Knowledge + Practice

Google Professional Cloud Developer (PCD) — Questions 451–525

964 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 7 of 13

451

Multi-Selecteasy

Which TWO are benefits of using Cloud Build for your CI/CD pipeline?

Select 2 answers

A.Built-in integration with Cloud Source Repositories, GitHub, and Bitbucket.

B.Provides unlimited free build minutes per day.

C.Supports only Java and Python.

D.Fully managed build service.

E.Requires manual setup for all test runners.

AnswersA, D

Seamless source code connectivity.

Why this answer

Cloud Build natively integrates with Cloud Source Repositories, GitHub, and Bitbucket, allowing you to automatically trigger builds on code commits without additional configuration. This tight integration streamlines the CI/CD pipeline by eliminating the need for external webhook management or custom connectors.

Exam trap

The PCD exam often tests the misconception that Cloud Build is limited to specific languages or requires manual setup, when in fact it is a fully managed, polyglot service with automated triggers and no manual test runner configuration needed.

Full explanation →

452

Multi-Selecteasy

A company is designing a polyglot persistence architecture for a social media platform. They need to store user profiles (relational), posts (document), and activity logs (time-series). Which THREE Google Cloud databases should they choose for these respective workloads?

Select 3 answers

A.Cloud SQL

B.Cloud Storage

C.Cloud Bigtable

D.Memorystore

E.Firestore

AnswersA, C, E

Cloud SQL is a relational database suitable for user profiles with ACID transactions.

Why this answer

Cloud SQL (or Spanner) for relational user profiles, Firestore for document posts, and Bigtable for time-series activity logs. Memorystore is a cache, not persistent. Cloud Storage is object storage.

Full explanation →

453

Multi-Selecthard

A team is building a serverless event-driven application using Cloud Functions and Cloud Pub/Sub. The function processes messages from a Pub/Sub subscription and writes results to Firestore. During peak hours, the function experiences high latency and some messages are being retried multiple times. Which three steps should the team take to improve reliability and scalability? (Choose three.)

Select 3 answers

A.Enable retry policy on the Pub/Sub subscription to automatically retry failed messages.

B.Batch multiple Pub/Sub messages into a single Cloud Function invocation.

C.Configure the Cloud Function with a min instance count and increase max instances.

D.Increase the Cloud Function timeout to the maximum allowed value.

E.Set a longer acknowledgement deadline for the subscription to allow more processing time.

AnswersA, C, E

Retry policy ensures messages are not lost and are retried until successful.

Why this answer

Enabling a retry policy on the Pub/Sub subscription ensures that messages that fail to be processed (e.g., due to transient errors or timeouts) are automatically retried. This prevents message loss and improves reliability by allowing the Cloud Function to reprocess messages without manual intervention. The retry policy works with the subscription's acknowledgement deadline, so messages are redelivered if not acknowledged in time.

Exam trap

The PCD exam often tests the misconception that increasing timeout or batching messages are universal fixes for latency, when in fact serverless scaling and proper acknowledgement handling are the correct levers for reliability and scalability.

Full explanation →

454

MCQhard

A company serves static content (images, CSS) through a Cloud Load Balancer with Cloud CDN enabled. They release a new version of the website with updated image assets. After deployment, users still see old images, even though the new image files are served from the backend. The team has already invalidated the cache for the directory containing the images using the Cloud CDN invalidation feature with a specific path. However, the old images persist. What is the most effective additional step to ensure users see the new images?

A.Set the cache TTL for the image directory to 0 seconds.

B.Use a wildcard in the Cloud CDN invalidation path (e.g., /images/*).

C.Change the load balancer cache mode to 'FORCE_CACHE_ALL'.

D.Configure cache key parameters to ignore query strings.

AnswerB

A wildcard ensures all objects under /images/ are invalidated, even if URLs have query parameters or other variations.

Why this answer

Cloud CDN cache invalidation requires exact path matching unless a wildcard is used. The team invalidated a specific path but likely missed the exact paths of the cached image files. Using a wildcard like `/images/*` ensures all objects under the `/images/` directory are invalidated, forcing the CDN to fetch the updated images from the backend.

Exam trap

The PCD exam often tests the nuance that Cloud CDN invalidation requires exact paths or wildcards, and candidates mistakenly think that invalidating a directory path (without a wildcard) will clear all files within it.

How to eliminate wrong answers

Option A is wrong because setting the cache TTL to 0 seconds would require reconfiguring the backend and waiting for the TTL to expire, which is not immediate and does not address the existing cached content; it only affects future caching behavior. Option C is wrong because 'FORCE_CACHE_ALL' mode forces all responses to be cached regardless of Cache-Control headers, which would worsen the problem by caching the old images even more aggressively. Option D is wrong because ignoring query strings in cache keys would not help clear existing cached entries; it only changes how new cache keys are generated and could actually cause the old cached images to persist if query strings were previously used to differentiate versions.

Full explanation →

455

Multi-Selecthard

A company is migrating a SQL Server database to Cloud SQL for SQL Server using Database Migration Service (DMS). They have created a continuous migration job with CDC. They need to test the migrated data before promotion without affecting the source. Which TWO actions should they take? (Choose 2 options.)

