Courseiva

Google Professional Cloud Developer (PCD) — Questions 376–450

964 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 13

Page 7
376
MCQeasy

A team is deploying a microservice on Cloud Run that requires environment variables with sensitive information, such as database passwords. What is the recommended way to provide these secrets?

A.Inject them directly in the Cloud Run YAML configuration.
B.Embed them in the container image as environment variables.
C.Store them in a Cloud Storage bucket and mount as a volume.
D.Use Secret Manager to store the secrets and refer to them in the Cloud Run service.
AnswerD

Secret Manager securely stores secrets and integrates with Cloud Run.

Why this answer

Secret Manager is Google Cloud's dedicated service for securely storing and managing sensitive data like API keys and database passwords. Cloud Run natively integrates with Secret Manager, allowing you to reference secret versions by name in your service configuration without exposing the secret value in plaintext. This approach ensures secrets are encrypted at rest and in transit, and access can be tightly controlled via IAM permissions.

Exam trap

The trap here is that candidates may confuse Cloud Storage with a volume mount capability in Cloud Run, or mistakenly think embedding secrets in the container image is acceptable because it 'works' in local development, ignoring the security and compliance implications in a production environment.

How to eliminate wrong answers

Option A is wrong because injecting secrets directly in the Cloud Run YAML configuration would expose them in plaintext in the deployment manifest and revision history, violating security best practices. Option B is wrong because embedding secrets in the container image as environment variables makes them accessible to anyone with image pull access and persists them in the image layers, which is insecure and difficult to rotate. Option C is wrong because Cloud Storage buckets do not natively support mounting as a volume in Cloud Run; Cloud Run supports mounting volumes from Filestore or Secret Manager, but not Cloud Storage, and storing secrets in a bucket without encryption key management or IAM fine-grained access control is not a recommended pattern for secrets.

Full explanation →
377
MCQmedium

A Cloud Run service experiences high latency under load. The service is a Node.js Express app that processes requests sequentially due to a global mutex. What is the most effective solution?

A.Remove the mutex and ensure request handling is asynchronous
B.Use Cloud Run for Anthos to handle load
C.Increase the number of CPUs per container
D.Increase the 'max-instances' setting
AnswerA

This directly addresses the bottleneck by allowing parallel processing.

Why this answer

The root cause is that the global mutex forces sequential processing, negating Node.js's asynchronous event loop. Removing the mutex and ensuring asynchronous request handling (e.g., using async/await or Promises) allows the single-threaded event loop to interleave I/O-bound tasks, dramatically reducing latency under concurrent load. This directly addresses the bottleneck without changing the underlying infrastructure.

Exam trap

The PCD exam often tests the misconception that scaling infrastructure (more CPUs, more instances) can fix application-level concurrency bugs, when the real solution is to fix the code to be non-blocking.

How to eliminate wrong answers

Option B is wrong because Cloud Run for Anthos adds Kubernetes orchestration but does not fix the application-level sequential processing caused by the mutex; it would still suffer from the same bottleneck. Option C is wrong because increasing CPUs per container does not help a single-threaded Node.js process that is blocked by a mutex; Node.js uses one event loop per container, and extra CPUs are underutilized. Option D is wrong because increasing 'max-instances' creates more containers, but each container still has the mutex, so each instance processes requests sequentially; the overall throughput may improve linearly but latency per request remains high due to queuing within each instance.

Full explanation →
378
MCQmedium

A company uses a polyglot persistence architecture: Cloud SQL for transactions, Bigtable for real-time analytics, and BigQuery for reporting. They need to synchronize data from Cloud SQL to Bigtable in near real-time. Which combination of services should they use?

A.Dataflow + Cloud SQL
B.Cloud Pub/Sub + Cloud Functions
C.Datastream + Dataflow
D.Cloud Functions + BigQuery
AnswerC

Datastream captures CDC and sends to Pub/Sub; Dataflow processes and writes to Bigtable.

Why this answer

Datastream can capture CDC from Cloud SQL (MySQL/PostgreSQL) and publish to Pub/Sub. Dataflow can then read from Pub/Sub and write to Bigtable. This provides near real-time sync.

Full explanation →
379
MCQeasy

A developer wants to deploy a containerized application to Google Kubernetes Engine (GKE) and ensure that new pods are automatically created if an existing pod fails. Which Kubernetes resource should be used?

A.Job
B.DaemonSet
C.Deployment
D.StatefulSet
AnswerC

Correct: A Deployment manages ReplicaSets and ensures the desired number of pods are running.

Why this answer

A Deployment is the correct Kubernetes resource for ensuring declarative updates and self-healing for stateless applications. It manages a ReplicaSet, which maintains the desired number of pod replicas; if a pod fails, the ReplicaSet controller automatically creates a replacement pod to match the desired state.

Exam trap

The trap here is that candidates often confuse Deployments with StatefulSets, assuming stateful applications always need StatefulSets, but the question explicitly describes a stateless containerized application that only needs automatic pod replacement, making Deployment the simplest and correct choice.

How to eliminate wrong answers

Option A is wrong because a Job is designed for batch or one-time tasks that run to completion, not for continuously running applications that need automatic pod replacement on failure. Option B is wrong because a DaemonSet ensures that exactly one pod runs on each node (or a subset of nodes), which is used for node-level services like logging or monitoring, not for maintaining a desired replica count across the cluster. Option D is wrong because a StatefulSet is used for stateful applications that require stable, unique network identifiers and persistent storage; while it also supports self-healing, it introduces ordering and identity guarantees that are unnecessary and overly complex for a simple stateless application that just needs automatic pod replacement.

Full explanation →
380
MCQhard

A company is migrating a 2 TB Oracle database to AlloyDB for PostgreSQL using Oracle to PostgreSQL migration tool (Ora2Pg). The migration must have minimal downtime. The team plans to use a two-phase approach: first a full dump, then incremental CDC. However, Ora2Pg does not natively support CDC. How should they achieve near-zero downtime migration?

A.Use Database Migration Service (DMS) with Oracle as source and AlloyDB as destination
B.Use Dataflow to stream Oracle changes from Pub/Sub to AlloyDB
C.Use Ora2Pg for the full dump, then manually capture Oracle redo logs and apply them to AlloyDB
D.Export Oracle data to CSV, load into AlloyDB, then use a custom script with cron to apply changes
AnswerA

DMS supports Oracle (via CDC) to AlloyDB, providing full dump + continuous replication for near-zero downtime.

Why this answer

Database Migration Service (DMS) supports continuous change data capture (CDC) from Oracle to AlloyDB for PostgreSQL, enabling near-zero downtime migration. Unlike Ora2Pg, which only handles full dump and restore, DMS uses Oracle LogMiner or binary logs to capture incremental changes and apply them to AlloyDB in near real-time, making it the correct choice for a two-phase migration with minimal downtime.

Exam trap

The PCD exam often tests the misconception that Ora2Pg can be extended with manual CDC scripts or that Dataflow is a simpler alternative, but the trap here is that DMS is the only Google Cloud managed service that natively supports Oracle-to-AlloyDB CDC without requiring custom development or external tools.

How to eliminate wrong answers

Option B is wrong because Dataflow streaming from Pub/Sub requires a custom CDC pipeline (e.g., Debezium) to capture Oracle changes, which adds complexity and latency, and is not a native or recommended approach for direct Oracle-to-AlloyDB migration. Option C is wrong because manually capturing and applying Oracle redo logs to AlloyDB is impractical and error-prone; redo logs are Oracle-specific binary files that cannot be directly applied to PostgreSQL without complex transformation and replay logic. Option D is wrong because exporting to CSV and using cron scripts for incremental changes cannot achieve near-zero downtime; cron-based batch updates introduce significant lag and risk data inconsistency, and CSV export does not support CDC.

Full explanation →
381
MCQmedium

A developer is integrating a legacy on-premises application with Cloud Storage. The application generates files that must be uploaded to a bucket. The developer cannot install any additional software on the on-premises server. Which approach should the developer use?

A.Use the gcloud CLI to copy files to the bucket.
B.Generate a signed URL and use an HTTP PUT request from the application.
C.Mount the bucket using Cloud Storage FUSE.
D.Deploy a Cloud Function that accepts file uploads and writes to the bucket.
AnswerB

A signed URL enables direct HTTP PUT uploads without any additional software on the client, meeting all requirements.

Why this answer

A signed URL allows the application to upload files directly via HTTP PUT without requiring any additional software installation on the on-premises server. The developer only needs to generate a signed URL (using Cloud Storage client libraries or gcloud CLI on another system) and then make a simple HTTP request from the application. Option A is wrong because the gcloud CLI would need to be installed on the server, which violates the constraint.

Option C is wrong because Cloud Storage FUSE requires installing a FUSE driver on the server. Option D is wrong because deploying a Cloud Function introduces extra complexity and still requires the application to send requests to the function, which would need additional logic.

Full explanation →
382
MCQhard

A team is migrating a monolithic .NET application to Cloud Run. The application uses .NET Framework 4.8 and depends on Windows-specific libraries. What is the recommended approach to containerize and deploy this application?

A.Deploy the application on Compute Engine with Windows Server
B.Use Cloud Run for Anthos on a Windows node pool
C.Port the application to .NET Core/.NET 6+ and run on Linux
D.Use a Windows base image and deploy to Cloud Run
AnswerC

This is the recommended approach to make the application compatible with Cloud Run.

Why this answer

Cloud Run only supports Linux containers, so a .NET Framework 4.8 application that depends on Windows-specific libraries cannot be directly deployed. The recommended approach is to port the application to .NET Core/.NET 6+ (now .NET 8/9), which is cross-platform and can run on Linux containers, enabling deployment to Cloud Run. This aligns with Google's guidance for modernizing legacy .NET applications to leverage serverless platforms.

Exam trap

The PCD exam often tests the misconception that Cloud Run can run any container image, including Windows-based ones, but the platform strictly supports only Linux containers, making option D a common trap for candidates unfamiliar with Cloud Run's runtime constraints.

How to eliminate wrong answers

Option A is wrong because deploying on Compute Engine with Windows Server is a lift-and-shift approach that does not leverage Cloud Run's serverless benefits and incurs higher operational overhead and cost. Option B is wrong because Cloud Run for Anthos does not support Windows node pools; it only supports Linux containers on GKE clusters. Option D is wrong because Cloud Run does not support Windows base images; it only runs Linux containers, and using a Windows base image would cause the deployment to fail.

Full explanation →
383
Multi-Selectmedium

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Select 3 answers
A.Automate the teardown of test resources after test completion
B.Use the Cloud Run emulator to run the service locally
C.Provision dedicated Pub/Sub topics and subscriptions for the test environment
D.Use the Firestore emulator to simulate Firestore operations
E.Create a separate Google Cloud project for testing
AnswersA, C, E

Prevents lingering resources and cost.

Why this answer

End-to-end testing of a Cloud Run service that interacts with Firestore and Pub/Sub must include automated teardown of test resources (e.g., Pub/Sub topics, subscriptions, Firestore documents) to prevent resource leaks and avoid incurring ongoing costs. Without teardown, leftover resources can cause quota exhaustion and interfere with subsequent test runs, making automation essential for reliable CI/CD pipelines.

Exam trap

The PCD exam often tests the distinction between emulators (suitable for unit/integration tests) and real services (required for end-to-end testing), leading candidates to incorrectly select the Firestore emulator as a valid step for end-to-end testing.

Full explanation →
384
MCQmedium

You are designing a Bigtable schema for an ad-tech platform that tracks ad impressions. Each impression has a unique ID, timestamp, user ID, and campaign ID. Queries frequently filter by user ID and time range. Which row key design is MOST appropriate to avoid hotspots and support efficient range scans?

A.Use the user ID as the row key
B.Use a composite key: hashed user ID prefix + timestamp
C.Use a composite key: campaign ID + timestamp
D.Use the impression ID as the row key
AnswerB

A hash of user ID as prefix distributes writes; appending timestamp allows efficient time-range scans per user.

