PCDOE Practice Test 33 — 15 Questions

Question 1

A DevOps engineer notices that some Compute Engine instances are not reporting metrics to Cloud Monitoring. Which two potential causes should they investigate? (Choose two.)

Accepted Answer

The instances have insufficient IAM permissions to write metrics.. Compute Engine instances require the appropriate IAM permissions (e.g., roles/monitoring.metricWriter) to write metrics to Cloud Monitoring. Without these permissions, the API calls to ingest metric data are denied, even if the Ops Agent is installed and running.

Answer

The instances are in a different region and Cloud Monitoring doesn't support cross-region.

Answer

The instances are preemptible and automatically stop reporting after 24 hours.

Answer

The instances are in a different project and not peered.

Question 2

An organization has multiple projects under a common folder. They want to enforce that all projects use the same VPC network from a central host project. However, one project needs to use a different VPC due to compliance requirements. How can this be achieved?

Accepted Answer

Set an organization policy to enforce shared VPC and create an exception for the specific project using the policy condition.. Google Cloud Organization Policies can enforce constraints like `compute.restrictSharedVpcHostProjects` to mandate shared VPC usage across projects. You can use policy conditions (e.g., `resource.matchTag`) to create an exception for a specific project that needs its own VPC, allowing it to bypass the constraint while all other projects remain bound to the central host project.

Answer

Use VPC Network Peering to connect the project to the host project.

Answer

Create a separate folder for the exception project and apply a different organizational policy.

Answer

Grant the project the necessary permissions to use its own VPC.

Question 3

A financial company is bootstrapping their Google Cloud organization for DevOps. They have strict compliance requirements: all projects must be under a folder hierarchy based on business units, and each project must have a Cloud Storage bucket with a retention policy of at least 1 year. They have 50 existing projects that need to be migrated into this hierarchy, and all future projects must comply. The team wants to automate as much as possible using Google Cloud services. Currently, projects are created manually with various ad-hoc permissions. What is the best approach to meet these requirements?

Accepted Answer

Define a resource hierarchy with folders, use a Cloud Build trigger to run a script that creates new projects and applies bucket retention, and use an organization policy to restrict project creation to a service account.. It uses Cloud Build triggers to automate project creation and bucket retention policy application, while restricting project creation to a service account via an organization policy ensures only authorized automation can create projects. This enforces the folder hierarchy and compliance requirements without manual intervention, aligning with DevOps automation principles.

Answer

Write a Terraform config to create folders and projects, but allow any user to create projects.

Answer

Create folders for each business unit, use a Cloud Function to move existing projects into folders, and set up an organization policy to require retention policies on buckets.

Answer

Use a single folder for all projects, apply a bucket retention policy at the folder level using a custom organization policy.

Question 4

A company runs a web application on Compute Engine behind a regional HTTP Load Balancer. Users report slow page load times during peak hours. CPU utilization on instances is under 60%, but network egress is near the instance's bandwidth limit. Which action should the engineer take?

Accepted Answer

Use a larger machine type with higher network throughput.. The bottleneck is network egress bandwidth, not CPU. Increasing the instance size to a machine type with higher network throughput (e.g., n2-highmem-4 vs. n2-standard-2) directly raises the per-instance egress cap, alleviating the bandwidth limit. Option D is correct because it addresses the root cause—insufficient network I/O capacity per instance.

Answer

Increase the number of instances in the instance group.

Answer

Switch to a global external HTTP Load Balancer.

Answer

Enable Cloud CDN.

Question 5

A company runs a microservices application on GKE. The checkout service has high tail latency. Using Cloud Profiler, the team finds that most time is spent in database queries. Which action should they take to improve performance?

Accepted Answer

Add database connection pooling using a sidecar proxy.. Database connection pooling reduces the overhead of establishing new connections for each request, which is a common cause of high tail latency in microservices. By using a sidecar proxy (e.g., Envoy or a dedicated connection pooler like PgBouncer), the checkout service can reuse existing database connections, minimizing latency spikes from connection setup and teardown. This directly addresses the root cause identified by Cloud Profiler—time spent in database queries—without requiring a database migration or scaling the service itself.

