PCDOE Practice Test 34 — 15 Questions

Question 1

A company is setting up a new Google Cloud organization for DevOps. They want to enforce that all projects have a specific set of VPC Service Controls perimeters. Which approach should they use to ensure these perimeters are automatically applied to all new projects?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define an organization policy with a constraint that requires all projects to be within a perimeter.. Google Cloud Organization Policies allow you to define and enforce constraints at the organization, folder, or project level. The `constraints/compute.restrictVpcServiceControls` constraint can be set to require all new projects to be within a specific VPC Service Controls perimeter, ensuring automatic enforcement without manual intervention.

Answer

Configure Cloud Shell to run a script that creates a perimeter when a new project is created.

Answer

Use Deployment Manager to deploy a configuration that creates a perimeter for each new project.

Answer

Create a VPC Service Controls perimeter and add the organization node as a member.

Question 2

You are creating a Cloud Monitoring dashboard to display the 99th percentile latency of your HTTP Load Balancer over the last 6 hours. Which MQL query should you use?

Accepted Answer

fetch loadbalancing.googleapis.com/https/total_latencies | align percentile(99). It uses the correct metric type (`total_latencies`) and the proper MQL function `percentile(99)` to compute the 99th percentile latency. The `fetch` statement targets the exact Cloud Monitoring metric for HTTPS load balancer latencies, and `align percentile(99)` aggregates the raw latency distribution data over the specified time window (last 6 hours) to produce the desired percentile value.

Answer

fetch https_lb_rule :: latency | align 99p

Answer

fetch loadbalancing.googleapis.com/https/request_count | align | ratio

Answer

fetch loadbalancing.googleapis.com/https/total_latencies | align 99 | with latency

Question 3

An incident is declared for a production service running on GKE. The on-call engineer suspects a recent code change may have introduced a memory leak. Which THREE actions should the engineer take to investigate and mitigate?

Accepted Answer

Increase the memory limit for the container as a temporary mitigation. Increasing the memory limit for the container provides a temporary mitigation to prevent the service from being killed by the Out of Memory (OOM) killer while the root cause is investigated. In GKE, the container's memory limit is defined in the pod spec under `resources.limits.memory`, and raising it gives the application more headroom to continue serving requests without immediate termination. This is a standard incident response practice to buy time for deeper analysis, such as reviewing logs and metrics, before applying a permanent fix.

Answer

Scale down the number of replicas to reduce memory pressure

Answer

Roll back the deployment immediately without further investigation

Question 4

Based on the log entry, what is the most likely cause of the 404 error?

Accepted Answer

The revision is not configured with the correct container port.. A 404 error on Cloud Run typically indicates that the request reached the service but no container is listening on the configured port. If the revision's container port does not match the port the application is actually serving on (e.g., the app listens on 8080 but the revision is configured for 3000), Cloud Run's HTTP ingress will fail to route traffic, resulting in a 404. This is the most likely cause because the error is not a permission or resource issue, but a routing mismatch at the container level.

Answer

The user does not have permission to invoke the service.

Answer

The Cloud Run service is not autoscaling properly, causing requests to be dropped.

Answer

The service has run out of memory.

Question 5

A DevOps engineer needs to set up a centralized logging solution for multiple projects. They want to store logs in a BigQuery dataset for analysis. What is the best approach?

Accepted Answer

Create an aggregated sink at the organization or folder level to export logs to BigQuery.. An aggregated sink at the organization or folder level allows you to collect logs from all projects within that hierarchy into a single BigQuery dataset in a centralized project. This approach eliminates the need to configure individual sinks per project, reduces administrative overhead, and ensures consistent log routing across the entire organization.

Answer

Use Cloud Logging's export feature to Pub/Sub and then to BigQuery.

Answer

Use the BigQuery Data Transfer Service for logs.

Answer

Create a sink in each project to export logs to the BigQuery dataset.

Question 6

A company is bootstrapping a Google Cloud organization for DevOps. Which TWO practices should be implemented to ensure secure and efficient management of infrastructure as code (IaC) pipelines?

Accepted Answer

Use a dedicated project for CI/CD pipelines that houses Cloud Build triggers and Cloud Source Repositories.. Using a dedicated project for CI/CD pipelines isolates Cloud Build triggers and Cloud Source Repositories from other workloads, preventing accidental interference and simplifying access control. This aligns with Google Cloud's recommended landing zone pattern where pipeline infrastructure is managed separately from application environments.

Answer

Store infrastructure secrets (e.g., API keys) directly in Terraform configuration files for simplicity.

Answer

Use a single project to host all development, staging, and production environments to reduce complexity.

Answer

Require manual approval from a security team for every infrastructure change.

Question 7

Which tool is recommended for managing the initial setup of a Google Cloud organization, including creating folders, projects, and IAM policies in an automated and repeatable manner?

Accepted Answer

Terraform. Terraform is the recommended tool for bootstrapping a Google Cloud organization because it is declarative, idempotent, and supports infrastructure-as-code (IaC) for creating folders, projects, and IAM policies in an automated and repeatable manner. Unlike Google Cloud's Deployment Manager, Terraform is cloud-agnostic and has a mature provider (hashicorp/google) that directly manages organization-level resources such as google_folder, google_project, and google_organization_iam_member. This aligns with DevOps best practices for version-controlled, reproducible infrastructure provisioning.

Answer

Deployment Manager

Answer

Cloud Console

Answer

gcloud command line

Question 8

Arrange the steps to migrate a monolithic application to microservices on Google Kubernetes Engine.

