PCDOE Hard Questions — 25 Difficult Questions

Question 1

A company uses Cloud Run for a stateless API service with concurrency set to 80. During a traffic spike, some requests return HTTP 500 errors and latency spikes. Cloud Monitoring shows container CPU utilization at 100% and memory usage at 70%. What is the most likely cause and the best first step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Concurrency per container is too high; reduce concurrency to 10. With CPU at 100% and memory at only 70%, the bottleneck is CPU, not memory. Cloud Run containers handle requests concurrently; setting concurrency to 80 means each container processes up to 80 requests simultaneously. When CPU is saturated, requests queue up, causing latency spikes and eventual HTTP 500 errors as the container becomes unresponsive. Reducing concurrency to 10 lowers the per-container request load, allowing each request to complete before CPU saturation occurs.

Answer

Maximum instances limit is too low; increase from 10 to 100

Answer

Min idle instances is too low; set min idle to 5 to reduce cold starts

Answer

Memory limit is too low; increase memory from 256 MiB to 512 MiB

Question 2

A company wants to enforce that all projects in the organization have a specific VPC Service Controls perimeter. What is the most efficient way to achieve this?

Accepted Answer

Use folder-level VPC Service Controls perimeters.. Folder-level VPC Service Controls perimeters allow you to apply a single perimeter configuration to all projects within a folder, ensuring consistent enforcement across the organization without needing to configure each project individually. This is the most efficient method because it leverages the resource hierarchy to inherit the policy, reducing administrative overhead and preventing misconfigurations.

Answer

Use project-level VPC Service Controls perimeters.

Answer

Use organization policies to set the perimeter.

Answer

Use a custom script to monitor and alert on non-compliant projects.

Question 3

A company uses BigQuery for analytics with many queries scanning terabytes daily. They need to reduce query costs without reducing usage. What is the most effective strategy?

Accepted Answer

Partition and cluster tables.. Partitioning and clustering BigQuery tables reduces the amount of data scanned per query by limiting partitions and using clustered columns for filtering, directly lowering on-demand query costs. This is the most effective cost-reduction strategy without reducing query volume.

Answer

Reserve capacity in specific regions.

Answer

Use flat-rate pricing with slots.

Answer

Use standard SQL instead of legacy SQL.

Question 4

A company uses Cloud Monitoring to track latency for a multi-region web application. The SLO is 99.9% of requests under 500ms over a 30-day rolling window. The error budget has been rapidly depleting over the last week. The operations team wants to understand the impact of recent deployments. Which approach should they use to correlate deployment changes with latency spikes?

Accepted Answer

Create a custom dashboard in Cloud Monitoring that includes latency charts and use annotation markers to indicate deployment times. Cloud Monitoring supports custom dashboards with annotation markers that can be programmatically or manually added to indicate deployment events. By overlaying these markers on latency charts, the operations team can visually correlate deployment times with latency spikes, enabling direct root-cause analysis without manual log searching or separate tools.

Answer

Use Cloud Logging to search for deployment logs and manually compare with latency metrics

Answer

Use Cloud Trace to analyze latency distributions for each deployment version

Answer

Configure Error Reporting to alert on latency threshold breaches

Question 5

A company runs a microservices architecture on GKE with Istio service mesh. They observe that service-to-service latency has increased after enabling mTLS. What is the most likely cause?

Accepted Answer

mTLS encryption overhead. Enabling mTLS in Istio encrypts all service-to-service traffic using mutual TLS, which adds CPU overhead for encryption and decryption of each request. This encryption overhead directly increases latency, especially for high-throughput or small-payload services, as the sidecar proxies must perform TLS handshakes and cryptographic operations on every packet.

Answer

Incorrect load balancer configuration

Answer

Network policy restriction

Answer

Sidecar proxy resource limits

Question 6

A team wants to optimize a batch processing job that is CPU-bound. Which Compute Engine machine family should they use?

