Knowledge + Practice

Google Professional Cloud Developer (PCD) — Questions 76–150

964 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 2 of 13

76

MCQeasy

A financial services company needs to maintain a backup of their Bigtable instance in a different geographic region. They want to restore the backup quickly in case of a regional failure. What should they do?

A.Set up a hot standby Bigtable cluster in another region using replication.

B.Use Cloud SQL cross-region backup copy feature.

C.Create a Bigtable backup and restore it to a cluster in another region.

D.Export the Bigtable data to Cloud Storage and import it into a new cluster.

AnswerC

Bigtable backups are cluster-specific and can be restored to any cluster in the same project, enabling cross-region recovery.

Why this answer

Bigtable backups are designed for exactly this use case: they are full, consistent copies of the table schema and data that can be restored to a different cluster in another region. This approach provides a fast, managed restore without the overhead of maintaining a hot standby or the complexity of export/import pipelines. Option C directly uses the Bigtable backup and restore feature, which is the recommended method for cross-region disaster recovery.

Exam trap

A common trap is confusing Bigtable replication (which is intra-region or within an instance) with backup/restore (which is cross-region). Replication does not support cross-region failover; backup and restore to a different region is the correct approach.

How to eliminate wrong answers

Option A is wrong because Bigtable does not support active-active replication across regions; it offers replication only within a single cluster or between clusters in the same instance, not as a hot standby for regional failover. Option B is wrong because Cloud SQL is a different database service (relational) and has no relevance to Bigtable; the question specifically asks about Bigtable, not Cloud SQL. Option D is wrong because exporting to Cloud Storage and importing is a manual, slower process that involves intermediate storage and additional steps, whereas a direct backup and restore is faster and more reliable for quick recovery.

Full explanation →

77

MCQhard

A financial services company runs a transaction processing microservice on Google Kubernetes Engine (GKE). The service uses Cloud Spanner as its database. After migrating from Cloud SQL to Spanner to improve scalability, the team notices that a small percentage of transactions fail with an 'ABORTED' error due to deadlock detection. The application currently performs no retries, and the failures cause customer-facing errors. The team also observes that under peak load, transaction latencies are around 500ms, which is acceptable but they want to ensure the system remains reliable. They need to implement a solution that minimizes failures while maintaining acceptable performance. Which course of action should they take?

A.Increase the number of Spanner nodes to reduce the probability of deadlocks.

B.Reduce the size of each transaction by splitting them into smaller ones.

C.Change the transaction isolation level to READ UNCOMMITTED to avoid deadlocks.

D.Implement retry logic with exponential backoff and random jitter for aborted transactions.

AnswerD

Retrying with backoff and jitter is the standard pattern for handling Spanner aborts, ensuring transient conflicts are resolved without significant latency impact.

Why this answer

In Cloud Spanner, 'ABORTED' errors due to deadlock detection are a normal part of the optimistic concurrency control mechanism. The correct solution is to implement retry logic with exponential backoff and random jitter, as recommended by Google's own documentation. This approach transparently handles transient deadlocks without requiring infrastructure changes or sacrificing consistency, and it maintains acceptable latency by spacing out retries.

Exam trap

The PCD exam often tests the misconception that scaling infrastructure (more nodes) or reducing transaction size alone can eliminate deadlocks, when in fact retry logic is the required pattern for handling transient aborts in distributed databases like Cloud Spanner.

How to eliminate wrong answers

Option A is wrong because increasing the number of Spanner nodes improves throughput and storage capacity but does not directly reduce the probability of deadlocks; deadlocks are a function of transaction contention, not node count. Option B is wrong because splitting transactions into smaller ones can reduce the chance of conflicts but does not eliminate the need for retry logic; it also may break application-level atomicity requirements. Option C is wrong because Cloud Spanner does not support READ UNCOMMITTED isolation; it provides serializable isolation (and optional stale reads), and lowering isolation is not possible and would violate consistency guarantees.

Full explanation →

78

MCQmedium

An e-commerce platform uses Cloud SQL for PostgreSQL for its inventory database. To meet a higher availability requirement, they decide to enable the HA configuration. What is the expected recovery point objective (RPO) with Cloud SQL HA?

A.0 (zero)

B.Depends on the replication lag

C.Up to 5 minutes

D.Up to 1 minute

AnswerA

Cloud SQL HA uses synchronous replication to the standby, guaranteeing no data loss on failover, i.e., RPO=0.

Why this answer

Cloud SQL for PostgreSQL HA uses synchronous replication to a standby instance in a different zone within the same region. This ensures that every write transaction is committed on both the primary and standby before acknowledging the client, resulting in zero data loss upon failover. Therefore, the RPO is 0 (zero).

Exam trap

The trap here is that candidates confuse Cloud SQL HA's synchronous replication with typical asynchronous replication used in self-managed PostgreSQL streaming replication, leading them to incorrectly assume a non-zero RPO due to replication lag.

How to eliminate wrong answers

Option B is wrong because Cloud SQL HA uses synchronous replication, not asynchronous, so there is no replication lag; the RPO is fixed at zero. Option C is wrong because an RPO of up to 5 minutes would imply asynchronous replication with potential data loss, which is not the case for Cloud SQL HA. Option D is wrong because an RPO of up to 1 minute still suggests some data loss window, whereas Cloud SQL HA guarantees zero data loss through synchronous replication.

Full explanation →

79

MCQhard

You are a developer at a company that runs a critical pricing engine on Compute Engine instances in a managed instance group (MIG) behind an internal TCP load balancer. The pricing engine is a stateful application that stores state in memory and also writes to a Cloud Bigtable instance for persistence. The application uses a custom port 8080. You need to migrate this application to Cloud Run for better scalability and reduced operational overhead. The application must maintain session affinity so that requests from the same client are routed to the same instance (since the in-memory state is not yet fully externalized). The application currently uses a health check on /healthz that returns 200 OK. You have containerized the application. When you deploy to Cloud Run, you notice that traffic is not sticky; every request might go to a different revision. You also need to ensure that Bigtable writes are performed asynchronously to avoid slowing down the pricing calculations. What should you do?

A.Implement a custom health check on TCP port 8080 in Cloud Run to ensure only healthy instances receive traffic.

B.Increase the container concurrency setting to 1 to force each container to handle one request at a time.

C.Use Cloud Run with an HTTP(S) External Load Balancer and enable session affinity on the backend service.

D.Deploy the application on Cloud Run and configure an Internal TCP/UDP Load Balancer in front of it with session affinity.

AnswerC

External load balancer provides session affinity; Cloud Run itself does not.

Why this answer

Cloud Run does not natively support session affinity, but you can achieve it by placing Cloud Run behind an external HTTP(S) load balancer and enabling session affinity on the backend service. This ensures that requests from the same client are routed to the same Cloud Run revision, maintaining session stickiness for the in-memory state. Option A is incorrect because Cloud Run does not support custom TCP health checks; it only supports HTTP health checks, and Cloud Run automatically handles health checks via the /healthz endpoint.

Option B is incorrect because setting concurrency to 1 does not provide session affinity; it only limits the number of concurrent requests per container, but subsequent requests from the same client may still go to different containers without a load balancer with session affinity. Option D is incorrect because Cloud Run cannot be placed behind an internal TCP/UDP load balancer; it only supports HTTP(S) traffic and must use an external load balancer for session affinity.

Full explanation →

80

MCQmedium

Refer to the exhibit. A company configured an HPA for their deployment. They notice that the HPA is not scaling based on the 'packets-per-second' metric. What is the most likely reason?

A.The metric is not available in the cluster.

B.The metric name 'packets-per-second' is incorrect.

C.The target type should be 'Value' instead of 'AverageValue'.

D.The HPA is using the wrong scaleTargetRef.

AnswerA

Custom metrics must be exposed via an adapter; if not, HPA cannot access it.

Why this answer

The 'packets-per-second' metric is a custom metric. If it is not registered in the cluster's metrics server (e.g., via custom metrics adapter), the HPA will not be able to collect it. The metric name and target type are correct.

The scaleTargetRef matches the deployment. Therefore, the metric being unavailable is the most likely issue.

Full explanation →

81

MCQeasy

An organization is migrating an on-premises PostgreSQL database to Cloud SQL. They want to minimize downtime during the cutover. Which Google Cloud service should they use to perform an online migration with near-zero downtime?

A.BigQuery Data Transfer Service

B.Cloud Dataflow

C.Transfer Appliance

D.Database Migration Service

AnswerD

DMS provides continuous migration with CDC, enabling near-zero-downtime cutover.

Why this answer

Database Migration Service (DMS) supports continuous migration jobs that perform a full dump, then CDC (change data capture), allowing for near-zero-downtime cutover by promoting the Cloud SQL replica.

Full explanation →

82

MCQhard

A developer created a Cloud Function that makes an HTTP request to an external API. The above error occurs intermittently. The external API is working correctly. What is the most likely cause?

A.The request to the external API has incorrect headers or payload

B.The function is not handling network retries properly

C.The Cloud Function is not deployed in the same region as the API

D.The function is timing out due to long response time

AnswerA

An invalid argument error strongly suggests the request parameters are incorrect.

Why this answer

The 'INVALID_ARGUMENT' error indicates the request payload or headers are malformed. Intermittent occurrence suggests a data-dependent issue rather than a permanent config problem.

Full explanation →

83

Multi-Selectmedium

A company is migrating an on-premises Oracle database to Google Cloud. They need a managed relational database with high availability, but they are not ready to redesign their schema for sharding. They also want to reduce licensing costs. Which TWO Google Cloud database services should they consider? (Choose 2)

Select 2 answers

A.Firestore

B.Cloud Spanner

C.Bigtable

D.Cloud SQL for SQL Server

E.AlloyDB

AnswersD, E

SQL Server is a direct lift-and-shift target with managed HA.

Why this answer

Cloud SQL supports managed MySQL, PostgreSQL, and SQL Server, suitable for lift-and-shift. AlloyDB is PostgreSQL-compatible and offers high performance with a columnar engine. Both are managed and reduce licensing costs compared to Oracle.

Full explanation →

84

MCQhard

During a continuous migration job from on-premises MySQL to Cloud SQL, the engineer notices that the migration job fails after the full dump phase with an error about character set mismatch. The source uses utf8 charset, but Cloud SQL defaults to utf8mb4. What is the best action to resolve this?

A.Ignore the error and promote the replica

B.Change Cloud SQL instance charset to utf8

C.Change the source database charset to utf8mb4

D.Use a one-time migration instead

AnswerC

Converting source to utf8mb4 ensures compatibility with Cloud SQL default.

Why this answer

The source charset 'utf8' in MySQL is actually utf8mb3 (3-byte UTF-8). Cloud SQL MySQL 8.0 defaults to utf8mb4. To avoid data loss, the source tables should be converted to utf8mb4 before migration, or the target must be configured to accept utf8mb3 if compatible.

Full explanation →

85

MCQhard

A company deploys a Java application on Compute Engine with a preemptible VM instance group managed by an instance template. The application writes critical state to local SSD. After a preemption event, the new instance starts fresh and loses state. What is the best practice to ensure state persistence?

