PCDOE Practice Questions 1 — 50 Questions

Question 1

A company uses Cloud Run for a stateless API service with concurrency set to 80. During a traffic spike, some requests return HTTP 500 errors and latency spikes. Cloud Monitoring shows container CPU utilization at 100% and memory usage at 70%. What is the most likely cause and the best first step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Concurrency per container is too high; reduce concurrency to 10. With CPU at 100% and memory at only 70%, the bottleneck is CPU, not memory. Cloud Run containers handle requests concurrently; setting concurrency to 80 means each container processes up to 80 requests simultaneously. When CPU is saturated, requests queue up, causing latency spikes and eventual HTTP 500 errors as the container becomes unresponsive. Reducing concurrency to 10 lowers the per-container request load, allowing each request to complete before CPU saturation occurs.

Answer

Maximum instances limit is too low; increase from 10 to 100

Answer

Min idle instances is too low; set min idle to 5 to reduce cold starts

Answer

Memory limit is too low; increase memory from 256 MiB to 512 MiB

Question 2

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

Accepted Answer

Cloud Asset Inventory can be used to discover all resources in the organization.. Option B is correct because Cloud Asset Inventory provides a centralized, organization-wide view of all Google Cloud resources and their metadata, making it the right tool to discover and inventory resources across every project in the organization during bootstrapping. Option E is correct because organization policies are hierarchical constraints that can be set at the organization, folder, or project level, with child nodes inheriting and able to further restrict (but not loosen) the parent policy, which is essential for enforcing governance as the org scales. Option A is wrong because enabling the cloudresourcemanager.googleapis.com API does not automatically apply any organization policies; policies must be explicitly defined and attached. Option C is wrong because projects do not automatically share a default VPC network — each project gets its own default network (or none), and shared VPC must be configured deliberately. Option D is wrong because Admin Activity audit logs are enabled by default and always on, while Data Access logs are the ones disabled by default and must be explicitly enabled per service.

Answer

After enabling the cloudresourcemanager.googleapis.com API, organization policies are automatically applied.

Answer

All projects in an organization automatically share a default VPC network.

Answer

Cloud Audit Logs are disabled by default and must be enabled for each service.

Question 3

Which TWO are best practices for implementing service monitoring strategies in Google Cloud?

Accepted Answer

Monitor the four golden signals (latency, traffic, errors, saturation) for every service.. A is correct because the four golden signals (latency, traffic, errors, saturation) are the foundational metrics recommended by Google SRE practices for monitoring any service. Monitoring these signals provides a comprehensive view of service health and user experience, enabling rapid detection of issues like high latency or resource exhaustion.

Answer

Rely solely on synthetic monitoring to measure user experience.

Answer

Use multiple monitoring tools to cover all aspects of the system.

Answer

Manually analyze logs and metrics to identify issues.

Question 4

A company uses Cloud Monitoring to track latency for a multi-region web application. The SLO is 99.9% of requests under 500ms over a 30-day rolling window. The error budget has been rapidly depleting over the last week. The operations team wants to understand the impact of recent deployments. Which approach should they use to correlate deployment changes with latency spikes?

Accepted Answer

Create a custom dashboard in Cloud Monitoring that includes latency charts and use annotation markers to indicate deployment times. Cloud Monitoring supports custom dashboards with annotation markers that can be programmatically or manually added to indicate deployment events. By overlaying these markers on latency charts, the operations team can visually correlate deployment times with latency spikes, enabling direct root-cause analysis without manual log searching or separate tools.

Answer

Use Cloud Logging to search for deployment logs and manually compare with latency metrics

Answer

Use Cloud Trace to analyze latency distributions for each deployment version

Answer

Configure Error Reporting to alert on latency threshold breaches

Question 5

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Accepted Answer

Identify time, then Clone, then Verify, then Promote, then Update connections. The correct sequence for recovering a Google Cloud SQL instance from a point-in-time backup is: first, identify the exact point-in-time to recover; second, clone the instance to that time; third, verify the cloned instance's data; fourth, promote the clone to become the primary instance; and fifth, update application connections to use the new primary. This order ensures a consistent and verifiable recovery process.