Accepted Answer

C2. C2 is the correct machine family because it is specifically designed for compute-intensive, CPU-bound workloads. It offers the highest clock speed and per-core performance among Compute Engine machine families, making it ideal for batch processing jobs that are limited by CPU throughput rather than memory or I/O.

Answer

E2

Answer

N2

Answer

M2

Question 7

A media streaming service uses Cloud Storage to store video files and serves them via Cloud CDN. Users in Asia report buffering issues. The team notices that the cache hit ratio is low in that region. The origin is a single Cloud Storage bucket in us-central1. Which set of actions would best improve performance for Asian users?

Accepted Answer

Create a new Cloud Storage bucket in an Asian region and use dual-region bucket with Cloud CDN.. Creating a new Cloud Storage bucket in an Asian region and using a dual-region bucket with Cloud CDN reduces latency by serving content from a geographically closer origin, improving cache hit ratios for Asian users. Cloud CDN caches content at edge locations, but if the origin is far away (us-central1), the first miss still incurs high latency. A dual-region bucket provides a local origin for cache misses, significantly reducing round-trip time.

Answer

Use Cloud Load Balancing with Cloud Armor to protect the origin.

Answer

Enable HTTP/2 on Cloud CDN and increase the TTL for video content.

Answer

Configure a custom domain on Cloud CDN with SSL and enable request collapsing.

Question 8

Refer to the exhibit. The team observes that some requests are fast while others are slow. Both requests have identical payload and response. What is the most likely cause of the latency difference?

Accepted Answer

The fast request hit a cached response. The fast request hit a cached response, meaning the reverse proxy or CDN served the response from its cache without forwarding the request to the origin server. This eliminates the round-trip time to the backend and the processing time on the origin, resulting in significantly lower latency. Since both requests have identical payloads and responses, caching is the most plausible explanation for the observed difference.

Answer

The slow request had a larger response size

Answer

The fast request used a different load balancer

Answer

The slow request used a different HTTP method

Question 9

A team uses Cloud Spanner for a global application. Query performance degrades as data grows. They notice that most queries filter on a column 'customer_id' but the primary key is a UUID. What is the best approach to optimize performance?

Accepted Answer

Reorder the primary key to start with customer_id. In Cloud Spanner, the primary key determines the physical ordering of rows on storage tablets. When queries filter on `customer_id` but the primary key starts with a UUID, Spanner must perform a full table scan because the filter cannot leverage the key order. Reordering the primary key to start with `customer_id` allows Spanner to use efficient key-range scans, dramatically reducing the number of rows read per query.

Answer

Enable query optimization hints

Answer

Use interleaved tables

Answer

Create a secondary index on customer_id

Question 10

Refer to the exhibit. A GKE pod is repeatedly crashing with the error shown. The deployment has resource requests of 512 MiB memory and limits of 1 GiB. What is the most likely cause and the best remediation?

Accepted Answer

The Java heap size exceeds the container memory limit; reduce the JVM heap size or increase the container memory limit. The error indicates an OutOfMemoryError (OOM) in the Java application, which occurs when the JVM heap size exceeds the container's memory limit. Since the deployment has a memory limit of 1 GiB, if the JVM is configured with a heap size larger than this limit (or if the heap plus other memory usage exceeds it), the container will be killed by Kubernetes. Reducing the JVM heap size or increasing the container memory limit directly resolves the mismatch.

Answer

The node is under memory pressure; add more nodes to the cluster

Answer

The container needs more CPU; increase CPU request and limit

Answer

The application has a memory leak; refactor the DataProcessor class

Question 11

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.. Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.

Answer

Use a user account for the CI/CD pipeline and assign it the necessary roles.

Answer

Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.

Answer

Generate a single service account key and securely distribute it to the CI/CD system.

Question 12

An organization uses Cloud Deploy with Skaffold to manage progressive delivery on GKE. After a rollout, the new revision shows a higher error rate in Stackdriver, but the Cloud Deploy pipeline did not automatically roll back. What is the most likely cause?

