PCDOE Practice Test 6 — 10 Questions

Question 1

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Option C is correct because hosting shared CI/CD tooling and artifacts (e.g., Cloud Build, Artifact Registry, or Jenkins) in a dedicated project isolates build infrastructure from workload projects, enabling centralized access control, quota management, and auditing while keeping pipelines reusable across the organization. Option D is correct because Organization Policies (e.g., constraints like constraints/iam.disableServiceAccountKeyCreation or constraints/compute.requireShieldedVm) provide guardrails that enforce compliance and security baselines consistently across all projects, which is essential for a scalable DevOps foundation. Option A is wrong because sharing a single service account key across projects violates least privilege, prevents per-project auditability, and creates a single point of compromise; keys should be scoped per workload and preferably replaced with workload identity federation. Option B is wrong because disabling Organization Policies removes the guardrails that prevent insecure or non-compliant configurations, increasing risk rather than enabling safe DevOps. Option E is wrong because a single broadly-permissioned service account used by all projects violates least privilege and blast-radius containment, and Google recommends distinct, narrowly scoped service accounts per project or workload.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 2

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. Option A is correct because a Shared VPC lets a host project centrally manage subnets and firewall rules while service projects from different teams attach to that network, which enforces consistent networking and avoids duplicated VPCs across the organization. Option D is correct because folders let you group projects by team, environment, or business unit and apply IAM policies and Organization Policies hierarchically, so permissions and constraints inherit cleanly to all contained projects. Option B is not a best practice because separate billing accounts per team add administrative overhead and fragment cost visibility; a single billing account with labels and budgets is preferred. Option C is wrong because granting all users the Project Creator role allows anyone to create projects freely, undermining governance and quota control. Option E is not a best practice because APIs should be enabled only where needed to follow least privilege and reduce attack surface, not blanket-enabled in every project.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 3

Which THREE are key considerations when setting up a Google Cloud organization for DevOps?

Accepted Answer

Enable audit logging and set up log sinks to a centralized logging project.. Option B is correct because enabling Cloud Audit Logs (Admin Activity, Data Access, and System Event logs) and configuring aggregated log sinks to a centralized logging project gives the organization a tamper-resistant, single pane for security monitoring, compliance, and incident response across all projects. Option C is correct because a Shared VPC lets a host project export subnets to service projects, providing centralized network administration, consistent firewall and routing policies, and private connectivity between DevOps projects without complex VPC peering meshes. Option D is correct because a folder hierarchy that mirrors the organizational structure (for example, folders per department, environment, or team) enables inheritance of IAM policies, org policies, and billing controls, which is fundamental to scalable DevOps governance. Option A is not recommended because sharing one project across development, staging, and production removes environment isolation, causing IAM, quota, and blast-radius problems; separate projects per environment are the Google-recommended pattern. Option E is wrong because storing secrets in code repositories exposes credentials to anyone with repo access and to history leaks; secrets should be kept in Secret Manager (or similar) and injected at runtime.

Answer

Use a single project for development, staging, and production to reduce overhead.

Answer

Store secrets directly in code repositories for easy access by CI/CD pipelines.

Question 4

A DevOps team is troubleshooting a web application that shows high latency during peak hours. The application runs on Google Kubernetes Engine (GKE). They want to identify which specific API calls are causing the delay. Which Google Cloud tool should they use?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool because it is a distributed tracing system that captures latency data from applications, allowing you to trace individual API calls and identify which specific endpoints are causing delays. Unlike Cloud Monitoring, which provides aggregate metrics, Cloud Trace provides per-request latency breakdowns, making it ideal for pinpointing slow API calls in a GKE environment.

Answer

Cloud Monitoring

Answer

Cloud Profiler

Answer

Cloud Logging

Question 5

Which TWO options are valid methods to trigger a Cloud Build build when code is pushed to a Cloud Source Repository?

Accepted Answer

Use a Cloud Pub/Sub message sent to the Cloud Build topic to create a build.. Options A and D are correct. Cloud Build triggers can be based on branch or tag push, and can also be triggered via Pub/Sub message. Option B is incorrect - Cloud Build does not directly listen to Cloud Pub/Sub subscriptions without a trigger. Option C is incorrect - builds are not automatically triggered by Cloud Logging. Option E is incorrect - Cloud Scheduler cannot directly trigger a build without a Pub/Sub or HTTP intermediary.

Answer

Have Cloud Logging monitor the repository and create a build via a logs-based metric.

Answer

Set up a Cloud Pub/Sub subscription that forwards events to Cloud Build.

Answer

Configure Cloud Scheduler to call the Cloud Build API periodically.

Question 6

Which THREE are benefits of migrating from Jenkins to Cloud Build?

Accepted Answer

No server maintenance. Cloud Build is a fully managed CI/CD service that runs on Google Cloud's infrastructure, eliminating the need for users to provision, configure, or maintain build servers. Unlike Jenkins, which requires ongoing administration of the Jenkins master and agent nodes, Cloud Build automatically scales resources and handles underlying server maintenance, including OS patches and hardware failures.

Answer

Support for any VCS

Answer

Built-in security scanning

Question 7

A team is implementing a CI/CD pipeline for a Kubernetes application. They want to use canary deployments with traffic splitting. Which tool or service is best suited for this?

Accepted Answer

Cloud Deploy with Skaffold. Cloud Deploy with Skaffold is best suited for canary deployments with traffic splitting because Cloud Deploy provides built-in support for progressive delivery strategies, including canary and blue-green deployments, and integrates with Skaffold to manage Kubernetes manifests and traffic routing via service mesh or ingress controllers. Skaffold handles the build and deploy stages, while Cloud Deploy orchestrates the rollout with automated traffic splitting and promotion/rollback logic, making it the only option that directly addresses the requirement.

Answer

Cloud Run

Answer

Cloud Build

Answer

Anthos Config Management

Question 8

A team notices that a Cloud Run service occasionally has high latency. They suspect a memory leak or excessive CPU usage. Which tool should they use to identify the bottleneck during those periods?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and memory usage data from your Cloud Run service, allowing you to identify which functions or code paths are consuming excessive resources during high-latency periods. Unlike monitoring or logging, Profiler provides a flame graph that pinpoints the exact bottleneck (e.g., a memory leak or CPU spike) at the function level, which is essential for diagnosing performance issues in a serverless environment.

Answer

Cloud Trace

Answer

Cloud Monitoring

Answer

Cloud Logging

Question 9

A large stateful service running on Compute Engine experiences variable performance due to CPU throttling from noisy neighbors. Which solution provides the most consistent performance?

Accepted Answer

Use sole-tenant nodes to isolate the VMs. Sole-tenant nodes ensure that your VMs are the only ones running on the underlying physical server, eliminating resource contention from other tenants (noisy neighbors). This provides consistent CPU performance because the vCPUs are not oversubscribed and the full physical core capacity is dedicated to your instances.

Answer

Enable live migration for the VMs

Answer

Use preemptible VMs for stateful workloads

Answer

Purchase committed use discounts for lower cost

Question 10

Which service should be used to monitor the health of HTTP endpoints from multiple locations?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) includes uptime checks that can be configured to probe HTTP endpoints from multiple global locations, measuring latency, availability, and response content. This makes it the correct service for monitoring the health of HTTP endpoints from diverse geographic regions.

Answer

Cloud Trace

Answer

Cloud Logging

Answer

Cloud Debugger