PCDOE Practice Test 32 — 15 Questions

Question 1

A DevOps team is troubleshooting a Cloud Build pipeline that fails intermittently when building a container image. The build step uses a custom build step that runs a vulnerability scan. The error log shows: 'Step #1: Error: failed to scan image: context deadline exceeded'. The build configuration includes 'timeout: 600s'. Which is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scan step is taking longer than the build timeout; increase the timeout value in the build configuration.. The error 'context deadline exceeded' indicates that the custom vulnerability scan step is taking longer than the build's configured timeout of 600 seconds. Cloud Build enforces a hard timeout for the entire build; if any step exceeds this duration, the build is terminated. Increasing the timeout value in the build configuration provides more time for the scan to complete, directly addressing the root cause.

Answer

The scan tool requires a specific dependency; add an installation step before scanning.

Answer

There is network latency between Cloud Build and the container registry; use VPC Service Controls.

Answer

The build step is running out of memory; increase the machine type to e2-highcpu-8.

Question 2

A Cloud Run service experiences high latency during cold starts. The service is memory-intensive. Which configuration change will most effectively reduce cold start latency?

Accepted Answer

Set a minimum number of instances.. Setting a minimum number of instances ensures that a baseline of pre-warmed instances is always running, eliminating cold starts for the initial requests. For a memory-intensive service, this avoids the latency penalty of loading large libraries or datasets into memory on first invocation. This is the most direct and effective configuration change to reduce cold start latency.

Answer

Decrease the container concurrency setting.

Answer

Increase the max instances limit.

Answer

Enable CPU boost for the service.

Question 3

Arrange the steps to implement a canary deployment for a Cloud Run service.

Accepted Answer

Deploy new revision with 0% traffic, then shift a small percentage of traffic to it, then monitor, then gradually increase traffic, then remove old revision.. In a canary deployment for Cloud Run, the correct sequence ensures minimal risk. First, deploy the new revision with 0% traffic. Then, route a small percentage (e.g., 1%) to it and monitor for errors or performance issues. If successful, gradually increase traffic while monitoring. Once the new revision is fully validated, point 100% traffic to it and remove the old revision. This incremental approach limits blast radius and allows rollback.

Answer

Shift a small percentage of traffic to the new revision, then deploy the new revision, then monitor, then gradually increase traffic, then remove old revision.

Answer

Deploy new revision with 0% traffic, then gradually increase traffic to 100%, then monitor, then remove old revision.

Answer

Deploy new revision with 0% traffic, then shift a small percentage of traffic, then remove old revision, then monitor, then gradually increase traffic.

Question 4

What is the primary benefit of using preemptible VMs?

Accepted Answer

Lower cost.. Preemptible VMs are Compute Engine instances that last a maximum of 24 hours and can be terminated at any time by Google. They offer a significantly lower price—up to 60-91% discount compared to standard VMs—making them ideal for batch jobs and fault-tolerant workloads where cost savings are the primary benefit.

Answer

Higher reliability.

Answer

Faster performance.

Answer

Better security.

Question 5

You are designing a globally distributed application using Cloud Spanner. The application has a write-heavy workload. You notice that write latency increases as the number of nodes increases. What is the most likely cause?

Accepted Answer

The workload has many cross-node transactions due to split rows.. In Cloud Spanner, write-heavy workloads with many cross-node transactions cause increased write latency as nodes are added. This occurs because Spanner splits rows across nodes, and transactions that span multiple splits require two-phase commit (2PC) coordination between nodes, which adds network overhead and latency. Adding more nodes increases the likelihood that a transaction touches multiple splits, exacerbating the coordination cost.

Answer

The instance is using a multi-region configuration with too many read-only replicas.

Answer

The application is using stale reads for write transactions.

Answer

The number of splits is too low, causing hotspots.

Question 6

An SRE team needs to implement an incident management workflow that automatically creates a ticket in their ITSM tool when a critical alert fires. They use Cloud Monitoring. Which approach should they use?