Why this answer

Using a hashed user ID prefix distributes writes across Bigtable tablets, preventing hotspots from sequential user IDs, while appending the timestamp enables efficient range scans within a user's data. Bigtable's lexicographic ordering on row keys means that the hashed prefix ensures load balancing, and the timestamp suffix allows scanning a specific time range for a given user without scanning irrelevant rows.

Exam trap

The trap here is that candidates often pick Option A, thinking user ID is a natural key for filtering, but fail to recognize that sequential or high-volume user IDs create hotspots in Bigtable's distributed architecture.

How to eliminate wrong answers

Option A is wrong because using the raw user ID as the row key can cause hotspots if user IDs are sequential or if a single user generates a high volume of impressions, leading to uneven load distribution across tablets. Option C is wrong because using campaign ID + timestamp scatters impressions for the same user across different row keys, making user-based time range scans inefficient and requiring multiple scans or filtering. Option D is wrong because using the impression ID as the row key results in a unique key per impression, which prevents any meaningful range scans by user or time and forces full table scans for common queries.

Full explanation →
385
MCQmedium

A financial services company needs to query data across Cloud SQL (PostgreSQL) and BigQuery without moving data. They want to use federated queries from BigQuery to access Cloud SQL tables. What must be created in BigQuery to enable this?

A.A BigQuery view
B.An external table
C.A Cloud SQL instance connection
D.A BigQuery dataset
AnswerC

A Cloud SQL instance connection (BigQuery connection) must be created to enable federated queries. It holds the instance details and credentials, and allows BigQuery to query Cloud SQL using EXTERNAL_QUERY.

Why this answer

BigQuery federated queries to Cloud SQL require a BigQuery connection (Cloud SQL instance connection) to be created first. This connection stores the credentials and instance details. Then, you use the EXTERNAL_QUERY function in a query to access Cloud SQL tables.

An external table is not used for federated queries; it is for querying external data sources like Cloud Storage.

Full explanation →
386
MCQeasy

A team is developing a microservice that needs to store user profile images in Cloud Storage. The service is deployed on Cloud Run and will be invoked by other services via HTTP. The images are uploaded by users and the service must validate that the file is an image (e.g., JPEG, PNG) before storing it. The team wants to minimize costs and operational overhead while ensuring that only valid images are stored. The current implementation uploads the file directly to Cloud Storage from the client, but the team wants to add validation in the service. Which approach should the team take?

A.Create a separate Cloud Function that receives the file, validates it, and uploads it to Cloud Storage. Invoke the Cloud Function from the client.
B.Have the client send the file to the Cloud Run service, validate the file on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library.
C.Validate the file on the client side before uploading directly to Cloud Storage, and rely on client-side validation.
D.Upload the file to Cloud Storage, then trigger a Cloud Function using Cloud Storage events to validate the file and delete it if invalid.
AnswerB

Correct; validates before upload, keeps architecture simple.

Why this answer

It keeps the validation logic within the Cloud Run service, which is already deployed and handling HTTP requests. The service can receive the file via HTTP, validate its MIME type and magic bytes on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library. This minimizes costs (no additional compute services) and operational overhead (single service to manage), while ensuring only valid images are stored.

Exam trap

The PCD exam often tests the misconception that client-side validation is sufficient for security, or that adding extra serverless functions is always the best way to add validation, when in fact the simplest and most cost-effective approach is to validate within the existing service.

How to eliminate wrong answers

Option A is wrong because it introduces an unnecessary separate Cloud Function, increasing operational overhead and cost, and the client would need to invoke a different endpoint, complicating the architecture. Option C is wrong because client-side validation alone is insufficient for security; a malicious client can bypass it and upload non-image files directly to Cloud Storage. Option D is wrong because it allows invalid files to be stored temporarily in Cloud Storage before validation, which wastes storage costs and creates a window where invalid data exists; it also adds complexity with a Cloud Function triggered by events.

Full explanation →
387
MCQeasy

A company wants to send events from a custom application to Cloud Pub/Sub, then process them with a Cloud Run service. The application runs on Compute Engine. What is the simplest way for the application to authenticate to Pub/Sub?

A.Use an API key for the Pub/Sub API.
B.Embed a service account JSON key in the application code.
C.Set up Cloud Endpoints to proxy the Pub/Sub requests.
D.Attach a service account to the Compute Engine instance with necessary Pub/Sub roles.
AnswerD

Attaching a service account to the Compute Engine instance allows automatic credential retrieval via the metadata server, making it the simplest and most secure approach.

Why this answer

Attaching a service account to the Compute Engine instance allows the application to automatically obtain credentials via the instance metadata server, which is the simplest and most secure method. Option A is wrong because API keys are not used for authentication to Pub/Sub; they lack identity-based access control. Option B is wrong because embedding a service account JSON key in the code is insecure and not best practice.

Option C is wrong because Cloud Endpoints adds unnecessary complexity for this use case and is not the simplest approach.

Full explanation →
388
Multi-Selectmedium

You are configuring a Cloud Spanner database for a financial application. You need to ensure that queries on the 'Orders' table by 'customer_id' are efficient without performing a full table scan. You also want to avoid index joins when possible. Which TWO actions should you take?

Select 2 answers
A.Use the STORING clause to include frequently queried columns in the index
B.Create a global secondary index on 'order_id'
C.Partition the table by customer_id
D.Use the INTERLEAVE IN clause to create a local index
E.Create a secondary index on 'customer_id'
AnswersA, E

STORING clause avoids index join by storing additional columns in the index.

Why this answer

The STORING clause in a Cloud Spanner secondary index allows you to include additional columns (e.g., frequently queried columns) directly in the index entries. This enables index-only scans, avoiding the need for an index join (back join) to fetch data from the base table, thus improving query efficiency. Option E is correct because creating a secondary index on 'customer_id' directly supports efficient point lookups and range scans on that column, preventing full table scans.

Exam trap

A common pitfall in Google Cloud Spanner is assuming that creating an interleaved index (via INTERLEAVE IN) on 'customer_id' is optimal for single-table queries. However, interleaved indexes are designed for parent-child relationships and still require index joins unless columns are stored with the STORING clause. For efficient queries on 'Orders' by 'customer_id', a secondary index with the STORING clause avoids full table scans and index joins.

Full explanation →
389
MCQeasy

A media company wants to serve video content globally with low latency and high throughput. Which Google Cloud service is best suited?

A.Cloud CDN
B.Cloud Load Balancer
C.Cloud Storage with public bucket
D.App Engine
AnswerA

Cloud CDN provides global content caching at edge locations, ensuring low latency and high throughput.

Why this answer

Cloud CDN leverages Google's global edge cache network to deliver video content from locations closest to end users, minimizing latency and offloading origin servers. It integrates with Cloud Load Balancer and Cloud Storage to provide high-throughput, low-latency streaming without requiring users to manage caching infrastructure.

Exam trap

The trap here is confusing load balancing (traffic distribution) with content delivery (caching at edge), leading candidates to choose Cloud Load Balancer when the question explicitly asks for low latency and high throughput for global video serving.

How to eliminate wrong answers

Option B is wrong because Cloud Load Balancer distributes traffic across backends but does not cache content; it alone cannot reduce latency for repeated requests or offload origin servers. Option C is wrong because Cloud Storage with a public bucket serves content directly from a single regional bucket, resulting in higher latency for global users and no edge caching to improve throughput. Option D is wrong because App Engine is a compute platform for hosting applications, not a content delivery service; it lacks built-in edge caching and global distribution optimized for video streaming.

Full explanation →
390
MCQhard

An organization is migrating from Oracle to Cloud SQL for PostgreSQL using Database Migration Service. They need to convert Oracle NUMBER(10,2) and VARCHAR2(100) columns to appropriate PostgreSQL types. What are the correct mappings?

A.NUMBER(10,2) → NUMERIC(10,2); VARCHAR2(100) → VARCHAR(100)
B.NUMBER(10,2) → DECIMAL(10,2); VARCHAR2(100) → TEXT
C.NUMBER(10,2) → INTEGER; VARCHAR2(100) → TEXT
D.NUMBER(10,2) → BIGINT; VARCHAR2(100) → CHAR(100)
AnswerA

Correct mapping preserving precision and length.

Why this answer

Oracle NUMBER maps to PostgreSQL NUMERIC (or DECIMAL), and VARCHAR2 maps to VARCHAR (or TEXT). The specified lengths are preserved.

Full explanation →
391
Multi-Selecthard

Which TWO are correct ways to reduce logging costs in Google Cloud? (Choose two.)

Select 2 answers
A.Set log bucket retention to a shorter period
B.Disable all audit logs to reduce volume
C.Export all logs to BigQuery for analysis
D.Increase the retention period from 30 days to 365 days
E.Use exclusion filters to drop debug logs
AnswersA, E

Shorter retention reduces storage costs.

Why this answer

Reducing the retention period for log buckets directly decreases the amount of log data stored, which lowers storage costs in Cloud Logging. Logs are billed based on volume ingested and stored; shorter retention means older logs are deleted sooner, reducing the total storage footprint and associated charges.

Exam trap

Google Cloud often tests the misconception that exporting logs to an external system like BigQuery reduces costs, when in fact it adds additional costs for the export destination, and the trap is that candidates confuse 'analysis' with 'cost reduction'.

Full explanation →
392
Multi-Selectmedium

A company needs to secure their Cloud SQL for MySQL instance. They want to ensure that only applications running within their VPC can connect, and that all connections are encrypted. Which two steps should they take? (Choose two.)

Select 2 answers
A.Use Cloud SQL Auth Proxy on the application side
B.Assign a public IP address to the instance
C.Enable the 'require_ssl' flag
D.Assign a private IP address to the instance
E.Enable IAM database authentication
AnswersC, D

Requires SSL for all connections.

Why this answer

Using private IP restricts connections to the VPC, and enabling SSL enforcement ensures encryption. IAM authentication is additional but not required for VPC-only connectivity.

Full explanation →
393
MCQhard

Refer to the exhibit. A developer runs the above command to deploy a Cloud Function triggered by Pub/Sub. The function fails to execute when a message is published. The logs show: "Function execution took 60001 ms, finished with status: 'timeout'". What should the developer do?

A.Change the trigger to HTTP
B.Reduce the number of function instances
C.Check the function code for long-running operations
D.Increase the function timeout to 9 minutes
AnswerC

The timeout indicates the function is taking too long; the proper fix is to optimize the code to complete within the allowed time.

Why this answer

The timeout error indicates the Cloud Function is exceeding its maximum execution duration. The default timeout for Cloud Functions is 60 seconds, and the logs confirm the function ran for 60001 ms before being forcibly terminated. The most likely cause is that the function code contains long-running operations (e.g., synchronous HTTP calls, database queries, or heavy computation) that do not complete within the allotted time.

Therefore, the developer should inspect and optimize the function code to reduce execution time, such as by using asynchronous processing or breaking the work into smaller chunks.

Exam trap

The PCD exam often tests the misconception that increasing the timeout is the correct fix for any timeout error, but the trap here is that the default timeout is 60 seconds and the logs show exactly 60001 ms, indicating the function is hitting the default limit — the correct first step is to optimize the code, not blindly extend the timeout.

How to eliminate wrong answers

Option A is wrong because changing the trigger to HTTP does not change the timeout behavior; Cloud Functions have the same maximum timeout (up to 9 minutes) regardless of trigger type, and the issue is execution duration, not the trigger mechanism. Option B is wrong because reducing the number of function instances does not affect the timeout of a single invocation; instances handle concurrency, not execution time per request, and fewer instances could even increase latency under load. Option D is wrong because while increasing the timeout to 9 minutes is possible (the maximum is 540 seconds), it is not the recommended first step; the logs show the function is timing out at the default 60 seconds, and simply extending the timeout without addressing the underlying long-running code would mask the problem and could lead to higher costs and resource consumption.

Full explanation →
394
MCQhard

A developer finds the JSON key shown in the exhibit in a Cloud Storage bucket that is publicly accessible. Which security best practice was violated?