Answer

Clone, then Identify time, then Verify, then Promote, then Update connections

Answer

Identify time, then Clone, then Promote, then Verify, then Update connections

Answer

Clone, then Identify time, then Promote, then Verify, then Update connections

Question 6

Which TWO practices should be implemented to optimize query performance in Cloud Spanner?

Accepted Answer

Use interleaved tables to co-locate related rows.. Option C is correct because interleaved tables physically co-locate child rows with their parent rows in the same split, so parent-child joins and lookups can be executed without network hops or distributed joins, which directly reduces query latency and improves performance. Option E is correct because Cloud Spanner uses secondary indexes to satisfy predicates efficiently; defining secondary indexes on columns frequently referenced in WHERE clauses lets the optimizer perform index scans instead of full table scans, cutting the amount of data read. Option A is not appropriate because manually splitting large tables into many smaller tables breaks the relational model and does not address Spanner's automatic sharding, which already distributes data across splits. Option B is wrong because creating excessive indexes on all columns adds write amplification and storage overhead and can degrade write performance without benefiting queries. Option D is incorrect because interleaving is a parent-child locality mechanism within a database and cannot be applied globally across regions; cross-region distribution is handled by the instance configuration, not by interleaving.

Answer

Split large tables into multiple smaller tables to distribute load.

Answer

Create as many indexes as possible on all columns.

Answer

Use globally distributed interleaving across regions.

Question 7

A company uses BigQuery on-demand pricing. To control costs, they want to prevent any single query from scanning more than 1 TB of data. How can they enforce this?

Accepted Answer

Use the maximum bytes billed parameter in the query settings. The maximum bytes billed parameter is a per-query setting in BigQuery that causes the query to fail if the estimated bytes to be scanned exceed the specified limit. This directly enforces a hard cap on data scanned per query, preventing any single query from processing more than 1 TB. It is available in the query settings of the BigQuery UI, bq command-line tool, and API, and is the intended mechanism for cost control at the query level.

Answer

Set a custom cost budget with alert at 1 TB

Answer

Use BigQuery reservations with 1 TB slot capacity

Answer

Set a query quota in the GCP Console quota page

Question 8

A company is implementing CI/CD for a microservices application on Google Kubernetes Engine (GKE). The team wants to ensure that each service can be built and deployed independently without affecting other services. They also need to enforce that only successfully tested builds are deployed to production. Which CI/CD approach should they use?

Accepted Answer

Create separate Cloud Build triggers per microservice, each building a container image, and use Cloud Deploy to manage canary deployments to GKE with automated promotion after tests pass.. It uses separate Cloud Build triggers per microservice to enable independent builds, and Cloud Deploy with canary deployments and automated promotion after tests pass ensures that only successfully tested builds reach production. This approach aligns with the requirements of independent service deployment and gated promotion to production on GKE.

Answer

Use Cloud Build to build all services and deploy to Cloud Run, then use traffic splitting to promote new versions.

Answer

Create a single Cloud Build trigger that builds all services and deploys to a staging cluster, then manually promote to production.

Answer

Use Spinnaker with a single pipeline that builds all services, and configure manual judgment gates for production promotion.

Question 9

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.. Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.

Answer

Use a user account for the CI/CD pipeline and assign it the necessary roles.

Answer

Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.

Answer

Generate a single service account key and securely distribute it to the CI/CD system.

Question 10

A company stores historical log data in Cloud Storage. The logs are accessed rarely after 30 days. They want to reduce storage costs while maintaining immediate access for occasional audits over the next year. What should they use?

Accepted Answer

Standard class storage with a lifecycle policy to transition to Nearline after 30 days and to Coldline after 90 days. It uses a lifecycle policy to automatically transition objects from Standard to Nearline after 30 days and then to Coldline after 90 days, which reduces cost as access frequency drops while still providing immediate (millisecond) access for occasional audits throughout the year. Nearline and Coldline both offer low-latency access with no retrieval delay, so the data remains available for audits. Option B (Nearline only) would not optimize costs for data older than 90 days that could move to cheaper Coldline. Option C (Coldline with deletion after 1 year) risks losing data needed for audits and does not tier from Standard. Option D (Archive) is unsuitable because Archive has retrieval latency of hours, violating the immediate-access requirement.