A.Modify the startup script to recover state from a snapshot

B.Refactor the application to write state to a persistent service like Cloud Storage

C.Configure the managed instance group as stateful to preserve local SSD data

D.Use a regular (non-preemptible) VM instead of preemptible

AnswerB

This decouples state from the instance, ensuring durability across preemptions.

Why this answer

Local SSD data is ephemeral and lost on VM preemption or termination. Refactoring the application to write critical state to a persistent service like Cloud Storage ensures data durability independent of the VM lifecycle. This aligns with the best practice of designing preemptible workloads to be stateless, where state is stored externally.

Exam trap

The PCD exam often tests the misconception that local SSD can be made persistent through MIG stateful configuration, but stateful MIGs do not protect against preemption—they only preserve instance name and metadata, not local SSD data on termination.

How to eliminate wrong answers

Option A is wrong because snapshots capture disk state at a point in time, but they are not designed for real-time state recovery; the startup script would need to restore from a snapshot, which adds latency and complexity, and the snapshot itself may be stale if not taken frequently. Option C is wrong because managed instance groups (MIGs) with stateful configuration preserve local SSD data only for specific instances, not for preemptible VMs which are terminated and recreated; stateful MIGs are intended for regular VMs where instance identity is preserved. Option D is wrong because using a non-preemptible VM avoids preemption but increases cost and defeats the purpose of using preemptible VMs for cost savings; the question asks for best practice to ensure state persistence, not to avoid preemption.

Full explanation →

86

MCQmedium

A team is migrating a monolithic application to a microservices architecture on Google Kubernetes Engine (GKE). They want to ensure that failures in one microservice do not cascade to others. Which design pattern should they implement?

A.Implement retry logic with exponential backoff for all inter-service calls.

B.Implement a circuit breaker pattern that opens when failure thresholds are exceeded.

C.Use synchronous HTTP calls with timeouts to detect failures quickly.

D.Use bulkheads to separate thread pools for each service.

AnswerB

Circuit breaker fails fast and prevents unnecessary load on failing services.

Why this answer

The circuit breaker pattern is the correct choice because it prevents cascading failures by monitoring inter-service calls and opening the circuit when failures exceed a threshold, allowing the system to fail fast and recover gracefully. In a GKE-based microservices architecture, this pattern is typically implemented using libraries like Resilience4j or Istio's circuit breaker, which can be configured to trip after a certain number of consecutive failures, thus protecting downstream services from being overwhelmed.

Exam trap

The PCD exam often tests the distinction between patterns that isolate failures within a component (bulkheads) versus patterns that prevent failures from propagating across components (circuit breaker), leading candidates to confuse the scope of each pattern.

How to eliminate wrong answers

Option A is wrong because retry logic with exponential backoff alone does not prevent cascading failures; it can actually exacerbate them by continuing to send requests to an already failing service, potentially causing resource exhaustion. Option C is wrong because synchronous HTTP calls with timeouts, while useful for detecting failures, do not provide a mechanism to stop repeated calls to a failing service, leading to thread pool starvation and cascading failures. Option D is wrong because bulkheads separate thread pools to isolate failures within a single service instance, but they do not prevent failures from propagating across different microservices in a distributed system.

Full explanation →

87

MCQhard

A company is designing a Bigtable schema for time-series data from millions of devices. Each device sends a reading every minute. The row key is currently 'device_id#timestamp'. The engineering team notices hot spots on a few popular devices. Which row key design change would BEST distribute writes across the cluster?

A.Promote device ID to column family

B.Use reversed domain for device IDs

C.Use only timestamp as row key

D.Append a random salt prefix to the row key

AnswerD

Salted keys randomize the start of the row key, distributing writes across nodes and avoiding hotspots.

Why this answer

Salted keys (prepending a hash prefix) distribute writes across tablet servers. Reversing the timestamp or field promotion alone may not solve hotspots from popular device IDs.

Full explanation →

88

Multi-Selectmedium

Which THREE are valid uses of Cloud Trace? (Choose three.)

Select 3 answers

A.Identifying latency bottlenecks in a distributed application

B.Monitoring CPU usage of a Compute Engine instance

C.Viewing the flow of requests through microservices

D.Analyzing the performance of external API calls

E.Exporting traces to Prometheus for long-term storage

AnswersA, C, D

Trace shows where time is spent across services.

Why this answer

Cloud Trace is a distributed tracing system that captures latency data from applications, allowing you to identify performance bottlenecks across services. Option A is correct because Cloud Trace provides detailed traces that show the time spent in each component of a distributed application, enabling you to pinpoint where delays occur.

Exam trap

The PCD exam often tests the distinction between tracing (Cloud Trace) and monitoring (Cloud Monitoring), so candidates mistakenly choose CPU usage monitoring as a valid use of Cloud Trace.

Full explanation →

89

MCQhard

A team uses Cloud Build to deploy applications that need to access a Cloud SQL database in a VPC. They want to avoid exposing the database to the public internet. Which configuration is required?

A.Configure Cloud Build to use a private pool in the same VPC as the database

B.Enable VPC Network Peering between Cloud Build and the database VPC

C.Use Cloud SQL Proxy in a Cloud Build step

D.Use a public IP on Cloud SQL and restrict by IP whitelist

AnswerA

Private pools run inside a VPC, enabling internal access to Cloud SQL.

Why this answer

Cloud Build private pools run in a customer-managed VPC, allowing workers to directly access resources like Cloud SQL instances via private IP without traversing the public internet. This configuration ensures the database is never exposed to the public internet, meeting the security requirement.

Exam trap

The PCD exam often tests the misconception that VPC peering or Cloud SQL Proxy can replace the need for placing Cloud Build workers inside the same VPC, but private pools are the only native way to run Cloud Build in your own VPC without public internet exposure.

How to eliminate wrong answers

Option B is wrong because VPC Network Peering is used to connect two VPC networks, but Cloud Build does not have its own VPC to peer; private pools are the correct mechanism to place Cloud Build workers inside the customer's VPC. Option C is wrong because Cloud SQL Proxy still requires a public IP or a private IP connection; while it can connect via private IP, it does not eliminate the need for the database to be accessible from the Cloud Build environment, and using a proxy in a Cloud Build step does not inherently avoid public exposure if the database has a public IP. Option D is wrong because using a public IP on Cloud SQL and restricting by IP whitelist still exposes the database to the public internet, albeit with access controls, which violates the requirement to avoid public exposure entirely.

Full explanation →

90

MCQeasy

A startup is building a mobile app that needs offline support and real-time synchronization across devices. The data is primarily user profiles and activity logs. Which Google Cloud database would best meet these requirements?

A.Cloud Spanner

B.Cloud SQL

C.Firestore

D.Cloud Bigtable

AnswerC

Firestore offers offline persistence and real-time sync, perfect for mobile and web apps.

Why this answer

Firestore provides offline data persistence and real-time sync, making it ideal for mobile apps. Cloud SQL and Spanner lack built-in offline support, and Bigtable is not suitable for complex document data.

Full explanation →

91

MCQmedium

A company wants to deploy a Bigtable instance for a production workload that requires high availability across zones. They also need to ensure consistent single-digit millisecond latency for reads. Which configuration should they choose?

A.Create a production instance with two clusters across two zones using SSD storage.

B.Create a production instance with one cluster and enable replication within the cluster.

C.Create a production instance with one cluster in a single zone using SSD storage.

D.Create a development instance with two clusters across two zones using HDD storage.

AnswerA

Two clusters in different zones provide HA; SSD provides low latency for production.

Why this answer

Bigtable replication across zones provides HA and read scaling. Production instances are required for production workloads. Development instances are limited and not for production.

HDD is slower, not recommended for low latency. A single cluster does not provide zone-level HA.

Full explanation →

92

Multi-Selecthard

You need to design a Firestore database for a mobile chat application that supports real-time updates and offline access. The app requires that users can only read and write their own messages. Which three configurations should you implement? (Choose three.)

Select 3 answers

A.Enable offline persistence in the client SDK

B.Use Firestore Native mode

C.Use Cloud SQL instead of Firestore for stronger consistency

D.Use Firestore Datastore mode

E.Define Security Rules that restrict read/write based on the authenticated user's UID

AnswersA, B, E

Offline persistence allows the app to work without connectivity and sync later.

Why this answer

Enabling offline persistence in the Firestore client SDK allows the mobile chat app to cache data locally, ensuring that users can read and write their own messages even when the device is temporarily offline. This is essential for a chat application that must support real-time updates and offline access, as Firestore automatically synchronizes local changes with the server when connectivity is restored.

Exam trap

Google often tests the distinction between Firestore Native mode and Datastore mode, where candidates mistakenly choose Datastore mode for real-time mobile apps, but Datastore mode lacks client-side real-time listeners and offline persistence, which are exclusive to Native mode.

Full explanation →

93

MCQeasy

Which Cloud SQL setting ensures that all client connections to the database use SSL?

A.Use private IP only.

B.Set the 'ssl_mode' to 'required'.

C.Enable IAM database authentication.

D.Set the 'require_ssl' flag to 'on'.

AnswerD

This flag enforces SSL for all connections.

Why this answer

The 'require_ssl' flag in Cloud SQL enforces SSL connections. If enabled, non-SSL connections are rejected. IAM database authentication controls login via IAM but does not mandate SSL.

Private IP alone does not enforce SSL; it's still possible to connect without SSL over the private network.

Full explanation →

94

MCQmedium

A company is migrating an Oracle database to AlloyDB for PostgreSQL using Database Migration Service. They have completed a full dump and are now in the CDC phase. They want to test the target database with minimal risk. What should they do?

A.Promote the continuous migration replica to a standalone instance

B.Stop the migration job and promote the replica

C.Create a snapshot of the target instance

D.Use Cloud SQL Auth Proxy to connect

AnswerA

Promotion converts the target to a standalone instance for testing. You can later set up a new migration job to catch up.

Why this answer

Database Migration Service allows creating a connection profile and a migration job. During the CDC phase, you can promote the replica to make the target database writable for testing. After testing, you can resume migration by re-creating the job.

Full explanation →

95

MCQmedium

A company wants to lift-and-shift an existing on-premises MySQL OLTP application to Google Cloud with minimal changes. They need up to 64 TB of storage and 96 vCPUs. Which database service should they use?

A.Cloud Spanner

B.Cloud SQL for MySQL

C.BigQuery

D.AlloyDB

AnswerB

Cloud SQL for MySQL supports the required specs and is ideal for lift-and-shift.

Why this answer

Cloud SQL for MySQL supports up to 64 TB storage and 96 vCPU, and requires minimal changes for lift-and-shift. AlloyDB is PostgreSQL-compatible, not MySQL. Cloud Spanner is not a drop-in replacement for MySQL.

BigQuery is for analytics.

Full explanation →

96

MCQeasy

A web application uses Cloud SQL for MySQL. The team expects a sudden spike in read-only traffic from a reporting tool. What should they use to offload read queries?

A.Automatic storage increase

B.Cross-region replication

C.Read replicas

D.Failover replica

AnswerC

Read replicas allow you to offload read queries from the primary instance, improving performance.

Why this answer

Read replicas in Cloud SQL for MySQL allow you to offload read traffic from the primary instance by creating one or more read-only copies. This is the correct approach for handling a sudden spike in read-only queries from a reporting tool, as it distributes the load without affecting write performance or requiring application changes beyond updating the connection string.