A.The key is not rotated regularly.
B.The key was created as a user-managed key instead of a Google-managed key.
C.The key was not encrypted using Cloud KMS.
D.The key was stored in a publicly accessible Cloud Storage bucket.
AnswerD

Service account keys must be kept confidential and never exposed publicly.

Why this answer

Storing a JSON key (a service account private key) in a publicly accessible Cloud Storage bucket directly violates the principle of least privilege and exposes sensitive credentials to unauthorized users. Any entity with read access to the bucket can retrieve the key and impersonate the service account, potentially gaining unauthorized access to Google Cloud resources.

Exam trap

The PCD exam often tests the distinction between encryption (which protects data at rest) and access control (which governs who can read the data), leading candidates to mistakenly choose an encryption-related option when the real issue is public exposure.

How to eliminate wrong answers

Option A is wrong because while key rotation is a security best practice, the violation here is the public exposure of the key, not the lack of rotation. Option B is wrong because the key type (user-managed vs. Google-managed) is irrelevant to the immediate security breach; the issue is the public accessibility of the bucket, not the key's management origin.

Option C is wrong because Cloud KMS encryption protects data at rest, but the key is already exposed by being in a public bucket; encryption does not prevent unauthorized access if the bucket permissions are misconfigured.

Full explanation →
395
Multi-Selectmedium

A gaming company uses Cloud Spanner for their global leaderboard. They want to reduce the number of stale reads and improve read performance while maintaining strong consistency for writes. Which TWO strategies should they implement? (Choose two)

Select 2 answers
A.Use interleaved tables to store child rows with parent rows
B.Increase the number of read replicas in each region
C.Create secondary indexes on frequently queried columns
D.Use strong reads for all queries
E.Use stale reads with a maximum staleness bound
AnswersC, E

Secondary indexes can dramatically improve query performance for non-key columns.

Why this answer

Secondary indexes in Cloud Spanner allow queries to access data directly from the index without scanning the entire base table, significantly improving read performance for frequently queried columns. Option E is correct because stale reads with a maximum staleness bound reduce contention and latency by allowing reads to return data that is slightly behind the current timestamp, which improves read throughput while still maintaining strong consistency for writes.

Exam trap

Google Cloud often tests the distinction between strong reads and stale reads in Cloud Spanner. The trap here is that candidates mistakenly think that using strong reads for all queries improves performance, when in fact stale reads with a maximum staleness bound reduce latency and contention while maintaining strong consistency for writes. Option D (strong reads) would increase contention and latency, not improve performance.

Full explanation →
396
MCQmedium

Refer to the exhibit. A developer uses the above cloudbuild.yaml for a Cloud Run service. The trigger is set to run on pushes to the main branch. After a push, the build succeeds but the deployment fails with a permission error. What is the most likely issue?

A.The Cloud Build service account lacks permission to deploy to Cloud Run
B.The region 'us-central1' is incorrect
C.The container image tag ${SHORT_SHA} is invalid
D.The Cloud Run service name 'my-service' is misspelled
AnswerA

Deploying to Cloud Run requires specific IAM roles (e.g., Cloud Run Admin, Service Account User) that might not be granted to the default Cloud Build service account.

Why this answer

The Cloud Build service account (typically the default compute engine service account or a user-specified service account) does not have the required IAM roles (e.g., roles/run.admin or roles/run.invoker) to deploy to Cloud Run. Even though the build step succeeds, the deployment step fails because the service account lacks the `run.services.create` or `run.services.update` permission for the target Cloud Run service.

Exam trap

The PCD exam often tests the misconception that a build success implies all subsequent steps will succeed, but the trap here is that the deployment step uses a different set of permissions (Cloud Run IAM) than the build step (Cloud Build IAM), and candidates may overlook the need to grant the Cloud Build service account the `roles/run.admin` role.

How to eliminate wrong answers

Option B is wrong because if the region 'us-central1' were incorrect, the deployment would fail with a region-not-found or resource-location error, not a permission error. Option C is wrong because the container image tag ${SHORT_SHA} is a valid Cloud Build substitution variable that resolves to the short commit SHA; an invalid tag would cause an image-not-found error, not a permission error. Option D is wrong because if the service name 'my-service' were misspelled, the deployment would fail with a resource-not-found error, not a permission error.

Full explanation →
397
MCQmedium

A company is designing a microservices application. They want to ensure that if one service fails, it does not cascade to other services. Which pattern should they implement?

A.Auto-scaling
B.Retry with exponential backoff
C.Load shedding
D.Circuit Breaker
AnswerD

Circuit breaker stops calls to a failing service, preventing cascade.

Why this answer

The Circuit Breaker pattern is the correct choice because it prevents cascading failures by monitoring service calls and opening the circuit when failures exceed a threshold, allowing the system to fail fast and avoid resource exhaustion. This pattern directly addresses the requirement to isolate failures between microservices, ensuring that a failure in one service does not propagate to others.

Exam trap

The PCD exam often tests the misconception that retry mechanisms or load shedding are sufficient for failure isolation, but they do not prevent cascading failures because they lack the stateful tripping and fast-fail behavior of the Circuit Breaker pattern.

How to eliminate wrong answers

Option A is wrong because Auto-scaling handles increased load by adding instances but does not prevent failure propagation between services. Option B is wrong because Retry with exponential backoff can actually worsen cascading failures by repeatedly attempting calls to a failing service, potentially overwhelming it further. Option C is wrong because Load shedding drops excess requests to protect a service from overload but does not isolate failures from propagating to dependent services.

Full explanation →
398
MCQhard

During a migration from Teradata to BigQuery, the team needs to convert Teradata BTEQ scripts to BigQuery SQL. Which of the following is a key difference between Teradata SQL and BigQuery SQL that the team must account for?

A.Teradata uses CURRENT_DATE; BigQuery uses CURRENT_DATE() with parentheses
B.Teradata uses FROM clause first; BigQuery uses SELECT first
C.Teradata uses backticks for identifiers; BigQuery uses double quotes
D.Teradata uses CAST for data type conversion; BigQuery uses CONVERT
AnswerA

BigQuery requires parentheses for functions, e.g., CURRENT_DATE().

Why this answer

Teradata uses a different syntax for temporal queries (e.g., CURRENT_DATE) and does not use backticks for identifiers. BigQuery SQL is based on GoogleSQL, which uses backticks for escaping reserved keywords and has different date functions.

Full explanation →
399
MCQmedium

A company runs a critical financial application on Google Cloud using Compute Engine instances in a managed instance group (MIG) with auto-scaling based on CPU utilization. The application stores state in a local SSD and relies on sticky sessions (session affinity). Recently, during a traffic spike, the MIG scaled out new instances, but some users lost their sessions because the load balancer routed them to a different instance. The team needs to maintain session persistence without sacrificing scalability. What should they do?

A.Implement a shared session store using Cloud Memorystore for Redis.
B.Increase the instance group's cooldown period to reduce scaling frequency.
C.Use a global HTTPS Load Balancer with cookie-based session affinity.
D.Use Cloud NAT for consistent source IP routing.
AnswerA

External session store makes sessions available to all instances.

Why this answer

Using Cloud Memorystore for Redis provides a centralized, external session store that decouples session state from individual Compute Engine instances. This ensures that any instance in the managed instance group can serve any user's request, maintaining session persistence even as the MIG scales out or in based on CPU utilization. It preserves scalability because the session store is independent of instance lifecycle, and Redis offers low-latency reads and writes suitable for session data.

Exam trap

The PCD exam often tests the misconception that session affinity alone is sufficient for session persistence, but the trap here is that candidates overlook the need for a shared external store when instances are ephemeral or can be terminated, as local SSD state is lost on instance stop/termination.

How to eliminate wrong answers

Option B is wrong because increasing the cooldown period only delays the scaling of new instances, which does not solve the fundamental problem of session state being stored locally on instances; users will still lose sessions if they are routed to a different instance after scaling. Option C is wrong because while a global HTTPS Load Balancer with cookie-based session affinity can route a user to the same instance, it does not address the issue that the session data is stored on a local SSD; if the instance is terminated or scaled down, the session is lost, and session affinity cannot guarantee persistence across instance failures or scaling events. Option D is wrong because Cloud NAT provides outbound internet connectivity with a consistent source IP for instances, but it does not affect how the load balancer routes incoming traffic or how session state is stored; it is irrelevant to session persistence.

Full explanation →
400
MCQeasy

A company is planning to migrate an on-premises Oracle database to Cloud SQL for PostgreSQL. They want to use Google's Database Migration Service (DMS) for continuous migration with minimal downtime. Which source connectivity method does DMS support for connecting to the Oracle database over the internet?

A.Cloud SQL Auth Proxy
B.Cloud Interconnect
C.VPC Network Peering to on-premises network via Cloud VPN
D.Direct connection using Oracle Net Services over public IP with SSL
AnswerC

Correct. VPC Network Peering via Cloud VPN creates a secure, internet-based tunnel between on-premises and Google Cloud, which DMS can use to access the Oracle database.

Why this answer

Google's Database Migration Service (DMS) supports connecting to an on-premises Oracle database over the internet using a Cloud VPN tunnel. This creates an encrypted connection between the on-premises network and Google Cloud VPC, allowing DMS to reach the source database securely. Cloud SQL Auth Proxy is not used for DMS source connectivity; it is a tool for client applications to connect to Cloud SQL instances.

Exam trap

Many candidates incorrectly think Cloud SQL Auth Proxy is used by DMS for source connectivity. However, DMS relies on network connectivity methods like Cloud VPN, Interconnect, or VPC peering to reach on-premises databases. Cloud SQL Auth Proxy is only for client connections to Cloud SQL.

How to eliminate wrong answers

Option B is wrong because Cloud Interconnect is a dedicated, high-bandwidth physical connection between on-premises and Google Cloud, not a method for connecting over the internet; it is used for private, low-latency connectivity, not for internet-based DMS migrations. Option C is wrong because VPC Network Peering to on-premises via Cloud VPN creates a site-to-site VPN tunnel over the internet, but DMS does not support connecting to an Oracle source database through a VPN; it requires direct connectivity via Cloud SQL Auth Proxy or a public IP with SSL. Option D is wrong because while Oracle Net Services over public IP with SSL is a valid connectivity method for some Google Cloud services, DMS specifically does not support direct Oracle Net Services connections over the internet; it relies on Cloud SQL Auth Proxy for internet-based migrations to ensure secure, authenticated tunnels.

Full explanation →
401
MCQeasy

A company needs a globally distributed relational database that provides strong ACID transactions across regions and a 99.999% availability SLA. Which Google Cloud database service meets these requirements?

A.Cloud SQL
B.Cloud Bigtable
C.Cloud Spanner
D.AlloyDB
AnswerC

Cloud Spanner is a globally distributed, horizontally scalable relational database with strong consistency and 99.999% availability SLA.

Why this answer

Cloud Spanner is the only Google Cloud database that offers globally distributed ACID transactions and a 99.999% SLA. Cloud SQL and AlloyDB are regional, and Bigtable is not relational.

Full explanation →
402
MCQeasy

A team wants to implement automated testing for a Python application deployed on Cloud Run. They want the tests to run as part of the CI/CD pipeline after the image is built but before it is deployed. Which approach should they use?

A.Use Cloud Function to run tests triggered by a Pub/Sub message after the image is published
B.Run unit tests before building the image using Cloud Build, but skip integration tests
C.Add a test step in Cloud Build that uses the built image to run integration tests before deploying
D.Deploy the image to a staging environment, run tests, and then promote to production
AnswerC

Cloud Build allows running containers from the built image as part of the pipeline.

Why this answer

Cloud Build allows you to add a test step that runs the built container image before deploying it to Cloud Run. This ensures integration tests validate the application in an environment identical to production, catching issues early in the CI/CD pipeline. Running tests after the image is built but before deployment is a standard practice for shift-left testing.

Exam trap

The PCD exam often tests the misconception that integration tests must be run in a separate staging environment or after deployment, when in fact Cloud Build can run them directly from the built image before deployment.