Select 2 answers

A.Use a separate DMS job to a different Cloud SQL instance for testing

B.Create a clone of the Cloud SQL instance (from the DMS target) and test on the clone

C.Stop the DMS job, test on the target, then resume

D.Test directly on the DMS target instance without promotion; changes won't affect source

E.Promote the DMS job to make the Cloud SQL instance the primary, then re-create the job for production

AnswersA, B

This keeps the production migration untouched.

Why this answer

Correct options: A and B. To test the migrated data without affecting the source database, you should either (A) use a separate DMS job to a different Cloud SQL instance specifically for testing, or (B) create a clone of the DMS target Cloud SQL instance and perform testing on that clone. Both approaches ensure the source remains unaffected.

Option C is incorrect because stopping the DMS job would halt CDC and require re-synchronization. Option D is incorrect because testing directly on the DMS target instance could lead to data inconsistencies and is not recommended. Option E is incorrect because promoting the DMS job would make the target the primary, breaking the migration job and affecting the source.

Full explanation →

456

Multi-Selecthard

A company is migrating an on-premises PostgreSQL database to Cloud SQL. They need to ensure high availability and minimize downtime during maintenance. They also want to enable IAM database authentication for enhanced security. Which three actions should they take? (Choose three.)

Select 3 answers

A.Create a Cloud SQL for PostgreSQL instance with regional HA configuration

B.Use Cloud SQL Auth Proxy for all connections

C.Grant the cloudsql.iamUser role to each user

D.Set the cloudsql.iam_authentication flag to 'on'

E.Create a cross-region read replica for failover

AnswersA, C, D

Regional HA provides automatic failover and zone redundancy.

Why this answer

Creating a Cloud SQL for PostgreSQL instance with regional HA configuration uses synchronous replication across two zones within the same region, providing automatic failover with minimal downtime. This ensures high availability and meets the requirement to minimize downtime during maintenance, as the standby instance takes over with no data loss.

Exam trap

Google Cloud exams often test the distinction between high availability (regional HA with synchronous replication) and disaster recovery (cross-region replicas with asynchronous replication), leading candidates to incorrectly choose cross-region replicas for minimizing maintenance downtime.

Full explanation →

457

MCQmedium

A team runs a microservice on Compute Engine behind a regional external HTTP load balancer. They want to automatically replace unhealthy instances without manual intervention. Which feature should they use?

A.Unmanaged instance group with health check

B.Instance template with manual replacement

C.Load balancer backend service health check only

D.Managed instance group with autoscaling and health check

AnswerD

Managed instance groups support autohealing, which automatically recreates instances based on health check results.

Why this answer

A managed instance group (MIG) with autoscaling and a health check is the correct choice because it automatically replaces unhealthy instances based on the health check results. The MIG uses the health check to detect failed instances, then automatically recreates them from the instance template, ensuring high availability without manual intervention. Autoscaling further adjusts the number of instances based on load, but the core replacement mechanism is driven by the MIG's health check and autohealing feature.

Exam trap

The trap here is that candidates often confuse the load balancer's health check (which only affects traffic routing) with the managed instance group's health check (which triggers automatic instance replacement), leading them to choose option C instead of D.

How to eliminate wrong answers

Option A is wrong because an unmanaged instance group does not support automatic replacement of unhealthy instances; it requires manual intervention to remove and add instances. Option B is wrong because an instance template is a configuration resource, not a mechanism for automatic replacement; it defines the VM configuration but does not provide any health-check-driven autohealing. Option C is wrong because a load balancer backend service health check alone only marks instances as unhealthy for traffic routing; it does not trigger instance replacement, which requires a managed instance group with autohealing.

Full explanation →

458

MCQmedium

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

A.Configure Cloud Run to only accept revisions from a specific source repository.

B.Use IAM conditions on the Cloud Run service account to allow only main branch builds.

C.Use Cloud Build triggers with a branch filter set to ^main$.

D.Create a separate Cloud Build trigger for each branch and manually disable non-main triggers.

AnswerC

Branch filters in triggers exactly match this requirement.

Why this answer

Cloud Build triggers support branch filters to control which branches trigger builds. By setting the branch filter to ^main$, only commits to the main branch will initiate the build and subsequent deployment to Cloud Run. Option A is wrong because Cloud Run does not filter revisions by source repository; it deploys whatever image is pushed.

Option B is wrong because IAM conditions control who can perform actions, not which branch triggered a build. Option D is wrong because it requires manual management and is error-prone; Cloud Build automatically handles branch filtering.

Full explanation →

459

MCQmedium

An organization has data in Amazon S3 that they want to query from BigQuery without moving it. Which BigQuery feature should they use?

A.Cloud Storage transfer service to copy data to GCS first

B.BigQuery federated queries with AWS Glue

C.BigQuery Omni

D.Bigtable federation

AnswerC

BigQuery Omni enables cross-cloud queries on AWS and Azure.

Why this answer

BigQuery Omni allows querying data across clouds, including Amazon S3, without moving the data.

Full explanation →

460

Multi-Selecthard

An organization uses Cloud Spanner in a multi-region configuration. They want to monitor performance and identify potential bottlenecks. Which three metrics should they review? (Choose three.)

Select 3 answers

A.Read and write latency

B.Processing units utilization

C.Disk bytes used

D.Rows deleted by deletes

E.High-priority CPU utilization

AnswersA, B, E

Latency is a key performance indicator.

