PCDOE Practice Test 3 — 30 Questions

Question 1

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

Accepted Answer

Use Cloud Build triggers with regular expressions on branch patterns and restrict access via IAM.. Cloud Build triggers natively support regular expressions on branch patterns, and IAM conditions can restrict which service accounts are allowed to invoke specific triggers. This provides a declarative, auditable, and least-privilege approach without custom code or external services.

Answer

Use Cloud Functions to validate branch names before triggering builds.

Answer

Use Cloud Source Repositories with branch protection rules.

Answer

Store the service account keys in Secret Manager and use them in build steps.

Question 2

A team is bootstrapping a new Google Cloud organization. Which TWO practices are recommended for managing project creation and resource hierarchy? (Choose two.)

Accepted Answer

Create a folder for each department to isolate resources.. Creating a folder for each department allows you to isolate resources, apply IAM policies at the folder level, and enforce organizational boundaries. This follows Google Cloud's recommended resource hierarchy best practices for multi-team environments, enabling delegated administration and cost tracking per department.

Answer

Use a centralized service account to create projects via API.

Answer

Use a single project for all development environments.

Answer

Assign project creator role to all users by default.

Question 3

A Cloud Build pipeline that deploys a container to Cloud Run fails with the error: `Missing required permission run.routes.invoke`. The Cloud Build service account has the 'Cloud Run Invoker' role. Which TWO additional steps should be taken?

Accepted Answer

Ensure the service account has the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account.. The Cloud Build service account needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account (the service account that Cloud Run uses to run the container). Without this permission, Cloud Build cannot impersonate the runtime service account to deploy the container, even if it has the Cloud Run Invoker role. The `run.routes.invoke` error occurs because the deployment process requires the ability to invoke the route, which is tied to the runtime service account's permissions.

Answer

Enable the Cloud Run API in the project.

Answer

Use a different service account for deployment.

Answer

Add the `run.routes.invoke` permission to a custom role.

Question 4

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. A shared VPC allows multiple projects to share a common VPC network, enabling centralized control of networking resources, firewall rules, and IP addressing. This is a best practice for multi-team organizations because it reduces administrative overhead, ensures consistent network policies, and simplifies connectivity between projects without requiring complex peering or VPN setups.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 5

A company uses Cloud Build and wants to trigger builds only from the master branch. Which configuration is required?

Accepted Answer

Set the branch filter to 'master' in the trigger.. Cloud Build triggers allow you to specify a branch filter using a regex pattern. Setting the filter to 'master' ensures that only pushes or pull requests targeting the master branch initiate the build. This is the native, supported method for branch-based triggering without additional overhead.

Answer

Create separate triggers for each branch.

Answer

Use a custom Cloud Build step to check the branch name.

Answer

Use a Cloud Function to call Cloud Build for master only.

Question 6

You are investigating a slow increase in latency for a service running on Compute Engine. You have Cloud Monitoring and Cloud Logging set up. Which tool would best help you identify the cause of the latency?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data from distributed applications by tracing requests as they propagate through services. It provides detailed latency distributions and per-span breakdowns, allowing you to pinpoint which component or operation is causing the slowdown. For a Compute Engine service with Cloud Monitoring and Logging already in place, Cloud Trace is the most direct tool to analyze request-level latency.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Debugger

Question 7

A team is experiencing increased latency in their microservices application after a new deployment. They suspect a specific service is the bottleneck. Which tool should they use to identify the slowest service in the request path?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool because it provides end-to-end latency analysis by capturing trace spans from each microservice in a request path. It aggregates and visualizes the time spent in each service, allowing you to pinpoint the slowest service causing the bottleneck. This directly addresses the need to identify the specific service responsible for increased latency after a deployment.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 8

To securely manage secrets (e.g., API keys) used in Cloud Build pipelines, which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the recommended service for storing and accessing secrets like API keys. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not designed for secrets, and Cloud KMS is not for direct secret storage.

