PCDOE Practice Test 2 — 30 Questions

Question 1

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Accepted Answer

Identify time, then Clone, then Verify, then Promote, then Update connections. The correct sequence for recovering a Google Cloud SQL instance from a point-in-time backup is: first, identify the exact point-in-time to recover; second, clone the instance to that time; third, verify the cloned instance's data; fourth, promote the clone to become the primary instance; and fifth, update application connections to use the new primary. This order ensures a consistent and verifiable recovery process.

Answer

Clone, then Identify time, then Verify, then Promote, then Update connections

Answer

Identify time, then Clone, then Promote, then Verify, then Update connections

Answer

Clone, then Identify time, then Promote, then Verify, then Update connections

Question 2

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Organization Policies can enforce that all new projects must have specific labels by using a constraint like `constraints/compute.requireOsLogin` is not for labels, but you can use a custom constraint with the `constraints/gcp.resourceLabels` to require labels on resources. However, for projects themselves, you can use an organization policy with a list constraint to mandate that certain labels are present on all projects, and the policy will block creation of any project that does not comply.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 3

Refer to the exhibit. A DevOps engineer applies this Terraform configuration but gets an error: "Error creating Project: googleapi: Error 403: The caller does not have permission to enable services". What is the most likely cause?

Accepted Answer

The service account used by Terraform lacks the Service Usage Admin role on the project.. The error 'The caller does not have permission to enable services' indicates that the identity (service account) used by Terraform to authenticate with the Google Cloud API lacks the required IAM permission to enable Google APIs on the project. The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) grants the necessary permissions, including serviceusage.services.enable and serviceusage.services.list, which are required to enable services like the Compute Engine API during resource creation. Without this role, the API call to enable services fails with a 403 error.

Answer

The org_id is incorrect.

Answer

The organization requires that the Compute Engine API be enabled before project creation.

Answer

The project ID already exists.

Question 4

A DevOps team wants to optimize resource utilization for their GKE deployment. Which built-in Kubernetes resource can automatically adjust CPU and memory requests based on historical usage?

Accepted Answer

VerticalPodAutoscaler. The VerticalPodAutoscaler (VPA) is the correct choice because it automatically adjusts CPU and memory resource requests (and limits) for pods based on historical usage data, optimizing resource utilization without manual intervention. Unlike the HorizontalPodAutoscaler, which scales the number of pods, the VPA modifies the resource specifications of existing pods to match observed demand.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

PodDisruptionBudget

Question 5

You are an on-call engineer responding to a critical service incident affecting a production application. According to Google's Incident Management best practices, which TWO actions should you take immediately after declaring the incident?

Accepted Answer

Communicate the incident status to stakeholders and affected teams.. Google's Incident Management best practices emphasize that immediately after declaring an incident, the on-call engineer must communicate the incident status to stakeholders and affected teams. This ensures that everyone is aware of the ongoing issue, sets expectations, and prevents redundant troubleshooting. Early communication also helps in coordinating response efforts and reducing confusion during the critical initial phase.

Answer

Notify the incident commander to take over coordination.

Answer

Begin documenting the incident for a postmortem report.

Answer

Roll back the latest deployment to the previous stable version.

Question 6

After deploying a new version of a Cloud Run service, the team notices an increase in 5xx errors. They want to quickly revert to the previous version while minimizing user impact. What is the recommended approach?

Accepted Answer

Use Cloud Run's traffic management to set 100% of traffic to the previous revision.. Cloud Run supports traffic splitting between revisions, allowing you to instantly route 100% of traffic to the previous revision without redeploying. This minimizes user impact because the rollback is immediate and does not require rebuilding or re-pulling container images. Option D is correct because it leverages Cloud Run's built-in traffic management feature for zero-downtime rollbacks.

Answer

Set the minimum number of instances of the new revision to 0.

Answer

Redeploy the previous version from the container registry.

Answer

Modify the ingress settings to restrict traffic to the new revision.

Question 7

An engineer wants to ensure that an alert is escalated if not acknowledged within 5 minutes. Which feature of Cloud Monitoring can achieve this?

Accepted Answer

Notification channel with escalation configuration.. Notification channels in Google Cloud Monitoring can be configured with an escalation policy that defines a sequence of recipients or notification methods to be contacted if an alert is not acknowledged within a specified time. By setting the escalation duration to 5 minutes, the system automatically escalates the alert to the next tier or channel if no acknowledgment is received, directly meeting the engineer's requirement.

Answer

Incident management tool like PagerDuty.

Answer

Using a webhook notification channel.

Answer

Alerting policy with a condition that checks for acknowledgment.