Why this answer

Processing units utilization indicates capacity, read/write latency measures performance, and high-priority CPU target helps identify contention. Rows deleted is not a performance metric.

Full explanation →

461

Multi-Selectmedium

A team is setting up a CI/CD pipeline using Cloud Build for a Node.js application. They want to ensure that only code from the main branch is deployed to production. Which TWO practices should they implement?

Select 2 answers

A.Store secrets in Cloud Build and use them in build steps.

B.Use Cloud Build substitutions to inject environment variables.

C.Use branch triggers to run tests only on push to main.

D.Use Cloud Build's inverted match with branch pattern to exclude non-main branches.

E.Use a manual approval step in Cloud Deploy before promoting to production.

AnswersC, E

This ensures the pipeline only executes when changes are made to the main branch.

Why this answer

Using a branch trigger that runs only on push to main ensures that only main branch code triggers the pipeline. Adding a manual approval step in Cloud Deploy before promoting to production adds a gate to prevent automatic deployment of untested code. Storing secrets or using substitutions are good practices but do not specifically restrict deployment to the main branch.

Full explanation →

462

MCQhard

A team is designing a data pipeline that uses Cloud Storage for input files, Cloud Functions to process each file, and writes results to BigQuery. The pipeline must guarantee exactly-once processing of each file, even if the function fails and retries. Which approach should the team take?

A.Use Cloud Storage triggers with event filters and configure the function to delete the file after successful processing

B.Use Cloud Pub/Sub to store file notification events and use Dataflow for processing with exactly-once guarantees

C.Use Cloud Tasks to queue file processing tasks and configure retries with deduplication

D.Use Cloud Workflows to orchestrate the pipeline and use idempotent writes to BigQuery

AnswerB

Dataflow provides exactly-once processing semantics when used with Pub/Sub.

Why this answer

Using Cloud Pub/Sub to store file notification events and Dataflow for processing provides exactly-once guarantees. Option A may lead to duplicates because Cloud Storage triggers are at-least-once. Option C with Cloud Tasks can deduplicate tasks but processing may still be at-least-once if not idempotent.

Option D with Cloud Workflows does not inherently provide exactly-once.

Full explanation →

463

MCQeasy

A company is migrating a monolithic Java application to Cloud Run. The application takes 10 minutes to start. What is the best deployment approach?

A.Migrate to App Engine Flexible Environment.

B.Use a custom runtime with a cold start optimization.

C.Optimize the Java application to start within 10 minutes and use startup CPU boost.

D.Increase the memory limit to 4 GB.

AnswerC

Cloud Run allows up to 10 minutes for startup; CPU boost helps.

Why this answer

Cloud Run allows a maximum container startup time of 10 minutes (600 seconds) by default, and the startup CPU boost feature temporarily allocates additional CPU during startup to accelerate initialization. By optimizing the application to start within this limit and enabling startup CPU boost, the company can directly address the cold start issue without changing the deployment platform or architecture.

Exam trap

The PCD exam often tests the misconception that increasing memory or changing platforms can fix startup time issues, when the real solution is to optimize the application startup within the platform's constraints and use built-in features like startup CPU boost.

How to eliminate wrong answers

Option A is wrong because migrating to App Engine Flexible Environment does not solve the startup time problem; it simply moves the monolithic app to another platform that also has its own startup constraints and does not inherently improve cold start performance. Option B is wrong because using a custom runtime with cold start optimization is not a standard Cloud Run feature; Cloud Run uses container images and does not offer a 'custom runtime' concept for cold start — the optimization must happen within the container itself. Option D is wrong because increasing the memory limit to 4 GB does not reduce startup time; memory allocation affects runtime performance but does not accelerate the initialization phase, which is CPU-bound.

Full explanation →

464

Multi-Selecthard

A DevOps team is troubleshooting high latency in a Cloud Bigtable instance. They notice that the row keys are lexicographically sorted timestamps. Which TWO actions will MOST improve performance? (Select 2 answers)

Select 2 answers

A.Add more Bigtable nodes

B.Increase the number of column families

C.Enable compression on column families

D.Use salt (hash prefix) in the row key

E.Redesign the row key to include a field promotion (e.g., user ID) before the timestamp

AnswersD, E

Randomizes row key distribution, reducing hotspots.

Why this answer

Adding a field promotion (e.g., user ID) to the row key distributes writes. Salting the row key with a hash prefix also distributes load. Adding nodes helps throughput but not the root cause.

Full explanation →

465

Drag & Dropmedium

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Deploying to GKE requires creating a cluster, authenticating, then applying manifests and exposing the service.

Full explanation →

466

MCQmedium

A team uses Cloud Build to build a Go application and deploy it to Cloud Run. The build triggers from a GitHub repository. The team wants to ensure that only commits to the 'main' branch trigger a production deployment, while other branches trigger a build but not a deployment. How should they configure this?

A.Configure the GitHub repository to only send push events from the main branch to Cloud Build.

B.Use a conditional step in cloudbuild.yaml that checks the $_BRANCH variable and skips deployment if not main.

C.Use a single Cloud Build trigger with a substitution variable for the branch name, and include a conditional step that runs deployment only when the variable equals 'main'.

D.Create two separate Cloud Build triggers: one for main branch with deployment step, and one for all branches without deployment step.

