PCDOE Multiple Select — 30 Questions

Question 1

You are designing alerting policies for a microservice architecture. Which TWO metrics are most suitable for triggering a page to the on-call engineer?

Accepted Answer

Latency P99 exceeding the SLO target for 5 minutes.. Error budget burn rate and high latency (P99 breaching SLO) directly indicate customer-facing issues and require immediate attention. CPU and request count are less critical.

Answer

Number of requests per second.

Answer

CPU utilization at 50%.

Answer

Memory usage trend.

Question 2

A team uses Cloud Build with a cloudbuild.yaml that deploys to multiple environments. They want to ensure that the production deployment step only runs when the build is triggered by a tag matching 'v*.*.*'. Which TWO configurations achieve this? (Choose two.)

Accepted Answer

In the cloudbuild.yaml, use a 'waitFor' condition that only runs the production step when the substitution variable $TAG_NAME matches 'v*.*.*'.. Cloud Build supports substitution variables like $TAG_NAME, which can be used in a 'waitFor' condition or as part of a step's entrypoint logic to gate execution. By checking if $TAG_NAME matches the glob pattern 'v*.*.*', the production deployment step will only run when the build is triggered by a matching tag, ensuring environment-specific control within a single cloudbuild.yaml.

Answer

In the cloudbuild.yaml, add a condition that checks if the branch name matches 'v*.*.*'.

Answer

Create a separate cloudbuild.yaml for production and use a branch filter '^main$' to trigger it.

Answer

Configure a manual approval step in Cloud Build that requires a production manager to approve before running the production deployment.

Question 3

Which TWO are valid methods to manage service account keys securely? (Select exactly 2)

Accepted Answer

Automate key rotation using a Cloud Function.. Automating key rotation with a Cloud Function ensures service account keys are rotated on a schedule without manual intervention, reducing the risk of key exposure. This aligns with Google Cloud's best practices for key management, as it enforces rotation policies programmatically and can integrate with Secret Manager to securely store and version keys.

Answer

Rotate keys manually every 90 days.

Answer

Embed keys in application code.

Answer

Store keys in Cloud Storage with public access.

Question 4

A site reliability engineer is defining SLOs for a microservice application running on Google Kubernetes Engine. The application serves user-facing API requests. Which TWO approaches should the engineer take to effectively monitor the service's performance?

Accepted Answer

Monitor the 99th percentile of request latency directly using Cloud Monitoring custom metrics.. Monitoring the 99th percentile (p99) of request latency directly captures the experience of the slowest 1% of users, which is critical for user-facing APIs where tail latency directly impacts user satisfaction. Cloud Monitoring custom metrics allow the engineer to instrument the application to emit precise latency distributions, enabling accurate SLO tracking rather than relying on averages that mask outliers.

Answer

Monitor average latency because it is most representative of typical user experience.

Answer

Monitor container CPU utilization as a proxy for application latency.

Answer

Use the number of running pods as the primary SLO indicator.

Question 5

A company runs a microservices architecture on GKE and notices high network latency between services. Which THREE actions can improve inter-service communication performance?

Accepted Answer

Implement caching at the API gateway to reduce redundant requests. Implementing caching at the API gateway reduces redundant requests, which directly decreases network round trips and lowers latency for repeated data retrievals. This is a common performance optimization in microservices architectures, as it offloads backend services and minimizes inter-service chatter.

Answer

Use Istio mTLS for all service-to-service communication

Answer

Increase the number of nodes in the cluster

Question 6

Which TWO of the following are essential elements of a comprehensive incident post-mortem document according to Google's Site Reliability Engineering (SRE) best practices?

Accepted Answer

A timeline of events leading to and during the incident.. A timeline of events is a core element of an incident post-mortem in Google SRE practice, as it provides a chronological reconstruction of the incident's progression, enabling teams to understand the sequence of failures and responses. This timeline is essential for identifying contributing factors and evaluating the effectiveness of mitigation actions, not just the root cause.

Answer

Exact code line numbers and commits that caused the incident.

Answer

A detailed analysis of the root cause only.

Answer

An attribution of blame to the individual or team responsible.

Question 7

Your team is running a high-traffic web application on Google Kubernetes Engine (GKE) and has configured Horizontal Pod Autoscaling (HPA) based on CPU utilization. Recently, the application experienced intermittent latency spikes during traffic bursts. You suspect that the HPA is not scaling quickly enough. Which TWO actions would most effectively improve the autoscaling responsiveness?