Question 8

A team uses Cloud Build with a Kaniko builder to containerize their application. The build fails with the error: 'failed to push to destination: failed to get credentials: failed to get credential from metadata service: failed to fetch metadata...' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the storage.objectAdmin role on the Container Registry bucket.. The error indicates that Kaniko cannot authenticate to push the built image to Container Registry. Kaniko uses the Cloud Build service account's credentials to authenticate with the registry. By default, the Cloud Build service account has the storage.objectViewer role on the Container Registry bucket, which allows pulling images but not pushing. To push, the service account needs the storage.objectAdmin or storage.objectCreator role on the bucket. Option D correctly identifies this missing permission as the most likely cause.

Answer

Kaniko requires a running Docker daemon in the build step.

Answer

The base image specified in the Dockerfile is not accessible from the build environment.

Answer

The Dockerfile has an invalid instruction causing Kaniko to fail.

Question 9

A DevOps engineer is responsible for cost optimization of GKE clusters. They have identified that many nodes are underutilized. What is the best approach to reduce costs without impacting availability?

Accepted Answer

Enable cluster autoscaler to automatically scale down nodes. Cluster autoscaler automatically scales down nodes when they are underutilized. Option B is manual and not scalable. Option C may cause disruptions. Option D reduces availability.

Answer

Use spot VMs for all node pools

Answer

Delete underutilized nodes manually

Answer

Migrate to a single zone cluster

Question 10

A company runs a CI/CD pipeline using Cloud Build and Cloud Deploy for a web application. The pipeline builds a container image, pushes it to Artifact Registry, and then deploys it to a GKE cluster using Cloud Deploy. Recently, the deployment step started failing with the error: 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry.' The container image is built in the same project as the target cluster. The Cloud Build service account has been granted the roles/cloudbuild.builds.builder and roles/artifactregistry.admin on the project. The DevOps engineer verified that the image exists in Artifact Registry and the path is correct. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Ensure that the Cloud Deploy delivery pipeline references the correct image path, including the project ID and repository.. The error 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry' indicates that the Cloud Deploy delivery pipeline is referencing an image path that does not match the actual location of the image. Even though the image exists in Artifact Registry and the path appears correct, Cloud Deploy validates the image reference (including project ID, repository name, and image tag) against the target project's registry. The engineer must ensure the delivery pipeline YAML or configuration explicitly specifies the correct full image path, including the project ID and repository, so that Cloud Deploy can resolve and verify the image during release creation.

Answer

Reconfigure Cloud Build to store images in a different Artifact Registry repository.

Answer

Grant the Cloud Deploy service account the roles/artifactregistry.reader role on the project.

Answer

Change the Cloud Build service account to include the roles/clouddeploy.jobRunner role.

Question 11

Your organization is adopting DevOps practices and needs to bootstrap a Google Cloud organization with multiple projects. You want to enforce consistent resource naming conventions and apply common organization policies across all projects. Which two services should you use together to achieve this?

Accepted Answer

Organization Policies and Resource Manager folders. To enforce consistent resource naming conventions and common organization policies across all projects, you need Organization Policies (via constraints) and Resource Manager folders. Organization Policies allow you to set rules such as custom naming constraints or disabling external IPs that apply across the entire resource hierarchy. Resource Manager folders help organize projects and can inherit policies. Service Accounts and IAM roles (C) control access but do not enforce naming conventions or policies directly. Therefore, only option D provides the appropriate services to achieve the goal.

Answer

Cloud Shell and Cloud Source Repositories

Answer

Cloud Deployment Manager and Cloud Audit Logs

Answer

Service Accounts and IAM roles

Question 12

Refer to the exhibit. What does this recommendation suggest?

Accepted Answer

Upgrade the instance.. The description explicitly states to upgrade the instance from n1-standard-2 to n1-standard-4, indicating a need for more resources.

Answer

Change the instance to preemptible.

Answer

Delete the instance.

Answer

Downgrade the instance.

Question 13

You are the SRE for a financial services application running on Google Cloud. Users report that certain transactions are taking over 10 seconds, while most complete in under 200ms. You use Cloud Profiler and Cloud Trace. Upon reviewing the profiler data, you see a hotspot in a method that calls a Cloud SQL database with a slow query. You identify the query and create an index to speed it up. However, you cannot deploy the index change immediately due to change management processes. The incident response team needs to mitigate the impact now. Which temporary measure should you take?

Accepted Answer

Implement caching of query results using Cloud Memorystore.. Caching the results of the slow query in Cloud Memorystore (Redis) immediately reduces the load on the Cloud SQL database and eliminates the need to execute the slow query repeatedly. This provides a temporary performance improvement without requiring any database schema changes or deployments, bypassing the change management delay. The hotspot in the profiler indicates the query itself is the bottleneck, and caching avoids that bottleneck entirely for repeated reads.

Answer

Increase the database connection pool size in the application.

Answer

Add a database read replica to offload read queries.

Answer

Scale up the Cloud SQL instance to more vCPUs.