Answer

Nearline class storage

Answer

Coldline class storage with a lifecycle policy to delete after 1 year

Answer

Archive class storage

Question 11

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Accepted Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Define delivery pipeline → Step 4: Push code → Step 5: Promote. The correct order for setting up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service begins with creating a build configuration file (cloudbuild.yaml) that specifies how to build and test the application. Next, you set a trigger (e.g., on push to a branch) in Cloud Build to automatically start builds. Then, you define a delivery pipeline in Cloud Deploy with targets (e.g., staging, production) and approval gates. After that, you push code to the repository, which triggers the build and, if successful, creates a release in the delivery pipeline. Finally, you promote the release through the stages (e.g., from staging to production) either automatically or after manual approval. This order ensures each prerequisite is in place before the next step, enabling a seamless automated workflow.

Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Push code → Step 4: Define delivery pipeline → Step 5: Promote

Answer

Step 1: Define delivery pipeline → Step 2: Create build config → Step 3: Set trigger → Step 4: Push code → Step 5: Promote

Answer

Step 1: Push code → Step 2: Create build config → Step 3: Set trigger → Step 4: Define delivery pipeline → Step 5: Promote

Question 12

An organization uses Cloud Deploy with Skaffold to manage progressive delivery on GKE. After a rollout, the new revision shows a higher error rate in Stackdriver, but the Cloud Deploy pipeline did not automatically roll back. What is the most likely cause?

Accepted Answer

The Cloud Deploy pipeline does not have a stackdriverMetrics verification job defined to check error rates.. Cloud Deploy does not automatically roll back based on error rates unless a verification job (such as a Stackdriver metrics check) is explicitly defined in the pipeline. Without a verification step that monitors error rates and fails the rollout, Cloud Deploy will continue advancing through phases even if the new revision is unhealthy. Therefore, the absence of a stackdriverMetrics verification job is the most likely cause.

Answer

The rollout strategy includes a manual approval step before advancing to the next phase.

Answer

The release was created with a '--disable-rollback' flag.

Answer

The rollout has not yet reached 100% traffic, so Cloud Deploy waits for full completion before evaluating health.

Question 13

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the roles/run.admin role.. The Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) requires the roles/run.admin role to deploy to Cloud Run. This role grants permission to create, update, and manage Cloud Run services. Without it, the deployment step fails with a 'Permission denied' error, even though the build itself succeeds.

Answer

The Cloud Run service account lacks the roles/cloudbuild.builds.builder role.

Answer

The trigger is missing the required deployment configuration.

Answer

The cloudbuild.yaml file has an incorrect image tag.

Question 14

Which Cloud Monitoring feature can directly correlate this error with the associated trace and VM instance?

Accepted Answer

Error Reporting. Error Reporting in Google Cloud automatically groups errors from Cloud Logging and can directly correlate an error with the associated trace ID and VM instance metadata. This is because Error Reporting ingests structured log entries that contain the `@type` field set to `type.googleapis.com/google.devtools.clouderrorreporting.v1beta1.ReportedErrorEvent` and parses the `serviceContext` and `context` fields to link the error to the specific trace and resource (e.g., VM instance).

Answer

Log-based metrics

Answer

Metrics Explorer

Answer

Alerting policies

Question 15

A company wants to monitor custom application metrics in real-time and trigger alerts when a metric exceeds a threshold. Which Google Cloud service should they use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it is designed to ingest custom application metrics via the Monitoring API or OpenTelemetry, create dashboards for real-time visualization, and configure alerting policies that trigger notifications when a metric exceeds a defined threshold. This directly meets the requirement for real-time monitoring and threshold-based alerts.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

Cloud Error Reporting

Question 16

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Accepted Answer

secretmanager.versions.access. The custom role assigned to the Cloud Build service account lacks the `secretmanager.versions.access` permission, which is required to access the payload of a secret version in Secret Manager. Without this permission, any attempt to read the secret value during a build step will fail with a permission denied error, even if the service account has other roles on the project.