How to eliminate wrong answers

Option A is wrong because using a Cloud Function triggered by a Pub/Sub message after the image is published introduces unnecessary latency and complexity, and tests would run after the image is already available, not before deployment. Option B is wrong because it suggests skipping integration tests entirely, which would miss critical runtime and dependency issues that only surface in the containerized environment. Option D is wrong because deploying to a staging environment before testing violates the requirement to run tests before deployment; it also adds extra infrastructure cost and delay without leveraging Cloud Build's built-in test capabilities.

Full explanation →
403
MCQeasy

Your application is deployed on Google Kubernetes Engine (GKE). You want to monitor resource usage at the pod level. Which tool should you use?

A.Cloud Trace
B.Cloud Logging
C.Cloud Profiler
D.Cloud Monitoring with Kubernetes integration
AnswerD

Cloud Monitoring provides built-in dashboards and metrics for GKE, including pod-level resource metrics.

Why this answer

Cloud Monitoring with Kubernetes integration is the correct choice because it provides native pod-level metrics such as CPU, memory, disk, and network usage by leveraging the Kubernetes API and cAdvisor. This integration automatically collects resource utilization from each pod without requiring manual instrumentation, making it ideal for monitoring resource usage at the pod level in GKE.

Exam trap

The PCD exam often tests the distinction between monitoring (metrics) and observability tools (tracing, logging, profiling), so candidates may confuse Cloud Trace or Cloud Profiler as solutions for resource usage monitoring because they deal with performance data, but they do not provide pod-level resource metrics.

How to eliminate wrong answers

Option A is wrong because Cloud Trace is a distributed tracing tool that captures latency data for requests across services, not resource usage metrics like CPU or memory at the pod level. Option B is wrong because Cloud Logging collects and stores log data (e.g., application logs, system logs), not numeric resource utilization metrics. Option C is wrong because Cloud Profiler is a continuous profiling tool that identifies performance bottlenecks in code (e.g., CPU or memory hot spots), but it does not provide real-time pod-level resource usage monitoring.

Full explanation →
404
Multi-Selectmedium

You are troubleshooting a performance issue in a microservices application. Which TWO tools from Google Cloud's operations suite would you use to trace a request across services and identify the slowest component?

Select 2 answers
A.Cloud Monitoring
B.Error Reporting
C.Cloud Profiler
D.Cloud Logging
E.Cloud Trace
AnswersA, E

Cloud Monitoring can display latency heatmaps and service graphs that help visualize the slowest component in a distributed trace.

Why this answer

Cloud Trace is the dedicated Google Cloud service for distributed tracing, capturing latency data as requests propagate through microservices. Cloud Monitoring provides the dashboards and alerting to visualize trace data and pinpoint the slowest component. Together, they enable end-to-end request tracing and performance bottleneck identification.

Exam trap

The PCD exam often tests the distinction between tools that monitor code performance (Profiler) versus tools that trace request flow (Trace), leading candidates to incorrectly select Cloud Profiler for tracing tasks.

Full explanation →
405
MCQhard

A Cloud SQL for MySQL instance configured with HA is experiencing a failover event. The application team reports that the database became unavailable for about 60 seconds during the failover. They want to minimize future downtime. What should they do?

A.Enable automated backups and point-in-time recovery
B.Increase the instance size to reduce failover time
C.Switch to a cross-region replica
D.Use Cloud SQL Proxy or configure the application to retry with a static IP
AnswerD

Cloud SQL Proxy provides a static IP, eliminating DNS propagation delays during failover.

Why this answer

Cloud SQL HA failover typically takes less than 60 seconds. The downtime could be due to DNS propagation or connection pooling issues. Using a proxy like Cloud SQL Auth proxy or a load balancer with a static IP can reduce failover time by avoiding DNS changes.

Full explanation →
406
Multi-Selectmedium

A company is migrating from Oracle to Cloud SQL for PostgreSQL using Database Migration Service. They need to ensure that the migration is validated before cutover. Which TWO actions should they take?

Select 2 answers
A.Run comparison queries (e.g., row counts, checksums) between source and target.
B.Take a snapshot of the source database before migration.
C.Disable foreign key constraints on the target to speed up migration.
D.Perform load testing on the Cloud SQL instance using production data shape.
E.Implement shadow writes from the application to both databases simultaneously.
AnswersA, D

This validates data consistency.

Why this answer

Running comparison queries (e.g., row counts, checksums) between the source Oracle database and the target Cloud SQL for PostgreSQL instance is a standard validation technique to ensure data consistency and completeness before cutover. Database Migration Service (DMS) handles continuous replication, but manual validation using queries like SELECT COUNT(*) or checksum functions (e.g., MD5 on concatenated columns) catches any discrepancies that might have been introduced during migration or replication lag.

Exam trap

Google Cloud certification exams often test the distinction between 'validation' actions (verifying data integrity) and 'cutover' or 'backup' actions, so the trap here is confusing operational steps like snapshots or shadow writes with the specific validation checks needed to confirm migration readiness.

Full explanation →
407
Multi-Selecteasy

A developer is building a containerized application on Cloud Run. They want to test the application locally before deploying. Which two tools should they use? (Choose 2)

Select 2 answers
A.Functions Framework
B.Docker Desktop
C.Cloud Build
D.Cloud Code for VS Code
E.Cloud Run for Anthos
AnswersB, D

Docker Desktop allows you to run the container locally exactly as it will run on Cloud Run.

Why this answer

Docker Desktop allows running the container locally. Cloud Code (for VS Code or IntelliJ) provides integrated debugging, local emulation, and one-click deployment to Cloud Run. Cloud Build is for CI/CD, not local testing.

Functions Framework is for Cloud Functions, not Cloud Run. Cloud Run for Anthos is for hybrid environments.

Full explanation →
408
MCQeasy

A data engineer needs to run a complex transformation pipeline between Cloud SQL and BigQuery, including joining data from both sources. The pipeline should run on a schedule and handle large volumes efficiently. Which service should they use?

A.Dataflow
B.Cloud Functions
C.Cloud Run
D.Datastream
AnswerA

Dataflow is ideal for complex data transformation pipelines with support for batch and streaming, scheduling, and multiple data sources.

Why this answer

Dataflow is the correct choice because it is a fully managed, serverless service for executing Apache Beam pipelines, which can handle complex transformations (e.g., joining data from Cloud SQL and BigQuery) at scale. It supports scheduled execution via Cloud Scheduler or built-in triggers, and its auto-scaling and exactly-once processing semantics ensure efficient handling of large volumes without manual infrastructure management.

Exam trap

Google often tests the distinction between data movement services (Datastream) and data processing services (Dataflow), so the trap here is that candidates mistake Datastream's CDC replication for a transformation pipeline, overlooking that it cannot perform complex joins or scheduled batch transformations.

How to eliminate wrong answers

Option B (Cloud Functions) is wrong because it is designed for lightweight, event-driven, short-lived functions (max 9 minutes timeout) and cannot handle complex, long-running ETL pipelines or large-volume joins between Cloud SQL and BigQuery. Option C (Cloud Run) is wrong because it is a containerized compute platform for stateless HTTP requests, not optimized for stateful, long-running data pipelines; it lacks native support for Apache Beam or distributed data processing across multiple sources. Option D (Datastream) is wrong because it is a serverless change data capture (CDC) and replication service for streaming data into BigQuery, not a transformation engine; it cannot perform complex joins or transformations between Cloud SQL and BigQuery.

Full explanation →
409
MCQeasy

You need a database that provides 99.999% availability SLA, global distribution, and supports ACID transactions across regions. Which Google Cloud database meets these requirements?

A.Bigtable
B.Cloud SQL
C.Firestore
D.Cloud Spanner
AnswerD

Spanner meets all requirements: 99.999% SLA, global, ACID.

Why this answer

Cloud Spanner is the only Google Cloud database that provides 99.999% availability SLA, global distribution via automatic synchronous replication across regions, and full ACID transactions across regions using TrueTime and Paxos-based consensus. It combines horizontal scalability with strong consistency, making it ideal for globally distributed applications requiring transactional integrity.

Exam trap

The trap here is that candidates often confuse Firestore's multi-region mode with true global ACID transactions, but Firestore only offers strong consistency within a single region and eventual consistency across regions, while Cloud Spanner is the only service that guarantees ACID across regions with a 99.999% SLA.

How to eliminate wrong answers

Option A is wrong because Bigtable is a NoSQL wide-column database that offers only eventual consistency (not ACID transactions) and does not support SQL queries or multi-region ACID transactions. Option B is wrong because Cloud SQL is a regional relational database with a 99.95% SLA (not 99.999%) and does not support global distribution or cross-region ACID transactions. Option C is wrong because Firestore is a NoSQL document database that provides strong consistency only within a single region (or multi-region with eventual consistency) and does not support ACID transactions across regions.

Full explanation →
410
MCQeasy

A team is developing a REST API on Cloud Run. They need to ensure that only authenticated requests from their corporate domain (example.com) are allowed. Which configuration should they use?

A.Set the Cloud Run service to require authentication and allow only the domain 'example.com' in the IAM policy
B.Implement custom authentication using Firestore to validate user tokens
C.Use Cloud Endpoints with an API key that is shared only with corporate users
D.Use Cloud Armor to deny traffic except from the corporate IP range
AnswerA

IAM policy with 'domain:example.com' on the service's roles/run.invoker restricts access.

Why this answer

Cloud Run's IAM integration allows you to require authentication (via the `--no-allow-unauthenticated` flag) and then use IAM conditions to restrict access to principals from a specific domain (e.g., `request.auth.claims.email` ends with `@example.com`). This ensures only authenticated requests from the corporate domain are permitted, leveraging Google Cloud's identity-aware proxy (IAP) capabilities without additional infrastructure.

Exam trap

The PCD exam often tests the distinction between authentication (verifying identity) and authorization (controlling access), and the trap here is that candidates confuse IP-based controls (Cloud Armor) with identity-based controls (IAM conditions), leading them to choose option D despite its inability to handle authenticated domain restrictions.

How to eliminate wrong answers

Option B is wrong because implementing custom authentication with Firestore to validate user tokens is unnecessary and adds complexity; Cloud Run natively supports token validation via IAM and does not require a separate database for token verification. Option C is wrong because Cloud Endpoints with an API key does not authenticate the user's identity or domain; API keys are for project identification, not user authentication, and sharing a key with corporate users would not restrict access to a specific domain. Option D is wrong because Cloud Armor filters traffic based on IP addresses, not user identity or domain; corporate IP ranges can change, and this approach would not handle mobile or remote users outside the corporate network.

Full explanation →
411
Multi-Selecteasy

Which TWO of the following are valid strategies for testing Cloud Functions locally before deployment?

Select 2 answers
A.Write unit tests that mock the HTTP request and response objects.
B.Use the Cloud Console to invoke the function with test events.
C.Use the Cloud Functions emulator provided by gcloud beta emulators.
D.Use the Functions Framework to start a local server that serves the function.
E.Deploy the function to a staging Cloud Functions project and test via HTTP invocations.
AnswersC, D

The emulator runs locally and simulates the Cloud Functions environment.

Why this answer

The `gcloud beta emulators` command includes a Cloud Functions emulator that allows you to run your functions locally in a simulated environment, enabling testing without deploying to the cloud. Option D is correct because the Functions Framework is an open-source library that starts a local HTTP server (typically on port 8080) and serves your function, matching the Cloud Functions runtime environment exactly.

Exam trap

The PCD exam often tests the distinction between 'local testing' and 'cloud-based testing' — the trap here is that candidates may think deploying to a staging project (Option E) qualifies as local testing, when in fact it is a remote deployment strategy that does not provide the speed or isolation of a local emulator.

Full explanation →
412
Multi-Selecteasy

Which two statements are true about Cloud Load Balancing? (Choose two.)

Select 2 answers
A.All load balancers support IPv6 client traffic.
B.SSL proxy load balancer supports non-HTTP traffic.
C.Global external HTTP(S) load balancer can distribute traffic across multiple regions.
D.Internal TCP/UDP load balancer can be used for traffic within a VPC.
E.Network load balancer can only balance TCP traffic.
AnswersC, D

This is a key feature of global load balancers.