AnswerC

Use $BRANCH_NAME and condition in build config.

Why this answer

Cloud Build provides the predefined substitution variable $BRANCH_NAME, which automatically receives the branch name from the trigger event. By using a conditional step in cloudbuild.yaml that checks if $BRANCH_NAME equals 'main', you can run the deployment step only for main branch commits, while still building on all branches. This approach keeps a single trigger and avoids unnecessary duplication or external filtering.

Exam trap

The PCD exam often tests the distinction between using a single trigger with conditional logic versus multiple triggers. Candidates may incorrectly assume that multiple triggers are required or that GitHub can filter events at the source, when in fact Cloud Build handles branch filtering through the predefined substitution variable $BRANCH_NAME (not $_BRANCH) and conditional steps.

How to eliminate wrong answers

Option A is wrong because GitHub cannot be configured to send only main branch push events to Cloud Build; Cloud Build triggers receive all push events from the repository, and filtering must be done within Cloud Build or the build config. Option B is wrong because $_BRANCH is a substitution variable, not an environment variable; it is available in Cloud Build but must be used with proper syntax (e.g., if [ "$_BRANCH" = "main" ]), and the option incorrectly refers to it as a variable without specifying the correct conditional logic. Option D is wrong because while two triggers could work, it is not the most efficient or recommended approach; it duplicates configuration and requires manual synchronization, whereas a single trigger with a conditional step is simpler and directly addresses the requirement.

Full explanation →

467

MCQmedium

Your application running on Google Kubernetes Engine (GKE) is experiencing intermittent latency spikes. You have enabled Cloud Monitoring and Cloud Logging. Which approach would be MOST effective to identify the root cause?

A.Increase the number of replicas or switch to a larger machine type.

B.Use Cloud Trace to analyze distributed tracing data for slow requests.

C.Examine CPU and memory utilization metrics in Cloud Monitoring for the GKE cluster.

D.Review recent Cloud Logging entries for error messages.

AnswerB

Tracing reveals per-request latencies and bottlenecks.

Why this answer

Cloud Trace is the most effective tool for identifying intermittent latency spikes because it provides end-to-end distributed tracing, allowing you to pinpoint which specific service or request path is causing the delay. Unlike aggregate metrics or logs, Cloud Trace captures individual request spans and can reveal high-latency operations, such as slow database queries or external API calls, that occur only under certain conditions.

Exam trap

The PCD exam often tests the distinction between aggregate monitoring (metrics, logs) and distributed tracing, trapping candidates who assume that high CPU/memory or error logs are the only indicators of performance issues, when in fact intermittent latency spikes are best diagnosed with trace-level data that shows the exact request path and timing.

How to eliminate wrong answers

Option A is wrong because increasing replicas or switching to a larger machine type is a reactive scaling action that does not identify the root cause of latency spikes; it may mask the issue but not reveal whether the problem is due to a code bottleneck, a slow dependency, or resource contention. Option C is wrong because CPU and memory utilization metrics in Cloud Monitoring show aggregate resource usage, which may not correlate with intermittent latency spikes caused by a specific slow request or a transient external dependency; high latency can occur even when CPU and memory are well within limits. Option D is wrong because reviewing Cloud Logging entries for error messages may miss the root cause if the latency spike is due to a slow but non-error operation (e.g., a database query taking 5 seconds without throwing an error); logs alone lack the timing context and traceability to identify which specific request or service caused the delay.

Full explanation →

468

MCQeasy

An e-commerce company relies on a Compute Engine backend serving content to global users. They notice high latency for users outside the primary region. Which service should they add to reduce latency by caching content at edge locations?

A.Cloud Armor

B.Cloud NAT

C.Cloud CDN

D.Cloud Endpoints

E.Cloud Load Balancing

AnswerC

Caches static content globally near users, reducing latency.

Why this answer

Cloud CDN (Content Delivery Network) uses Google's global edge cache locations to serve cached content closer to users, reducing latency for requests that would otherwise travel to the origin Compute Engine backend in a single region. By caching static or dynamic content at edge nodes, Cloud CDN minimizes round-trip time and offloads traffic from the backend instance.

Exam trap

The PCD exam often tests the distinction between load balancing (which distributes traffic but does not cache) and CDN (which caches at edge locations), leading candidates to mistakenly choose Cloud Load Balancing because they associate it with global performance improvements.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) and DDoS protection service that filters traffic based on security rules, not a caching or content delivery service. Option B is wrong because Cloud NAT provides outbound internet connectivity for private instances via network address translation, it does not cache content or reduce latency for inbound user requests. Option D is wrong because Cloud Endpoints is an API management service that handles authentication, quotas, and monitoring for APIs, not a content caching or edge delivery solution.

Option E is wrong because Cloud Load Balancing distributes traffic across backend instances for high availability and scalability, but it does not cache content at edge locations; it still requires the request to reach the origin region.

Full explanation →

469

MCQeasy

A developer is writing integration tests for a Cloud Function that uses Cloud Firestore. The tests must run in a local environment without incurring costs or affecting production data. What should the developer use?

A.Create a separate GCP project for testing and use its Firestore.

B.Mock the Firestore client library calls.

C.Use the Firestore emulator running locally.

D.Run tests against the production Firestore instance with a test prefix.

AnswerC

Emulator provides local, free, and isolated testing.