Exam trap

The PCD exam often tests the distinction between read replicas (for scaling reads) and failover replicas (for high availability), tempting candidates to choose failover replica because it sounds like it can handle traffic, but it cannot serve reads independently in Cloud SQL for MySQL.

How to eliminate wrong answers

Option A is wrong because automatic storage increase only adds disk space when the instance runs low, which does nothing to offload read queries or reduce CPU/memory load from read traffic. Option B is wrong because cross-region replication is designed for disaster recovery and geographic redundancy, not for scaling read capacity; it introduces latency and does not provide a local read endpoint for the reporting tool. Option D is wrong because a failover replica (also called a standby or HA replica) is a synchronous copy used for high availability and automatic failover, not for offloading read queries; it cannot serve read traffic independently in Cloud SQL for MySQL.

Full explanation →

97

MCQhard

A company uses Cloud SQL for MySQL with automated backups enabled. They want to perform point-in-time recovery (PITR) to recover from an accidental data deletion that occurred 10 minutes ago. What must be configured for PITR to work?

A.Increase the binlog retention period

B.Enable the slow query log

C.Enable automated backups only

D.Create a cross-region replica

AnswerC

Automated backups are already enabled, which enables PITR. No further action is needed.

Why this answer

Point-in-time recovery (PITR) for Cloud SQL for MySQL is automatically enabled when automated backups are enabled. Binary logging is enabled by default and retains logs for 7 days, which is sufficient for recovering data deleted 10 minutes ago. No additional configuration is required in this scenario.

Full explanation →

98

MCQhard

A company is migrating a monolithic application to microservices on Google Cloud. They have strict requirements for service-to-service communication: requests must be authenticated, authorized, and encrypted in transit. They also need to enforce fine-grained access control based on the requesting service identity. Which Google Cloud service should they use to achieve these goals?

A.Cloud Run with ingress control

B.Cloud Armor with IAM

C.Cloud Service Mesh (Anthos Service Mesh)

D.Cloud Endpoints with API keys

AnswerC

Cloud Service Mesh provides mutual TLS and policy-based access control for microservices.

Why this answer

Cloud Service Mesh (Anthos Service Mesh) provides mutual TLS, fine-grained authorization policies, and service identity. Option A is for API management, option B is for DDoS protection, and option D is for serverless ingress control.

Full explanation →

99

MCQeasy

Refer to the exhibit. You run the above command to build and push a Docker image to Container Registry. The build fails with an error: 'denied: Unauthenticated access'. What should you do to resolve this?

A.Grant the Cloud Build service account the Storage Object Admin role on the project

B.Grant the Cloud Build service account the Project Editor role

C.Grant the Compute Engine default service account the Storage Object Creator role

D.Run gcloud auth login as the project owner before submitting the build

AnswerA

This allows push to Container Registry, which is backed by Cloud Storage.

Why this answer

The error 'denied: Unauthenticated access' indicates that the Cloud Build service account does not have permission to push images to Container Registry. By default, Cloud Build uses the Cloud Build service account (service-[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com) to execute builds. Granting the Storage Object Admin role (roles/storage.admin) to this service account provides the necessary permissions to write objects (Docker image layers) to the Container Registry bucket in Cloud Storage, resolving the authentication failure.

Exam trap

The PCD exam often tests the distinction between the Cloud Build service account and the Compute Engine default service account, leading candidates to incorrectly choose Option C because they confuse the service account used by Cloud Build with the one used by Compute Engine instances.

How to eliminate wrong answers

Option B is wrong because granting the Project Editor role (roles/editor) is overly permissive and violates the principle of least privilege; it includes many unnecessary permissions beyond what is required for pushing images. Option C is wrong because the Compute Engine default service account is not used by Cloud Build; Cloud Build uses its own dedicated service account, and granting roles to the Compute Engine default service account would not resolve the build's authentication error. Option D is wrong because 'gcloud auth login' authenticates the user running the command, not the Cloud Build service account; the build runs in a non-interactive environment and relies on the service account's credentials, not the user's OAuth tokens.

Full explanation →

100

MCQmedium

An application writes structured logs to Cloud Logging. The team wants to create a metric based on the value of a JSON field 'order_total' to alert when totals exceed $1000. What type of metric should they use?

A.Uptime check metric.

B.Log-based metric.

C.Error Reporting metric.

D.Custom metric from Cloud Monitoring agent.

AnswerB

Extracts 'order_total' from logs and creates a metric.

Why this answer

A log-based metric extracts a numeric value from a log entry's JSON payload using a regular expression or a label extractor. By defining a log-based metric on the 'order_total' field and setting an alert threshold of $1000, the team can monitor and alert on high-value orders directly from Cloud Logging without additional instrumentation.

Exam trap

The PCD exam often tests the distinction between log-based metrics and custom metrics from agents, where candidates mistakenly think a custom metric agent is required to extract values from logs, but Cloud Logging's built-in log-based metrics handle this directly without any agent.

How to eliminate wrong answers

Option A is wrong because uptime check metrics monitor the availability and response time of a URL or service, not the value of a field in structured logs. Option C is wrong because Error Reporting metrics are designed to count and group application errors (e.g., exceptions, stack traces), not to extract arbitrary numeric fields like 'order_total'. Option D is wrong because custom metrics from the Cloud Monitoring agent require installing and configuring the agent on a VM to collect system-level metrics (e.g., CPU, memory), not to parse log entries.

Full explanation →

101

MCQmedium

A company is deploying a containerized application on Google Kubernetes Engine (GKE). The development team has built a Docker image and pushed it to Artifact Registry. They want to automate the deployment process so that whenever a new image is pushed to the registry, the application is automatically updated in the GKE cluster. Which combination of services should they use to achieve this?

A.Use Cloud Deploy to create a delivery pipeline that watches the Artifact Registry and promotes the image to GKE.

B.Set up a Cloud Build trigger that monitors the Artifact Registry and runs a build step to update the GKE deployment using kubectl.

C.Schedule a Cloud Scheduler job that periodically checks for new images in Artifact Registry and updates the GKE deployment.

D.Configure a Cloud Run service that is automatically deployed when a new image is pushed to Artifact Registry.

AnswerB

Correct: Cloud Build can be triggered by an Artifact Registry push and execute kubectl commands to update the deployment.

Why this answer

Cloud Build can be configured with a trigger that monitors Artifact Registry for new image pushes. When a new image is pushed, the trigger executes a build step that uses kubectl to update the GKE deployment, enabling continuous deployment without manual intervention.

Exam trap

The trap here is confusing Cloud Deploy's pipeline capabilities with event-driven triggers, leading candidates to choose Option A, but Cloud Deploy requires an explicit trigger (like a Cloud Build invocation) and does not directly watch Artifact Registry for image pushes.

How to eliminate wrong answers

Option A is wrong because Cloud Deploy does not natively watch Artifact Registry for image pushes; it is designed for managing delivery pipelines with Skaffold and requires explicit triggers or integration with Cloud Build. Option C is wrong because Cloud Scheduler is a cron-based job scheduler that does not react to events in real time; it would introduce latency and inefficiency by polling, and it lacks native integration to detect new images. Option D is wrong because Cloud Run is a serverless compute platform for stateless containers, not a deployment automation service for GKE; it cannot update a GKE cluster's deployment.

Full explanation →

102

MCQmedium

A company runs a batch job daily that processes large files from Cloud Storage and stores results in BigQuery. The job requires significant compute for about 10 minutes and is fault-tolerant. Which compute option is most cost-effective?

A.Cloud Run Jobs

B.Always-on Compute Engine VM

C.GKE cluster with a single node

D.Preemptible VM

E.Cloud Functions (9-minute timeout)

AnswerD

Low cost, suitable for fault-tolerant and short-lived workloads.

Why this answer

Preemptible VMs offer the same compute capacity as regular VMs at a significantly lower cost (up to 80% discount), and since the batch job runs for only 10 minutes daily and is fault-tolerant, it can handle the occasional preemption without data loss. The job's short duration and fault tolerance make preemptible instances ideal, as they can be restarted if terminated.

Exam trap

The PCD exam often tests the misconception that Cloud Functions or Cloud Run Jobs are always the cheapest serverless options, but the trap here is that the 9-minute timeout of Cloud Functions disqualifies it, and candidates overlook the cost savings of preemptible VMs for fault-tolerant, short-duration batch jobs.

How to eliminate wrong answers

Option A is wrong because Cloud Run Jobs have a maximum timeout of 60 minutes, which is sufficient, but they are designed for stateless containers and may incur higher costs per vCPU-hour compared to preemptible VMs for sustained batch processing. Option B is wrong because an always-on Compute Engine VM incurs costs 24/7, even when the job is not running, making it far more expensive than a preemptible VM that only runs for 10 minutes daily. Option C is wrong because a GKE cluster with a single node introduces unnecessary orchestration overhead and cost (including cluster management fees) for a simple batch job that does not require container orchestration.

Option E is wrong because Cloud Functions has a 9-minute timeout, which is insufficient for a job requiring 10 minutes of compute, and it is not designed for long-running batch processing.

Full explanation →

103

MCQmedium

A team is migrating a monolithic application to microservices on Google Kubernetes Engine (GKE). They want to ensure that if one microservice fails, it does not cascade to other services. Which design pattern should they implement?

A.Circuit Breaker pattern

B.Event-driven architecture

C.Retry with exponential backoff

D.Bulkhead pattern

AnswerA

Circuit Breaker pattern prevents cascading failures by opening the circuit when failures exceed a threshold.

Why this answer

The Circuit Breaker pattern is correct because it prevents cascading failures by monitoring for failures in a downstream microservice and, once a threshold is exceeded, immediately failing requests to that service without attempting the call. In GKE, this can be implemented using tools like Istio or Envoy sidecar proxies, which can be configured with circuit breaker settings to stop traffic to unhealthy pods, allowing the system to recover gracefully.

Exam trap

The PCD exam often tests the distinction between patterns that prevent cascading failures (Circuit Breaker) versus patterns that handle transient failures (Retry) or isolate resources (Bulkhead), so candidates mistakenly choose Retry or Bulkhead because they sound like they prevent failure spread, but they do not provide the fail-fast mechanism that stops the cascade.

How to eliminate wrong answers

Option B (Event-driven architecture) is wrong because it describes a communication style where services produce and consume events asynchronously, but it does not inherently provide failure isolation or prevent cascading failures; it can actually increase complexity in failure handling. Option C (Retry with exponential backoff) is wrong because it is a technique for handling transient failures by retrying with increasing delays, but it does not stop cascading failures; in fact, retrying a failing service can exacerbate the problem by adding load. Option D (Bulkhead pattern) is wrong because it isolates resources (e.g., thread pools or connections) per service or component to prevent a failure in one from exhausting shared resources, but it does not directly stop a failing service from being called; it limits blast radius but does not provide the fail-fast behavior of a circuit breaker.

Full explanation →

104

MCQeasy

A company wants to perform cross-cloud analytics, querying data stored in both Google Cloud BigQuery and Amazon S3. Which BigQuery feature enables this?

A.Cloud Data Fusion

B.BigQuery Data Transfer Service

C.BigQuery federated queries

D.BigQuery Omni

AnswerD

BigQuery Omni supports cross-cloud queries.