Answer

Migrate the database to Cloud Spanner.

Answer

Increase the number of replicas of the checkout service.

Answer

Enable Cloud CDN for the checkout API.

Question 6

Refer to the exhibit. A GKE node shows MemoryPressure condition. What should the team do to improve performance of pods scheduled on this node?

Accepted Answer

Enable cluster autoscaler to scale up new nodes. When a GKE node reports a MemoryPressure condition, it means the node's kubelet is actively evicting pods to free memory, which degrades performance. Enabling cluster autoscaler allows the cluster to automatically provision new nodes when existing nodes are under memory pressure, redistributing pods and alleviating the condition without manual intervention.

Answer

Increase the node's memory by changing the machine type

Answer

Adjust pod resource requests to leave more allocatable memory

Answer

Evict pods and delete the node

Question 7

A team uses Spinnaker on GKE for deployment. They notice that deployments are taking too long because of manual judgment gates. They want to automatically approve deployments if the canary analysis passes predefined thresholds. What Spinnaker feature should they use?

Accepted Answer

Automated canary analysis. Spinnaker's Automated Canary Analysis (ACA) feature allows teams to define canary analysis thresholds and automatically promote or roll back deployments based on the analysis results, eliminating the need for manual judgment gates. This directly addresses the requirement to automatically approve deployments when predefined thresholds are met, without human intervention.

Answer

Automated rollback

Answer

Policy engine with OPA

Answer

Pipeline expressions

Question 8

A large enterprise is designing a centralized DevOps platform across multiple business units. They want to use a shared CI/CD pipeline that deploys to projects in different folders. Which approach ensures secure, auditable deployments while minimizing IAM administration?

Accepted Answer

Use a cross-project service account in the CI/CD project with required roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM.. A cross-project service account in the CI/CD project, granted the necessary roles (e.g., Cloud Run Admin, Compute Admin) on target projects via IAM, allows the shared pipeline to deploy resources across folders without duplicating service accounts. This centralizes IAM administration, ensures auditability through a single identity, and follows the principle of least privilege by granting only required roles on target projects.

Answer

Use Cloud Build triggers directly in each target project with separate code repositories.

Answer

Grant the Cloud Build Editor role to all developers across projects to allow them to create pipelines.

Answer

Create a separate service account in each target project with the Cloud Build service agent role, and use impersonation from the CI/CD project.

Question 9

You are a DevOps engineer for a startup bootstrapping their Google Cloud organization. They have a single project for all environments (dev, test, prod) and a flat resource hierarchy. Recently, a developer accidentally deleted a production Cloud Storage bucket, causing data loss. The team wants to prevent this in the future with minimal disruption. They also want to enforce that all new projects follow a naming convention like 'company-environment-xxx'. The CTO wants a solution using native Google Cloud services without third-party tools. What should you do?

Accepted Answer

Create folders for each environment, move existing resources into folders, and apply an organization policy to enforce the naming convention on project creation.. Creating folders for each environment (dev, test, prod) and moving existing resources into them establishes a hierarchical resource structure that allows organization policies to be applied at the folder level. The organization policy constraint `constraints/resourcemanager.allowedProjectCreation` can enforce the naming convention on project creation, and IAM roles can be scoped to folders to restrict bucket deletion (e.g., using `roles/storage.objectAdmin` instead of `roles/storage.admin`). This solution uses native Google Cloud services (Resource Manager, Organization Policies, IAM) with minimal disruption by not requiring code changes or third-party tools.

Answer

Implement a Cloud Function that renames projects not following the convention and deletes buckets not in a folder.

Answer

Grant all users the Project Creator role but restrict bucket deletion with IAM.

Answer

Use Google Cloud Deployment Manager to create projects with predefined templates.

Question 10

A company wants to reduce the response time of a globally distributed web application. Which Google Cloud service can cache static content at edge locations to improve performance?

