

Answer

Switch the payment service's HTTP/2 protocol to HTTP/1.1 to reduce overhead, and increase the memory request limit to avoid out-of-memory errors.

Answer

Scale the payment service horizontally by increasing the minimum number of replicas to handle peak load, and adjust the HPA to scale faster.