PCDOE Practice Test 8 — 10 Questions

Question 1

A team has set up the alerting policies shown in the exhibit. They receive an alert for High Memory but not for High CPU. What is the most likely reason?

Accepted Answer

The Cloud Monitoring agent is not installed or not reporting on the instance, so the memory metric is missing.. Option A is correct because the High Memory alert fires while the High CPU alert does not, indicating that the memory metric is available but the CPU metric is missing. This typically happens when the Cloud Monitoring agent is installed but not properly reporting CPU metrics, or when the agent is missing entirely and only the memory metric is being collected via a different mechanism (e.g., guest-attributes). Without the agent, standard CPU utilization metrics are not exposed to Cloud Monitoring, while memory metrics may still be available through other means, causing the memory alert to trigger but not the CPU alert.

Answer

The CPU alert's duration of 300 seconds prevents it from firing before the memory alert.

Answer

The memory alert has a higher threshold value, making it easier to trigger.

Answer

The CPU metric is not available because the instance does not have the Cloud Monitoring agent installed.

Question 2

A company is using Google Cloud and wants to monitor and control costs. Which TWO actions should they take? (Choose two.)

Accepted Answer

Set up budget alerts to notify when spending exceeds thresholds.. Setting up budget alerts (option A) is a core cost control action because it allows you to define a budget amount and receive notifications when actual or forecasted spending exceeds a specified threshold (e.g., 50%, 90%, 100%). This enables proactive intervention before costs spiral out of control. Using labels (option B) to categorize resources (e.g., by team, project, or environment) allows you to track and allocate costs accurately in billing reports, making it easier to identify cost drivers and enforce accountability.

Answer

Disable all unnecessary APIs at the organization level.

Answer

Export billing data to BigQuery for detailed analysis.

Answer

Grant billing account access to all project owners.

Question 3

You are a DevOps engineer at a large e-commerce company that runs its production workloads on Google Kubernetes Engine (GKE) in the us-central1 region. The cluster has 500 nodes, each with 8 vCPUs and 32 GB of memory, and uses preemptible VMs for cost savings. Over the past month, the monthly GKE cost has increased by 30% unexpectedly. Upon reviewing the billing reports, you notice a significant spike in Compute Engine costs, specifically for 'Sustained Use Discount' line items, but the total cost is higher than expected. You also observe that the cluster's node utilization is inconsistent, with some nodes running at 90% CPU and memory while others are below 20%. Your team has been deploying stateless microservices and using Cluster Autoscaler with default settings. The application traffic is variable but predictable, with peaks on weekends. You need to reduce the GKE costs without impacting performance. What should you do?

Accepted Answer

Enable node auto-provisioning and migrate baseline workloads to nodes covered by committed use discounts (1-year or 3-year).. Option A is correct because enabling node auto-provisioning allows GKE to automatically select the most cost-effective node configurations for your workloads, reducing waste from over-provisioned nodes. Migrating baseline workloads to nodes covered by committed use discounts (CUDs) locks in lower prices for predictable usage, directly addressing the 30% cost spike caused by inconsistent utilization and unexpected sustained use discount charges. This combination optimizes both variable and steady-state workloads without sacrificing performance.

Answer

Increase the minimum number of nodes in the cluster to 300 and use a larger machine type to reduce the number of pods per node.

Answer

Switch the cluster to a single-zone configuration and reduce the number of nodes to 200 to lower base costs.

Answer

Reduce the number of preemptible VMs to 30% and use only on-demand VMs for the remaining nodes to improve reliability.

Question 4

Which TWO actions can reduce tail latency in a microservices architecture deployed on GKE? (Choose 2)

Accepted Answer

Run multiple replicas of each service and use a load balancer with least-request algorithm.. Option A is correct because running multiple replicas and using a load balancer with a least-request algorithm distributes incoming requests to the pod with the fewest active connections, reducing queuing delay and preventing any single replica from becoming a hotspot. This directly lowers tail latency by ensuring that slow or overloaded pods are not overwhelmed, and the load balancer's algorithm minimizes the variance in response times across replicas.

Answer

Use a single large machine type for all services.

Answer

Enable session affinity to keep users on the same pod.

Answer

Increase the batch size for processing requests.

Question 5

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

Accepted Answer

Cloud Asset Inventory can be used to discover all resources in the organization.. Cloud Asset Inventory provides a complete view of all resources (e.g., Compute Engine instances, Cloud Storage buckets, IAM policies) across the entire organization, including all folders and projects. This is essential for DevOps bootstrapping to audit, monitor, and manage resources at scale. It uses the Cloud Asset API to export asset metadata and supports real-time feeds for change detection.