Answer

cloudbuild.builds.update

Answer

run.services.get

Answer

iam.serviceAccounts.actAs

Question 17

A DevOps team is troubleshooting a Cloud Build pipeline that fails intermittently when building a container image. The build step uses a custom build step that runs a vulnerability scan. The error log shows: 'Step #1: Error: failed to scan image: context deadline exceeded'. The build configuration includes 'timeout: 600s'. Which is the most likely cause and solution?

Accepted Answer

The scan step is taking longer than the build timeout; increase the timeout value in the build configuration.. The error 'context deadline exceeded' indicates that the custom vulnerability scan step is taking longer than the build's configured timeout of 600 seconds. Cloud Build enforces a hard timeout for the entire build; if any step exceeds this duration, the build is terminated. Increasing the timeout value in the build configuration provides more time for the scan to complete, directly addressing the root cause.

Answer

The scan tool requires a specific dependency; add an installation step before scanning.

Answer

There is network latency between Cloud Build and the container registry; use VPC Service Controls.

Answer

The build step is running out of memory; increase the machine type to e2-highcpu-8.

Question 18

An organization wants to implement a CI/CD pipeline that automatically deploys to a staging environment on every push to the main branch, and deploys to production only after a manual approval. They use Cloud Build and Cloud Deploy. What is the best way to configure this?

Accepted Answer

Configure a Cloud Deploy delivery pipeline with a staging target (automatic promotion) and a production target (require approval).. Cloud Deploy natively supports delivery pipelines with multiple targets, where you can configure automatic promotion to staging and require manual approval for production. This aligns with the requirement for a CI/CD pipeline that deploys to staging on every push to main and to production only after manual approval, using Cloud Build for the build and Cloud Deploy for the deployment orchestration.

Answer

Create a single Cloud Build pipeline that deploys to both staging and production using conditional steps based on branch name.

Answer

Use Cloud Build to deploy to Cloud Run, and configure traffic splitting to gradually shift traffic from staging to production.

Answer

Use Cloud Build triggers with two separate build configs: one for staging (automatic), one for production (manual trigger).

Question 19

A startup wants to reduce their Google Cloud costs for a batch processing job that runs nightly for 3 hours. The job is fault-tolerant and can tolerate interruptions. What is the most cost-effective compute option?

Accepted Answer

Preemptible VM. Preemptible VMs (Option D) are the most cost-effective because they offer up to 60-91% discount and are suitable for fault-tolerant, interruptible batch jobs. Standard VMs (Option A) are more expensive. Shielded VMs (Option B) provide security features but no cost savings. Sole-tenant nodes (Option C) provide isolation but are more costly.

Answer

Standard VM

Answer

Shielded VM

Answer

Sole-tenant node

Question 20

Your company runs a multi-region application on GKE across us-east1 and europe-west1. The application serves a global user base with a strict SLO of 99.95% availability. Recently, the team noticed that during peak hours, some users in South America experience high latency and intermittent errors. The GKE clusters are monitored via Cloud Monitoring with custom dashboards and alerting policies. The team has set up a single alerting policy that triggers when the global error rate exceeds 0.1%. However, the alert fires only after the issue has persisted for 10 minutes, and by then the customer impact is already significant. You need to improve the detection and response time. Which action should you take first?

Accepted Answer

Create separate alerting policies per region with shorter evaluation periods, and set up a notification channel for the on-call team.. The current single global alerting policy with a 10-minute evaluation period introduces a significant delay in detecting regional issues. By creating separate alerting policies per region with shorter evaluation periods, you can detect and respond to regional anomalies (like high latency in South America) much faster, directly improving the detection time for the multi-region application and reducing customer impact.

Answer

Add a dashboard that shows latency by region and set up a log-based metric for error counting.

Answer

Reduce the alerting policy's duration to 1 minute and increase the threshold to 0.5% to reduce noise.

Answer

Implement a canary deployment strategy to roll back changes quickly.