Accepted Answer

Configure a custom metric in HPA based on the application's request latency (e.g., p99 latency).. Using a custom metric based on request latency (e.g., p99 latency) allows HPA to react to application performance degradation directly, rather than relying solely on CPU utilization which may lag behind traffic bursts. This provides a more immediate signal for scaling, as latency spikes often precede CPU saturation in web applications. Option D is correct because reducing the --horizontal-pod-autoscaler-upscale-stabilization window (default 5 minutes) to a lower value like 30 seconds decreases the time HPA waits before acting on scale-up recommendations, enabling faster response to sudden load increases.

Answer

Increase the target CPU utilization percentage to 90% so that pods are less likely to be added.

Answer

Set the maxReplicas of the HPA to a value lower than the expected peak traffic to force faster scaling.

Answer

Increase the --horizontal-pod-autoscaler-sync-period flag to 30 seconds and increase the --horizontal-pod-autoscaler-upscale-delay flag to 5 minutes.

Question 8

A company uses BigQuery on-demand pricing. They want to reduce costs without changing usage patterns. Which THREE strategies are effective? (Choose three.)

Accepted Answer

Use clustered tables.. Partitioning and clustering reduce data scanned per query. Materialized views precompute results to reduce scanned data on repeated queries.

Answer

Use legacy SQL instead of standard SQL.

Answer

Use flat-rate pricing.

Question 9

A team is troubleshooting a slow response time on an App Engine standard environment application. The application uses Cloud SQL as its database. Which TWO actions should the team take to identify the bottleneck?

Accepted Answer

Examine App Engine request logs for latency patterns.. Examining App Engine request logs reveals latency patterns, such as which endpoints or operations are slow, helping to pinpoint whether the bottleneck is in the application code, network, or database. Option C is correct because enabling Cloud SQL slow query logging identifies long-running SQL queries that could be causing database contention or inefficient data retrieval, directly addressing a common performance bottleneck in App Engine applications using Cloud SQL.

Answer

Increase the number of App Engine instances.

Answer

Enable Cloud CDN to cache responses.

Answer

Disable caching to ensure fresh data.

Question 10

A DevOps team is bootstrapping a Google Cloud organization. They need to ensure that all projects have a consistent set of labels applied automatically. Which two approaches can they use? (Choose TWO.)

Accepted Answer

Use an organization policy that requires labels.. Organization Policies can enforce that all new projects must have specific labels by using a constraint like `constraints/compute.requireOsLogin` is not for labels, but you can use a custom constraint with the `constraints/gcp.resourceLabels` to require labels on resources. However, for projects themselves, you can use an organization policy with a list constraint to mandate that certain labels are present on all projects, and the policy will block creation of any project that does not comply.

Answer

Use a Terraform module to create projects with labels.

Answer

Use a folder-level constraint to enforce labels.

Answer

Use Cloud Asset Inventory to monitor labels.

Question 11

You are an on-call engineer responding to a critical service incident affecting a production application. According to Google's Incident Management best practices, which TWO actions should you take immediately after declaring the incident?

Accepted Answer

Communicate the incident status to stakeholders and affected teams.. Google's Incident Management best practices emphasize that immediately after declaring an incident, the on-call engineer must communicate the incident status to stakeholders and affected teams. This ensures that everyone is aware of the ongoing issue, sets expectations, and prevents redundant troubleshooting. Early communication also helps in coordinating response efforts and reducing confusion during the critical initial phase.

Answer

Notify the incident commander to take over coordination.

Answer

Begin documenting the incident for a postmortem report.

Answer

Roll back the latest deployment to the previous stable version.

Question 12

Your organization is adopting DevOps practices and needs to bootstrap a Google Cloud organization with multiple projects. You want to enforce consistent resource naming conventions and apply common organization policies across all projects. Which two services should you use together to achieve this?

Accepted Answer

Organization Policies and Resource Manager folders. To enforce consistent resource naming conventions and common organization policies across all projects, you need Organization Policies (via constraints) and Resource Manager folders. Organization Policies allow you to set rules such as custom naming constraints or disabling external IPs that apply across the entire resource hierarchy. Resource Manager folders help organize projects and can inherit policies. Service Accounts and IAM roles (C) control access but do not enforce naming conventions or policies directly. Therefore, only option D provides the appropriate services to achieve the goal.

Answer

Cloud Shell and Cloud Source Repositories

Answer

Cloud Deployment Manager and Cloud Audit Logs

Answer

Service Accounts and IAM roles

Question 13

Which TWO tools should be used for real-time incident collaboration and communication?

Accepted Answer

Cloud Monitoring Incident Response (beta).. Cloud Monitoring Incident Response (beta) provides a dedicated interface for real-time incident management, including automated notifications, escalation policies, and a centralized timeline for collaboration. Google Chat with a dedicated incident room enables real-time communication and coordination among incident responders, allowing them to share updates, logs, and runbooks in a structured channel. Together, these tools fulfill the need for both incident orchestration and synchronous collaboration during active incidents.

Answer

Google Meet only.