Why this answer

BigQuery Omni allows querying data across clouds (AWS and Azure) using BigQuery, without moving data.

Full explanation →

105

MCQeasy

A team is using Cloud Monitoring to set up an alerting policy for a Compute Engine instance that runs a web server. The team wants to be notified if the instance's CPU utilization exceeds 80% for 5 minutes. Which threshold type should they use?

A.Ratio threshold

B.Metric threshold

C.MQL (Monitoring Query Language)

D.Forecast threshold

AnswerB

Correct: a metric threshold directly checks if a metric exceeds a set value over a duration.

Why this answer

A metric threshold alerting policy directly monitors a numeric metric (e.g., CPU utilization) and triggers when the value exceeds a defined threshold (80%) for a specified duration (5 minutes). This is the standard approach for simple threshold-based alerts on a single metric in Cloud Monitoring.

Exam trap

The PCD exam often tests the distinction between simple metric thresholds and more advanced options like MQL or forecast thresholds, tempting candidates to overcomplicate the solution when a basic metric threshold is sufficient.

How to eliminate wrong answers

Option A is wrong because a ratio threshold is used for comparing two metrics (e.g., errors per request), not for a single metric like CPU utilization. Option C is wrong because MQL is a powerful query language for complex, multi-metric or time-shifted analysis, but it is overkill and unnecessary for a simple static threshold on one metric. Option D is wrong because a forecast threshold predicts future metric values based on historical trends, not for detecting current or recent breaches of a fixed threshold.

Full explanation →

106

Multi-Selectmedium

A gaming company wants to store player profiles and game state data that require strong consistency and the ability to run SQL queries. They also need to support real-time leaderboards with high write throughput. Which two Google Cloud databases should they consider? (Choose 2)

Select 2 answers

A.Memorystore for Redis

B.Cloud Bigtable

C.AlloyDB

D.Firestore

E.Cloud Spanner

AnswersA, E

Redis is ideal for real-time leaderboards due to sorted sets and low latency.

Why this answer

Cloud Spanner provides strong consistency and SQL, while Memorystore for Redis can be used for real-time leaderboards with high throughput. Bigtable and Firestore do not have SQL, and AlloyDB is not ideal for high-throughput leaderboards.

Full explanation →

107

MCQmedium

A company needs to run AlloyDB on-premises to maintain data sovereignty while leveraging the same management APIs as in Google Cloud. Which AlloyDB offering should they use?

A.Cloud SQL for PostgreSQL with HA

B.AlloyDB Omni

C.Bigtable Omni

D.AlloyDB cluster with cross-region replication

AnswerB

AlloyDB Omni is the on-premises version that provides the same engine and management APIs.

Why this answer

AlloyDB Omni is designed for on-premises deployment with the same AlloyDB engine, managed via Google Cloud’s APIs or CLI. AlloyDB clusters are cloud-only. Cloud SQL is a different service.

Bigtable Omni is for Bigtable, not AlloyDB.

Full explanation →

108

MCQhard

A developer is writing unit tests for a Python Cloud Run service that uses Cloud Firestore. They want to avoid hitting the real Firestore during tests. What should they use?

A.Use a real Firestore database but with a test project.

B.Mock the Firestore client using a library like unittest.mock.

C.Disable network access during tests.

D.Use the Firestore emulator for unit tests.

AnswerB

Mocking isolates the unit of code from external services.

Why this answer

Unit tests should isolate the code under test from external dependencies. Using `unittest.mock` to mock the Firestore client allows the developer to simulate Firestore calls and return controlled responses without any network I/O, ensuring tests are fast, deterministic, and independent of the real Firestore service.

Exam trap

The trap here is that candidates often confuse the Firestore emulator (a local integration testing tool) with a proper unit testing mock, leading them to choose option D even though the emulator is not suitable for isolated unit tests.

How to eliminate wrong answers

Option A is wrong because using a real Firestore database, even in a test project, still incurs network latency, potential costs, and dependency on the Firestore service being available, which violates the principle of unit test isolation. Option C is wrong because disabling network access during tests does not automatically prevent the Firestore client from attempting to connect; it would likely cause connection errors rather than gracefully simulating Firestore behavior. Option D is wrong because the Firestore emulator is intended for integration tests or end-to-end testing, not for pure unit tests; it still requires running a local emulator process and introduces external state management that unit tests should avoid.

Full explanation →

109

MCQeasy

An application deployed on Google Kubernetes Engine (GKE) is experiencing intermittent high latency. The operations team wants to quickly identify which specific code path is causing the delay. What should they use?

A.Enable Cloud Trace and analyze trace spans.

B.Use Cloud Profiler to identify memory leaks.

C.Set up a Cloud Monitoring uptime check.

D.Review Cloud Logging logs to find error messages.

AnswerA

Cloud Trace captures request spans and shows time spent in each component.

Why this answer

Cloud Trace is designed specifically for latency analysis in distributed systems like GKE. It captures end-to-end request latency and breaks it down into individual spans, each representing a specific code path or service call. By analyzing these spans, the operations team can pinpoint which exact code path (e.g., a database query, external API call, or internal function) is causing the intermittent high latency.

Exam trap

The PCD exam often tests the distinction between tools that measure latency (Cloud Trace) versus tools that measure resource utilization (Cloud Profiler) or availability (Cloud Monitoring uptime checks), leading candidates to confuse profiling with tracing.

How to eliminate wrong answers

Option B is wrong because Cloud Profiler identifies performance bottlenecks related to CPU and memory usage (e.g., memory leaks, hot functions), not intermittent latency caused by specific code paths. Option C is wrong because a Cloud Monitoring uptime check only verifies that the application is reachable and responding within a configured timeout; it does not provide granular latency breakdowns per code path. Option D is wrong because reviewing Cloud Logging logs for error messages would only surface failures or exceptions, not the normal but slow execution paths that cause intermittent high latency.

Full explanation →

110

MCQhard

During a Cloud Build run, a developer sees the error: "Step #0: error: failed to fetch metadata: connection refused". The build is trying to access a private Docker registry in a different project. What is the most likely cause?

A.The registry does not exist

B.The build environment cannot reach the registry due to network restrictions

C.The build service account lacks IAM permissions to the registry

D.The build is using a public pool with no access to internal networks

AnswerB

Connection refused typically means the target is actively refusing the connection, often due to firewalls or VPC Service Controls preventing access.

Why this answer

The error 'connection refused' indicates a network connectivity issue, not an authentication or authorization problem. The most likely cause is that the build environment (Cloud Build) cannot reach the private Docker registry in the other project due to network restrictions such as VPC Service Controls, firewall rules, or the registry being in a different VPC network. Authentication errors would typically show 'denied' or 'unauthorized'.

Therefore, option B is correct.

Full explanation →

111

MCQeasy

An engineer is deploying a Cloud SQL for SQL Server instance and wants to automatically increase storage when the disk usage reaches a threshold. Which flag should they set?

A.Enable 'automatic storage increase'

B.Set 'disk size' to unlimited

C.Configure 'storage tier' to auto-scale

D.Use 'persistent disk auto-resize'

AnswerA

This flag enables automatic disk resizing.

Why this answer

Cloud SQL supports the 'storage auto-increase' flag. When enabled, Cloud SQL automatically increases storage size in small increments when free space is low. This is set at instance creation or update.

Full explanation →

112

MCQhard

An organization runs a critical application on Compute Engine with a regional managed instance group. They want to achieve 99.99% availability. Which architecture should they use?

A.Regional MIG with instances in two zones

B.Single zone MIG with multiple instances

C.Regional MIG with instances in three zones

D.Multi-region deployment with global load balancer

AnswerC

Three zones provide higher availability within a region.

Why this answer

To achieve 99.99% availability, the architecture must tolerate both a zonal failure and a single instance failure. A regional managed instance group (MIG) with instances in three zones ensures that even if one zone becomes unavailable, the remaining two zones can still serve traffic, meeting the 99.99% uptime target. Three zones provide the necessary redundancy because a two-zone regional MIG can only survive a single zone failure but not a simultaneous instance failure in the remaining zone, whereas three zones allow for a rolling update or failure of one zone while still maintaining quorum.

Exam trap

The PCD exam often tests the misconception that two zones are sufficient for 99.99% availability, but the trap here is that two zones only provide 99.9% availability because they cannot tolerate a simultaneous instance failure in the remaining zone during a zonal outage or maintenance event.

How to eliminate wrong answers

Option A is wrong because a regional MIG with instances in only two zones can survive a single zone failure, but if an instance in the remaining zone fails or a rolling update is performed, the application may drop below the required capacity, failing to achieve 99.99% availability. Option B is wrong because a single zone MIG with multiple instances cannot survive a zonal outage; if the entire zone fails, all instances are lost, making 99.99% availability impossible. Option D is wrong because while a multi-region deployment with a global load balancer can provide even higher availability, the question specifically asks for an architecture using Compute Engine with a regional managed instance group, and a multi-region deployment is not a regional MIG architecture; it introduces cross-region latency and complexity not required for the stated 99.99% target.

Full explanation →

113

MCQhard

A financial services company is migrating a Redshift data warehouse to BigQuery. They need to stage data in Amazon S3 before transferring. Which service should they use to automate the transfer?

A.BigQuery Data Transfer Service

B.Cloud Data Fusion

C.Cloud Storage Transfer Service

D.Cloud Composer

AnswerA

Data Transfer Service supports Amazon S3 as a source for scheduled transfers into BigQuery.

Why this answer

BigQuery Data Transfer Service supports scheduled transfers from Amazon S3 to BigQuery, handling incremental loads. It is the recommended service for this scenario.

Full explanation →

114

Multi-Selecthard

An organization is migrating a large Oracle database to Cloud SQL for PostgreSQL. They need to handle Oracle's SEQUENCE objects, which are used for primary key generation. Which THREE approaches are valid for this migration?

Select 3 answers

A.Remove all sequences and use UUIDs generated by the application.

B.Replace Oracle sequences with PostgreSQL SERIAL columns.

C.Use PostgreSQL's IDENTITY columns (GENERATED AS IDENTITY).

D.Create PostgreSQL sequences and use nextval() in INSERT statements.

E.Use Oracle sequences directly in PostgreSQL via a compatibility layer.

AnswersB, C, D

SERIAL is a PostgreSQL feature that creates an auto-incrementing integer column, similar to Oracle sequences used for primary keys.

Why this answer

PostgreSQL has SERIAL, sequences, and IDENTITY columns. Oracle sequences can be converted to PostgreSQL sequences or IDENTITY columns. SERIAL is a shorthand for creating a sequence on a column.

Full explanation →

115

Multi-Selectmedium

A team is designing a cloud-native application that must be highly available and resilient to zone failures. Which three practices should they follow? (Choose three.)

Select 3 answers

A.Use a single Load Balancer with multiple backends.

B.Deploy resources across multiple zones.

C.Use zonal managed instance groups with 100% target utilization.

D.Store data in regional persistent disks.

E.Implement health checks and autohealing.

AnswersB, D, E

Distributing instances across zones protects against zone-level failures.

Why this answer

Deploying resources across multiple zones ensures that the application remains available even if an entire zone fails. In Google Cloud, zones are independent failure domains, and distributing workloads across them is a fundamental pattern for achieving high availability and resilience to zone-level outages.

