PCDOE Practice Test 7 — 10 Questions

Question 1

A DevOps engineer is bootstrapping a CI/CD pipeline using Cloud Build. They need to ensure that only specific service accounts can trigger builds on certain branches. What is the recommended approach?

Accepted Answer

Use Cloud Build triggers with regular expressions on branch patterns and restrict access via IAM.. Cloud Build triggers natively support regular expressions on branch patterns, and IAM conditions can restrict which service accounts are allowed to invoke specific triggers. This provides a declarative, auditable, and least-privilege approach without custom code or external services.

Answer

Use Cloud Functions to validate branch names before triggering builds.

Answer

Use Cloud Source Repositories with branch protection rules.

Answer

Store the service account keys in Secret Manager and use them in build steps.

Question 2

A team is bootstrapping a new Google Cloud organization. Which TWO practices are recommended for managing project creation and resource hierarchy? (Choose two.)

Accepted Answer

Create a folder for each department to isolate resources.. Creating a folder for each department allows you to isolate resources, apply IAM policies at the folder level, and enforce organizational boundaries. This follows Google Cloud's recommended resource hierarchy best practices for multi-team environments, enabling delegated administration and cost tracking per department.

Answer

Use a centralized service account to create projects via API.

Answer

Use a single project for all development environments.

Answer

Assign project creator role to all users by default.

Question 3

A Cloud Build pipeline that deploys a container to Cloud Run fails with the error: `Missing required permission run.routes.invoke`. The Cloud Build service account has the 'Cloud Run Invoker' role. Which TWO additional steps should be taken?

Accepted Answer

Ensure the service account has the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account.. The Cloud Build service account needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account (the service account that Cloud Run uses to run the container). Without this permission, Cloud Build cannot impersonate the runtime service account to deploy the container, even if it has the Cloud Run Invoker role. The `run.routes.invoke` error occurs because the deployment process requires the ability to invoke the route, which is tied to the runtime service account's permissions.

Answer

Enable the Cloud Run API in the project.

Answer

Use a different service account for deployment.

Answer

Add the `run.routes.invoke` permission to a custom role.

Question 4

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. A shared VPC allows multiple projects to share a common VPC network, enabling centralized control of networking resources, firewall rules, and IP addressing. This is a best practice for multi-team organizations because it reduces administrative overhead, ensures consistent network policies, and simplifies connectivity between projects without requiring complex peering or VPN setups.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 5

A company uses Cloud Build and wants to trigger builds only from the master branch. Which configuration is required?

Accepted Answer

Set the branch filter to 'master' in the trigger.. Cloud Build triggers allow you to specify a branch filter using a regex pattern. Setting the filter to 'master' ensures that only pushes or pull requests targeting the master branch initiate the build. This is the native, supported method for branch-based triggering without additional overhead.

Answer

Create separate triggers for each branch.

Answer

Use a custom Cloud Build step to check the branch name.

Answer

Use a Cloud Function to call Cloud Build for master only.

Question 6

You are investigating a slow increase in latency for a service running on Compute Engine. You have Cloud Monitoring and Cloud Logging set up. Which tool would best help you identify the cause of the latency?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data from distributed applications by tracing requests as they propagate through services. It provides detailed latency distributions and per-span breakdowns, allowing you to pinpoint which component or operation is causing the slowdown. For a Compute Engine service with Cloud Monitoring and Logging already in place, Cloud Trace is the most direct tool to analyze request-level latency.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Debugger

Question 7

A team is experiencing increased latency in their microservices application after a new deployment. They suspect a specific service is the bottleneck. Which tool should they use to identify the slowest service in the request path?

Accepted Answer

Cloud Trace. Cloud Trace is the correct tool because it provides end-to-end latency analysis by capturing trace spans from each microservice in a request path. It aggregates and visualizes the time spent in each service, allowing you to pinpoint the slowest service causing the bottleneck. This directly addresses the need to identify the specific service responsible for increased latency after a deployment.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 8

To securely manage secrets (e.g., API keys) used in Cloud Build pipelines, which service should be used?

Accepted Answer

Secret Manager. Secret Manager is the recommended service for storing and accessing secrets like API keys. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not designed for secrets, and Cloud KMS is not for direct secret storage.

Answer

Cloud KMS

Answer

Cloud Key Management Service (duplicate)

Answer

Cloud Storage

Question 9

A company has an application that experiences intermittent errors. They want to be notified immediately when the error rate exceeds 1% of total requests. What should they implement?

Accepted Answer

Create a log-based metric counting error logs and set an alerting policy in Cloud Monitoring. The requirement is to be notified when the error rate exceeds 1% of total requests, which requires a metric that counts error logs relative to total requests. A log-based metric in Cloud Logging can filter for error log entries (e.g., status codes 5xx), and an alerting policy in Cloud Monitoring can trigger when the ratio of error logs to total requests surpasses 1%. This directly addresses the intermittent error rate condition with precise threshold-based alerting.

Answer

Create an uptime check pointing to the application endpoint

Answer

Use Cloud Trace to analyze latency and set an alert on trace spans

Answer

Create a dashboard showing error count over time

Question 10

Which TWO options are valid methods to create a custom metric descriptor in Cloud Monitoring?

Accepted Answer

Using the gcloud commands: gcloud monitoring metrics create. The `gcloud monitoring metrics create` command directly invokes the Cloud Monitoring API to create a custom metric descriptor. Option E is correct because the Cloud Monitoring API's `CreateMetricDescriptor` method is the programmatic way to define a custom metric, specifying its type, unit, and labels. Both methods result in a new metric descriptor being registered in the project's metric store.

Answer

Creating a log-based metric

Answer

Using Terraform resource google_monitoring_metric_descriptor

Answer

Deploying a Prometheus exporter with the Ops Agent