PCDOE Hard Questions — 25 Difficult Questions

Question 1

A multinational corporation is bootstrapping a Google Cloud organization with multiple subsidiaries. Each subsidiary needs its own folder with IAM policies that are managed locally, but the parent company wants to enforce a global policy that restricts the use of certain machine types (e.g., N2D) for cost control. However, one subsidiary has a legitimate need for those machine types in a specific project. What is the best way to handle this exception while maintaining the global policy?

Accepted Answer

Create a custom organization policy with a condition that excludes the exception project from the restriction.. Option B is correct because custom organization policies with conditions can selectively exclude projects from certain restrictions. Option A is wrong because standard machine type constraints do not support per-project whitelists. Option C is wrong because it does not enforce the global policy across subsidiaries. Option D is wrong because it only audits, not enforces.

Answer

Set an organization policy that denies N2D machine types, then create a separate policy at the project level to allow them for the exception project.

Answer

Use an audit-only policy and rely on a team to review and approve machine type usage.

Answer

Place each subsidiary in its own folder and set the machine type restriction only on folders that require it.

Question 2

An organization is using Cloud Source Repositories and wants to enforce that all commits are signed with a verified GPG key. How can they enforce this?

Accepted Answer

Enable the Signed Commits policy in the repository settings.. Option C is correct because Cloud Source Repositories provides a built-in 'Signed Commits' policy in the repository settings that, when enabled, rejects any push containing commits that are not signed with a verified GPG key. This policy is enforced server-side at the repository level, ensuring that only signed commits are accepted without requiring external tools or custom scripts.

Answer

Use a branch protection rule in Cloud Source Repositories.

Answer

Use Cloud Functions to validate commits after push.

Answer

Use a pre-receive hook in Cloud Source Repositories.

Question 3

A DevOps engineer notices that developers are accidentally deleting Cloud Storage buckets. The organization wants to prevent accidental deletion while still allowing developers to manage bucket objects. What is the best practice?

Accepted Answer

Set a bucket retention policy with deletion lock.. A bucket retention policy with a deletion lock prevents the deletion of the bucket itself, even by users with owner permissions, while still allowing developers to manage objects within the bucket. This is the only option that directly enforces a hard, irreversible lock on bucket deletion, meeting the requirement to prevent accidental deletion without restricting object management.

Answer

Enable Cloud Audit Logging and set up alerts on bucket deletion.

Answer

Set a bucket IAM policy denying storage.objects.delete for developers.

Answer

Use an organization policy to disable bucket deletion across the org.

Question 4

A DevOps engineer is designing a CI/CD pipeline using Cloud Build. Which TWO configurations are necessary to ensure secure and reliable deployments? (Choose two.)

Accepted Answer

Use manual approval steps for production deployments.. Options C and E are correct. Secret Manager provides security, and manual approval ensures reliability.

Answer

Use Cloud Build triggers with branch filters.

Answer

Push all artifacts to a public Container Registry.

Answer

Enable Cloud Build service account with Editor role.

Question 5

You are designing alerting policies for a microservice architecture. Which TWO metrics are most suitable for triggering a page to the on-call engineer?

Accepted Answer

Latency P99 exceeding the SLO target for 5 minutes.. Error budget burn rate and high latency (P99 breaching SLO) directly indicate customer-facing issues and require immediate attention. CPU and request count are less critical.

Answer

Number of requests per second.

Answer

CPU utilization at 50%.

Answer

Memory usage trend.

Question 6

A multinational company runs an application on Google Cloud with an SLO of 99.99% monthly availability. They use a multi-region deployment with Cloud Load Balancing and Cloud Spanner. During a regional outage in us-central1, traffic fails over to us-east1. However, the incident response team is not alerted because the error budget burn rate remained below the alert threshold. What should the team change to ensure timely alerting for such regional failures?

Accepted Answer

Create a custom dashboard and alert for regional unavailability using Cloud Monitoring metrics like load_balancing/backend_request_count and region health checks.. Option D is correct because implementing a 'signals of possible trouble' dashboard and alerts for regional failures provides early warning even before SLO is breached. Option A is wrong because lowering the burn rate alert threshold may cause noise but could help, but it's not the best practice for regional failures. Option B is wrong because the burn rate is already calculated over a longer window; reducing window might help but could increase noise. Option C is wrong because changing SLO to 99.9% would increase error budget but not address alerting.

Answer

Shorten the SLO compliance window from 30 days to 7 days.

Answer

Change the SLO to 99.9% to allow more error budget.

Answer

Reduce the error budget burn rate alert threshold from 10% to 5% per hour.

Question 7

An organization has a service that must meet a 99.99% SLO. The service runs on GKE and uses Cloud SQL. The team notices that during a major incident, the error budget is consumed rapidly. They want to implement a mechanism to automatically rollback deployments that cause sustained error budget consumption above a threshold. What is the best approach?