Accepted Answer

The Cloud Deploy pipeline does not have a stackdriverMetrics verification job defined to check error rates.. Cloud Deploy does not automatically roll back based on error rates unless a verification job (such as a Stackdriver metrics check) is explicitly defined in the pipeline. Without a verification step that monitors error rates and fails the rollout, Cloud Deploy will continue advancing through phases even if the new revision is unhealthy. Therefore, the absence of a stackdriverMetrics verification job is the most likely cause.

Answer

The rollout strategy includes a manual approval step before advancing to the next phase.

Answer

The release was created with a '--disable-rollback' flag.

Answer

The rollout has not yet reached 100% traffic, so Cloud Deploy waits for full completion before evaluating health.

Question 13

Which Cloud Monitoring feature can directly correlate this error with the associated trace and VM instance?

Accepted Answer

Error Reporting. Error Reporting in Google Cloud automatically groups errors from Cloud Logging and can directly correlate an error with the associated trace ID and VM instance metadata. This is because Error Reporting ingests structured log entries that contain the `@type` field set to `type.googleapis.com/google.devtools.clouderrorreporting.v1beta1.ReportedErrorEvent` and parses the `serviceContext` and `context` fields to link the error to the specific trace and resource (e.g., VM instance).

Answer

Log-based metrics

Answer

Metrics Explorer

Answer

Alerting policies

Question 14

Refer to the exhibit. A DevOps engineer assigned this custom role to a service account used in Cloud Build. The pipeline fails when trying to access a secret stored in Secret Manager. Which permission is missing?

Accepted Answer

secretmanager.versions.access. The custom role assigned to the Cloud Build service account lacks the `secretmanager.versions.access` permission, which is required to access the payload of a secret version in Secret Manager. Without this permission, any attempt to read the secret value during a build step will fail with a permission denied error, even if the service account has other roles on the project.

Answer

cloudbuild.builds.update

Answer

run.services.get

Answer

iam.serviceAccounts.actAs

Question 15

You manage a production environment with a web service deployed on Compute Engine instances behind a HTTP(S) Load Balancer. The service has a health check configured on the load balancer, probing a health endpoint every 10 seconds. After a recent configuration change, you observe that all instances are marked as unhealthy and traffic is failing. The health check response is 200 OK from the instances, but the load balancer still marks them unhealthy. The health check configuration: protocol: HTTP, port: 80, request path: /health, interval: 10s, timeout: 5s, unhealthy threshold: 2. The instances are running a custom web server. What is the most likely cause?

Accepted Answer

The health check response is coming from a different server (e.g., a reverse proxy) that returns 200 but does not represent the actual service health.. The health check is receiving a 200 OK response from a reverse proxy or intermediary that is not the actual web server, so the load balancer's health check does not reflect the true health of the application. Even though the response is successful, the load balancer marks instances unhealthy because the health check is likely failing to reach the intended health endpoint on the custom web server, or the response is not coming from the service itself. This scenario often occurs when a reverse proxy (e.g., nginx) returns a static 200 for /health without forwarding the request to the backend service, causing the load balancer to see a healthy response but the service to be actually unhealthy.

Answer

The load balancer is misconfigured with an incorrect protocol (HTTPS instead of HTTP).

Answer

The health check port is incorrectly configured as 80 but the service is listening on 8080.

Answer

The health check timeout is greater than the interval, causing overlapping probes.

Question 16

A DevOps team is troubleshooting a Cloud Build pipeline that fails intermittently when building a container image. The build step uses a custom build step that runs a vulnerability scan. The error log shows: 'Step #1: Error: failed to scan image: context deadline exceeded'. The build configuration includes 'timeout: 600s'. Which is the most likely cause and solution?

Accepted Answer

The scan step is taking longer than the build timeout; increase the timeout value in the build configuration.. The error 'context deadline exceeded' indicates that the custom vulnerability scan step is taking longer than the build's configured timeout of 600 seconds. Cloud Build enforces a hard timeout for the entire build; if any step exceeds this duration, the build is terminated. Increasing the timeout value in the build configuration provides more time for the scan to complete, directly addressing the root cause.