Exam trap

The trap here is that candidates may think a single load balancer is sufficient for high availability, but in cloud-native design, the load balancer itself is a managed service that is inherently resilient, while the real risk is having backends in only one zone or no spare capacity to absorb failures.

Full explanation →

116

MCQhard

Your Bigtable cluster is experiencing high latency for a table that stores IoT sensor data. The row key format is deviceID#timestamp. You discover that most reads query the last hour of data for a few devices. How can you optimize row key design to improve read performance?

A.Reverse the timestamp in the row key (e.g., deviceID#MAXTIME - timestamp)

B.Separate frequently accessed data into a different column family

C.Use a single table with a composite key including device type

D.Add a salt prefix to the row key

AnswerA

This places recent data near each other, making range scans faster.

Why this answer

Reversing the timestamp (e.g., deviceID#MAXTIME - timestamp) ensures that for a given deviceID, the most recent data appears first in the lexicographic order of row keys. This allows reads querying the last hour of data to perform a contiguous range scan on a small set of rows, reducing read latency. It does not improve write distribution (all rows for a device still hash to the same tablet), but the read performance benefit is significant for this workload.

Exam trap

Some candidates mistakenly think that adding a salt prefix is always the best solution for hotspotting, but in this scenario, the salt would break the ability to efficiently query recent data for a specific device, making timestamp reversal the correct optimization.

How to eliminate wrong answers

Option B is wrong because separating data into a different column family does not address the root cause of hotspotting; column families affect storage and access patterns within a row, not row key distribution across tablets. Option C is wrong because using a composite key with device type does not solve the hotspotting issue; it still results in sequential writes for the same device, and device type adds no benefit for time-range queries. Option D is wrong because adding a salt prefix (e.g., a random hash) would scatter writes but would also scatter reads, making it impossible to efficiently query the last hour of data for a specific device without scanning all salts.

Full explanation →

117

MCQhard

A company is using Cloud Bigtable for a time-series application. They need to ensure that if one zone fails, the database remains available for reads and writes with minimal downtime. Which configuration should they use?

A.Enable auto-scaling on the cluster

B.Use a development instance type

C.Use a single-cluster instance with SSD storage

D.Add a secondary cluster in a different zone within the same region

AnswerD

Replication across zones provides HA with automatic failover.

Why this answer

Adding a secondary cluster in a different zone within the same region provides replication and automatic failover for both reads and writes.

Full explanation →

118

Multi-Selectmedium

A team is deploying a new version of an application on GKE using a rolling update. They want to ensure that the update proceeds only if the new pods are healthy. Which two steps should they include? (Choose two.)

Select 2 answers

A.Set the minReadySeconds field in the deployment.

B.Define a readiness probe for the container.

C.Define a liveness probe for the container.

D.Set the revisionHistoryLimit to 10.

E.Use a postStart lifecycle hook to test health.

AnswersA, B

minReadySeconds ensures the pod is ready for that duration before being considered available.

Why this answer

Setting `minReadySeconds` in a Deployment ensures that a newly created Pod is considered ready only after it has been stable for that duration, preventing the rolling update from proceeding if the Pod fails shortly after startup. Option B is correct because a readiness probe determines whether a Pod is ready to serve traffic; during a rolling update, the Deployment controller waits for the new Pod's readiness probe to succeed before scaling down old Pods, ensuring the update only continues when new Pods are healthy.

Exam trap

The PCD exam often tests the distinction between readiness and liveness probes, and the trap here is that candidates confuse liveness probes (which restart containers) with readiness probes (which control traffic and rolling update progression), leading them to incorrectly select a liveness probe as a health gate for the update.

Full explanation →

119

MCQeasy

A team is migrating a legacy application database to Cloud SQL. They want to implement versioned schema changes as part of their CI/CD pipeline. Which tool should they use?

A.Liquibase

B.gcloud sql import

C.Cloud Deployment Manager

D.Cloud Build

AnswerA

Liquibase is a database schema change management tool that supports versioning and CI/CD integration.

Why this answer

Liquibase is a database schema migration tool that supports version-controlled, repeatable schema changes and integrates well with CI/CD pipelines. Option B (gcloud sql import) is used for importing data, not schema versioning. Option C (Cloud Deployment Manager) is for infrastructure-as-code, not database schema migrations.

Option D (Cloud Build) is a CI/CD service but does not provide built-in schema migration capabilities; Liquibase is the specialized tool for this purpose.

Full explanation →

120

Multi-Selecthard

A company wants to automate the deployment of a microservice application to Cloud Run using Cloud Build. They want to ensure zero-downtime deployments and traffic migration. Which three features should they utilize? (Choose three.)

Select 3 answers

A.Cloud Build triggers to build and deploy on code changes.

B.Cloud Run min and max instance settings.

C.Cloud Run managed continuous deployment from a repository.

D.Cloud Run gradual rollout with --no-traffic flag.

E.Cloud Run revision traffic splitting.

AnswersA, D, E

Triggers automate the build and deploy pipeline on code changes.

Why this answer

Cloud Build triggers can be configured to automatically build and deploy a microservice to Cloud Run whenever code changes are pushed to a repository. This enables continuous delivery and ensures that the latest code is deployed without manual intervention, supporting zero-downtime deployments when combined with traffic management features.

Exam trap

Google often tests the distinction between features that enable automation (like triggers) versus features that manage traffic (like splitting and no-traffic flags), and the trap here is that candidates might select 'managed continuous deployment' (C) as a separate feature when it is actually a combination of triggers and deployment settings, leading to an incorrect count of three distinct features.

Full explanation →

121

Multi-Selectmedium

A company is designing a highly available application on Google Cloud using multiple regions. Which TWO strategies should they implement to achieve this?

Select 2 answers

A.Use zonal persistent disks for stateful data.

B.Use a global load balancer to distribute traffic across regions.

C.Deploy a single instance group in one region for simplicity.

D.Configure managed instance groups in multiple regions.

E.Store all data in a single Cloud Storage bucket.

AnswersB, D

Global load balancers route traffic to the closest healthy backend, enabling multi-region high availability.

Why this answer

A global load balancer (e.g., Google Cloud External HTTPS Load Balancer) can distribute traffic across multiple regions, providing cross-region failover and low-latency routing. This is a fundamental pattern for multi-region high availability, as it allows traffic to be directed to healthy backends in any region, even if an entire region fails.

Exam trap

The trap here is that candidates often confuse zonal resources (like persistent disks) with regional or multi-regional resources, or they assume that a single-region deployment with a load balancer is sufficient for high availability, ignoring the need for geographic redundancy.

Full explanation →

122

MCQmedium

An organization wants to migrate a Redshift data warehouse to BigQuery. They have a large dataset stored in Redshift. What is the most efficient migration approach for the initial data load?

A.Copy Redshift data to Cloud Storage using gsutil, then load into BigQuery.

B.Export data directly from Redshift to BigQuery using a JDBC connection.

C.Unload data from Redshift to Amazon S3, then load from S3 into BigQuery using BigQuery Data Transfer Service.

D.Use the BigQuery Connector for Redshift to stream data directly.

AnswerC

This is the standard pattern: unload to S3, then transfer to BigQuery via Data Transfer Service.

Why this answer

The recommended approach is to unload data from Redshift to Amazon S3 in Parquet or Avro format, then use BigQuery Data Transfer Service or load jobs to ingest from S3. Direct export from Redshift to BigQuery is not possible. Using a Cloud Storage intermediary would require copying from S3 to GCS, adding latency and cost.

Full explanation →

123

MCQmedium

Refer to the exhibit. A developer runs the command and sees that the Cloud Run service is publicly accessible. The security team requires that only authenticated requests from a specific service account in the same project are allowed. What should the developer do to modify the IAM policy?

A.Add a new binding with the service account as the only member of roles/run.invoker

B.Update the IAM policy to remove the allUsers member from the roles/run.invoker binding

C.Change the service's ingress settings to "Internal and Cloud Load Balancing"

D.Remove the roles/run.viewer binding and add the service account to roles/run.invoker

AnswerB

Removing allUsers revokes public access. Then ensure the service account has invoker role.

Why this answer

Modifying the IAM policy to remove the allUsers member from the roles/run.invoker binding revokes public access, ensuring only authenticated requests are allowed. The service account can then be granted the roles/run.invoker role if it does not already have it. Option A adds the service account as an invoker but does not remove the allUsers member, so the service remains publicly accessible.

Option C changes ingress settings, which controls network-level access, not IAM authentication; it does not address the requirement for authenticated requests. Option D removes the viewer role and adds the service account to invoker, but it fails to remove the allUsers member, leaving public access intact.

Full explanation →

124

MCQmedium

You are designing a global user-facing application that requires strong consistency, horizontal scalability, and 99.999% availability across multiple continents. Which database service should you choose?

A.Cloud SQL

B.Firestore

C.Cloud Spanner

D.Bigtable

AnswerC

Correct: globally distributed, strong consistency, horizontal scaling, 99.999% SLA.

Why this answer

Cloud Spanner is the only Google Cloud database service that provides strong consistency, horizontal scalability, and 99.999% availability across multiple continents. It uses synchronous replication and the TrueTime API to deliver external consistency across globally distributed nodes, making it ideal for global user-facing applications that require ACID transactions at scale.

Exam trap

Google's professional certification exams often test the misconception that a NoSQL database like Bigtable or Firestore can provide strong consistency across multiple regions, but only Spanner combines horizontal scalability with ACID transactions and global strong consistency via synchronous replication.

How to eliminate wrong answers

Option A is wrong because Cloud SQL is a regional relational database that supports only up to 99.95% availability and cannot scale horizontally across multiple continents; it is designed for single-region deployments. Option B is wrong because Firestore offers strong consistency only within a single region and uses eventual consistency for multi-region configurations, failing the requirement for strong consistency across continents. Option D is wrong because Bigtable is a NoSQL wide-column database that provides only eventual consistency and is not designed for ACID transactions or relational queries, making it unsuitable for applications requiring strong consistency.

Full explanation →

125

Multi-Selectmedium

A company is migrating a MySQL database to Cloud SQL. They want to test the migration by sending writes to both the old and new databases simultaneously and comparing results. Which TWO techniques should they use?

Select 2 answers

A.Shadow writes (dual-write to both databases)

B.Rollback plan documentation

C.Load testing with production data shape

D.Database Migration Service continuous migration

E.Comparison queries to validate data consistency

AnswersA, E

Sends writes to both old and new DB for comparison.

Why this answer

Shadow writes, also known as dual-writes, allow the application to send the same write operations to both the old MySQL database and the new Cloud SQL database simultaneously. This technique enables real-time comparison of the results from both databases to verify that the migration is handling writes correctly without disrupting the existing production workload.

Exam trap

Google Cloud often tests the distinction between techniques that validate data consistency (shadow writes + comparison queries) versus tools that handle replication or performance testing, leading candidates to mistakenly select load testing or continuous migration as methods for write verification.

Full explanation →

126

Multi-Selectmedium

A company is migrating a Snowflake data warehouse to BigQuery. They need to convert Snowflake SQL to BigQuery SQL. Which TWO tools or services can assist with this conversion?