Why this answer

The Firestore emulator, part of the Firebase Local Emulator Suite, allows integration tests to run entirely on the local machine without network calls to GCP. This avoids incurring costs and prevents any impact on production data, as all operations are performed against an in-memory Firestore instance that mimics the real service's behavior.

Exam trap

The PCD exam often tests the distinction between unit testing (mocking) and integration testing (using emulators), and the trap here is that candidates may choose mocking (Option B) thinking it is sufficient for integration tests, but mocking cannot validate the actual Firestore behavior like query ordering, transaction atomicity, or security rule enforcement.

How to eliminate wrong answers

Option A is wrong because creating a separate GCP project for testing still incurs costs for Firestore usage (reads, writes, storage) and requires network connectivity, which contradicts the requirement of a local environment without costs. Option B is wrong because mocking the Firestore client library calls would test only the mock's behavior, not the actual integration with Firestore's query, transaction, or security rule logic, thus failing to validate real integration scenarios. Option D is wrong because running tests against the production Firestore instance with a test prefix still incurs costs for every operation and risks data contamination or accidental deletion, even with a prefix, as production data is still accessed over the network.

Full explanation →

470

MCQeasy

A startup wants to use Firestore for a mobile app. They need to restrict access so that users can only read and write their own data. Which Firestore security rule feature should they use?

A.Use Firebase Authentication and enable anonymous sign-in.

B.Set up IAM roles for each user.

C.Use the get() function to retrieve the user's document each time.

D.Use request.auth to get the user's UID and compare it to the document's owner field.

AnswerD

This is the standard way to enforce per-user access.

Why this answer

Firestore security rules use `request.auth` to identify the authenticated user and `resource.data` to access document fields. Combining these allows rules to compare the user ID in the request with the document’s owner field. `get()` and `exists()` are functions for cross-document validation, not for user identity.

Full explanation →

471

MCQhard

A company has a Cloud Run service that uses Cloud SQL. They notice that the number of database connections is increasing over time, causing connection pool exhaustion. They have enabled Cloud Monitoring and see a custom metric for active DB connections. To proactively alert when the connection count exceeds 80% of the maximum pool size (which is 100), which alerting approach is most efficient?

A.Create a metric threshold alert on the custom metric with condition > 80.

B.Create a forecast alert to predict when connections will exceed 80.

C.Create an alert on the Cloud SQL system metric for 'cloudsql.googleapis.com/database/connections/num_failed_reserved'.

D.Create a ratio alert using an MQL query that divides the active connections by the max connections and alerts when > 0.8.

AnswerD

Correct: ratio dynamically adjusts if max changes, and is a best practice.

Why this answer

It creates a ratio alert using MQL to divide the active connections by the maximum pool size (100), triggering when the ratio exceeds 0.8 (80%). This directly measures the utilization of the connection pool, which is the most efficient way to alert on impending exhaustion. It avoids hardcoding a static threshold that would break if the pool size changes, and it uses the custom metric already being monitored.

Exam trap

The PCD exam often tests the distinction between static thresholds and ratio-based alerts, trapping candidates who choose a simple numeric threshold without considering maintainability or the need to normalize against the pool size.

How to eliminate wrong answers

Option A is wrong because a static threshold of >80 does not scale with the maximum pool size; if the pool size changes, the alert threshold must be manually updated, making it less maintainable. Option B is wrong because a forecast alert predicts future values, which is unnecessary here since the condition is a simple threshold on current utilization, and forecasting adds latency and complexity without benefit. Option C is wrong because 'cloudsql.googleapis.com/database/connections/num_failed_reserved' tracks failed reserved connections, not active connections, so it would not alert on the actual connection count approaching the pool limit.

Full explanation →

472

Multi-Selecthard

You are migrating a MySQL application to Cloud SQL. The application uses a read-heavy workload with occasional writes. You need to offload read traffic to replicas and ensure high availability. Which THREE steps should you take? (Choose 3)

Select 3 answers

A.Use MySQL native replication instead of Cloud SQL replication

B.Create read replicas in the same region

C.Create a Cloud SQL HA instance for the primary

D.Configure the application to use the Cloud SQL Proxy for connection pooling

E.Enable cross-region replication for the primary

AnswersB, C, D

Read replicas handle read traffic and can be promoted if needed.

Why this answer

Creating an HA instance provides automatic failover. Adding read replicas offloads read traffic. Enabling the proxy for connection pooling ensures efficient connections.

Full explanation →

473

MCQhard

A development team uses Cloud Build for CI/CD with a monorepo containing multiple microservices. They want to implement a strategy where only the services affected by a commit are built and deployed. Which approach best achieves this?

A.Use a single Cloud Build trigger with a condition to check changed files

B.Use Cloud Functions to detect changes and trigger builds

C.Use a single Cloud Build trigger with a bash script to detect changes

D.Use multiple Cloud Build triggers, one per service, each with a path filter for its directory

AnswerD

This is the recommended pattern: each trigger only activates when files under its path change.

Why this answer

Cloud Build triggers support path filters that allow you to specify which directories or files should initiate a build. By creating one trigger per microservice directory, only the service whose code has changed will be built and deployed, which is the most efficient and native approach for a monorepo with multiple services.