Accepted Answer

Set up a deployment pipeline with Cloud Deploy that includes a predeployment validation step that checks the current error budget burn rate and blocks the release if the burn rate exceeds 10% per hour.. Option A is correct because using Cloud Deploy or Spinnaker with automated rollback based on error budget burn rate is the recommended pattern. Option B is wrong because Cloud Build is CI, not deployment orchestration. Option C is wrong because canary deployments reduce blast radius but don't auto-rollback. Option D is wrong because manual rollback via Cloud Console is not automated.

Answer

Use Cloud Scheduler to run a script that checks error budget and rolls back if needed.

Answer

Implement a canary deployment strategy with manual approval steps.

Answer

Configure Cloud Build to automatically revert the last commit if error budget is consumed.

Question 8

During a post-incident review, the team discovers that a misconfiguration in Cloud Armor caused legitimate traffic to be blocked, leading to a outage. The misconfiguration was introduced by a junior engineer who had overly permissive IAM roles. What is the best way to prevent similar incidents in the future?

Accepted Answer

Use Organization Policy constraints to restrict allowed IP ranges and rules in Cloud Armor security policies.. Option D is correct because enforcing guardrails with Organization Policies can prevent misconfigurations at scale. Option A is wrong because removing the engineer's access is punitive but doesn't prevent others. Option B is wrong because peer reviews reduce human error but are not automated. Option C is wrong because Cloud Armor logs help detection but not prevention.

Answer

Enforce a mandatory peer review for all Cloud Armor configuration changes.

Answer

Revoke the junior engineer's access to Cloud Armor and grant read-only access.

Answer

Enable Cloud Armor security policy logs and create alerting for blocked traffic spikes.

Question 9

A team wants to implement multi-cluster monitoring for GKE using Managed Service for Prometheus. Which configuration is required?

Accepted Answer

Enable Managed Service for Prometheus in each cluster and configure a single Cloud Monitoring workspace to collect metrics from all clusters. Managed Service for Prometheus is a Google Cloud-managed, multi-cluster monitoring solution. To collect metrics from multiple GKE clusters, you must enable the service in each cluster individually and then configure a single Cloud Monitoring workspace to aggregate the data. This ensures each cluster runs its own collection pipeline, while the workspace provides a unified view across all clusters.

Answer

Enable Managed Service for Prometheus in one cluster and have other clusters forward metrics to it

Answer

Use Cloud Monitoring agent on nodes in each cluster

Answer

Set up a separate workspace per cluster

Question 10

A financial services company uses Spanner for their core database. They notice that some transactions are taking longer than expected, especially during cross-region writes. They have set up Spanner with regional configuration. What is the most likely cause?

Accepted Answer

The transaction is experiencing contention due to a hot spot. In a regional Spanner configuration, cross-region writes are not possible; hot spots (contention) are a common cause of latency. Stale reads are fast, and transaction size alone rarely causes significant delays.

Answer

The transaction is using stale reads

Answer

The transaction is not using a read-write transaction

Answer

The transaction is too large

Question 11

Refer to the exhibit. After applying the shown firewall rule, users report increased latency to a web application. What is the most likely cause?

Accepted Answer

The rule contains both allow and deny for the same traffic, creating a conflict.. Correct: The rule has both allow and deny with same ports, and the rule is contradictory; the deny overrides because deny rules are evaluated after allow? Actually in VPC firewall rules, allow and deny cannot both be specified in the same rule. This is an invalid combination. The rule may cause unexpected behavior. Option A is wrong because logging alone does not cause latency. Option B is wrong because source range is all. Option D is wrong because priority is not high.

Answer

The rule priority is set to 1000, which is too low.

Answer

The source range covers all IPs, causing excessive traffic.

Answer

The firewall rule has logging enabled, which adds overhead.

Question 12

You are designing a globally distributed application using Cloud Spanner. The application has a write-heavy workload. You notice that write latency increases as the number of nodes increases. What is the most likely cause?

Accepted Answer

The workload has many cross-node transactions due to split rows.. Option B is correct because in Cloud Spanner, write-heavy workloads with many cross-node transactions cause increased write latency as nodes are added. This occurs because Spanner splits rows across nodes, and transactions that span multiple splits require two-phase commit (2PC) coordination between nodes, which adds network overhead and latency. Adding more nodes increases the likelihood that a transaction touches multiple splits, exacerbating the coordination cost.

Answer

The instance is using a multi-region configuration with too many read-only replicas.

Answer

The application is using stale reads for write transactions.

Answer

The number of splits is too low, causing hotspots.

Question 13

Which THREE factors should you consider when designing a Cloud Run service for optimal performance under unpredictable traffic patterns? (Choose 3)

Accepted Answer

Set a minimum number of instances to reduce cold starts.. Option B is correct because setting a minimum number of instances ensures that Cloud Run always keeps a baseline of warm instances ready to serve requests. This eliminates cold starts for the first requests during traffic spikes, which is critical for unpredictable traffic patterns where latency spikes from cold starts would degrade user experience.