Select 1 answer

A.gcloud bigquery copy

B.BigQuery Data Transfer Service

C.Cloud SQL Auth Proxy

D.Cloud Dataflow

E.BigQuery Migration Service

AnswersE

Correct: The BigQuery Migration Service provides automated SQL translation from Snowflake to BigQuery, including schema, DDL, and DML statements.

Why this answer

The BigQuery Migration Service (option E) is the dedicated tool for converting Snowflake SQL to BigQuery SQL, handling schema, DDL, and DML translations. The BigQuery Data Transfer Service (option B) does not support Snowflake as a source and does not perform SQL conversion; it is used for scheduling data transfers from supported sources. Therefore, only option E is correct.

Exam trap

Candidates may mistakenly think the BigQuery Data Transfer Service handles SQL conversion, but it only moves data from supported sources. The correct tool for SQL translation is the BigQuery Migration Service.

Full explanation →

127

MCQmedium

Your company is deploying a web application on Cloud Run using a continuous deployment pipeline from Cloud Build. The application is built as a Docker container and pushed to Container Registry. The Cloud Run service is configured with the '--no-allow-unauthenticated' flag. You have set up Cloud Build triggers to build and deploy on commits to the main branch. The deployment works correctly for the first few commits, but after adding a new environment variable in the Cloud Build configuration file (cloudbuild.yaml), the deployment fails with an error that the Cloud Run service cannot be updated because the new revision fails health checks. The application code has not changed. What is the most likely cause?

A.The Cloud Build service account does not have permission to update the Cloud Run service.

B.The new environment variable exceeds the maximum size limit for environment variables in Cloud Run.

C.The health check configuration in the Cloud Run service was overwritten by the new deployment.

D.The new environment variable causes the application to fail its startup or health check.

AnswerD

A misconfigured environment variable can cause the app to crash.

Why this answer

The application code has not changed, yet the deployment fails health checks immediately after adding a new environment variable. This indicates that the application is likely reading that variable at startup and crashing or failing its readiness probe due to an invalid value, missing dependency, or misconfiguration. Cloud Run requires the new revision to pass health checks (e.g., HTTP GET on the configured port) before it can serve traffic; if the variable causes the app to exit or hang, the revision is considered unhealthy and the update is rejected.

Exam trap

The PCD exam often tests the misconception that environment variables are harmless metadata and cannot cause deployment failures, when in fact they can break application startup logic or health check responses.

How to eliminate wrong answers

Option A is wrong because the Cloud Build service account already successfully deployed the first few revisions, so permissions are not the issue. Option B is wrong because Cloud Run environment variables have a total size limit of 64 KB for all variables combined, and a single new variable is extremely unlikely to exceed that. Option C is wrong because Cloud Run health check configuration (startup, liveness, readiness probes) is defined in the service YAML or via gcloud flags and is not overwritten by adding an environment variable in cloudbuild.yaml; the health check settings remain unchanged.

Full explanation →

128

MCQmedium

Refer to the exhibit. You have the above cloudbuild.yaml file. The build succeeds but the call to the function fails with a permission error. What is the most likely cause?

A.The function is using the wrong trigger type

B.The runtime 'nodejs16' is not supported

C.The '--allow-unauthenticated' flag is not allowed in Cloud Build

D.The function call is occurring before the deployment is fully complete, and the function is not yet ready to serve requests

AnswerD

The function may still be provisioning; add a sleep or check status.

Why this answer

The most likely cause is that the Cloud Build step deploys the function, but the subsequent test call occurs before the function's HTTP endpoint is fully provisioned and serving requests. Cloud Functions deployment is asynchronous; after the `gcloud functions deploy` command returns, the function may still be in a 'DEPLOYING' or 'ACTIVE' state but not yet ready to handle traffic. A permission error in this context typically arises because the function's IAM policy (e.g., `--allow-unauthenticated`) is applied only after the deployment completes, and the function's runtime endpoint may return a 403 until fully ready.

Exam trap

The PCD exam often tests the misconception that a successful `gcloud functions deploy` output means the function is immediately ready to serve requests, when in reality the deployment is asynchronous and the function may not be fully operational for several seconds.

How to eliminate wrong answers

Option A is wrong because the trigger type (HTTP trigger via `--trigger-http`) is correctly specified for a function that is called via HTTP; a permission error is unrelated to trigger type. Option B is wrong because `nodejs16` is a supported runtime in Cloud Functions (deprecated but still functional during the transition period), and a runtime error would manifest as a build failure, not a permission error. Option C is wrong because `--allow-unauthenticated` is a valid flag in `gcloud functions deploy` and is allowed in Cloud Build; it grants allUsers the `roles/cloudfunctions.invoker` role, and its absence would cause a permission error, but the flag itself is not disallowed.

Full explanation →

129

MCQmedium

A team is migrating a Teradata data warehouse to BigQuery. They use BTEQ scripts for ETL. What is the best approach to migrate the BTEQ scripts?

A.Use a third-party tool like Ora2Pg to convert BTEQ scripts.

B.Rewrite BTEQ scripts as BigQuery SQL using GoogleSQL syntax, manually handling differences.

C.Use BigQuery Data Transfer Service to automatically convert BTEQ scripts to BigQuery SQL.

D.Run BTEQ scripts directly in BigQuery using the BigQuery Connector for Teradata.

AnswerB

Manual rewriting is necessary because BTEQ is a scripting language with Teradata-specific syntax.

Why this answer

Teradata BTEQ scripts use Teradata SQL dialect. BigQuery uses GoogleSQL (or legacy SQL). Direct translation is needed.

The BigQuery Data Transfer Service can automate loading from Teradata but does not convert BTEQ scripts. Manual rewriting or using a SQL translation tool is required. Some BTEQ commands have no BigQuery equivalent (e.g., .EXPORT).

Full explanation →

130

MCQeasy

A team uses Cloud Build to deploy a containerized application to Cloud Run. The build step fails intermittently with the error 'Failed to trigger build: Build timed out'. What is the most likely cause?

A.The build exceeds the default Cloud Build timeout.

B.The build machine has insufficient memory.

C.The Dockerfile contains invalid syntax.

D.The Cloud Build service account lacks permissions to deploy to Cloud Run.

AnswerA

Default timeout is 10 minutes; exceeding it causes build timeout.

Why this answer

The error 'Failed to trigger build: Build timed out' indicates that the Cloud Build execution exceeded the maximum allowed duration. By default, Cloud Build has a timeout of 10 minutes for build steps. If the build process (e.g., pulling dependencies, building the container image) takes longer than this default timeout, the build is automatically terminated, resulting in this intermittent failure.

Increasing the timeout in the build configuration or using a larger machine type can resolve this.

Exam trap

The PCD exam often tests the distinction between timeout errors and resource or permission errors, so candidates mistakenly attribute a timeout to insufficient memory or permissions when the error message explicitly points to duration limits.

How to eliminate wrong answers

Option B is wrong because insufficient memory on the build machine would typically cause an out-of-memory (OOM) error or a build failure with a different message, not a timeout error. Option C is wrong because invalid Dockerfile syntax would cause a build failure during the Docker build step with a syntax error message, not a timeout. Option D is wrong because a lack of permissions for the Cloud Build service account to deploy to Cloud Run would result in a permission denied or authorization error, not a build timeout.

Full explanation →

131

MCQeasy

A company wants to back up their Cloud Spanner database for disaster recovery. They need a backup that can be restored in a different region. Which backup method should they use?

A.Use Bigtable managed backups

B.Use Cloud SQL export

C.Use gcloud spanner operations backup

D.Use Spanner export to GCS

AnswerD

Spanner export creates a full backup in Avro format in GCS, which can be restored cross-region.

Why this answer

Cloud Spanner supports full database exports to GCS in Avro format. These exports can be restored to any Spanner instance, including in a different region. There are no incremental backups; only full exports.

Full explanation →

132

MCQeasy

A developer needs to store configuration parameters for a Cloud Run service, such as database connection strings and API keys. The values must be encrypted at rest and in transit. Which service should be used?

A.Cloud SQL

B.Cloud Storage

C.Firestore

D.Secret Manager

AnswerD

Secret Manager is a secure and convenient storage system for secrets.

Why this answer

Secret Manager is the correct service for storing configuration parameters like database connection strings and API keys, as it provides encryption at rest and in transit, along with fine-grained access control. Cloud SQL is a relational database service, not designed for secret storage. Cloud Storage is for object storage, not secrets.

Firestore is a NoSQL database and not intended for secret management.

Full explanation →

133

MCQeasy

An application running on Cloud Run experiences cold starts causing latency spikes. What is the most cost-effective solution to reduce cold starts?

A.Set a minimum number of instances

B.Increase the container's CPU allocation

C.Enable HTTP keep-alive connections

D.Use a larger container memory size

AnswerA

Minimum instances keep the specified number of instances always warm, eliminating cold starts for those instances.

Why this answer

Setting a minimum number of instances ensures that Cloud Run always keeps at least one instance warm (idle) to serve incoming requests instantly, eliminating cold start latency. This is the most cost-effective solution because you only pay for the minimum instances when they are idle (at a reduced rate), whereas other options increase per-request cost or do not address the root cause of cold starts.

Exam trap

The PCD exam often tests the misconception that scaling resources (CPU or memory) or optimizing network connections can eliminate cold starts, but the only way to prevent cold starts is to keep instances warm, which is achieved by setting a minimum number of instances.

How to eliminate wrong answers

Option B is wrong because increasing CPU allocation does not prevent cold starts; it only speeds up request processing after the instance is already running, and it increases cost per instance without keeping instances warm. Option C is wrong because HTTP keep-alive connections reduce latency for subsequent requests over the same connection but do not eliminate the initial cold start when a new instance is created. Option D is wrong because larger memory size does not prevent cold starts; it may even increase cold start time due to longer container initialization, and it raises the cost per instance without guaranteeing a warm instance.

Full explanation →

134

MCQmedium

A team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that if a pod fails, Kubernetes automatically replaces it and maintains the desired number of replicas. Which Kubernetes resource should they use?

A.StatefulSet

B.Deployment

C.Job

D.DaemonSet

AnswerB

A Deployment provides declarative updates for pods and ReplicaSets. It ensures that the desired number of pods are running and replaces failed pods automatically.

Why this answer

A Deployment is the correct Kubernetes resource for managing stateless microservices that require automatic pod replacement to maintain a desired replica count. It uses a ReplicaSet to ensure the specified number of pod replicas are running, and if a pod fails, the ReplicaSet controller immediately creates a new pod to restore the desired state.

Exam trap

The PCD exam often tests the distinction between stateless and stateful workloads, where candidates mistakenly choose StatefulSet for any application that needs high availability, overlooking that Deployments are the standard for stateless microservices with automatic replacement.

How to eliminate wrong answers

Option A is wrong because StatefulSet is designed for stateful applications that require stable network identities and persistent storage; it does not automatically replace pods in the same way as a Deployment for stateless workloads, and its pod replacement behavior is ordered and graceful, not immediate. Option C is wrong because a Job is used for batch or one-time tasks that run to completion, not for maintaining a desired number of continuously running replicas. Option D is wrong because a DaemonSet ensures that a copy of a pod runs on every node (or a subset of nodes) in the cluster, which is used for node-level services like logging or monitoring, not for maintaining a specific replica count across the cluster.