Accepted Answer

Use a Cloud Pub/Sub notification channel and a Cloud Function that receives the alert and calls the ITSM API.. Cloud Monitoring can send alert notifications to a Cloud Pub/Sub topic, which then triggers a Cloud Function. The Cloud Function can parse the alert payload and call the ITSM tool's API to create a ticket, providing a reliable, scalable, and decoupled integration that supports custom logic and error handling.

Answer

Configure the alerting policy to send notifications via email to the ITSM system's email-to-ticket feature.

Answer

Create a webhook notification channel directly to the ITSM tool.

Answer

Use the Cloud Monitoring API to periodically pull alerts and create tickets.

Question 7

A team is using Cloud Monitoring to track the performance of a microservices application. They set up an uptime check for each service, but they notice that some checks are failing intermittently without actual service degradation. What is the most likely cause?

Accepted Answer

The timeout setting is too short for the service's typical latency.. The most likely cause is that the timeout setting is too short, causing false positives when the service response time temporarily exceeds the timeout. Other options are less plausible: uptime checks typically run from multiple regions; load balancer 503 errors would indicate a real issue; quota exceed would prevent checks from running.

Answer

The services are behind a load balancer that occasionally returns 503 during scaling.

Answer

Uptime checks are deployed in a single region, causing false positives.

Answer

The project's quota for uptime checks has been exceeded.

Question 8

Which TWO actions can reduce startup latency for a Cloud Run service?

Accepted Answer

Optimize the container image to reduce size.. A smaller container image reduces the time required to pull the image from the registry to the compute node during cold starts. Cloud Run's startup latency is dominated by image download and filesystem extraction; optimizing the image (e.g., using distroless base images, multi-stage builds, or removing unnecessary layers) directly shortens this critical path.

Answer

Use a regional Cloud Run with separate service per region.

Answer

Increase the maximum instances limit.

Answer

Increase the container concurrency setting.

Question 9

Your organization has multiple teams that need to deploy infrastructure using Terraform. You want to enforce that all Terraform state files are stored in a central Cloud Storage bucket with versioning enabled. You also need to ensure that only the CI/CD pipeline can write to the bucket. What is the best way to enforce this?

Accepted Answer

Use IAM conditions to restrict access to the bucket only when the requester is the CI/CD service account.. IAM conditions allow you to bind a role to a principal (the CI/CD service account) and then restrict access based on attributes of the request, such as the requester's identity. By using a condition that checks `iam.googleapis.com/principal` equals the CI/CD service account email, you ensure that only that specific service account can write to the bucket, even if other principals have the role. This enforces the policy without relying on network constructs or overly broad role assignments.

Answer

Use VPC Service Controls to restrict access to the bucket from only the CI/CD pipeline's VPC.

Answer

Create a custom IAM role with permissions to write to the bucket and assign it to the CI/CD service account.

Answer

Grant the Storage Object Admin role to the CI/CD service account at the bucket level.

Question 10

A DevOps team is defining an SLO for a web application that runs on Compute Engine behind an HTTP Load Balancer. They need to measure the proportion of requests that complete within 300ms. Which Cloud Monitoring metric is most appropriate as the SLI?

Accepted Answer

loadbalancing.googleapis.com/https/total_latencies. The SLI must measure the proportion of requests completing within 300ms, which is a latency distribution metric. The `total_latencies` metric from the HTTP Load Balancer provides a histogram of request latencies, allowing you to compute the percentage of requests below a threshold (e.g., 300ms). This directly supports the SLO definition.

Answer

loadbalancing.googleapis.com/https/backend_request_bytes

Answer

loadbalancing.googleapis.com/https/frontend_tcp_rtt

Answer

loadbalancing.googleapis.com/https/request_count

Question 11

A cloud operations team is implementing monitoring for a microservices application deployed on Compute Engine. They want to create a custom dashboard in Cloud Monitoring that shows the 99th percentile latency of a specific service over the last hour. Which combination of Cloud Monitoring features should they use?

