PCDOE Practice Test 31 — 15 Questions

Question 1

A team wants to monitor the latency of a microservice deployed on GKE. Which Google Cloud tool should they use to collect custom metrics?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct tool because it allows you to collect, visualize, and alert on custom metrics via the Monitoring API or the `custom.googleapis.com` metric namespace. For a microservice on GKE, you can instrument your application with the OpenTelemetry SDK or the Cloud Monitoring client library to push custom latency metrics directly into Cloud Monitoring, where they can be queried and used in dashboards or alerting policies.

Answer

Cloud Logging

Answer

Cloud Trace

Answer

Error Reporting

Question 2

An organization uses Cloud CDN with an HTTP(S) Load Balancer to serve static content. They observe that cache hit ratio is lower than expected. The content is immutable and has long Cache-Control headers. What is the most likely cause?

Accepted Answer

The requests include unique query parameters like session IDs.. When Cloud CDN serves content with long Cache-Control headers but unique query parameters (like session IDs) are appended to each request, the cache treats each URL as a distinct object. This causes cache misses because the load balancer forwards requests with different query strings to the origin, preventing the CDN from serving cached responses. The correct answer is A because this behavior directly undermines cache efficiency despite proper cache headers.

Answer

The Cache-Control max-age is set too short.

Answer

The load balancer is configured with SSL termination.

Answer

The content is served using signed URLs with expiration.

Question 3

A company uses Cloud Monitoring to set up alerting for their production system. They want to reduce alert fatigue while ensuring critical issues are caught quickly. Which two strategies should they implement? (Select TWO)

Accepted Answer

Use notification channels with escalation policies. Notification channels with escalation policies ensure that alerts are routed to the appropriate responders based on severity and time thresholds, reducing noise by preventing low-severity issues from repeatedly notifying the same person. Escalation policies automatically escalate unacknowledged critical alerts to higher-level teams, ensuring critical issues are caught quickly without overwhelming on-call staff.

Answer

Use low threshold values to catch issues early

Answer

Disable alerts during off-hours

Answer

Set up separate alerts for each microservice

Question 4

A DevOps team is using Cloud Build to build and push container images. The build times have increased significantly. They suspect that the build cache is not being used effectively. Which build configuration change would likely improve cache usage?

Accepted Answer

Use kaniko instead of Docker. Kaniko is a cache-aware container image builder that can leverage a remote image registry as a cache layer, unlike the default Docker builder which relies on a local Docker daemon and its local layer cache. By using Kaniko with a configured cache repository, the team can reuse previously built layers across builds, even when builds run on different Cloud Build workers, significantly reducing build times.

Answer

Increase the machine type

Answer

Use a private pool

Answer

Enable parallel builds

Question 5

Your organization requires that all new Google Cloud projects are automatically configured with a common set of VPC networks and subnets, and that these networks must be created before any resources are deployed. What is the best approach to enforce this requirement across the organization?

Accepted Answer

Use Organization Policies with a custom constraint to enforce that all projects must have a specific VPC network configuration.. Organization Policies with custom constraints allow you to enforce that all new projects automatically include specific VPC networks and subnets before any resources are deployed. This is the only approach that provides mandatory, organization-wide enforcement at the project creation level, ensuring compliance without relying on manual templates or post-creation configuration.

Answer

Create a Cloud Deployment Manager template and share it with all project owners.

Answer

Set up VPC Network Peering between all projects to enforce network connectivity.

Answer

Configure a shared VPC host project and attach all new service projects to it.

Question 6

You are responding to an incident where a new release has caused increased error rates. Which TWO actions should you take immediately?

Accepted Answer

Notify stakeholders.. Immediately notifying stakeholders (such as product owners, support teams, and affected users) is a critical first step in incident management. It ensures transparency, sets expectations, and allows coordinated response efforts. In the PCDOE framework, stakeholder communication is prioritized to maintain trust and align business impact with technical remediation.

Answer

Disable the alert.

Answer

Push a hotfix without testing.

Answer

Create a post-mortem document.

Question 7

An organization has a strict compliance requirement that all CI/CD pipelines must use customer-managed encryption keys (CMEK) for any artifacts stored in Cloud Storage. How can this be enforced at the organization level?