Accepted Answer

Identify contexts, then containerize, then deploy, then set up communication between microservices, then redirect traffic.. Identify contexts, containerize, deploy, set up communication, redirect traffic.

Answer

Containerize, then identify contexts, then deploy, then set up communication between microservices, then redirect traffic.

Answer

Identify contexts, then deploy, then containerize, then set up communication between microservices, then redirect traffic.

Answer

Identify contexts, then containerize, then set up communication between microservices, then deploy, then redirect traffic.

Question 9

A company runs a microservices architecture on GKE with Istio service mesh. They observe that service-to-service latency has increased after enabling mTLS. What is the most likely cause?

Accepted Answer

mTLS encryption overhead. Enabling mTLS in Istio encrypts all service-to-service traffic using mutual TLS, which adds CPU overhead for encryption and decryption of each request. This encryption overhead directly increases latency, especially for high-throughput or small-payload services, as the sidecar proxies must perform TLS handshakes and cryptographic operations on every packet.

Answer

Incorrect load balancer configuration

Answer

Network policy restriction

Answer

Sidecar proxy resource limits

Question 10

A company uses Cloud Storage to store archival data. They want to minimize storage costs while maintaining availability. Which storage class should they use?

Accepted Answer

Archive storage class.. The Archive storage class is the correct choice because it offers the lowest storage cost for archival data that is accessed less than once per year, with a 365-day minimum storage duration and retrieval costs that are higher than other classes. This aligns with the requirement to minimize storage costs while maintaining availability, as Archive data is still available for retrieval (though with a longer latency) and is replicated for durability.

Answer

Nearline storage class.

Answer

Standard storage class.

Answer

Coldline storage class.

Question 11

A team deploys a Cloud Function that processes user requests. They notice cold starts cause high latency for the first request after a period of inactivity. What is the most effective way to reduce cold starts?

Accepted Answer

Set the minimum instances to 1. Setting minimum instances to 1 pre-warms a function instance, keeping it idle and ready to serve requests immediately. This eliminates the cold start latency for the first request after inactivity because the runtime environment is already initialized and loaded into memory.

Answer

Use a larger function timeout

Answer

Increase the memory allocation

Answer

Deploy the function in multiple regions

Question 12

A company runs a stateful workload on Compute Engine with local SSDs. They need to improve disk I/O performance without changing the instance type. Which THREE actions should they take?

Accepted Answer

Stripe data across multiple local SSD volumes using RAID 0.. Striping data across multiple local SSD volumes using RAID 0 increases the aggregate I/O throughput and IOPS by distributing read and write operations across all disks in parallel. This directly improves disk I/O performance without changing the instance type, as local SSDs are physically attached to the host and offer the highest performance when combined.

Answer

Migrate to persistent SSD for better durability.

Answer

Enable encryption for the local SSDs to reduce I/O overhead.

Question 13

Refer to the exhibit. A DevOps engineer is debugging a Cloud Build pipeline that fails after the second step. The error indicates that the docker push fails with a permission denied error. The service account used by Cloud Build has the roles/storage.objectAdmin role on the project. What is the most likely cause of the failure?

Accepted Answer

The Cloud Build service account needs the roles/artifactregistry.writer role.. The service account has storage.objectAdmin which grants access to Cloud Storage, not Artifact Registry. Pushing to Artifact Registry requires the roles/artifactregistry.writer (or admin) role. Option A is too vague. Option D is already performed in the first step. Option B is less likely as the path appears correct. Option C correctly identifies the missing role.

Answer

The docker push command uses an incorrect repository path.

Answer

The service account does not have permission to push to Artifact Registry.

Answer

The gcloud auth configure-docker step must be run for Artifact Registry.

Question 14

A company uses Spinnaker for continuous delivery across multiple GKE clusters. After a recent infrastructure change, the 'Canary' deployment strategy fails during the 'disable' phase of the old version. The error log shows: 'Unable to disable server group: Not authorized to perform compute.instanceGroups.update.' What is the most likely root cause?

Accepted Answer

The Spinnaker service account lacks the compute.instanceGroups.update permission on the project.. The error 'Unable to disable server group: Not authorized to perform compute.instanceGroups.update' directly indicates an IAM permissions issue. In Spinnaker, the service account used to interact with GCP must have the compute.instanceGroups.update permission to manage instance groups during the disable phase of a canary deployment. Option C correctly identifies that the Spinnaker service account lacks this specific permission on the project.

Answer

The GKE cluster has reached its maximum node quota.

Answer

The Cloud Deploy pipeline is missing the required IAM role for the Spinnaker service account.

Answer

The Kayenta canary analysis service is not configured correctly.

Question 15

A company uses Cloud Build to deploy a microservices application to Google Kubernetes Engine (GKE). They want to integrate Container Analysis to scan images for vulnerabilities before deployment. What is the minimal set of changes needed to achieve this?

Accepted Answer

Enable the Container Analysis API; no changes to the build configuration are needed.. Enabling the Container Analysis API allows Cloud Build to automatically scan container images for vulnerabilities when they are pushed to Container Registry or Artifact Registry. No additional build steps or configuration changes are required. Option B is incorrect because migrating to Artifact Registry is not minimal; Container Analysis works with both registries. Option C is incorrect because Cloud Build already integrates with Container Analysis, so adding a separate scanner is unnecessary. Option D is incorrect because Binary Authorization is a policy enforcement tool that uses scan results but does not perform scanning itself.

Answer

Migrate images from Container Registry to Artifact Registry and enable vulnerability scanning there.

Answer

Add a build step to run a vulnerability scanner CLI tool before pushing the image.

Answer

Enable Binary Authorization to block deployment of vulnerable images.