Answer

Jira.

Answer

Cloud Trace.

Question 14

A DevOps team is designing a CI/CD pipeline using Cloud Build and Spinnaker. They want to ensure secrets are managed securely. Which three recommended practices should they implement? (Choose THREE.)

Accepted Answer

Grant Cloud Build service account access to secrets via IAM.. A is correct because Cloud Build's service account must be granted IAM roles (e.g., roles/secretmanager.secretAccessor) on the Secret Manager secret to allow the pipeline to retrieve the secret value at build time. Without explicit IAM binding, the service account lacks permission to access the secret, causing the build to fail. This follows the principle of least privilege and ensures that only authorized identities can read secrets.

Answer

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Answer

Base64 encode secrets and store them in Cloud Build substitutions.

Question 15

A team is bootstrapping a new Google Cloud organization. Which TWO practices are recommended for managing project creation and resource hierarchy? (Choose two.)

Accepted Answer

Create a folder for each department to isolate resources.. Creating a folder for each department allows you to isolate resources, apply IAM policies at the folder level, and enforce organizational boundaries. This follows Google Cloud's recommended resource hierarchy best practices for multi-team environments, enabling delegated administration and cost tracking per department.

Answer

Use a centralized service account to create projects via API.

Answer

Use a single project for all development environments.

Answer

Assign project creator role to all users by default.

Question 16

A Cloud Build pipeline that deploys a container to Cloud Run fails with the error: `Missing required permission run.routes.invoke`. The Cloud Build service account has the 'Cloud Run Invoker' role. Which TWO additional steps should be taken?

Accepted Answer

Ensure the service account has the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account.. The Cloud Build service account needs the `iam.serviceAccounts.actAs` permission on the Cloud Run runtime service account (the service account that Cloud Run uses to run the container). Without this permission, Cloud Build cannot impersonate the runtime service account to deploy the container, even if it has the Cloud Run Invoker role. The `run.routes.invoke` error occurs because the deployment process requires the ability to invoke the route, which is tied to the runtime service account's permissions.

Answer

Enable the Cloud Run API in the project.

Answer

Use a different service account for deployment.

Answer

Add the `run.routes.invoke` permission to a custom role.

Question 17

Which TWO are best practices when setting up a Google Cloud organization for multiple teams? (Select exactly 2)

Accepted Answer

Use a shared VPC to connect projects.. A shared VPC allows multiple projects to share a common VPC network, enabling centralized control of networking resources, firewall rules, and IP addressing. This is a best practice for multi-team organizations because it reduces administrative overhead, ensures consistent network policies, and simplifies connectivity between projects without requiring complex peering or VPN setups.

Answer

Create a separate billing account for each team.

Answer

Grant all users the Project Creator role.

Answer

Enable the Compute Engine API in every project.

Question 18

Which TWO options are valid methods to create a custom metric descriptor in Cloud Monitoring?

Accepted Answer

Using the gcloud commands: gcloud monitoring metrics create. The `gcloud monitoring metrics create` command directly invokes the Cloud Monitoring API to create a custom metric descriptor. Option E is correct because the Cloud Monitoring API's `CreateMetricDescriptor` method is the programmatic way to define a custom metric, specifying its type, unit, and labels. Both methods result in a new metric descriptor being registered in the project's metric store.

Answer

Creating a log-based metric

Answer

Using Terraform resource google_monitoring_metric_descriptor

Answer

Deploying a Prometheus exporter with the Ops Agent

Question 19

A company runs a nightly batch data processing job on Compute Engine instances. The job runs for approximately 2 hours each night and is fault-tolerant (can resume from checkpoint). The team wants to minimize costs. Which TWO strategies should they implement? (Choose two.)

Accepted Answer

Use preemptible VMs for the worker nodes.. Preemptible VMs are significantly cheaper than standard VMs (up to 60-80% discount) and are ideal for fault-tolerant, short-lived batch jobs that can resume from checkpoints. Since the job runs nightly for only 2 hours and can handle interruptions, preemptible VMs minimize costs without risking job completion.

Answer

Purchase 1-year committed use discounts for the worker nodes.

Answer

Migrate the workload to Cloud Functions.

Answer

Enable sustained use discounts by keeping the instances running 24/7.

Question 20

Which THREE are benefits of migrating from Jenkins to Cloud Build?

Accepted Answer

No server maintenance. Cloud Build is a fully managed CI/CD service that runs on Google Cloud's infrastructure, eliminating the need for users to provision, configure, or maintain build servers. Unlike Jenkins, which requires ongoing administration of the Jenkins master and agent nodes, Cloud Build automatically scales resources and handles underlying server maintenance, including OS patches and hardware failures.

Answer

Support for any VCS

Answer

Built-in security scanning