Why this answer

The global external HTTP(S) load balancer is a proxy-based, Layer 7 load balancer that uses a single anycast IP address and can distribute traffic across backend instances in multiple regions, enabling global load balancing with automatic failover. Option D is correct because the internal TCP/UDP load balancer is a regional, pass-through load balancer that operates at Layer 4 and is designed to distribute traffic among instances within the same VPC and region, using RFC 1918 private IP addresses.

Exam trap

The trap here is that candidates often assume all load balancers support IPv6 or that SSL proxy can handle any TCP traffic, but Google Cloud specifically restricts SSL proxy to TCP with SSL termination and the Network load balancer to both TCP and UDP, not just TCP.

Full explanation →
413
Matchingmedium

Match each Cloud SQL database engine to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Open-source relational database

Advanced open-source relational database

Microsoft relational database with Windows integration

PostgreSQL-compatible with high performance for transactions

Globally distributed, strongly consistent relational database

Why these pairings

Cloud SQL offers managed relational databases; AlloyDB and Spanner are for higher scale.

Full explanation →
414
MCQmedium

Refer to the exhibit. A developer sees this log entry in Cloud Logging. The application is running on Compute Engine. Which tool should they use to further diagnose the cause of the connection refusal?

A.Cloud Monitoring to check network metrics.
B.Cloud Profiler to identify CPU bottlenecks.
C.Cloud Trace to trace the request flow.
D.VPC Flow Logs to analyze network traffic.
AnswerD

Correct: VPC Flow Logs capture connection metadata and can show whether traffic was accepted or denied.

Why this answer

The log entry indicates a connection refusal, which is a network-level issue. VPC Flow Logs capture metadata about network traffic to and from Compute Engine instances, including whether connections were accepted or rejected. By analyzing these logs, the developer can identify the source and destination IPs, ports, and protocol, and determine if a firewall rule or routing issue is causing the refusal.

Exam trap

The PCD exam often tests the distinction between application-level monitoring tools (Trace, Profiler) and network-level diagnostics (VPC Flow Logs), trapping candidates who confuse a connection refusal with a performance or code issue.

How to eliminate wrong answers

Option A is wrong because Cloud Monitoring provides metrics and alerts for resource utilization and performance, but it does not capture per-connection network traffic metadata needed to diagnose a connection refusal. Option B is wrong because Cloud Profiler is designed to identify CPU and memory bottlenecks in application code, not network connectivity issues. Option C is wrong because Cloud Trace traces request latency and flow through distributed services, but it does not log network-level connection refusals or firewall drops.

Full explanation →
415
MCQmedium

Refer to the exhibit. The alert fires when what happens?

A.When the rate of responses on App Engine exceeds 10 per second for 5 minutes
B.When the cumulative response count on App Engine exceeds 10 for 5 minutes
C.When the latency exceeds 10 seconds for 5 minutes
D.When the response rate drops below 10 per second for 5 minutes
AnswerA

ALIGN_RATE computes per-second rate, threshold >10, duration 300s.

Why this answer

The alert is configured to fire when the rate of responses on App Engine exceeds 10 per second for a sustained period of 5 minutes. This is a rate-based threshold, not a cumulative count or latency metric, which is why option A correctly describes the condition.

Exam trap

The PCD exam often tests the distinction between rate-based and cumulative-based thresholds, and the trap here is that candidates confuse 'rate per second' with 'total count over time' or misread the direction of the threshold (exceeding vs. dropping below).

How to eliminate wrong answers

Option B is wrong because it describes a cumulative response count exceeding 10 over 5 minutes, but the alert is based on a rate (per second), not a total count. Option C is wrong because it refers to latency exceeding 10 seconds, but the alert is triggered by response rate, not latency. Option D is wrong because it describes the response rate dropping below 10 per second, but the alert fires when the rate exceeds 10 per second, not when it drops below.

Full explanation →
416
MCQhard

A development team is using Cloud Trace to analyze performance bottlenecks in a Node.js application deployed on GKE. They have enabled trace sampling at 10% and can see some traces, but many requests are not captured. They want to increase the sampling rate to 100% for a specific high-traffic endpoint while keeping the default sampling rate for other endpoints. How can they achieve this?

A.Use a separate trace exporter for the high-traffic endpoint.
B.Increase the quota for trace spans per request.
C.Implement a custom sampler in the application code to sample the specific endpoint at 100%.
D.Set the global trace sampling rate to 100% in the application configuration.
AnswerC

A custom sampler allows per-endpoint sampling rates as needed.

Why this answer

Cloud Trace allows you to implement a custom sampler in your application code to override the default sampling rate for specific endpoints. By using the OpenTelemetry SDK, you can create a sampler that checks the request path and returns a sampling decision of 1.0 (100%) for the high-traffic endpoint while delegating to the default sampler (e.g., 0.1) for all other requests. This gives you fine-grained control without affecting the global sampling configuration.

Exam trap

The PCD exam often tests the distinction between sampling rate configuration (which controls which requests are traced) and quota or exporter settings (which control data transmission limits), leading candidates to confuse increasing span quotas with increasing sampling probability.

How to eliminate wrong answers

Option A is wrong because using a separate trace exporter does not control sampling rate; exporters are responsible for sending trace data to the backend, not for deciding which spans to capture. Option B is wrong because increasing the quota for trace spans per request addresses limits on the number of spans that can be sent, not the sampling rate; it does not change the probability of capturing a request. Option D is wrong because setting the global trace sampling rate to 100% would capture all requests across all endpoints, which contradicts the requirement to keep the default sampling rate for other endpoints.

Full explanation →
417
MCQhard

A developer runs the above command and cloudbuild.yaml. The build fails at the deploy step with a permission error. The developer has the Cloud Build Editor role on the project. What is the likely cause?

A.The Cloud Build service account lacks the Cloud Run Admin role.
B.The Cloud Build Editor role does not have permission to submit builds.
C.The Docker image is not in a format compatible with Cloud Run.
D.The build step uses the 'gcloud' command without authentication.
AnswerA

The Cloud Build service account needs Cloud Run Admin (or roles/run.admin) to deploy services.

Why this answer

The Cloud Build Editor role grants permissions to submit builds and execute build steps, but the actual execution of those steps (including the deploy step) runs under the Cloud Build service account. By default, this service account does not have the Cloud Run Admin role, which is required to deploy to Cloud Run. Without this role, the `gcloud run deploy` command fails with a permission error.

Exam trap

The PCD exam often tests the distinction between the permissions of the user who triggers a build (e.g., Cloud Build Editor) and the permissions of the service account that executes the build steps, leading candidates to incorrectly assume the user's role applies to all build actions.

How to eliminate wrong answers

Option B is wrong because the Cloud Build Editor role explicitly includes the `cloudbuild.builds.create` permission, which allows submitting builds; the error occurs during the deploy step, not during build submission. Option C is wrong because Cloud Run accepts standard OCI-compliant Docker images, and an incompatible image format would cause a different error (e.g., 'Image format not recognized'), not a permission error. Option D is wrong because the `gcloud` command in a Cloud Build step automatically uses the Cloud Build service account's credentials via the metadata server; no explicit authentication is needed, and a missing authentication would result in an 'unauthenticated' error, not a permission error.

Full explanation →
418
MCQeasy

Which Cloud Spanner configuration provides the highest availability and global read scalability?

A.Regional configuration with 1 read-write and 2 read-only replicas
B.Multi-region configuration
C.Regional configuration with 3 read-write replicas
D.Single-zone configuration
AnswerB

Multi-region provides global distribution, higher availability, and reads from closest replica.

Why this answer

Multi-region configurations replicate data across multiple regions, providing higher availability and global read scalability compared to regional configurations.

Full explanation →
419
MCQeasy

A company needs to back up a Cloud Bigtable instance daily and be able to restore it to a different region in case of a regional outage. What is the recommended approach?

A.Use Cloud Scheduler to trigger a Dataflow job that exports the Bigtable table to Avro files in GCS, then import in another region
B.Use Bigtable replication with a multi-cluster routing policy
C.Create a Bigtable managed backup of the cluster and restore it to a cluster in the desired region
D.Export the table using the HBase shell to a Cloud Storage bucket and import it in the new region
AnswerC

Bigtable managed backups allow easy cross-cluster restore, including to different regions.

Why this answer

Bigtable managed backups are the recommended approach for disaster recovery across regions. They allow you to create a consistent backup of a Bigtable cluster and restore it to a different cluster in another region, ensuring data durability and recoverability in case of a regional outage. This method is fully managed, does not require custom code, and preserves the table schema and data integrity.

Exam trap

The Google Cloud Professional Data Engineer exam often tests the distinction between replication (for high availability and low-latency reads) and managed backups (for point-in-time recovery and cross-region disaster recovery), leading candidates to choose replication when the requirement explicitly calls for a backup that can be restored independently.

How to eliminate wrong answers

Option A is wrong because exporting Bigtable tables via Dataflow to Avro files in GCS and then importing in another region is more complex, slower, and not the recommended approach for disaster recovery; it is typically used for data migration or analytics, not for automated daily backups with regional failover. Option B is wrong because Bigtable replication with a multi-cluster routing policy provides high availability and low-latency reads across regions but does not create a point-in-time backup that can be restored independently; it replicates live data, which could propagate corruption or accidental deletions. Option D is wrong because exporting a table using the HBase shell to a Cloud Storage bucket is a manual, ad-hoc process that lacks automation, consistency guarantees, and is not designed for production-grade daily backups; it also requires custom scripting and does not leverage Bigtable's native backup features.

Full explanation →
420
MCQeasy

A team is using Cloud SQL for MySQL and wants to recover the database to a specific point in time within the last 7 days. They have automated backups enabled. Which feature must be configured to enable point-in-time recovery (PITR)?

A.Use Database Migration Service for continuous replication
B.Configure cross-region replication
C.Enable binary logging and set a suitable binlog retention period
D.Enable automated backups only
AnswerC

PITR uses binlogs to replay transactions after the last full backup.

Why this answer

PITR for Cloud SQL MySQL requires binary log (binlog) retention to be set appropriately.

Full explanation →
421
MCQhard

A Cloud Spanner instance is experiencing high read latency. The instance has a single regional configuration. Monitoring shows high-priority CPU utilization is above 90%. What should the engineer do to reduce latency?

A.Change the instance configuration to a multi-region setup
B.Increase the number of processing units
C.Reduce the number of indexes
D.Decrease the number of nodes to reduce contention
AnswerB

Adding compute capacity reduces CPU saturation and latency.

Why this answer

High-priority CPU utilization above 90% indicates that the instance's compute resources are saturated, causing queuing and increased read latency. Increasing the number of processing units (or nodes) adds more CPU capacity, allowing the instance to handle more concurrent reads and reducing latency. This directly addresses the root cause of resource contention.

Exam trap

The trap here is that candidates may confuse high CPU utilization with a need for geographic distribution (multi-region) or think reducing indexes will lower CPU load, when in fact the correct action is to scale compute capacity by increasing processing units or nodes.

How to eliminate wrong answers

Option A is wrong because changing to a multi-region configuration adds replication and geographic distribution, which can increase write latency and does not directly resolve high CPU utilization; it may even worsen read latency due to cross-region consistency overhead. Option C is wrong because reducing indexes can lower write amplification and storage overhead, but it does not address the immediate CPU bottleneck for reads; indexes are typically used to speed up reads, and removing them could increase read latency. Option D is wrong because decreasing the number of nodes reduces total CPU capacity, which would increase CPU utilization and contention, making latency worse.

Full explanation →
422
MCQeasy

A developer needs to test a Cloud Function locally before deploying. Which tool should they use?

A.Docker container with a custom entrypoint.
B.gcloud functions call command.
C.Cloud Code for VS Code or IntelliJ.
D.Functions Framework for your language.
AnswerD

Functions Framework provides a local server for testing Cloud Functions.