Accepted Answer

Cloud CDN. Cloud CDN (Content Delivery Network) uses Google's globally distributed edge caches to serve static content (e.g., images, CSS, JavaScript) from locations closer to users, reducing latency and offloading origin servers. It integrates with external HTTPS load balancers to automatically cache responses based on cache-control headers, directly addressing the goal of improving response time for a globally distributed web application.

Answer

Cloud DNS

Answer

Cloud NAT

Answer

Cloud Armor

Question 11

An SRE team created the above logs-based metric. They expect it to count the number of HTTP 500 errors per instance. However, the metric shows no data. What is the most likely cause?

Accepted Answer

The log entries might not have the 'status' field in jsonPayload; it could be in a different location or format.. The most likely reason for a logs-based metric showing no data is that the log entries do not contain the expected 'status' field in jsonPayload, or it is located in a different field (e.g., httpRequest.status) or formatted as a string instead of an integer. Cloud Logging metrics rely on exact field paths defined in the metric descriptor; if the field is missing or misnamed, no data points are generated.

Answer

The metric kind is DELTA but should be CUMULATIVE.

Answer

The metric name does not follow the required naming convention.

Answer

The labelExtractors must use regex instead of JSON path.

Question 12

A company wants to monitor custom application metrics in real-time and trigger alerts when a metric exceeds a threshold. Which Google Cloud service should they use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it is designed to ingest custom application metrics via the Monitoring API or OpenTelemetry, create dashboards for real-time visualization, and configure alerting policies that trigger notifications when a metric exceeds a defined threshold. This directly meets the requirement for real-time monitoring and threshold-based alerts.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

Cloud Error Reporting

Question 13

An application on GKE frequently reads the same data from a Cloud Storage bucket. The data changes rarely. Which solution will best improve read performance and reduce costs?

Accepted Answer

Deploy a sidecar container that caches the data in an emptyDir volume.. Deploying a sidecar container with an emptyDir volume caches frequently accessed, rarely changing data locally within the pod. This reduces latency by avoiding repeated network calls to Cloud Storage and eliminates egress and operation costs for those reads. emptyDir volumes are ephemeral and tied to the pod's lifecycle, making them ideal for caching read-heavy, static data without incurring persistent storage costs.

Answer

Configure a Cloud SQL read replica for the data.

Answer

Increase the number of nodes in the cluster.

Answer

Use a StatefulSet with a persistent volume claim to store the data.

Question 14

A company wants to optimize costs for their Google Kubernetes Engine (GKE) clusters. Which three best practices should they implement? (Choose three.)

Accepted Answer

Use committed use discounts for long-running workloads. The correct answers are C, D, and E. Committed use discounts (C) reduce costs for predictable, long-running workloads by offering a discount in exchange for a commitment to use a certain amount of resources. Properly setting pod resource requests and limits (D) prevents overprovisioning and ensures efficient resource utilization, directly reducing costs. Preemptible nodes (E) are short-lived, cheaper instances ideal for stateless, fault-tolerant workloads, offering significant cost savings. Option A (node auto-provisioning) can help right-size clusters but is not a direct cost optimization practice—it may even increase costs if not carefully configured. Option B (regional clusters) improves availability but incurs higher costs due to multi-zone replication, so it is not a cost-saving measure.

Answer

Use node auto-provisioning to dynamically add nodes

Answer

Use regional clusters instead of zonal clusters

Question 15

A startup runs a mobile app backend on App Engine standard environment. They recently added new features, and the app's response time increased significantly. The team suspects instance startup time is causing cold starts for new users. They have already reduced code size and enabled warmup requests. What is the best next step to improve performance?

Accepted Answer

Increase the number of idle instances using automatic scaling settings. Warmup requests reduce cold starts by initializing the app before live traffic arrives, but they don't eliminate startup latency for new instances. Increasing the number of idle instances via automatic scaling settings ensures that pre-warmed, ready-to-serve instances are always available, so new users never trigger a cold start. This directly addresses the root cause—instance startup time—without changing the environment or adding complexity.

Answer

Migrate to App Engine flexible environment

Answer

Implement a latency-based health check to redirect traffic

Answer

Use Cloud Endpoints to limit traffic and reduce load