Answer

Cloud KMS

Answer

Cloud Key Management Service (duplicate)

Answer

Cloud Storage

Question 9

A company has an application that experiences intermittent errors. They want to be notified immediately when the error rate exceeds 1% of total requests. What should they implement?

Accepted Answer

Create a log-based metric counting error logs and set an alerting policy in Cloud Monitoring. The requirement is to be notified when the error rate exceeds 1% of total requests, which requires a metric that counts error logs relative to total requests. A log-based metric in Cloud Logging can filter for error log entries (e.g., status codes 5xx), and an alerting policy in Cloud Monitoring can trigger when the ratio of error logs to total requests surpasses 1%. This directly addresses the intermittent error rate condition with precise threshold-based alerting.

Answer

Create an uptime check pointing to the application endpoint

Answer

Use Cloud Trace to analyze latency and set an alert on trace spans

Answer

Create a dashboard showing error count over time

Question 10

Which TWO options are valid methods to create a custom metric descriptor in Cloud Monitoring?

Accepted Answer

Using the gcloud commands: gcloud monitoring metrics create. The `gcloud monitoring metrics create` command directly invokes the Cloud Monitoring API to create a custom metric descriptor. Option E is correct because the Cloud Monitoring API's `CreateMetricDescriptor` method is the programmatic way to define a custom metric, specifying its type, unit, and labels. Both methods result in a new metric descriptor being registered in the project's metric store.

Answer

Creating a log-based metric

Answer

Using Terraform resource google_monitoring_metric_descriptor

Answer

Deploying a Prometheus exporter with the Ops Agent

Question 11

Which Cloud Monitoring feature can directly correlate this error with the associated trace and VM instance?

Accepted Answer

Error Reporting. Error Reporting in Google Cloud automatically groups errors from Cloud Logging and can directly correlate an error with the associated trace ID and VM instance metadata. This is because Error Reporting ingests structured log entries that contain the `@type` field set to `type.googleapis.com/google.devtools.clouderrorreporting.v1beta1.ReportedErrorEvent` and parses the `serviceContext` and `context` fields to link the error to the specific trace and resource (e.g., VM instance).

Answer

Log-based metrics

Answer

Metrics Explorer

Answer

Alerting policies

Question 12

A company runs a nightly batch data processing job on Compute Engine instances. The job runs for approximately 2 hours each night and is fault-tolerant (can resume from checkpoint). The team wants to minimize costs. Which TWO strategies should they implement? (Choose two.)

Accepted Answer

Use preemptible VMs for the worker nodes.. Preemptible VMs are significantly cheaper than standard VMs (up to 60-80% discount) and are ideal for fault-tolerant, short-lived batch jobs that can resume from checkpoints. Since the job runs nightly for only 2 hours and can handle interruptions, preemptible VMs minimize costs without risking job completion.

Answer

Purchase 1-year committed use discounts for the worker nodes.

Answer

Migrate the workload to Cloud Functions.

Answer

Enable sustained use discounts by keeping the instances running 24/7.

Question 13

What is the effect of the 'timeshiftDuration' of '3600s' in the dashboard widget?

Accepted Answer

The chart compares current data to data from 1 hour ago. The 'timeshiftDuration' parameter in a dashboard widget shifts the time range of the comparison data relative to the primary time range. Setting 'timeshiftDuration' to '3600s' means the chart compares the current data (within the selected time range) against data from exactly 1 hour (3600 seconds) earlier. This is commonly used for offset comparisons, such as week-over-week or hour-over-hour analysis, and does not alter the primary data range or aggregation.

Answer

The chart shows data from the last 1 hour

Answer

The metric is aggregated over 1 hour

Answer

The dashboard updates every hour

Question 14

Refer to the exhibit. What does the alert condition indicate?