Why this answer

The Functions Framework is the correct tool because it is an open-source library that allows you to run Cloud Functions locally on your machine, emulating the Cloud Functions runtime environment. This enables you to test your function's behavior, including HTTP triggers and event handling, without deploying to Google Cloud. Option D is correct because the Functions Framework is specifically designed for local development and testing of Cloud Functions.

Exam trap

The trap here is that candidates often confuse the 'gcloud functions call' command (which is for remote invocation) with a local testing tool, or they assume that Cloud Code is the standalone tool rather than recognizing that it depends on the Functions Framework for local execution.

How to eliminate wrong answers

Option A is wrong because using a Docker container with a custom entrypoint is an overly complex and non-standard approach; while you could theoretically run a function in a container, the Functions Framework provides a simpler, purpose-built solution that directly emulates the Cloud Functions environment. Option B is wrong because the 'gcloud functions call' command is used to invoke a deployed Cloud Function remotely, not to test locally; it requires the function to already be deployed in the cloud. Option C is wrong because Cloud Code for VS Code or IntelliJ is an IDE extension that provides tools for developing and deploying Cloud Functions, but it relies on the Functions Framework under the hood for local testing; the question asks for the specific tool to use, and the Functions Framework is the core component.

Full explanation →
423
MCQmedium

A company needs to run a PostgreSQL-compatible database with 4x faster OLTP performance than standard PostgreSQL, and also wants to run analytical queries on the same data without extracting to a separate system. Which Google Cloud database should they choose?

A.Cloud Spanner
B.Cloud SQL for PostgreSQL
C.AlloyDB
D.BigQuery
AnswerC

AlloyDB provides 4x faster OLTP, PostgreSQL compatibility, and in-database analytics.

Why this answer

AlloyDB is a PostgreSQL-compatible database that delivers up to 4x faster OLTP performance than standard PostgreSQL through a combination of a columnar engine, adaptive indexing, and a disaggregated storage architecture. It also supports running analytical queries on the same data without extraction, using its built-in columnar engine for fast analytics on transactional data.

Exam trap

The trap here is that candidates may confuse Cloud SQL for PostgreSQL as the obvious choice for PostgreSQL compatibility, overlooking the specific performance requirement of 4x faster OLTP and the need for built-in analytical capabilities, which only AlloyDB satisfies.

How to eliminate wrong answers

Option A is wrong because Cloud Spanner is a globally distributed, strongly consistent relational database designed for horizontal scaling across regions, but it is not PostgreSQL-compatible and does not offer the specific 4x OLTP performance boost over PostgreSQL. Option B is wrong because Cloud SQL for PostgreSQL is a fully managed PostgreSQL service that provides standard PostgreSQL performance, not the 4x faster OLTP performance required, and it lacks a built-in columnar engine for running analytical queries on the same data without extraction. Option D is wrong because BigQuery is a serverless data warehouse designed for analytical queries, not OLTP workloads, and it is not PostgreSQL-compatible.

Full explanation →
424
Multi-Selecthard

Which THREE are best practices for building applications on GKE? (Choose three.)

Select 3 answers
A.Set resource requests and limits for CPU and memory
B.Use nodeSelector to pin pods to specific node instances for performance consistency
C.Define readiness and liveness probes for your containers
D.Use StatefulSets for all applications to preserve state across restarts
E.Use Google-managed SSL certificates for HTTPS ingress
AnswersA, C, E

Prevents resource starvation and ensures fair scheduling.

Why this answer

Setting resource requests and limits for CPU and memory is a best practice because it allows Kubernetes to make informed scheduling decisions and ensures that pods do not exceed their allocated resources, preventing resource starvation for other workloads. Requests guarantee a minimum amount of resources for the pod, while limits cap the maximum, enabling the cluster autoscaler and scheduler to optimize node utilization and maintain stability.

Exam trap

The PCD exam often tests the misconception that nodeSelector is a best practice for performance consistency, when in fact it reduces scheduling flexibility and is discouraged in favor of node affinity or taints/tolerations for more granular control.

Full explanation →
425
MCQmedium

A company runs a Cloud Spanner instance with 2000 processing units. They notice that the high-priority CPU utilization is consistently above 80% during peak hours. Which action should they take to improve performance?

A.Enable auto-scaling with a high-priority CPU target of 65%
B.Enable read replicas to offload CPU
C.Reduce the number of processing units to save cost
D.Switch to node-based scaling and add 2 nodes
AnswerA

Auto-scaling will add capacity when CPU exceeds the target.

Why this answer

Auto-scaling can adjust processing units based on high-priority CPU target. Manually increasing processing units or nodes also works, but auto-scaling is the recommended approach.

Full explanation →
426
MCQmedium

A company uses Cloud SQL for PostgreSQL and wants to set up point-in-time recovery (PITR) with a recovery window of 7 days. They have automated backups enabled. What additional configuration is required to achieve PITR?

A.Create an on-demand backup every hour for the last 7 days.
B.Set up a cross-region backup copy with a retention of 7 days.
C.Configure the backup retention period to 7 days and ensure automatic backup is enabled.
D.Enable binlog replication on the instance.
AnswerC

Cloud SQL for PostgreSQL PITR uses automated backups and WAL logs retained according to the backup retention setting.

Why this answer

Point-in-time recovery (PITR) in Cloud SQL for PostgreSQL relies on write-ahead log (WAL) archiving, which is automatically enabled when automated backups are turned on. To retain the WAL logs needed to replay transactions to any point within the recovery window, you must set the backup retention period to at least 7 days. Option C correctly combines a 7-day backup retention with automated backups, which is the only additional configuration required beyond the default automated backup setting.

Exam trap

A common pitfall for Google Cloud exams is assuming PITR requires additional features like binlogs or cross-region replication, when in fact for Cloud SQL PostgreSQL, simply configuring the backup retention period to cover the desired recovery window is sufficient.

How to eliminate wrong answers

Option A is wrong because on-demand backups are full snapshots, not incremental logs; they do not provide the continuous transaction log replay needed for PITR, and creating them every hour is unnecessary and costly. Option B is wrong because cross-region backup copies are for disaster recovery and do not affect the retention of WAL logs in the source region; PITR requires local WAL retention, not a replicated copy. Option D is wrong because binlog replication is a MySQL/MariaDB feature; PostgreSQL uses WAL (write-ahead log) for replication and PITR, not binlogs.

Full explanation →
427
MCQeasy

You are designing a global e-commerce application with a product catalog that must be strongly consistent across continents and have 99.999% availability. Transactions must span multiple items and maintain ACID guarantees. Which Google Cloud database should you choose?

A.Cloud Spanner
B.Cloud Bigtable
C.Cloud SQL for PostgreSQL
D.Firestore Native mode
AnswerA

Spanner provides global distribution, strong consistency, and 99.999% SLA.

Why this answer

Cloud Spanner is the only Google Cloud database that offers globally distributed ACID transactions, strong consistency across regions, and a 99.999% SLA. Cloud SQL is regional only, Firestore is eventually consistent across regions, and Bigtable is eventually consistent across clusters.

Full explanation →
428
MCQmedium

A company is building a microservice that processes incoming HTTP requests, performs some business logic, and writes results to Firestore. The service has variable traffic with occasional spikes. The development team wants to minimize cold start latency and prefers to use a containerized application with a custom runtime. Which compute option should they choose?

A.Compute Engine
B.Cloud Run
C.App Engine Standard
D.Cloud Functions (1st gen)
AnswerB

Cloud Run supports containers, autoscaling, and can minimize cold starts via min instances.

Why this answer

Cloud Run is the correct choice because it runs containerized applications in a fully managed, serverless environment that automatically scales to zero and can handle variable traffic with occasional spikes. It minimizes cold start latency by keeping instances warm when traffic is expected, and it supports custom runtimes via Docker containers, meeting the team's requirement for a containerized application with a custom runtime.

Exam trap

The PCD exam often tests the distinction between serverless container services (Cloud Run) and serverless functions (Cloud Functions), where candidates mistakenly choose Cloud Functions for any serverless need, overlooking the requirement for a custom runtime and containerized application.

How to eliminate wrong answers

Option A is wrong because Compute Engine requires manual management of virtual machines, does not automatically scale to zero, and would incur cold start latency from provisioning and booting VMs, making it unsuitable for minimizing cold start latency with variable traffic. Option C is wrong because App Engine Standard uses pre-defined runtimes (e.g., Python, Java, Go) and does not support custom runtimes via containers, which violates the team's preference for a containerized application with a custom runtime. Option D is wrong because Cloud Functions (1st gen) is not containerized; it uses a function-as-a-service model with limited runtime support and does not allow custom runtime configurations via Docker containers, failing the containerized application requirement.

Full explanation →
429
MCQeasy

Your mobile app uses Firestore to store user profiles. You need to restrict access so that users can only read/write their own data. Which Firestore feature should you use?

A.Data Bundles
B.Security Rules
C.Composite indexes
D.IAM roles
AnswerB

Correct: Security Rules allow condition-based access at the document level.

Why this answer

Firestore Security Rules are the correct choice because they allow you to define granular access controls based on user identity. By using the `request.auth.uid` variable in your rules, you can restrict read and write operations to documents where the user's UID matches a field in the document (e.g., `resource.data.user_id == request.auth.uid`), ensuring users can only access their own data.

Exam trap

The Google Cloud exam often tests the distinction between security controls (Security Rules) and performance optimizations (Composite indexes), so the trap here is confusing a feature that speeds up queries with one that enforces access restrictions.

How to eliminate wrong answers

Option A is wrong because Data Bundles are used to package Firestore data for offline or static export, not for access control. Option C is wrong because Composite indexes improve query performance by allowing efficient sorting and filtering on multiple fields, but they do not enforce security or authentication. Option D is wrong because IAM roles manage permissions at the Google Cloud project or resource level (e.g., granting a service account access to Firestore), not for per-user, document-level access control within an app.

Full explanation →
430
MCQmedium

A company runs a stateful microservice that requires read-after-write consistency but can tolerate some latency for writes. They are currently using a single Cloud SQL instance and want to scale read traffic. Which approach should they take?

A.Use Cloud Memorystore to cache reads
B.Shard the database manually
C.Enable Cloud SQL read replicas
D.Use Cloud Bigtable
E.Migrate to Cloud Spanner
AnswerC

Scales read capacity with eventual consistency, good for the described needs.

Why this answer

Cloud SQL read replicas are the correct choice because they provide an asynchronous read-only copy of the primary instance, which can scale read traffic without compromising the read-after-write consistency required by the stateful microservice. The primary instance handles all writes, ensuring strong consistency for writes, while replicas serve stale reads that eventually become consistent, which aligns with the tolerance for write latency.

Exam trap

The PCD exam often tests the misconception that caching (Memorystore) is the default solution for scaling reads, but the trap here is that caching does not guarantee read-after-write consistency, whereas read replicas can be configured to serve stale reads while the primary maintains strong consistency for writes.

How to eliminate wrong answers

Option A is wrong because Cloud Memorystore (Redis/Memcached) caches data in memory, but it does not guarantee read-after-write consistency — a write to Cloud SQL may not be immediately reflected in the cache, leading to stale reads. Option B is wrong because manual sharding distributes data across multiple databases, which complicates consistency guarantees and requires application-level logic to maintain read-after-write consistency, increasing complexity and risk. Option D is wrong because Cloud Bigtable is a NoSQL wide-column store optimized for high-throughput, low-latency analytics, not for transactional workloads requiring strong read-after-write consistency.

Option E is wrong because Cloud Spanner provides strong global consistency and horizontal scaling, but it is overkill for this scenario — it introduces higher cost and complexity when a simpler read replica solution suffices.

Full explanation →
431
MCQhard

Your application uses Cloud Spanner with strong reads, but you are experiencing high latency for read requests. You don't need absolute consistency for every read; stale data up to 5 seconds is acceptable. How can you reduce read latency?