Question 14

Refer to the exhibit. The DevOps team is trying to create a new service account key. The operation fails with a permission error. What is the most likely cause?

Accepted Answer

The organization policy prevents uploading service account keys.. Organization policies can explicitly restrict the creation of service account keys at the organization, folder, or project level. When a key upload fails with a permission error despite the user having the necessary IAM roles, the most likely cause is an organization policy constraint such as `iam.disableServiceAccountKeyUpload` that blocks the operation. This policy overrides any IAM permissions granted to the user.

Answer

The project-level IAM denies the action.

Answer

The service account is disabled.

Answer

The service account lacks the iam.serviceAccountKeys.create permission.

Question 15

Match each Google Cloud tool to its function in incident management.

Accepted Answer

Cloud Logging: Collect and store log data from applications and services.. In incident management, Cloud Logging collects logs, Cloud Monitoring provides metrics and alerts, Error Reporting aggregates errors, and Cloud Trace traces requests. Common confusions include mixing Cloud Logging with monitoring or debugger functions.

Answer

Cloud Logging: Provide visibility into performance and health.

Answer

Cloud Debugger: Store and analyze logs.

Question 16

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Accepted Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Define delivery pipeline → Step 4: Push code → Step 5: Promote. The correct order for setting up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service begins with creating a build configuration file (cloudbuild.yaml) that specifies how to build and test the application. Next, you set a trigger (e.g., on push to a branch) in Cloud Build to automatically start builds. Then, you define a delivery pipeline in Cloud Deploy with targets (e.g., staging, production) and approval gates. After that, you push code to the repository, which triggers the build and, if successful, creates a release in the delivery pipeline. Finally, you promote the release through the stages (e.g., from staging to production) either automatically or after manual approval. This order ensures each prerequisite is in place before the next step, enabling a seamless automated workflow.

Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Push code → Step 4: Define delivery pipeline → Step 5: Promote

Answer

Step 1: Define delivery pipeline → Step 2: Create build config → Step 3: Set trigger → Step 4: Push code → Step 5: Promote

Answer

Step 1: Push code → Step 2: Create build config → Step 3: Set trigger → Step 4: Define delivery pipeline → Step 5: Promote

Question 17

Arrange the steps to troubleshoot a high latency issue on a Google Cloud HTTP(S) Load Balancer.

Accepted Answer

Check health checks, then review load balancer logs, then analyze metrics, then identify the problematic backend, then take corrective action.. Start with health checks, then logs, metrics, identify culprit, and take action.

Answer

Analyze metrics, then review logs, then check health checks, then identify the problematic backend, then take corrective action.

Answer

Check health checks, then identify the problematic backend from logs, then take corrective action, then analyze metrics, then verify.

Answer

Review logs, then analyze metrics, then identify the problematic backend, then take corrective action.

Question 18

Arrange the steps to set up a Google Cloud Monitoring alerting policy for a Compute Engine instance.

Accepted Answer

Create notification channel, then define condition, set evaluation parameters, attach the channel, then save.. First create a notification channel, then define the condition, set evaluation parameters, attach the channel, and save.

Answer

Save, then attach the channel, set evaluation parameters, define condition, then create notification channel.

Answer

Define condition, then create notification channel, attach the channel, set evaluation parameters, then save.

Answer

Create notification channel, set evaluation parameters, define condition, attach the channel, then save.

Question 19

Match each Kubernetes resource to its role in a DevOps pipeline.

Accepted Answer

Pod: Smallest deployable unit, runs containers.. Key Kubernetes objects for application management. Pod runs containers, Deployment manages replicas and updates, Service provides stable networking, ConfigMap stores non-sensitive configuration, and Ingress controls external HTTP access.

Answer

Pod: Provides stable IP and DNS for a set of pods.

Answer

Deployment: Stores configuration data as key-value pairs.

Answer

ConfigMap: Manages external HTTP access to services.

Question 20

A Cloud Build pipeline uses the above cloudbuild.yaml. When triggered, the deploy step fails with: 'ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.update' denied on resource.' The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely cause?

Accepted Answer

The nested 'gcloud builds submit' command runs with a different service account that does not have the Cloud Run Admin role.. When a Cloud Build pipeline uses a nested `gcloud builds submit` command, the nested build runs under the default Compute Engine service account (or a user-specified service account) rather than the top-level Cloud Build service account. Even if the top-level service account has the Cloud Run Admin role, the nested build's service account may lack the `run.services.update` permission, causing the deploy step to fail with PERMISSION_DENIED.

Answer

The substitution variable ${_ENV} is not properly passed to the nested build.

Answer

The 'gcr.io/cloud-builders/gcloud' image does not support the 'gcloud run deploy' command.

Answer

The Cloud Build service account at the top level does not have the 'run.services.update' permission.