Accepted Answer

It alerts for any Cloud Run revision that has more than 1000 requests in a 1-minute window.. The alert condition in the exhibit uses a per-revision metric (e.g., `run.googleapis.com/request_count`) with a threshold of 1000 and a 1-minute window. This means the alert fires for any individual Cloud Run revision that exceeds 1000 requests within that window, not for the aggregate across all revisions. Option B correctly identifies this per-revision behavior.

Answer

It alerts when the request count drops below 1000 for 1 minute.

Answer

It alerts when the average request count across all revisions exceeds 1000 over 1 minute.

Answer

It alerts when the total request count across all revisions exceeds 1000 per minute.

Question 15

A latency-sensitive web application uses Cloud CDN. What configuration change would most directly reduce cache miss rates?

Accepted Answer

Enable cache static content and set appropriate cache modes. Enabling cache static content and setting appropriate cache modes directly reduces cache miss rates by ensuring that more requests are served from the Cloud CDN cache rather than forwarded to the origin. This configuration allows the CDN to store and serve static assets (e.g., images, CSS, JavaScript) based on cache keys and TTLs, minimizing the number of cache misses for eligible content.

Answer

Enable Cloud Armor to filter malicious traffic

Answer

Use signed URLs to restrict access

Answer

Set TTL to 0 to ensure content is always fresh

Question 16

Which tool can be used to capture and analyze latency spikes in a distributed application?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool for capturing and analyzing latency spikes in a distributed application because it provides end-to-end latency tracking by instrumenting requests as they traverse microservices. It collects trace spans with timing data, allowing you to identify bottlenecks and pinpoint the exact service or operation causing the spike.

Answer

Cloud Logging

Answer

Cloud Debugger

Answer

Cloud Monitoring

Question 17

Which service is commonly used for time-series data and real-time analytics?

Accepted Answer

Bigtable. Bigtable is a fully managed, scalable NoSQL database optimized for large analytical and operational workloads, including time-series data and real-time analytics. It provides sub-10ms latency for high-throughput reads and writes, making it ideal for IoT, monitoring, and financial data streams. Its column-oriented storage and automatic sharding support efficient time-based queries and aggregation.

Answer

Cloud SQL

Answer

Firestore

Answer

Cloud Spanner

Question 18

During bootstrapping, a DevOps lead wants to ensure that all projects in the 'dev' folder have a consistent set of VPC firewall rules and network policies. They are considering using a shared VPC or VPC Network Peering. Which approach provides the most control and consistency for DevOps teams while minimizing administrative overhead?

Accepted Answer

Implement a shared VPC with a host project managed by the network team, and allow DevOps teams to use subnets in their service projects.. A shared VPC with a host project managed by the network team provides centralized control over VPC firewall rules and network policies, ensuring consistency across all service projects in the 'dev' folder. This approach minimizes administrative overhead because DevOps teams can create subnets in their service projects without needing to manage network infrastructure, while the network team enforces a uniform security posture.

Answer

Use VPC Service Controls to define perimeters for each project.

Answer

Create a separate VPC in each project and use Cloud VPN to connect them.

Answer

Use VPC Network Peering between all projects to allow connectivity.

Question 19

Which service should be used to monitor the health of HTTP endpoints from multiple locations?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) includes uptime checks that can be configured to probe HTTP endpoints from multiple global locations, measuring latency, availability, and response content. This makes it the correct service for monitoring the health of HTTP endpoints from diverse geographic regions.

Answer

Cloud Trace

Answer

Cloud Logging

Answer

Cloud Debugger

Question 20

A company serves static assets (images, CSS) to global users. Users in distant regions experience slow load times. Which service should they use to optimize delivery?

Accepted Answer

Cloud CDN. Cloud CDN (Content Delivery Network) caches static assets (images, CSS) at edge locations worldwide, reducing latency for distant users by serving content from a nearby point of presence (PoP). This directly addresses slow load times caused by geographic distance, as the origin server is no longer the sole source of delivery.

Answer

Cloud Load Balancing

Answer

Cloud NAT

Answer

Cloud Armor