Exam trap

The trap here is that candidates often think a single trigger with conditional logic (Option A or C) is simpler, but they overlook that Cloud Build triggers natively support path-based filtering, which is the most efficient and correct way to achieve per-service selective builds in a monorepo.

How to eliminate wrong answers

Option A is wrong because a single Cloud Build trigger with a condition to check changed files would still require the trigger to fire on every commit, and the condition logic would need to be implemented externally or via a build step, which is less efficient and not the native way to filter per service. Option B is wrong because using Cloud Functions to detect changes and trigger builds adds unnecessary complexity and latency; Cloud Build triggers already have built-in path filtering that achieves the same goal without an extra serverless function. Option C is wrong because a single Cloud Build trigger with a bash script to detect changes would still fire on every commit, and the script would need to parse the commit diff and conditionally skip builds, which is error-prone and wastes trigger invocations and build minutes.

Full explanation →

474

MCQeasy

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

A.BigQuery

B.Cloud Spanner

C.Firestore

D.Cloud Bigtable

AnswerD

Cloud Bigtable’s underlying storage architecture uses a distributed, sorted key-value map with sparse, column-oriented storage, enabling it to sustain millions of reads per second with single-digit millisecond latency on time-series data. Its built-in time-based row-key design directly satisfies the petabyte-scale ingestion and low-latency query constraints by co-locating sequential timestamps for efficient range scans.

Why this answer

Cloud Bigtable is designed for petabyte-scale, low-latency, high-throughput NoSQL storage for time-series, IoT, and financial data.

Full explanation →

475

MCQmedium

A company needs to run hybrid transactional/analytical processing (HTAP) workloads on a PostgreSQL-compatible database. They want to use in-database ML inference and require 4x faster OLTP performance compared to standard PostgreSQL. Which database should they choose?

A.BigQuery

B.Cloud SQL for PostgreSQL

C.AlloyDB for PostgreSQL

D.Cloud Spanner

AnswerC

AlloyDB meets all requirements: PostgreSQL-compatible, columnar engine, ML inference, and faster OLTP.

Why this answer

AlloyDB is PostgreSQL-compatible, offers a columnar engine for fast analytics, supports in-database ML, and claims up to 4x faster OLTP than Cloud SQL PostgreSQL.

Full explanation →

476

MCQhard

A security audit reveals that a service account has been granted excessive permissions. The exhibit shows the IAM policy for a project. Which statement best describes the security issue?

A.The policy is missing an explicit deny for public access.

B.The service account has more permissions than necessary because objectAdmin includes all objectViewer permissions.

C.The service account should have roles/storage.admin instead.

D.The service account has both admin and viewer roles, causing a conflict.

AnswerB

The viewer role is redundant and indicates excessive permissions.

Why this answer

The objectAdmin role (roles/storage.objectAdmin) inherently includes all permissions of the objectViewer role (roles/storage.objectViewer). Granting both roles to the same service account is redundant and indicates over-permissioning. Option A is incorrect because IAM policies are allow-by-default; missing an explicit deny is not the issue here.

Option C is incorrect because roles/storage.admin would be even more permissive than the current set of roles. Option D is incorrect because there is no conflict; IAM roles are additive, not conflicting.

Full explanation →

477

Multi-Selecthard

A company is performing a lift-and-shift migration of an on-premises Oracle database to Cloud SQL for PostgreSQL using DMS with continuous migration. Which THREE prerequisites must be met before starting the migration job?

Select 3 answers

A.Create a source connection profile in DMS.

B.Ensure network connectivity between the source and Cloud SQL (e.g., VPC peering).

C.Install Cloud SQL Auth Proxy on the source server.

D.Enable archivelog mode on the source Oracle database.

E.Convert all NUMBER columns to NUMERIC manually.

AnswersA, B, D

Connection profiles define source and target endpoints.

Why this answer

DMS continuous migration requires archivelog mode for CDC, appropriate network connectivity (VPC peering or proxy), and a connection profile for the source.

Full explanation →

478

Multi-Selectmedium

Which THREE practices should be followed when deploying a containerized application to Cloud Run?

Select 3 answers

A.Avoid writing to the local filesystem for data that must persist across requests.

B.Set a maximum request timeout of 10 minutes to avoid cold starts.

C.Hardcode port 8080 in the container.

D.Design the application to be stateless, storing session data externally (e.g., Firestore).

E.Use Cloud Run's built-in autoscaling to handle traffic bursts.

AnswersA, D, E

Local filesystem is ephemeral; use external storage for persistent data.

Why this answer

Cloud Run instances are ephemeral and the local filesystem is not persisted across requests or instance restarts. Writing to local disk for data that must survive beyond a single request will cause data loss when the instance is recycled, which is a fundamental characteristic of serverless container platforms.

Exam trap

A common trap on the Google Professional Cloud Developer exam is the belief that setting a maximum request timeout to 10 minutes can avoid cold starts in Cloud Run. In reality, cold starts are related to instance lifecycle and can only be mitigated by configuring min instances or using traffic shaping, not by changing the request timeout.

Full explanation →

479

MCQmedium

A company has a legacy monolithic application running on Compute Engine that is being migrated to microservices on GKE. During the migration, they need to maintain performance monitoring across both environments. The legacy application uses Stackdriver Logging and Monitoring agents (now Ops Agent) and exports logs to Cloud Logging. The new microservices are instrumented with OpenTelemetry for traces and metrics. The team wants a unified view of performance across both environments, including distributed traces from the new services and log-based metrics from the legacy app. They also want to correlate logs and traces for troubleshooting. Which solution should they implement?

