PCDOE Timed Practice Test 2 — 10 Questions

Question 1

An organization is using Cloud Source Repositories and wants to enforce that all commits are signed with a verified GPG key. How can they enforce this?

Accepted Answer

Enable the Signed Commits policy in the repository settings.. Option C is correct because Cloud Source Repositories provides a built-in 'Signed Commits' policy in the repository settings that, when enabled, rejects any push containing commits that are not signed with a verified GPG key. This policy is enforced server-side at the repository level, ensuring that only signed commits are accepted without requiring external tools or custom scripts.

Answer

Use a branch protection rule in Cloud Source Repositories.

Answer

Use Cloud Functions to validate commits after push.

Answer

Use a pre-receive hook in Cloud Source Repositories.

Question 2

A DevOps engineer notices that developers are accidentally deleting Cloud Storage buckets. The organization wants to prevent accidental deletion while still allowing developers to manage bucket objects. What is the best practice?

Accepted Answer

Set a bucket retention policy with deletion lock.. A bucket retention policy with a deletion lock prevents the deletion of the bucket itself, even by users with owner permissions, while still allowing developers to manage objects within the bucket. This is the only option that directly enforces a hard, irreversible lock on bucket deletion, meeting the requirement to prevent accidental deletion without restricting object management.

Answer

Enable Cloud Audit Logging and set up alerts on bucket deletion.

Answer

Set a bucket IAM policy denying storage.objects.delete for developers.

Answer

Use an organization policy to disable bucket deletion across the org.

Question 3

A DevOps engineer is designing a CI/CD pipeline using Cloud Build. Which TWO configurations are necessary to ensure secure and reliable deployments? (Choose two.)

Accepted Answer

Use manual approval steps for production deployments.. Options C and E are correct. Secret Manager provides security, and manual approval ensures reliability.

Answer

Use Cloud Build triggers with branch filters.

Answer

Push all artifacts to a public Container Registry.

Answer

Enable Cloud Build service account with Editor role.

Question 4

A startup is bootstrapping their Google Cloud organization with the following constraints: they have a small team of 10 developers, each with varying levels of expertise. They want a simple setup that allows developers to experiment in their own projects but prevents them from deleting production resources. They also want to enforce a budget limit on each project to avoid unexpected costs. The team has no prior Google Cloud experience and wants minimal operational overhead. Which of the following approaches best meets their needs?

Accepted Answer

Create a folder for production and a folder for development, assign developers Editor on dev projects and Viewer on prod, set budget alerts on both folders.. Option B provides clear separation and cost control with minimal complexity.

Answer

Use a single project with VPC Service Controls to isolate resources.

Answer

Create a single project for all developers, use budget alerts, and give everyone Owner role.

Answer

Create a project per developer, give them Owner role, and set a budget on each project.

Question 5

You are designing alerting policies for a microservice architecture. Which TWO metrics are most suitable for triggering a page to the on-call engineer?

Accepted Answer

Latency P99 exceeding the SLO target for 5 minutes.. Error budget burn rate and high latency (P99 breaching SLO) directly indicate customer-facing issues and require immediate attention. CPU and request count are less critical.

Answer

Number of requests per second.

Answer

CPU utilization at 50%.

Answer

Memory usage trend.

Question 6

A multinational company runs an application on Google Cloud with an SLO of 99.99% monthly availability. They use a multi-region deployment with Cloud Load Balancing and Cloud Spanner. During a regional outage in us-central1, traffic fails over to us-east1. However, the incident response team is not alerted because the error budget burn rate remained below the alert threshold. What should the team change to ensure timely alerting for such regional failures?

Accepted Answer

Create a custom dashboard and alert for regional unavailability using Cloud Monitoring metrics like load_balancing/backend_request_count and region health checks.. Option D is correct because implementing a 'signals of possible trouble' dashboard and alerts for regional failures provides early warning even before SLO is breached. Option A is wrong because lowering the burn rate alert threshold may cause noise but could help, but it's not the best practice for regional failures. Option B is wrong because the burn rate is already calculated over a longer window; reducing window might help but could increase noise. Option C is wrong because changing SLO to 99.9% would increase error budget but not address alerting.

Answer

Shorten the SLO compliance window from 30 days to 7 days.

Answer

Change the SLO to 99.9% to allow more error budget.

Answer

Reduce the error budget burn rate alert threshold from 10% to 5% per hour.

Question 7

An organization has a service that must meet a 99.99% SLO. The service runs on GKE and uses Cloud SQL. The team notices that during a major incident, the error budget is consumed rapidly. They want to implement a mechanism to automatically rollback deployments that cause sustained error budget consumption above a threshold. What is the best approach?

Accepted Answer

Set up a deployment pipeline with Cloud Deploy that includes a predeployment validation step that checks the current error budget burn rate and blocks the release if the burn rate exceeds 10% per hour.. Option A is correct because using Cloud Deploy or Spinnaker with automated rollback based on error budget burn rate is the recommended pattern. Option B is wrong because Cloud Build is CI, not deployment orchestration. Option C is wrong because canary deployments reduce blast radius but don't auto-rollback. Option D is wrong because manual rollback via Cloud Console is not automated.

Answer

Use Cloud Scheduler to run a script that checks error budget and rolls back if needed.

Answer

Implement a canary deployment strategy with manual approval steps.

Answer

Configure Cloud Build to automatically revert the last commit if error budget is consumed.

Question 8

During a post-incident review, the team discovers that a misconfiguration in Cloud Armor caused legitimate traffic to be blocked, leading to a outage. The misconfiguration was introduced by a junior engineer who had overly permissive IAM roles. What is the best way to prevent similar incidents in the future?

Accepted Answer

Use Organization Policy constraints to restrict allowed IP ranges and rules in Cloud Armor security policies.. Option D is correct because enforcing guardrails with Organization Policies can prevent misconfigurations at scale. Option A is wrong because removing the engineer's access is punitive but doesn't prevent others. Option B is wrong because peer reviews reduce human error but are not automated. Option C is wrong because Cloud Armor logs help detection but not prevention.

Answer

Enforce a mandatory peer review for all Cloud Armor configuration changes.

Answer

Revoke the junior engineer's access to Cloud Armor and grant read-only access.

Answer

Enable Cloud Armor security policy logs and create alerting for blocked traffic spikes.

Question 9

During a canary deployment of a new version of a microservice, the engineer notices increased error rates in the canary instances. What is the best immediate action?

Accepted Answer

Perform a rollback of the canary to the previous version.. When error rates increase in a canary, the safest immediate action is to roll back the canary to prevent further impact on users. Pausing and investigating is reasonable but allows continued errors. Scaling up the canary would worsen the issue. Continuing the rollout would be irresponsible.

Answer

Continue the rollout to see if errors stabilize.

Answer

Scale up the canary instances to handle load.

Answer

Pause the rollout and investigate the errors.

Question 10

An SRE team created the above logs-based metric. They expect it to count the number of HTTP 500 errors per instance. However, the metric shows no data. What is the most likely cause?

Accepted Answer

The log entries might not have the 'status' field in jsonPayload; it could be in a different location or format.. Option B is correct because the most likely reason for a logs-based metric showing no data is that the log entries do not contain the expected 'status' field in jsonPayload, or it is located in a different field (e.g., httpRequest.status) or formatted as a string instead of an integer. Cloud Logging metrics rely on exact field paths defined in the metric descriptor; if the field is missing or misnamed, no data points are generated.

Answer

The metric kind is DELTA but should be CUMULATIVE.

Answer

The metric name does not follow the required naming convention.

Answer

The labelExtractors must use regex instead of JSON path.