A.Use the read timestamp to read the latest data
B.Use bounded staleness reads with a max staleness of 5 seconds
C.Create a global secondary index on frequently read columns
D.Use DML instead of mutations for writes
AnswerB

This allows reads from replicas without waiting for strong consistency, reducing latency.

Why this answer

Using bounded staleness allows reads to be served from replicas that may be slightly stale (up to 5 seconds), reducing latency. Read timestamps and DML are not relevant, and global indexes would not help.

Full explanation →
432
MCQeasy

A mobile app needs to store user preferences and allow offline read-write sync when the device reconnects. The data is simple key-value pairs. Which Google Cloud database is MOST suitable?

A.Firestore
B.Memorystore for Redis
C.Cloud Bigtable
D.Cloud SQL
AnswerA

Firestore provides offline persistence and automatic synchronization for mobile apps.

Why this answer

Firestore provides offline persistence and automatic sync, making it ideal for mobile apps. Cloud SQL does not have built-in offline sync. Bigtable is not designed for mobile clients.

Memorystore is a cache, not a persistent database.

Full explanation →
433
Multi-Selectmedium

A development team is building a containerized application on Google Cloud. They want to implement a CI/CD pipeline that automatically builds and tests their application on every push to the main branch. Which TWO actions should they take to achieve this?

Select 2 answers
A.Configure a Cloud Build trigger to run on push events to the main branch.
B.Add a cloudbuild.yaml file to the repository that defines build steps and tests.
C.Enable Cloud Run for Anthos to automatically deploy after build.
D.Use Cloud Scheduler to trigger a Cloud Build trigger every 5 minutes.
E.Create a Cloud Source Repository and use Cloud Functions to build on push.
AnswersA, B

Cloud Build triggers on push events enable automatic builds and tests.

Why this answer

Cloud Build triggers can be configured to automatically start a build whenever a push event occurs on a specific branch, such as main. This is the standard way to initiate a CI/CD pipeline in response to code changes in Google Cloud.

Exam trap

The trap here is that candidates may confuse deployment targets (like Cloud Run) or time-based schedulers (like Cloud Scheduler) with event-driven CI/CD triggers, missing that only a push-based trigger combined with a build configuration file directly achieves the requirement.

Full explanation →
434
Multi-Selecteasy

A company deploys a containerized application to Cloud Run using Cloud Build. They want to implement a rolling update strategy with zero downtime. Which two actions should they take? (Choose two.)

Select 2 answers
A.Gradually shift traffic to the new revision using the gcloud run services update-traffic command.
B.Create a new Cloud Run service for the new revision.
C.Deploy the new revision with the --no-traffic flag.
D.Set the min-instances attribute to 1 to keep at least one instance running.
E.Use the gcloud run deploy command with the --concurrency flag.
AnswersA, C

Correct. Traffic shifting allows incremental rollout and monitoring.

Why this answer

The `gcloud run services update-traffic` command allows you to gradually shift traffic from the current revision to a new revision, enabling a rolling update with zero downtime. This command supports percentage-based traffic splitting, which ensures that the new revision is incrementally exposed to users while the old revision remains active, thus maintaining service availability throughout the deployment.

Exam trap

The PCD exam often tests the misconception that `min-instances` or `--concurrency` flags are involved in traffic management or rolling updates, when in fact they only control instance lifecycle and concurrency limits, not traffic routing.

Full explanation →
435
MCQmedium

A company is migrating from Redshift to BigQuery. They have large datasets in Amazon S3. What is the recommended approach to transfer this data into BigQuery?

A.Use Cloud Dataflow to read from S3 and write to BigQuery.
B.Copy data from S3 to GCS using Storage Transfer Service, then load into BigQuery.
C.Use Database Migration Service with Redshift endpoint.
D.Use BigQuery Data Transfer Service for Redshift.
AnswerD

This service can transfer data from Redshift to BigQuery by first unloading to S3.

Why this answer

The typical approach is to use BigQuery Data Transfer Service for Redshift (which can unload to S3 and then load into BigQuery), or manually export from Redshift to S3, transfer to GCS, and load into BigQuery. But the question specifies S3 as intermediate; using Transfer Service for Redshift is the managed option.

Full explanation →
436
MCQmedium

A company is migrating a monolithic Java application to microservices on Google Kubernetes Engine (GKE). The application uses a shared MySQL database. The team wants to adopt a testing strategy that validates service interactions without deploying to a full cluster. Which testing approach is most appropriate?

A.Load testing to simulate production traffic.
B.Unit testing with mocked dependencies.
C.Consumer-driven contract testing with tools like Spring Cloud Contract.
D.End-to-end testing in a staging environment.
AnswerC

Contract testing validates that services adhere to agreed-upon contracts without full deployment.

Why this answer

Consumer-driven contract testing (CDC) with tools like Spring Cloud Contract validates the interactions between microservices by defining and verifying API contracts (e.g., request/response formats, headers, status codes) without requiring a full GKE cluster. This approach is ideal for a migration from a monolithic Java application because it ensures that each service adheres to its expected behavior when communicating over HTTP or messaging, catching integration issues early in the development cycle. It does not require deploying to a cluster, making it faster and more lightweight than end-to-end testing.

Exam trap

The PCD exam often tests the distinction between testing levels in a microservices context; the trap here is that candidates confuse 'validating service interactions without a full cluster' with end-to-end testing, but the key constraint is avoiding full deployment, which CDC satisfies by using contract stubs and provider verification in isolated environments.

How to eliminate wrong answers

Option A is wrong because load testing simulates production traffic to measure performance and scalability, not to validate service interactions or contract adherence; it requires a deployed environment and does not verify individual API contracts. Option B is wrong because unit testing with mocked dependencies isolates a single class or method, but it cannot validate real service-to-service interactions, HTTP semantics, or message formats across microservices boundaries. Option D is wrong because end-to-end testing in a staging environment validates the entire system flow but requires a full cluster deployment, which contradicts the requirement to test without deploying to a full cluster.

Full explanation →
437
MCQmedium

A team is performing a shadow writes testing strategy as part of database migration validation. What does this involve?

A.Creating a snapshot of the source database
B.Running comparison queries after migration
C.Duplicating all writes to both source and target databases and comparing
D.Writing test data only to the new database
AnswerC

This is the definition of shadow writes.

Why this answer

Shadow writes involve writing the same data to both the old and new databases simultaneously during the testing phase, then comparing the results to ensure consistency.

Full explanation →
438
MCQeasy

What is the primary benefit of using Cloud Load Balancing with global anycast IP?

A.Provides DDoS protection
B.Supports WebSocket
C.Reduces latency for users worldwide
D.Enables cross-zone failover
AnswerC

Anycast directs traffic to the closest region, minimizing network hops and latency.

Why this answer

Cloud Load Balancing with a global anycast IP directs user traffic to the nearest available backend instance based on network topology and latency. This minimizes the number of network hops and reduces round-trip time, providing lower latency for users worldwide compared to a single-region deployment.

Exam trap

The PCD exam often tests the misconception that global anycast IP is primarily for DDoS protection or that it provides cross-zone failover, when in fact its core benefit is latency reduction via proximity-based routing.

How to eliminate wrong answers

Option A is wrong because while Cloud Load Balancing can absorb some volumetric attacks due to its scale, its primary benefit is not DDoS protection; dedicated services like Cloud Armor or third-party DDoS mitigation are designed for that purpose. Option B is wrong because WebSocket support is a feature of the load balancer's protocol handling (e.g., HTTP/2 or TCP proxy), not a benefit specific to global anycast IP. Option D is wrong because cross-zone failover is a regional capability that ensures high availability within a single region; global anycast IP enables multi-region failover and traffic steering, not cross-zone failover.

Full explanation →
439
MCQeasy

You deployed a new version of your application that uses Cloud Pub/Sub for asynchronous messaging. After deployment, you notice that messages are accumulating in the subscription backlog. You suspect the subscriber is too slow. Which tool should you use to diagnose?

A.Cloud Trace to trace message processing.
B.Cloud Monitoring to check subscriber's processing latency and throughput.
C.Cloud Logging to view subscriber logs.
D.Cloud Profiler to profile subscriber code.
AnswerB

Cloud Monitoring has built-in metrics for Pub/Sub subscriptions, including 'subscriber latency' and 'sent messages count', which can confirm if the subscriber is too slow.

Why this answer

Cloud Monitoring is the correct tool because it provides metrics such as subscriber processing latency, throughput, and backlog size for Pub/Sub subscriptions. By examining these metrics, you can quantify how slow the subscriber is and identify whether the issue is due to high latency or insufficient throughput, directly addressing the suspicion of a slow subscriber.

Exam trap

The PCD exam often tests the distinction between monitoring (metrics) and tracing (request paths) — the trap here is that candidates confuse Cloud Trace's ability to trace individual messages with Cloud Monitoring's ability to aggregate subscriber performance metrics, leading them to pick Cloud Trace instead of Cloud Monitoring.

How to eliminate wrong answers

Option A is wrong because Cloud Trace is designed for distributed tracing of request latency across services, not for monitoring Pub/Sub subscription backlog or subscriber processing metrics. Option C is wrong because Cloud Logging captures log entries from your application, but it does not provide the real-time performance metrics (like processing latency or throughput) needed to diagnose a slow subscriber. Option D is wrong because Cloud Profiler profiles CPU and memory usage of your code, but it does not directly measure Pub/Sub subscriber processing latency or backlog accumulation.

Full explanation →
440
MCQmedium

A financial services company needs a globally distributed database with strong consistency across continents, 99.999% SLA, and support for ACID transactions. They expect millions of transactions per day. Which Google Cloud database should they use?

A.Cloud SQL
B.Cloud Spanner
C.Bigtable
D.Firestore
AnswerB

Cloud Spanner meets all requirements: global distribution, strong consistency, ACID transactions, and 99.999% SLA.

Why this answer

Cloud Spanner is the only Google Cloud database that offers global distribution with strong consistency, ACID transactions, and 99.999% SLA. It is designed for mission-critical workloads that require horizontal scaling and geo-replication.

Full explanation →
441
MCQmedium

You need to create an uptime check for an external HTTPS endpoint and configure an alert that sends a notification if the check fails for 3 consecutive attempts. Which configuration is correct?

A.Create an uptime check with check interval 5 min and alert condition with duration 3 min
B.Create an uptime check with check interval 1 min and alert condition with duration 3 min
C.Create an uptime check with check interval 5 min and alert condition with downtime 15 min
D.Create an uptime check with check interval 1 min and alert condition with duration 1 min
AnswerB

1-minute interval with 3-minute duration means 3 consecutive failures trigger alert.

Why this answer

To trigger an alert after 3 consecutive failures with a 1-minute check interval, the alert condition must have a duration of 3 minutes. This ensures that the alert fires only when the endpoint has been down for three successive checks, matching the requirement exactly.

Exam trap

The PCD exam often tests the distinction between 'duration' (the time window for consecutive failures) and 'downtime' (a different metric), leading candidates to confuse the alert condition parameter name or miscalculate the required duration for a given number of consecutive failures.

How to eliminate wrong answers

Option A is wrong because a 5-minute check interval with a 3-minute duration would only cover part of one check interval, not three consecutive failures; the alert would never trigger correctly. Option C is wrong because a 5-minute check interval with a 15-minute downtime condition would require three consecutive failures (3 × 5 = 15), but the term 'downtime' is not the correct parameter name in Google Cloud Monitoring—the correct term is 'duration'. Option D is wrong because a 1-minute check interval with a 1-minute duration would trigger after only one failure, not three consecutive attempts.

Full explanation →
442
MCQeasy

A company wants to run a batch job every hour that processes files from Cloud Storage. The job takes about 10 minutes. Which serverless option should they use?

A.Cloud Run jobs
B.Cloud Functions with Cloud Scheduler
C.Compute Engine with cron
D.App Engine Cron Service with Cloud Tasks
AnswerB

Cloud Functions triggered by Cloud Scheduler is serverless and simple for periodic tasks.