A.Keep monitoring separate and use separate dashboards for legacy and new.

B.Use a third-party APM tool that supports both environments.

C.Use Cloud Monitoring dashboards and ingest OpenTelemetry metrics into Cloud Monitoring, while using Cloud Logging log-based metrics from legacy app.

D.Rewrite the legacy app to use OpenTelemetry.

AnswerC

This approach unifies metrics and logs from both environments, enabling correlation.

Why this answer

It provides a unified view by ingesting OpenTelemetry metrics into Cloud Monitoring and using Cloud Logging log-based metrics from the legacy app. Cloud Monitoring supports OpenTelemetry metrics via the OpenTelemetry Protocol (OTLP) and can correlate them with log-based metrics from the legacy app, enabling distributed tracing and log correlation in a single dashboard.

Exam trap

The trap here is that candidates may think rewriting the legacy app is necessary for unified monitoring, but Google Cloud's native support for OpenTelemetry and log-based metrics allows integration without code changes.

How to eliminate wrong answers

Option A is wrong because keeping monitoring separate defeats the goal of a unified view and correlation between logs and traces, which is essential for troubleshooting across environments. Option B is wrong because while a third-party APM tool could work, it introduces unnecessary complexity and cost, and the question specifically asks for a solution using existing Google Cloud tools (Cloud Monitoring and Cloud Logging). Option D is wrong because rewriting the legacy app to use OpenTelemetry is a significant engineering effort that may not be feasible or necessary; the legacy app already exports logs via the Ops Agent, which can be used for log-based metrics without modification.

Full explanation →

480

MCQmedium

A financial application requires ACID transactions across multiple rows and tables in a single region with less than 10ms latency and strong consistency. The application must handle up to 10,000 transactions per second. Which database should you use?

A.Cloud SQL

B.Firestore

C.Cloud Spanner

D.Bigtable

AnswerC

Correct: ACID, strong consistency, horizontal scaling, low latency.

Why this answer

Cloud Spanner provides ACID transactions, strong consistency, and horizontal scalability, with latency in the single-digit milliseconds for regional instances. It can handle 10K TPS easily. Cloud SQL is ACID but limited in scaling (read replicas, but not horizontal write scaling).

Firestore is NoSQL with limited transaction scope. Bigtable is not ACID.

Full explanation →

481

Multi-Selecteasy

A developer wants to profile their application's CPU and memory usage to identify performance bottlenecks. Which TWO Google Cloud services should they use?

Select 2 answers

A.Cloud Logging

B.Cloud Debugger

C.Cloud Profiler

D.Cloud Trace

E.Cloud Monitoring

AnswersC, D

Cloud Profiler continuously collects and analyzes CPU and memory usage at the function level, making it ideal for identifying performance bottlenecks.

Why this answer

The two Google Cloud services that a developer should use to profile application CPU and memory usage and identify performance bottlenecks are Cloud Profiler and Cloud Trace. Cloud Profiler (Option C) continuously gathers and analyzes call stacks and resource consumption across your application, pinpointing functions that consume the most CPU and memory. Cloud Trace (Option D) provides distributed tracing to analyze request latency and identify performance bottlenecks in microservices architectures.

Together, they offer a comprehensive view of application performance, with Profiler focusing on resource-intensive code paths and Trace focusing on request-level delays.

Exam trap

A common trap is confusing Cloud Monitoring (which shows VM-level CPU/memory metrics) with Cloud Profiler (application-level function-by-function profiling), leading candidates to select Cloud Monitoring instead of Cloud Profiler. Additionally, candidates may overlook Cloud Trace because it is associated with latency rather than direct CPU/memory profiling, but it is essential for identifying performance bottlenecks in distributed applications.

Full explanation →

482

MCQeasy

What is the first step to resolve this error?

A.Roll back the deployment.

B.Restart the service.

C.Increase memory for the service.

D.Add a null check on line 45.

AnswerD

This directly resolves the NullPointerException.

Why this answer

The error is a NullReferenceException, which occurs when code attempts to access a member of a null object. Adding a null check on line 45 prevents the exception by ensuring the object is not null before use, which is the standard first step in debugging such runtime errors in managed code environments like .NET or Java.

Exam trap

The PCD exam often tests the misconception that infrastructure changes (like restarting or scaling) can fix code-level bugs, tempting candidates to choose operational fixes instead of debugging the actual null reference in the application logic.

How to eliminate wrong answers

Option A is wrong because rolling back the deployment reverts to a previous version but does not fix the underlying null reference issue; the error will reappear if the same code path is executed. Option B is wrong because restarting the service only clears transient state and does not address the root cause of a null object reference in the code. Option C is wrong because increasing memory for the service does not resolve a null reference; memory issues typically cause OutOfMemoryException or performance degradation, not NullReferenceException.

Full explanation →

483

MCQmedium

A company is using Database Migration Service to continuously migrate data from an on-premises PostgreSQL database to Cloud SQL for PostgreSQL. The source database is behind a firewall. Which two steps are required to establish connectivity? (Choose two.)