Accepted Answer

Create an Organization Policy with constraint `constraints/gcp.storageRequireCmeK`.. The Organization Policy constraint `constraints/gcp.storageRequireCmeK` is specifically designed to enforce that all new Cloud Storage buckets must be created with a customer-managed encryption key (CMEK). This policy is applied at the organization, folder, or project level and prevents the creation of buckets that do not use CMEK, thereby meeting the compliance requirement at the organizational level.

Answer

Use IAM conditions on storage buckets to require CMEK.

Answer

Use Cloud Asset Inventory to scan for non-compliant buckets.

Answer

Configure Cloud Audit Logs to monitor and alert on non-CMEK usage.

Question 8

Your team manages a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). The pipeline uses Cloud Build to build container images and push them to Artifact Registry, then uses a Cloud Build step with kubectl to apply Kubernetes manifests stored in a separate 'manifests' repository. Recently, the team has experienced issues: sometimes a new image is deployed to production even though the corresponding pull request (PR) has not been merged into the main branch of the manifests repository. Also, rollbacks are slow because the previous image tag is overwritten. The team wants to ensure that only code that passes all tests and is merged to main is deployed, and that each deployment uses a unique immutable image tag. What should the team do?

Accepted Answer

Consolidate application code and Kubernetes manifests into a single repository. Configure Cloud Build triggers to build and run tests on all branches, but only deploy to GKE when changes are merged to the main branch. Use the full commit SHA as the image tag.. Consolidating the application code and Kubernetes manifests into a single repository ensures that the image tag (full commit SHA) is uniquely tied to the exact code and manifest changes that passed all tests. By configuring Cloud Build triggers to deploy only on merges to the main branch, the team guarantees that only fully tested, merged code reaches production. Using the full commit SHA as the image tag provides immutability and enables fast, precise rollbacks by referencing the exact image from Artifact Registry.

Answer

Keep the current architecture but modify Cloud Build triggers to only run on the main branch of both repositories. Use the short SHA ($SHORT_SHA) as the image tag.

Answer

Move all source code and manifests into a single repository. Use Cloud Build triggers to build and test on every push, and deploy only on pushes to the main branch. Use the commit SHA ($COMMIT_SHA) as the image tag.

Answer

Keep application and manifests in separate repositories. Use Cloud Build triggers to build on changes to the app repo, and use a separate trigger on the manifests repo to deploy. Use the 'latest' tag for the image.

Question 9

Which TWO practices should be implemented to optimize query performance in Cloud Spanner?

Accepted Answer

Use interleaved tables to co-locate related rows.. Interleaved tables in Cloud Spanner physically co-locate parent and child rows on the same split, reducing cross-node round trips and improving join performance. This design leverages Spanner's hierarchical storage model to minimize latency for queries that access related data together.

Answer

Split large tables into multiple smaller tables to distribute load.

Answer

Create as many indexes as possible on all columns.

Answer

Use globally distributed interleaving across regions.

Question 10

A company is migrating a batch processing workload to Google Cloud. The workload is CPU-intensive and runs for a few hours each day. Which Compute Engine machine family should they choose to optimize performance and cost?

Accepted Answer

Compute-optimized (C2/C2D). A is correct because the workload is CPU-intensive and runs for a few hours each day, which is a sustained, compute-bound task. Compute-optimized machines (C2/C2D) are designed specifically for high-performance computing (HPC) and batch processing, offering the highest ratio of vCPU to memory and the fastest single-threaded performance on Google Cloud. This minimizes runtime and cost per job compared to general-purpose or burstable families.

Answer

Burstable (T2D)

Answer

GPU-accelerated (A2)

Answer

Memory-optimized (M2)

Question 11

Which TWO actions should a DevOps engineer take to reduce latency for a global user base accessing a web application hosted on Compute Engine?

Accepted Answer

Configure instance groups in multiple regions with a global load balancer.. Deploying instance groups in multiple regions and using a global load balancer (e.g., Google Cloud External HTTP(S) Load Balancer) allows user requests to be routed to the closest healthy backend, reducing network round-trip time. This geo-distribution minimizes latency by serving content from the nearest regional endpoint rather than a single centralized location.