Full explanation →

135

MCQhard

A company uses Cloud Run for a serverless application that processes user uploads. Users report that sometimes the first request after a period of inactivity takes very long (cold start). The application is stateless. They want to minimize cold start latency while keeping costs low. The application is deployed with default settings: min instances = 0, max instances = 100, CPU always off, and a container image of 1GB. What should they do to reduce cold start latency?

A.Set min instances to 1 to keep a warm instance.

B.Increase container memory from the default to reduce startup time.

C.Use a larger container image to include more dependencies.

D.Enable CPU always on allocation.

AnswerA

Keeping a minimum number of instances eliminates cold starts.

Why this answer

Setting min instances to 1 ensures that at least one instance is always warm and ready to serve requests, eliminating the cold start for the first request after a period of inactivity. Since the application is stateless and the default min instances is 0, Cloud Run scales down to zero, causing a cold start on the next request. By keeping one instance warm, you minimize latency without significantly increasing cost, as you only pay for the single idle instance.

Exam trap

The PCD exam often tests the misconception that increasing resources (memory or CPU) or enabling CPU always on reduces cold start latency, when in fact the root cause is the instance being scaled to zero and the solution is to keep at least one instance warm via min instances.

How to eliminate wrong answers

Option B is wrong because increasing container memory does not reduce startup time; it only affects the CPU and memory resources available during execution, not the time to initialize the container. Option C is wrong because using a larger container image increases the download and extraction time during cold start, worsening the latency problem. Option D is wrong because enabling CPU always on allocation keeps the CPU active even when the instance is idle, which increases cost without addressing the cold start issue—the instance still scales to zero if min instances is 0.

Full explanation →

136

Multi-Selecthard

An e-commerce platform uses Cloud Spanner for order management and Bigtable for product recommendations. They need to replicate order changes to the Bigtable cluster in real-time for updating recommendations. The team must ensure that all order updates are captured and delivered exactly once, in order, to the Bigtable pipeline. Which THREE components should they use?

Select 3 answers

A.Cloud Spanner Change Streams

B.Cloud Tasks

C.Dataflow

D.Pub/Sub

E.Cloud Functions

AnswersA, C, D

Change streams capture all mutations in a Spanner table and can be sent to Pub/Sub.

Why this answer

Spanner change streams capture all data changes (inserts, updates, deletes) and can publish to Pub/Sub. Dataflow can consume these messages and write to Bigtable with exactly-once processing. Pub/Sub provides ordered delivery when using message ordering.

Cloud Tasks is not suitable for high-throughput streaming. Cloud Functions would be too slow and less reliable for exactly-once. BigQuery is not needed.

Full explanation →

137

MCQeasy

A web application hosted on Compute Engine is experiencing slow response times during peak hours. Which Cloud Monitoring metric should be examined first to identify the bottleneck?

A.CPU utilization of backend instances

B.Number of incoming requests per second

C.Memory usage of backend instances

D.95th percentile request latency measured by Cloud Load Balancing

AnswerD

This metric directly measures user-facing response time, and a high latency indicates a performance issue that needs investigation.

Why this answer

The 95th percentile request latency measured by Cloud Load Balancing is the most direct indicator of user-perceived performance degradation. High latency at the load balancer level captures the end-to-end response time, including network, backend processing, and queuing delays, making it the first metric to examine when diagnosing slow response times during peak hours.

Exam trap

The PCD exam often tests the distinction between resource utilization metrics (CPU, memory) and performance metrics (latency), trapping candidates who assume high CPU or memory is always the root cause of slow response times, when in fact latency metrics provide the direct measure of user experience.

How to eliminate wrong answers

Option A is wrong because CPU utilization alone does not capture network latency, queuing delays, or application-level bottlenecks; a backend can have low CPU but still be slow due to I/O waits or database contention. Option B is wrong because the number of incoming requests per second measures throughput, not latency; high request volume can cause slowdowns, but latency is the direct symptom of the bottleneck. Option C is wrong because memory usage is a resource metric that may indicate swapping or OOM risks, but it is not the primary indicator of response time issues; a system can have ample memory yet still experience high latency due to other factors.

Full explanation →

138

MCQmedium

A company is migrating a monolithic application to a microservices architecture on Google Cloud. They want to decouple services and ensure that a failure in one service does not impact others. Which pattern should they implement?

A.Implement caching with Memorystore

B.Increase the number of instances of each service

C.Use synchronous HTTP calls with retries

D.Implement circuit breaker pattern using a service mesh like Istio

AnswerD

Circuit breaker trips on failures, isolating the fault.

Why this answer

The circuit breaker pattern, implemented via a service mesh like Istio, is the correct approach because it prevents cascading failures by monitoring service health and stopping requests to a failing service until it recovers. Istio's Envoy sidecar proxies enforce circuit breaking at the network layer, allowing the system to degrade gracefully without impacting other services.

Exam trap

The PCD exam often tests the misconception that scaling instances (Option B) or adding caching (Option A) is sufficient for fault isolation, but these patterns address performance and availability, not decoupling or failure containment.

How to eliminate wrong answers

Option A is wrong because caching with Memorystore improves read performance and reduces latency but does not decouple services or prevent failure propagation; a failing service still receives requests. Option B is wrong because increasing instance count improves scalability and fault tolerance through redundancy but does not isolate failures—a failing service can still overwhelm downstream services or cause cascading issues. Option C is wrong because synchronous HTTP calls with retries increase coupling and can exacerbate failures by causing retry storms, overwhelming already failing services and violating the goal of decoupling.

Full explanation →

139

MCQhard

A company uses Cloud Monitoring with custom metrics. They have a custom metric called 'requests_total' with labels 'endpoint', 'status_code'. They want to create an alert that fires if the error rate (status_code >=500) for any endpoint exceeds 5% over a 5-minute window. Which MQL query should they use?

A.fetch custom::requests_total | { filter status_code >= 500 ; group_by [endpoint], sum() } / { group_by [endpoint], sum() } | condition gt 0.05

B.fetch custom::requests_total | filter status_code < 500 | ratio | condition gt 0.05

C.fetch custom::requests_total | group_by [endpoint], sum() | filter status_code >= 500 | ratio | condition gt 0.05

D.fetch custom::requests_total | filter status_code >= 500 | ratio | condition gt 0.05

AnswerA

Correct: groups errors and total by endpoint, divides, and applies condition.

Why this answer

It first filters for error responses (status_code >= 500), then groups by endpoint and sums the error count, and divides that by the total count per endpoint (also grouped and summed). This computes the error rate per endpoint, and the condition fires when that rate exceeds 0.05 (5%) over the 5-minute window. The use of two separate group_by operations within a join (the `{ ... } / { ... }` syntax) is the correct MQL pattern for calculating a ratio per label.

Exam trap

The PCD exam often tests the distinction between `ratio` (which operates on the number of time series) and explicit division with group_by (which operates on metric values per label), leading candidates to incorrectly choose a `ratio`-based query that ignores per-endpoint grouping.

How to eliminate wrong answers

Option B is wrong because it filters for status_code < 500 (successes) instead of errors, and uses `ratio` without the proper group_by to compute per-endpoint rates, which would produce an overall ratio across all endpoints. Option C is wrong because it applies `group_by [endpoint], sum()` before filtering for errors, which sums all requests first and then filters, making it impossible to compute a per-endpoint error rate correctly. Option D is wrong because it uses `ratio` without any group_by, which would compute the overall error rate across all endpoints combined, not per endpoint as required.

Full explanation →

140

MCQmedium

A company is developing a microservices application on Google Cloud. Each service is deployed as a Docker container on Cloud Run. The development team wants to ensure that inter-service communication is encrypted and authenticated. What is the best approach?

A.Use Cloud Run's built-in IAM-based authentication and automatic TLS for internal requests.

B.Configure mutual TLS (mTLS) between services using Cloud Endpoints.

C.Deploy a sidecar proxy on each Cloud Run service to handle TLS termination.

D.Assign a service account to each service and use its private key to sign requests.

AnswerA

Cloud Run uses IAM to authenticate requests between services and automatically provisions TLS certificates.

Why this answer

Cloud Run automatically provisions TLS certificates for all incoming requests and supports IAM-based authentication for internal requests between services in the same Google Cloud project. This means inter-service communication is encrypted by default via HTTPS and can be authenticated by configuring the receiving service to require a valid IAM token from the caller, without any additional infrastructure or sidecar proxies.

Exam trap

The PCD exam often tests the misconception that you need to manually configure mTLS or deploy sidecar proxies for encryption and authentication in Cloud Run, when in fact Cloud Run's built-in IAM and automatic TLS handle both requirements natively.

How to eliminate wrong answers

Option B is wrong because Cloud Endpoints is an API management service for external-facing APIs, not designed for internal service-to-service mTLS on Cloud Run; Cloud Run already handles TLS termination natively. Option C is wrong because deploying a sidecar proxy on Cloud Run is unnecessary and adds complexity — Cloud Run automatically terminates TLS at the ingress and supports IAM-based authentication without requiring a separate proxy. Option D is wrong because using a service account's private key to sign requests is not a built-in Cloud Run feature; Cloud Run uses IAM tokens (e.g., OIDC tokens) for authentication, not raw private key signing.

Full explanation →

141

Matchingmedium

Match each command-line tool to its primary use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Manage Google Cloud resources

Interact with Cloud Storage

Run BigQuery queries and manage datasets

Manage Kubernetes clusters

Continuous development for Kubernetes applications

Why these pairings

The correct matches are: gcloud for general GCP management, gsutil for Cloud Storage, kubectl for Kubernetes, and bq for BigQuery. Common confusions include mixing up gcloud with gsutil, or kubectl with bq.

Full explanation →

142

MCQmedium

A company uses Cloud Run for a serverless application. They notice that cold starts are causing high latency for some requests. What is the best strategy to reduce cold starts?

A.Increase the max instances setting

B.Set a minimum number of instances to keep containers always warm

C.Migrate the application to Cloud Functions

D.Reduce the container concurrency setting

AnswerB

Min instances ensures pre-warmed containers are always ready.

Why this answer

Setting a minimum number of instances ensures that Cloud Run keeps a baseline of container instances always warm and ready to serve requests. This eliminates cold starts for the first requests that hit those pre-warmed instances, directly addressing the latency issue. Cloud Run automatically scales to zero when idle, but a minimum instance setting overrides that behavior for the specified number of containers.

Exam trap

The trap here is that candidates often confuse 'max instances' with 'min instances,' thinking that raising the upper limit will somehow pre-warm containers, when in fact it only controls the ceiling for scaling out, not the floor for keeping instances alive.

How to eliminate wrong answers

Option A is wrong because increasing the max instances setting only raises the upper scaling limit, which does nothing to prevent cold starts; it can actually increase the number of cold starts if traffic spikes cause new instances to be created. Option C is wrong because migrating to Cloud Functions does not inherently solve cold starts—Cloud Functions also has cold start latency, and the underlying infrastructure is similar; the recommendation would be the same (set a minimum instance count). Option D is wrong because reducing the container concurrency setting limits how many concurrent requests a single container can handle, which may force more instances to be created (increasing cold starts) rather than reducing them.