Answer

Use HTTP/2 for faster connection reuse.

Answer

Configure VPC egress through Cloud NAT for lower latency.

Question 14

An e-commerce platform is using Cloud Load Balancing with a backend service that has a custom health check. The health check is failing intermittently, causing traffic to be routed away from healthy instances. The team has enabled Cloud Logging and wants to diagnose the issue. Which log view should they examine to see the health check probe results?

Accepted Answer

Load balancer logs (type: 'loadbalancing.googleapis.com'). Load balancer logs (type: 'loadbalancing.googleapis.com') contain detailed records of health check probes, including the probe source IP, target instance, response code, and latency. This is the exact log view that captures health check probe results, enabling the team to identify intermittent failures by correlating probe timestamps with instance health status changes.

Answer

VPC flow logs

Answer

Cloud Audit Logs (Admin Activity)

Answer

Instance serial port output logs

Question 15

Which TWO are valid methods to manage service account keys securely? (Select exactly 2)

Accepted Answer

Automate key rotation using a Cloud Function.. Option B is correct because automating key rotation with a Cloud Function ensures service account keys are rotated on a schedule without manual intervention, reducing the risk of key exposure. This aligns with Google Cloud's best practices for key management, as it enforces rotation policies programmatically and can integrate with Secret Manager to securely store and version keys.

Answer

Rotate keys manually every 90 days.

Answer

Embed keys in application code.

Answer

Store keys in Cloud Storage with public access.

Question 16

Which THREE steps are typically part of a formal incident postmortem according to Google SRE best practices?

Accepted Answer

Assign action items with deadlines.. Option B is correct because Google SRE postmortems emphasize creating actionable follow-ups to prevent recurrence. Assigning action items with deadlines ensures that identified issues are systematically addressed, which is a core principle of blameless postmortems focused on process improvement rather than punishment.

Answer

Identify the person responsible for the incident.

Answer

Implement a solution immediately.

Question 17

A company wants to reduce costs associated with Cloud Monitoring. They have many custom metrics and high ingestion rates. Which cost optimization strategy is most effective?

Accepted Answer

Delete all unused custom metrics and reduce labels.. Option D is correct because deleting unused custom metrics and reducing labels directly reduces the volume of data ingested and stored, which is the primary cost driver in Cloud Monitoring (formerly Stackdriver). Custom metrics incur charges per data point ingested, and each unique label combination creates additional time series, multiplying costs. This strategy eliminates waste without sacrificing necessary monitoring fidelity.

Answer

Use log-based metrics instead of custom metrics.

Answer

Aggregate metrics into buckets and export to BigQuery for analysis.

Answer

Reduce the sampling rate of all custom metrics to 1 minute.

Question 18

Refer to the exhibit. What is the effect of the metricRelabelings section in this ServiceMonitor?

Accepted Answer

It drops all metrics whose name starts with 'container_'.. The `metricRelabelings` section in a ServiceMonitor uses Prometheus relabeling rules to modify or filter metrics before ingestion. The `action: drop` directive, combined with a `regex: 'container_.*'` pattern matching the metric name, causes all metrics whose names start with 'container_' to be dropped (i.e., not scraped). This is a common pattern to exclude unwanted metrics and reduce cardinality.

Answer

It adds a label called 'container_' to all metrics.

Answer

It only keeps metrics whose name starts with 'container_'.

Answer

It renames all metrics with the prefix 'container_' to remove the prefix.

Question 19

A team is designing a dashboard for their production environment using Cloud Monitoring. Which three types of information should be included on the dashboard to support incident response? (Choose three.)

Accepted Answer

Resource utilization trends. Resource utilization trends (A) are essential for incident response because they provide historical context, enabling responders to identify anomalies, correlate changes with incidents, and predict capacity issues. Cloud Monitoring's Metrics Explorer and dashboards allow you to plot trends over time, which is critical for root cause analysis during an active incident.

Answer

Real-time user feedback

Answer

Security audit logs

Question 20

An organization is implementing SLO-based alerting for a critical service. They want to alert when the service has consumed 50% of its error budget over a 30-day window. Considering best practices for alert sensitivity and noise reduction, which alerting approach should they use?

Accepted Answer

Alert on the burn rate over a 1-hour window with a threshold of 10.. Option A is correct because alerting on a burn rate of 10 over a 1-hour window directly indicates that the service is consuming error budget at a rate that would exhaust the entire 30-day budget in 3 days (since 30 days / 10 = 3 days). This approach balances sensitivity and noise reduction by using a sufficiently long window (1 hour) to smooth out transient spikes, while the high threshold ensures only significant sustained degradation triggers an alert, aligning with SRE best practices for multi-window, multi-burn-rate alerting.

Answer

Alert on the burn rate over a 5-minute window with a threshold of 0.5.

Answer

Alert on the error budget remaining with a threshold of 50%.

Answer

Alert on the SLI value directly with a threshold of 99.9%.