Answer

After enabling the cloudresourcemanager.googleapis.com API, organization policies are automatically applied.

Answer

All projects in an organization automatically share a default VPC network.

Answer

Cloud Audit Logs are disabled by default and must be enabled for each service.

Question 6

Your organization has multiple teams that need to deploy infrastructure using Terraform. You want to enforce that all Terraform state files are stored in a central Cloud Storage bucket with versioning enabled. You also need to ensure that only the CI/CD pipeline can write to the bucket. What is the best way to enforce this?

Accepted Answer

Use IAM conditions to restrict access to the bucket only when the requester is the CI/CD service account.. Option D is correct because IAM conditions allow you to bind a role to a principal (the CI/CD service account) and then restrict access based on attributes of the request, such as the requester's identity. By using a condition that checks `iam.googleapis.com/principal` equals the CI/CD service account email, you ensure that only that specific service account can write to the bucket, even if other principals have the role. This enforces the policy without relying on network constructs or overly broad role assignments.

Answer

Use VPC Service Controls to restrict access to the bucket from only the CI/CD pipeline's VPC.

Answer

Create a custom IAM role with permissions to write to the bucket and assign it to the CI/CD service account.

Answer

Grant the Storage Object Admin role to the CI/CD service account at the bucket level.

Question 7

Which TWO are best practices for bootstrapping a Google Cloud organization for DevOps?

Accepted Answer

Use a separate project to host shared CI/CD tools and artifacts.. Option C is correct because hosting shared CI/CD tools and artifacts in a dedicated project follows the principle of resource isolation and centralized management. This approach simplifies access control, cost tracking, and lifecycle management for DevOps pipelines, as the project acts as a single source of truth for build outputs and deployment tools.

Answer

Share a single service account key across multiple projects for simplicity.

Answer

Disable Organization Policies to allow maximum flexibility for DevOps teams.

Answer

Create a single service account with broad permissions to be used by all projects.

Question 8

A DevOps team is troubleshooting a Cloud Build pipeline that fails intermittently when building a container image. The build step uses a custom build step that runs a vulnerability scan. The error log shows: 'Step #1: Error: failed to scan image: context deadline exceeded'. The build configuration includes 'timeout: 600s'. Which is the most likely cause and solution?

Accepted Answer

The scan step is taking longer than the build timeout; increase the timeout value in the build configuration.. The error 'context deadline exceeded' indicates that the custom vulnerability scan step is taking longer than the build's configured timeout of 600 seconds. Cloud Build enforces a hard timeout for the entire build; if any step exceeds this duration, the build is terminated. Increasing the timeout value in the build configuration provides more time for the scan to complete, directly addressing the root cause.

Answer

The scan tool requires a specific dependency; add an installation step before scanning.

Answer

There is network latency between Cloud Build and the container registry; use VPC Service Controls.

Answer

The build step is running out of memory; increase the machine type to e2-highcpu-8.

Question 9

A company runs a web application on Google Kubernetes Engine (GKE) with multiple services. They want to reduce costs without impacting performance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Enable node auto-provisioning to automatically adjust node pools.. Option C is correct because node auto-provisioning in GKE automatically creates and scales node pools based on the resource requirements of pending pods. This eliminates the need for manual node pool management and ensures that only the necessary compute resources are provisioned, reducing costs without manual intervention or over-provisioning.

Answer

Enable cluster autoscaling and manually scale nodes based on peak load.

Answer

Deploy a service mesh like Istio to optimize traffic routing.

Question 10

Your team has deployed a microservices application on Google Kubernetes Engine (GKE). You notice that one service has high latency during peak hours. The service is CPU-bound and uses a HorizontalPodAutoscaler (HPA) based on CPU utilization. What is the most likely cause of the latency?

Accepted Answer

The HPA's target CPU utilization is set too high, causing the autoscaler to react slowly.. Option B is correct because when the HPA's target CPU utilization is set too high, the autoscaler waits until the average CPU utilization exceeds that threshold before scaling up. During peak hours, the service becomes CPU-bound and latency increases as pods are overwhelmed, but the HPA reacts slowly because it only triggers when the high threshold is breached, causing a delay in adding new pods to handle the load.

Answer

The GKE cluster uses preemptible nodes that are frequently reclaimed.

Answer

The service uses a global external HTTP(S) load balancer with session affinity.

Answer

The application does not implement request autoscaling at the application layer.

PCDOE Practice Test 8 — 10 Questions

Exhibit

PCDOE Practice Test 8 — 10 Questions

Exhibit