PCDOE Practice Test 4 — 10 Questions

Question 1

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Accepted Answer

Identify time, then Clone, then Verify, then Promote, then Update connections. The correct sequence for recovering a Google Cloud SQL instance from a point-in-time backup is: first, identify the exact point-in-time to recover; second, clone the instance to that time; third, verify the cloned instance's data; fourth, promote the clone to become the primary instance; and fifth, update application connections to use the new primary. This order ensures a consistent and verifiable recovery process.

Answer

Clone, then Identify time, then Verify, then Promote, then Update connections

Answer

Identify time, then Clone, then Promote, then Verify, then Update connections

Answer

Clone, then Identify time, then Promote, then Verify, then Update connections

Question 2

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Organization Policies can enforce that all new projects must have specific labels by using a constraint like `constraints/compute.requireOsLogin` is not for labels, but you can use a custom constraint with the `constraints/gcp.resourceLabels` to require labels on resources. However, for projects themselves, you can use an organization policy with a list constraint to mandate that certain labels are present on all projects, and the policy will block creation of any project that does not comply.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 3

Refer to the exhibit. A DevOps engineer applies this Terraform configuration but gets an error: "Error creating Project: googleapi: Error 403: The caller does not have permission to enable services". What is the most likely cause?

Accepted Answer

The service account used by Terraform lacks the Service Usage Admin role on the project.. The error 'The caller does not have permission to enable services' indicates that the identity (service account) used by Terraform to authenticate with the Google Cloud API lacks the required IAM permission to enable Google APIs on the project. The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) grants the necessary permissions, including serviceusage.services.enable and serviceusage.services.list, which are required to enable services like the Compute Engine API during resource creation. Without this role, the API call to enable services fails with a 403 error.

Answer

The org_id is incorrect.

Answer

The organization requires that the Compute Engine API be enabled before project creation.

Answer

The project ID already exists.

Question 4

A DevOps team wants to optimize resource utilization for their GKE deployment. Which built-in Kubernetes resource can automatically adjust CPU and memory requests based on historical usage?

Accepted Answer

VerticalPodAutoscaler. The VerticalPodAutoscaler (VPA) is the correct choice because it automatically adjusts CPU and memory resource requests (and limits) for pods based on historical usage data, optimizing resource utilization without manual intervention. Unlike the HorizontalPodAutoscaler, which scales the number of pods, the VPA modifies the resource specifications of existing pods to match observed demand.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

PodDisruptionBudget

Question 5

You are an on-call engineer responding to a critical service incident affecting a production application. According to Google's Incident Management best practices, which TWO actions should you take immediately after declaring the incident?

Accepted Answer

Communicate the incident status to stakeholders and affected teams.. Google's Incident Management best practices emphasize that immediately after declaring an incident, the on-call engineer must communicate the incident status to stakeholders and affected teams. This ensures that everyone is aware of the ongoing issue, sets expectations, and prevents redundant troubleshooting. Early communication also helps in coordinating response efforts and reducing confusion during the critical initial phase.

Answer

Notify the incident commander to take over coordination.

Answer

Begin documenting the incident for a postmortem report.

Answer

Roll back the latest deployment to the previous stable version.

Question 6

After deploying a new version of a Cloud Run service, the team notices an increase in 5xx errors. They want to quickly revert to the previous version while minimizing user impact. What is the recommended approach?

Accepted Answer

Use Cloud Run's traffic management to set 100% of traffic to the previous revision.. Cloud Run supports traffic splitting between revisions, allowing you to instantly route 100% of traffic to the previous revision without redeploying. This minimizes user impact because the rollback is immediate and does not require rebuilding or re-pulling container images. Option D is correct because it leverages Cloud Run's built-in traffic management feature for zero-downtime rollbacks.

Answer

Set the minimum number of instances of the new revision to 0.

Answer

Redeploy the previous version from the container registry.

Answer

Modify the ingress settings to restrict traffic to the new revision.

Question 7

An engineer wants to ensure that an alert is escalated if not acknowledged within 5 minutes. Which feature of Cloud Monitoring can achieve this?

Accepted Answer

Notification channel with escalation configuration.. Notification channels in Google Cloud Monitoring can be configured with an escalation policy that defines a sequence of recipients or notification methods to be contacted if an alert is not acknowledged within a specified time. By setting the escalation duration to 5 minutes, the system automatically escalates the alert to the next tier or channel if no acknowledgment is received, directly meeting the engineer's requirement.

Answer

Incident management tool like PagerDuty.

Answer

Using a webhook notification channel.

Answer

Alerting policy with a condition that checks for acknowledgment.

Question 8

A team uses Cloud Build with a Kaniko builder to containerize their application. The build fails with the error: 'failed to push to destination: failed to get credentials: failed to get credential from metadata service: failed to fetch metadata...' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the storage.objectAdmin role on the Container Registry bucket.. The error indicates that Kaniko cannot authenticate to push the built image to Container Registry. Kaniko uses the Cloud Build service account's credentials to authenticate with the registry. By default, the Cloud Build service account has the storage.objectViewer role on the Container Registry bucket, which allows pulling images but not pushing. To push, the service account needs the storage.objectAdmin or storage.objectCreator role on the bucket. Option D correctly identifies this missing permission as the most likely cause.

Answer

Kaniko requires a running Docker daemon in the build step.

Answer

The base image specified in the Dockerfile is not accessible from the build environment.

Answer

The Dockerfile has an invalid instruction causing Kaniko to fail.

Question 9

A DevOps engineer is responsible for cost optimization of GKE clusters. They have identified that many nodes are underutilized. What is the best approach to reduce costs without impacting availability?

Accepted Answer

Enable cluster autoscaler to automatically scale down nodes. Cluster autoscaler automatically scales down nodes when they are underutilized. Option B is manual and not scalable. Option C may cause disruptions. Option D reduces availability.

Answer

Use spot VMs for all node pools

Answer

Delete underutilized nodes manually

Answer

Migrate to a single zone cluster

Question 10

A company runs a CI/CD pipeline using Cloud Build and Cloud Deploy for a web application. The pipeline builds a container image, pushes it to Artifact Registry, and then deploys it to a GKE cluster using Cloud Deploy. Recently, the deployment step started failing with the error: 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry.' The container image is built in the same project as the target cluster. The Cloud Build service account has been granted the roles/cloudbuild.builds.builder and roles/artifactregistry.admin on the project. The DevOps engineer verified that the image exists in Artifact Registry and the path is correct. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Ensure that the Cloud Deploy delivery pipeline references the correct image path, including the project ID and repository.. The error 'INVALID_ARGUMENT: The release contains one or more images that are not in the target project's Artifact Registry' indicates that the Cloud Deploy delivery pipeline is referencing an image path that does not match the actual location of the image. Even though the image exists in Artifact Registry and the path appears correct, Cloud Deploy validates the image reference (including project ID, repository name, and image tag) against the target project's registry. The engineer must ensure the delivery pipeline YAML or configuration explicitly specifies the correct full image path, including the project ID and repository, so that Cloud Deploy can resolve and verify the image during release creation.

Answer

Reconfigure Cloud Build to store images in a different Artifact Registry repository.

Answer

Grant the Cloud Deploy service account the roles/artifactregistry.reader role on the project.

Answer

Change the Cloud Build service account to include the roles/clouddeploy.jobRunner role.