Answer

The scan tool requires a specific dependency; add an installation step before scanning.

Answer

There is network latency between Cloud Build and the container registry; use VPC Service Controls.

Answer

The build step is running out of memory; increase the machine type to e2-highcpu-8.

Question 17

Your company runs a multi-region application on GKE across us-east1 and europe-west1. The application serves a global user base with a strict SLO of 99.95% availability. Recently, the team noticed that during peak hours, some users in South America experience high latency and intermittent errors. The GKE clusters are monitored via Cloud Monitoring with custom dashboards and alerting policies. The team has set up a single alerting policy that triggers when the global error rate exceeds 0.1%. However, the alert fires only after the issue has persisted for 10 minutes, and by then the customer impact is already significant. You need to improve the detection and response time. Which action should you take first?

Accepted Answer

Create separate alerting policies per region with shorter evaluation periods, and set up a notification channel for the on-call team.. The current single global alerting policy with a 10-minute evaluation period introduces a significant delay in detecting regional issues. By creating separate alerting policies per region with shorter evaluation periods, you can detect and respond to regional anomalies (like high latency in South America) much faster, directly improving the detection time for the multi-region application and reducing customer impact.

Answer

Add a dashboard that shows latency by region and set up a log-based metric for error counting.

Answer

Reduce the alerting policy's duration to 1 minute and increase the threshold to 0.5% to reduce noise.

Answer

Implement a canary deployment strategy to roll back changes quickly.

Question 18

During a post-incident review, the team discovers that a misconfiguration in Cloud Armor caused legitimate traffic to be blocked, leading to a outage. The misconfiguration was introduced by a junior engineer who had overly permissive IAM roles. What is the best way to prevent similar incidents in the future?

Accepted Answer

Use Organization Policy constraints to restrict allowed IP ranges and rules in Cloud Armor security policies.. Organization Policy constraints in Google Cloud allow administrators to enforce guardrails at the organization, folder, or project level that restrict what configurations are allowed — for example, limiting allowed IP ranges or rule types in Cloud Armor security policies. This prevents a misconfigured policy from ever being applied, regardless of the engineer's IAM permissions, addressing the root cause of overly permissive changes.

Answer

Enforce a mandatory peer review for all Cloud Armor configuration changes.

Answer

Revoke the junior engineer's access to Cloud Armor and grant read-only access.

Answer

Enable Cloud Armor security policy logs and create alerting for blocked traffic spikes.

Question 19

A service is deployed on Cloud Run. You need to monitor memory usage per revision. How can you create an alert?

Accepted Answer

Configure Cloud Run to send metrics to Cloud Monitoring and create an alert in Cloud Monitoring. Cloud Run automatically exports built-in metrics, including memory usage per revision, to Cloud Monitoring without any additional configuration. By creating an alerting policy in Cloud Monitoring based on the `run.googleapis.com/container/memory/utilizations` metric, you can monitor memory usage per revision directly. Option B correctly identifies this native integration, making it the most efficient and reliable approach.

Answer

Deploy a sidecar container that collects memory metrics and pushes to Cloud Monitoring

Answer

Use Cloud Console and navigate to Cloud Run services to set an alert directly

Answer

Use Cloud Logging to parse container logs for memory usage

Question 20

A team wants to ensure zero-downtime deployments for a Cloud Run service. They plan to gradually shift traffic from the current revision to the new one. What should they configure?

Accepted Answer

Use Cloud Run's traffic splitting feature to slowly increase traffic to the new revision. Cloud Run natively supports traffic splitting between revisions, allowing you to gradually shift a percentage of traffic to a new revision while the old revision continues serving the remainder. This enables canary or gradual rollouts with zero downtime, and you can adjust percentages incrementally via multiple updates until the new revision reaches 100%.

Answer

Use Cloud Build to directly replace the revision

Answer

Set traffic to 100% on the new revision gradually using multiple updates

Answer

Configure a rolling update strategy in Cloud Deploy