Answer

Enable HTTP/2 on the load balancer.

Answer

Increase the machine type of the instances.

Answer

Use Cloud Load Balancing with global anycast IP.

Question 12

A company runs a production web application on Google Compute Engine behind an HTTP(S) load balancer. The application is deployed across multiple managed instance groups in three regions (us-east1, europe-west1, asia-east1). Recently, users report slow page load times. Monitoring shows that CPU utilization on instances is consistently low (around 30%) but memory usage is high (over 80%). The application uses a self-managed in-memory cache per instance to store session data and frequently accessed objects. The team is considering adding more instances to the instance groups to distribute the load. However, they notice that the load balancer's latency is spiking and the cache hit ratio is low. What is the most likely issue and what should the engineer do?

Accepted Answer

Migrate to a managed in-memory cache like Memorystore for Redis to serve as a centralized cache shared by all instances.. The low cache hit ratio and high memory usage indicate that each instance's self-managed in-memory cache is fragmented and inefficient, as session data and frequently accessed objects are not shared across instances. This forces the load balancer to repeatedly fetch data from the backend, causing latency spikes. Migrating to a centralized managed cache like Memorystore for Redis eliminates per-instance cache duplication, improves cache hit ratio, and reduces load balancer latency by serving data from a single, consistent cache.

Answer

Add more instances to the instance groups to increase total memory capacity.

Answer

Increase the machine type of instances to have more memory per instance (e.g., n1-highmem-4).

Answer

Enable autoscaling based on memory utilization.

Question 13

A company is moving large amounts of data between regions. Which two actions can reduce network egress costs? (Choose two.)

Accepted Answer

Consolidate resources to a single region. Options A and B are correct. Consolidating resources to a single region eliminates cross-region egress, directly reducing costs. Using Cloud CDN to cache static content serves requests from edge locations, reducing egress from the origin. Options C, D, and E are incorrect: Cloud Interconnect primarily reduces egress costs to on-premises, not between regions; VPN uses the public internet and still incurs egress charges; VPC Network Peering within the same region is free but does not reduce cross-region egress, and peering across regions still incurs costs.

Answer

Use Cloud Interconnect to connect to on-premises

Answer

Use a VPN connection to on-premises

Answer

Use VPC Network Peering within the same VPC network

Question 14

Which TWO practices help reduce Mean Time to Resolve (MTTR) for production incidents?

Accepted Answer

Implement runbooks for common incident types.. B is correct because runbooks provide step-by-step, pre-approved procedures for common incident types, enabling engineers to follow a consistent, repeatable process without needing to diagnose from scratch. This reduces the time spent on investigation and decision-making, directly lowering Mean Time to Resolve (MTTR) by standardizing the response for known issues.

Answer

Conduct postmortems only after major incidents.

Answer

Use a shared on-call rotating schedule.

Answer

Increase logging verbosity for all services.

Question 15

A startup is building a CI/CD pipeline for their Cloud Run service. They use Cloud Build to build a Docker image, push it to Artifact Registry, and then deploy to Cloud Run with the 'gcloud run deploy' command in the build config. The initial deployment works, but subsequent builds fail at the deploy step with a permission error: 'Permission denied to deploy revision to Cloud Run service'. The Cloud Build service account has the Cloud Run Developer role. The developers can manually deploy from their workstations using their own accounts. What is the most likely cause?

Accepted Answer

The Cloud Build service account needs the 'iam.serviceAccounts.actAs' permission on the Cloud Run runtime service account.. Cloud Run requires the service account to have the 'iam.serviceAccounts.actAs' permission on the runtime service account used by Cloud Run (the compute engine default service account or a custom one). The Cloud Run Developer role alone does not include this. Option A is incorrect because the error is permission-related, not API enablement. Option B is incorrect because Artifact Registry permissions are for pushing images, not deploying. Option C is incorrect because Cloud Build uses its own service account, not user credentials.

Answer

The developers added the '--impersonate-service-account' flag inadvertently in the build config.

Answer

The Cloud Run API is not enabled in the project.

Answer

The Cloud Build service account lacks Artifact Registry read permissions to pull the image.