Accepted Answer

Use a distribution metric with the 99th percentile alignment function in a Metrics Explorer chart.. Cloud Monitoring's distribution metrics inherently store a histogram of values, allowing percentile calculations like the 99th percentile. By selecting the 99th percentile alignment function in a Metrics Explorer chart, the dashboard directly computes and displays the desired latency threshold from the distribution data over the specified time window.

Answer

Use a gauge metric with the max alignment function in a Metrics Explorer chart.

Answer

Use an uptime check metric and configure the latency percentile in the chart.

Answer

Create a logs-based metric from application logs and use the count alignment.

Question 12

An organization is bootstrapping their Google Cloud environment and wants to implement a shared VPC for DevOps workloads. The network team manages the host project, while DevOps teams have service projects. They need to ensure that DevOps teams can create resources in their service projects that use the shared VPC, but they cannot change the host project's network configuration. Which IAM roles should be granted to the DevOps team's service account on the host project?

Accepted Answer

roles/compute.networkUser. The DevOps team needs to use the shared VPC's resources (e.g., subnets) from their service projects without modifying the host project's network configuration. The `roles/compute.networkUser` role grants permission to use existing networks and subnets in the host project, but not to create, modify, or delete them. This aligns with the principle of least privilege for a shared VPC setup.

Answer

roles/compute.securityViewer

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Question 13

A financial services firm is implementing a CI/CD pipeline with Cloud Build and Artifact Registry. Their security policy requires all data to remain within a VPC Service Controls perimeter. They have configured Cloud Build to use a private worker pool with no external IP addresses and have set up VPC-SC to allow traffic between Cloud Build and Artifact Registry within the perimeter. However, builds that push Docker images to Artifact Registry fail with the error: 'denied: Unauthenticated request. Push access to the repository is denied.' The build configuration includes the step: 'steps: - name: gcr.io/cloud-builders/docker args: [push, us-central1-docker.pkg.dev/myproject/my-repo/myimage]' The Cloud Build service account has been granted roles/artifactregistry.writer on the repository. What is the most likely cause?

Accepted Answer

The VPC-SC perimeter does not allow egress to the Artifact Registry API endpoint.. VPC Service Controls can block access to Artifact Registry API endpoints if they are not explicitly allowed within the perimeter, resulting in an 'Unauthenticated request' error despite correct IAM permissions. Option A is incorrect because the service account permissions are sufficient; the issue is network-level access. Option C is incorrect because missing a version tag would not cause an authentication error. Option D is incorrect because private worker pools and Artifact Registry can be in different regions.

Answer

The Cloud Build service account does not have permissions to authenticate to Artifact Registry when using a private pool.

Answer

The Docker push is failing because the image tag is missing a version.

Answer

The Artifact Registry repository is in a different region than the Cloud Build worker pool.

Question 14

A DevOps team uses Cloud Build and Cloud Deploy to deploy to GKE. They want to implement a gated deployment where a manual approval is required before promoting from staging to production. What two resources should they configure? (Select TWO)

Accepted Answer

A Cloud Deploy approval rule in the delivery pipeline. A Cloud Deploy approval rule in the delivery pipeline defines a manual gate that pauses the pipeline at a specific stage (e.g., before promoting to production) and requires explicit approval to proceed. Option D is correct because setting the `requireApproval` attribute to `true` on a Cloud Deploy target enforces that any rollout targeting that environment must receive manual approval before the deployment proceeds.

Answer

A Cloud Pub/Sub topic to notify approvers

Answer

A Cloud Deploy rollout with a pre-deploy hook

Answer

A Cloud Build trigger with a manual approval step

Question 15

A company runs a web application on Google Kubernetes Engine (GKE) with multiple services. They want to reduce costs without impacting performance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Enable node auto-provisioning to automatically adjust node pools.. Node auto-provisioning in GKE automatically creates and scales node pools based on the resource requirements of pending pods. This eliminates the need for manual node pool management and ensures that only the necessary compute resources are provisioned, reducing costs without manual intervention or over-provisioning.

Answer

Enable cluster autoscaling and manually scale nodes based on peak load.

Answer

Deploy a service mesh like Istio to optimize traffic routing.