Full explanation →

143

Multi-Selecthard

Which THREE common issues cause deployment failures on App Engine? (Choose 3.)

Select 3 answers

A.Using a runtime version that is not available in the app's region.

B.Exceeding the maximum file size limit for application files.

C.Setting the app to scale to 0 instances.

D.Uploading a configuration file (e.g., cron.yaml) with invalid syntax.

E.Creating a resource with backend type set to 'backend' instead of 'frontend'.

AnswersA, B, D

Some runtimes may not be available everywhere.

Why this answer

App Engine requires that the runtime version specified in your app.yaml is available in the region where the application is deployed. If you select a runtime version that has been deprecated or is not yet rolled out to that region, the deployment will fail with an error indicating the runtime is unavailable. This is a common issue when using newer runtime versions that are only available in certain regions.

Exam trap

A common misconception is that App Engine Standard cannot scale to zero instances. In reality, App Engine Standard supports automatic scaling with min_instances set to 0, allowing instances to scale down to zero when there is no traffic. The flexible environment, however, requires at least one instance.

This question tests the understanding that scaling to zero instances is a valid configuration in App Engine Standard, so it is not a common cause of deployment failure.

Full explanation →

144

MCQhard

Refer to the exhibit. The user developer@example.com tries to create a firewall rule and receives a permission denied error. What is the most likely reason?

A.The user lacks compute.networkAdmin role

B.The user lacks compute.securityAdmin role

C.The user is missing compute.firewalls.create permission

D.All of the above

AnswerD

All three statements are correct; the user needs one of the roles or the specific permission.

Why this answer

All of the above. In Google Cloud, creating a firewall rule requires the `compute.securityAdmin` role (which includes `compute.firewalls.create` permission) or the `compute.networkAdmin` role (which also includes `compute.firewalls.create` permission). If the user lacks any of these roles or the specific permission, they will receive a permission denied error.

While options A, B, and C are individually true statements, the question asks for the 'most likely reason,' and since all three are valid, the single correct answer is D. This tests the understanding that multiple permission deficiencies can cause the same error.

Exam trap

The trap here is that there are three individually correct statements (A, B, C) and candidates might pick only one, but the question is designed to test whether you recognize that all three are valid reasons for the same error, making 'All of the above' the correct answer.

How to eliminate wrong answers

Option A is correct because the `compute.networkAdmin` role includes the `compute.firewalls.create` permission, and lacking it would cause a permission denied error. Option B is correct because the `compute.securityAdmin` role also includes the `compute.firewalls.create` permission, and lacking it would also cause the error. Option C is correct because the `compute.firewalls.create` permission is the specific IAM permission required to create firewall rules, and missing it directly results in a permission denied error.

Since all three options are individually valid reasons, the question expects the candidate to recognize that multiple factors can cause the same error, making D the only fully correct answer.

Full explanation →

145

MCQhard

A company has a Cloud Run service that ingests messages from a Cloud Pub/Sub subscription. The service uses automatic scaling based on CPU. Recently, the team noticed that when message volume spikes, the service scales up slowly, causing a backlog. What is the most effective solution to reduce the time to scale out?

A.Increase the max instances for the Cloud Run service to 100.

B.Use Cloud Tasks to buffer messages and configure a Cloud Scheduler job to pull from the queue.

C.Set a minimum number of instances on the Cloud Run service to 5.

D.Change the subscription type from pull to push and set the Cloud Run service as the push endpoint.

AnswerD

Push subscriptions invoke the service directly upon message delivery, reducing latency and improving scaling speed.

Why this answer

Using a push subscription from Pub/Sub directly triggers Cloud Run invocations, which reduces latency compared to pull subscriptions that require polling. This improves scaling responsiveness during traffic spikes. Option A is wrong because increasing max instances does not accelerate scaling speed; it only sets an upper limit.

Option B is wrong because adding Cloud Tasks and Cloud Scheduler introduces extra latency without solving the scaling delay. Option C is wrong because setting a minimum number of instances can reduce cold starts but does not speed up scaling from zero to the minimum; it only ensures a base level of instances are always running.

Full explanation →

146

MCQhard

Your team is using Cloud Build to build and test a Java application. The build includes unit tests, integration tests, and static code analysis. The build is failing intermittently due to flaky tests. You want to automatically retry the failed steps without rebuilding everything. Which Cloud Build feature should you use?

A.Configure a Cloud Build trigger to rerun the build on failure

B.Set the 'allowFailure: false' and 'retry: 2' options on the test steps in the cloudbuild.yaml

C.Use build substitutions to pass different test parameters on failure

D.Increase the timeout for the build to allow retries

AnswerB

Cloud Build supports step-level retry with 'retry' field.

Why this answer

Cloud Build supports the `retry` option on individual build steps, which allows a step to be automatically retried a specified number of times upon failure without re-executing previous steps. This is ideal for handling flaky tests, as it only reruns the failed step, preserving build artifacts and avoiding a full rebuild.

Exam trap

The PCD exam often tests the misconception that retrying a build must involve the entire pipeline (trigger or timeout), when in fact Cloud Build provides a step-level retry option that preserves previous step outputs and avoids full rebuilds.

How to eliminate wrong answers

Option A is wrong because configuring a Cloud Build trigger to rerun the entire build on failure would rebuild everything from scratch, including steps that succeeded, which is inefficient and does not target only the flaky test step. Option C is wrong because build substitutions are used to parameterize build configurations at submission time, not to trigger retries on failure; they cannot automatically rerun a failed step. Option D is wrong because increasing the build timeout only extends the maximum duration allowed for the build, it does not provide any retry mechanism for failed steps.

Full explanation →

147

MCQmedium

A development team wants to implement a CI/CD pipeline for a containerized application on Google Cloud. They are using Cloud Build and Cloud Deploy. The application requires canary deployments with automatic rollback if the error rate increases by more than 10% within 5 minutes after deployment. Which Cloud Deploy feature should they configure?

A.Define a Cloud Deploy deployment policy with a rollout policy that uses a canary strategy and a verification phase with automated rollback

B.Configure a Pub/Sub notification on the rollout to trigger a rollback via a Cloud Function

C.Use Cloud Monitoring to create an alert policy that triggers a Cloud Function to rollback the deployment

D.Set up a Cloud Build trigger to rebuild the previous image on error

AnswerA

Cloud Deploy deployment policies can automate rollback based on criteria like error rate thresholds.

Why this answer

Cloud Deploy's deployment policies allow you to define a canary rollout strategy with an automated verification phase. When the verification phase detects that the error rate exceeds the defined threshold (e.g., 10% increase within 5 minutes), Cloud Deploy automatically initiates a rollback to the previous stable revision, meeting the team's requirement without additional custom code.

Exam trap

The trap here is that candidates often assume external monitoring and custom functions (Options B and C) are required for automated rollbacks, overlooking Cloud Deploy's native deployment policy feature that directly supports canary rollouts with automated rollback based on verification phase conditions.

How to eliminate wrong answers

Option B is wrong because while Pub/Sub notifications can be used to trigger external actions, this approach requires a custom Cloud Function to interpret the notification and perform the rollback, which is not a native Cloud Deploy feature and adds unnecessary complexity and latency. Option C is wrong because Cloud Monitoring alert policies can trigger Cloud Functions, but this is an external workaround that does not leverage Cloud Deploy's built-in automated rollback capabilities; it also introduces a dependency on external monitoring and custom rollback logic. Option D is wrong because Cloud Build triggers are designed for building and testing, not for managing deployment rollbacks; rebuilding a previous image does not automatically revert the running deployment and ignores Cloud Deploy's rollout management.

Full explanation →

148

MCQmedium

An application running on GKE is experiencing high latency. The team uses Cloud Trace to identify the bottleneck. They notice that a particular service spends most of its time waiting on a database query. How can they optimize performance?

A.Decrease the number of pods to reduce load

B.Use Cloud CDN to cache database results

C.Optimize the database query and add appropriate indexes

D.Increase the number of replicas for the service

AnswerC

Query optimization reduces execution time.

Why this answer

The bottleneck is identified as a database query causing high latency. Optimizing the query and adding appropriate indexes directly reduces the time spent waiting on the database, which is the root cause. Cloud Trace shows the service is waiting on the database, so improving database performance is the most effective solution.

Exam trap

Google Cloud often tests the misconception that scaling horizontally (adding replicas) solves all performance issues, but here the bottleneck is external to the service (database), so scaling the service does not reduce the per-query wait time.

How to eliminate wrong answers

Option A is wrong because decreasing the number of pods reduces concurrency and can increase latency under load, not decrease it. Option B is wrong because Cloud CDN caches static content at edge locations, not dynamic database query results, and cannot cache database responses that are unique per request. Option D is wrong because increasing replicas spreads the load but does not address the database query latency; the service will still wait the same amount of time per query, and may even increase database contention.

Full explanation →

149

Multi-Selectmedium

A company wants to query data across Cloud SQL (MySQL) and BigQuery using federated queries. They want to avoid data movement. Which TWO components must be set up?

Select 2 answers

A.External table in BigQuery

B.Cloud SQL instance

C.Cloud Storage bucket

D.BigQuery connection

E.Dataflow pipeline

AnswersA, D

Allows querying the Cloud SQL data from BigQuery.

Why this answer

A BigQuery connection (external data source) is required to link to Cloud SQL. An external table in BigQuery references the Cloud SQL table for querying. A Cloud SQL instance is the source, but the connection and external table are the components set up in BigQuery.

Full explanation →

150

MCQmedium

An application running on GKE needs to access a Cloud SQL instance. The team wants to avoid using Cloud SQL Auth Proxy to reduce complexity. What is the most secure alternative?

A.Whitelist the GKE node external IPs in Cloud SQL authorized networks.

B.Use a Cloud SQL read replica with a public IP.

C.Use Private Service Connect to connect privately.

D.Configure Cloud SQL to allow all traffic from the VPC.

AnswerC

Private Service Connect offers secure private connectivity.

Why this answer

Private Service Connect (PSC) allows your GKE cluster to connect to Cloud SQL privately using internal IPs within the same VPC, without exposing traffic to the public internet or requiring the Cloud SQL Auth Proxy. PSC creates a private endpoint that routes traffic through Google's internal network, providing secure, low-latency connectivity while reducing operational overhead.

Exam trap

The trap here is that candidates often assume whitelisting IPs (Option A) is sufficient for security, but they overlook that private connectivity via PSC or VPC peering is the most secure method because it avoids public internet exposure entirely.

How to eliminate wrong answers

Option A is wrong because whitelisting GKE node external IPs in Cloud SQL authorized networks exposes the database to the public internet, increasing the attack surface and requiring static IP management, which is less secure than private connectivity. Option B is wrong because using a Cloud SQL read replica with a public IP still exposes the replica to the internet, and read replicas are not designed for primary application connectivity; they are for read scaling and disaster recovery. Option D is wrong because configuring Cloud SQL to allow all traffic from the VPC is not a specific feature; Cloud SQL does not support a blanket 'allow all' rule, and the correct approach is to use Private Service Connect or VPC peering for private access.

Full explanation →

Page 2 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCD by domain

Target a specific domain to shore up weak areas.

Designing highly scalable, available, and reliable cloud-native applications Building and testing applications Deploying applications Integrating Google Cloud services

See all domains with question counts →