Why this answer

Cloud Functions triggered by Cloud Scheduler is ideal for periodic, short-lived batch jobs that process files. Cloud Run Jobs is also suitable but less event-driven. Compute Engine requires manual setup.

App Engine Cron Service is possible but more complex.

Full explanation →
443
MCQhard

Your company runs a production App Engine standard environment service (module 'frontend', version 'v2') that handles e-commerce checkout requests. You have set up an alerting policy on a custom metric 'request_latency' that fires when latency exceeds 500ms for 1 minute. Recently, customers have complained about slow checkout times, but no alert has fired. You examine the exhibit: the log entry shows a latency of 0.452s (452ms) for a request to '/api/checkout'. The custom metric is defined from OpenTelemetry instrumentation. What is the most likely reason the alert did not fire?

A.The alert condition uses a threshold on a metric that is not being written because the OpenTelemetry exporter is not configured for the 'frontend' module.
B.The log entry does not contain the required custom metric data because the httpRequest field is not parsed by Cloud Monitoring.
C.The alert threshold is 500ms, and the exhibited request latency is 452ms, which is below the threshold. Individual requests may be below the threshold, so the alert does not fire.
D.The custom metric is only emitted for version 'v1', and the current version is 'v2', so no metric data is available for the alert.
AnswerC

The log shows a single request below threshold; the alert requires exceeding for 1 minute.

Why this answer

The alerting policy is configured to fire when the custom metric 'request_latency' exceeds 500ms for 1 minute. The exhibited log entry shows a latency of 452ms, which is below the 500ms threshold. The alert condition is based on a metric threshold, not individual log entries, and since the metric value remains below the threshold, the alert does not trigger.

Exam trap

The PCD exam often tests the distinction between individual log entries and aggregated metric thresholds, leading candidates to mistakenly assume that any request latency near the threshold should trigger an alert, when in fact the alert condition requires sustained violation over the evaluation window.

How to eliminate wrong answers

Option A is wrong because the OpenTelemetry exporter is correctly configured for the 'frontend' module, as evidenced by the custom metric data being present in the log entry (the latency value of 0.452s is recorded). Option B is wrong because the custom metric is defined from OpenTelemetry instrumentation, not from parsing the httpRequest field; Cloud Monitoring ingests the metric directly via the OpenTelemetry exporter, not by parsing log entries. Option D is wrong because the log entry explicitly shows the request was handled by version 'v2' (the exhibit shows 'module frontend, version v2'), and the custom metric is emitted for the current version, not only for 'v1'.

Full explanation →
444
MCQeasy

Refer to the exhibit. You are reviewing a Cloud Monitoring MQL query. What is the purpose of this query?

A.It displays the raw CPU utilization data points that exceed 90%.
B.It shows the 5-minute average CPU utilization for all instances, then filters out those with average > 90%.
C.It computes the 5-minute average of CPU utilization and then selects instances where any data point exceeded 90%.
D.It filters for instances with CPU utilization > 90% and then computes the 5-minute average.
AnswerD

Filter first, then align, as shown in the query order.

Why this answer

The MQL query uses the `filter` clause to first select only time series where `cpu.utilization` exceeds 90%, and then applies the `avg` aggregation over a 5-minute window. This order of operations ensures that the average is computed only on the filtered data points, not on all instances.

Exam trap

The PCD exam often tests the order of operations in MQL queries, specifically whether the filter or aggregation is applied first, leading candidates to confuse the sequence and misinterpret the query's purpose.

How to eliminate wrong answers

Option A is wrong because the query does not display raw data points; it applies a 5-minute average aggregation. Option B is wrong because it incorrectly suggests that the average is computed first and then filtered, whereas MQL processes the filter before the aggregation. Option C is wrong because it describes selecting instances based on any data point exceeding 90%, but the filter in MQL applies to each data point in the time series, not to instances as a whole.

Full explanation →
445
MCQeasy

A developer needs to build a CI/CD pipeline that automatically tests and deploys a Node.js application to Cloud Run whenever a pull request is merged to the main branch. Which Google Cloud service should be used to trigger the pipeline?

A.Cloud Functions
B.Cloud Deploy
C.Cloud Build
D.App Engine
AnswerC

Cloud Build triggers integrate with source repositories to start builds on events.

Why this answer

Cloud Build is the correct service because it is Google Cloud's fully managed CI/CD platform that can automatically trigger pipeline executions in response to repository events, such as a pull request merge to the main branch. By configuring a Cloud Build trigger with a source repository (e.g., Cloud Source Repositories, GitHub, or Bitbucket), the developer can define build steps to test the Node.js application and deploy it to Cloud Run using the `gcloud run deploy` command or a dedicated builder. This makes Cloud Build the native and most direct choice for building, testing, and deploying to Cloud Run in a single automated pipeline.

Exam trap

The trap here is that candidates may confuse Cloud Deploy (a delivery-only service) with a full CI/CD pipeline, overlooking that Cloud Build is the service that actually performs the build, test, and deployment steps triggered by repository events.

How to eliminate wrong answers

Option A is wrong because Cloud Functions is a serverless compute service for running event-driven code, not a CI/CD pipeline orchestrator; it lacks native support for multi-step build, test, and deploy workflows triggered by repository merge events. Option B is wrong because Cloud Deploy is a continuous delivery service focused on managing rollout strategies (e.g., canary, blue/green) to targets like GKE or Cloud Run, but it does not perform the build or test phases and requires a separate CI system (like Cloud Build) to produce artifacts. Option D is wrong because App Engine is a fully managed platform for hosting applications, not a CI/CD pipeline service; it cannot trigger builds or tests based on repository events.

Full explanation →
446
MCQeasy

A company uses Cloud Logging to store application logs. They need to keep logs for 3 years for compliance. What is the most cost-effective way to store logs for this duration?

A.Use Cloud Logging's default retention
B.Create a sink to export logs to Pub/Sub
C.Create a sink to export logs to Cloud Storage with object lifecycle rules
D.Create a sink to export logs to BigQuery
AnswerC

Cloud Storage with lifecycle rules allows cost-effective long-term storage.

Why this answer

Cloud Logging's default retention is limited (e.g., 30 days for logs, with some exceptions up to 400 days), so it cannot meet a 3-year compliance requirement. Exporting logs to Cloud Storage and applying object lifecycle rules allows you to automatically transition objects to lower-cost storage classes (e.g., from Standard to Nearline, Coldline, or Archive) and delete them after the retention period, minimizing cost while meeting the 3-year retention need.

Exam trap

The PCD exam often tests the misconception that Cloud Logging's default retention can be extended indefinitely or that exporting to BigQuery is always the best for analytics, but the trap here is that long-term compliance storage requires a cost-optimized archival solution like Cloud Storage with lifecycle rules, not a query-optimized or streaming service.

How to eliminate wrong answers

Option A is wrong because Cloud Logging's default retention is typically 30 days (or up to 400 days for some log types), far short of the required 3 years, and cannot be extended to that duration without exporting. Option B is wrong because exporting to Pub/Sub is designed for real-time streaming and processing, not for long-term archival storage; Pub/Sub messages have a maximum retention of 7 days and are not cost-effective for 3-year retention. Option D is wrong because BigQuery is optimized for analytics and querying, not for long-term archival storage; storing logs in BigQuery for 3 years would incur significant storage and query costs, making it less cost-effective than Cloud Storage with lifecycle rules.

Full explanation →
447
Multi-Selectmedium

A company is migrating a MySQL OLTP database to Cloud SQL. The database has a peak of 10,000 read queries per second (QPS) and 2,000 write QPS. The team wants to reduce read latency and offload read traffic from the primary instance. Which TWO actions should they take? (Choose TWO.)

Select 2 answers
A.Enable automatic storage increase on the primary
B.Create cross-region read replicas for geographic load balancing
C.Create Cloud SQL read replicas in the same region
D.Implement Memorystore for Redis to cache frequent read results
E.Increase the machine type of the primary instance
AnswersC, D

Read replicas serve read traffic, reducing load on the primary and decreasing read latency.

Why this answer

Cloud SQL supports read replicas (up to 10) that can serve read traffic, offloading the primary. Cross-region replicas increase latency. Using a Memorystore cache reduces repeated reads.

Increasing primary machine type does not offload reads; it just scales the primary. Enabling automatic storage increase is for storage, not read performance.

Full explanation →
448
MCQmedium

A team is designing a Cloud Spanner schema for a hierarchical product catalog with categories and products. They want to ensure that products are stored in the same split as their parent category for low-latency queries. Which feature should they use?

A.Use a composite primary key with category ID as the first part, but no interleaving
B.Use Cloud Spanner's commit timestamp feature
C.Use interleaved tables with the products table interleaved in the categories table
D.Define a global secondary index on the category ID
AnswerC

Interleaving stores child rows with parent rows in the same split, improving locality.

Why this answer

Cloud Spanner interleaved tables allow storing child rows (products) with their parent row (category) in the same split, providing low-latency joins and locality. The parent-child relationship is defined using the `INTERLEAVE IN PARENT` clause.

Full explanation →
449
MCQmedium

A company is migrating an on-premises PostgreSQL database to Cloud SQL for PostgreSQL using Database Migration Service (DMS). They need to minimize downtime during the cutover. What should they do to achieve a zero-downtime cutover?

A.Create a continuous migration job, let it replicate changes, then promote the Cloud SQL replica to primary.
B.Set up VPC peering between on-premises and Cloud SQL, then use pg_dump and pg_restore.
C.Use Cloud SQL Auth Proxy to connect and manually copy data using a script.
D.Create a one-time migration job and stop the source database during the migration.
AnswerA

Continuous migration with CDC allows near-zero downtime cutover by promoting the replica.

Why this answer

Database Migration Service (DMS) supports continuous migration jobs that use PostgreSQL logical replication to keep the Cloud SQL replica synchronized with the on-premises source. When you are ready to cut over, you promote the Cloud SQL replica to a standalone primary, which applies any remaining changes and makes the database available with minimal downtime — typically only seconds for the final replication lag to clear.

Exam trap

A common trap is assuming that any migration method involving a 'replica' automatically guarantees zero downtime without understanding that only continuous replication with promotion achieves that goal.

How to eliminate wrong answers

Option B is wrong because VPC peering alone does not enable zero-downtime migration; pg_dump and pg_restore are offline, bulk-copy methods that require the source database to be read-only or stopped during the dump, causing significant downtime. Option C is wrong because Cloud SQL Auth Proxy is an authentication proxy for secure connections, not a replication tool; manually copying data with a script is a batch operation that cannot achieve near-zero downtime as it lacks continuous change capture. Option D is wrong because a one-time migration job performs a full snapshot copy and does not replicate ongoing changes; stopping the source database during migration guarantees downtime equal to the migration duration.

Full explanation →
450
Multi-Selectmedium

A team is using Firestore for a mobile application. They need to write security rules that allow users to read and write only their own documents. The documents have a field 'ownerId' that matches the user's UID. Which THREE rule components should they use? (Choose 3.)

Select 3 answers
A.Use resource.data to access the document's fields.
B.Use request.resource to validate incoming data during writes.
C.Write a rule that allows read if request.auth.uid == resource.data.ownerId.
D.Use the exists() function to check if the ownerId field exists.
E.Use request.auth to verify user identity.
AnswersA, B, E

Correct. resource.data gives access to the current document's fields, such as 'ownerId'.

Why this answer

The three core components for Firestore security rules that allow users to read/write only their own documents are: (A) resource.data to access document fields, (B) request.resource to validate incoming write data, and (E) request.auth to verify the user's identity. Option C is a complete rule that combines A and E, not a separate component. Option D is incorrect because exists() checks document existence, not field matching.

Exam trap

This question asks for 'rule components' (building blocks), not complete rule statements. Option C is a complete rule, not a component.

Full explanation →
Page 5

Page 6 of 13

Page 7

All pages

12345678910111213

Practice PCD by domain

Target a specific domain to shore up weak areas.

Designing highly scalable, available, and reliable cloud-native applicationsBuilding and testing applicationsDeploying applicationsIntegrating Google Cloud services
See all domains with question counts →