A.Install Cloud SQL Auth Proxy on the source database server

B.Open firewall ports for DMS public IPs

C.Use Cloud Interconnect

D.Set up VPC peering between the customer's VPC and the Cloud SQL VPC

E.Configure a Cloud VPN tunnel to the source database

AnswerA, D

Auth Proxy creates an encrypted tunnel for DMS to connect to the source.

Why this answer

Cloud SQL Auth Proxy provides a secure way to connect to Cloud SQL from on-premises without requiring a public IP or firewall rules for the Cloud SQL instance. It uses a TLS tunnel to the Cloud SQL instance, which is ideal when the source database is behind a firewall and you need to establish outbound connectivity from the on-premises environment to Cloud SQL. This avoids exposing the Cloud SQL instance to the public internet.

Option D is correct because VPC peering allows the customer's VPC to communicate with the Cloud SQL VPC privately, enabling Database Migration Service to access the Cloud SQL instance without traversing the public internet. This is a common configuration when using private IP for Cloud SQL.

Exam trap

A common pitfall is thinking that DMS requires opening firewall ports for its public IPs or that a VPN tunnel is mandatory, when in fact Cloud SQL Auth Proxy or VPC peering are the correct connectivity methods for Google Cloud.

How to eliminate wrong answers

Option B is wrong because DMS uses Cloud SQL Auth Proxy or a private connectivity method (like VPC peering) to connect to the source database; it does not use public IPs that require opening firewall ports for DMS public IPs. Option C is wrong because Cloud Interconnect is a dedicated, high-bandwidth connection between on-premises and Google Cloud, but it is not a required step for DMS connectivity; DMS can work over a VPN or Cloud SQL Auth Proxy without Cloud Interconnect. Option E is wrong because a Cloud VPN tunnel is used to connect on-premises networks to a VPC, but DMS does not require a VPN tunnel to the source database; it uses Cloud SQL Auth Proxy or VPC peering to reach the Cloud SQL instance, not the source database.

Full explanation →

484

MCQeasy

An engineer needs to create a Cloud SQL MySQL instance that can automatically failover to a standby in a different zone within the same region. Which configuration should be used?

A.Read replica in same zone

B.Regional HA configuration

C.Zonal availability configuration

D.Cross-region failover replica

AnswerB

This creates a synchronous standby in a different zone within the same region, enabling automatic failover under 60 seconds.

Why this answer

Cloud SQL HA configuration creates a primary and a standby instance in different zones within the same region. The standby is synchronously replicated and automatic failover occurs in under 60 seconds. Cross-region failover is not supported; read replicas are for read scaling and DR, not automatic failover.

Zonal availability is a single-zone instance without HA.

Full explanation →

485

MCQeasy

An organization runs a MySQL database on Cloud SQL. They want to ensure that all connections to the database are encrypted. Which action should they take?

A.Set the 'require_ssl' flag on the Cloud SQL instance to 'on'

B.Use the Cloud SQL Auth Proxy

C.Enable IAM database authentication

D.Create the instance with the '--require-ssl' flag

AnswerA

This flag enforces SSL for all connections.

Why this answer

Enabling the 'require_ssl' flag ensures that only SSL/TLS connections are accepted, enforcing encryption for all client connections.

Full explanation →

486

Multi-Selecthard

A team is deploying a critical application on Google Kubernetes Engine (GKE) and needs to ensure high availability and disaster recovery. Which THREE actions should they take?

Select 3 answers

A.Deploy all pods in a single zone for simplicity.

B.Use a regional cluster with control plane replicated across zones.

C.Distribute workloads across multiple zones using node affinity and anti-affinity.

D.Use a zonal cluster to reduce costs.

E.Configure PodDisruptionBudgets to ensure minimum pod availability.

AnswersB, C, E

Regional clusters replicate the control plane across multiple zones, providing high availability.

Why this answer

A regional cluster in GKE replicates the control plane across multiple zones within a region, ensuring that if one zone fails, the control plane remains available. This is essential for high availability and disaster recovery, as it eliminates a single point of failure for cluster management operations.

Exam trap

The PCD exam often tests the misconception that a zonal cluster is sufficient for disaster recovery because it is cheaper, but the trap is that a zonal cluster's control plane is not replicated, making it vulnerable to zonal failures, whereas a regional cluster provides the necessary redundancy for both control plane and workloads.

Full explanation →

487

MCQeasy

A company is migrating a MySQL 5.7 database to Cloud SQL for MySQL 8.0. They use MyISAM tables and utf8 charset. What changes must they make during migration?

A.Convert MyISAM tables to InnoDB and change charset from utf8 to utf8mb4.

B.Convert MyISAM to InnoDB only; utf8 is fine in MySQL 8.0.

C.No changes needed; Cloud SQL automatically converts MyISAM to InnoDB and utf8 to utf8mb4.

D.Change charset to utf8mb4 only; MyISAM is supported in Cloud SQL.

AnswerA

MyISAM is not supported in high availability; InnoDB is required. utf8mb4 supports full Unicode.

Why this answer

MySQL 8.0 defaults to InnoDB, and utf8mb4 is recommended. MyISAM tables should be converted to InnoDB. utf8 in MySQL is an alias for utf8mb3 (3-byte), which cannot store emoji; utf8mb4 (4-byte) is recommended. MySQL 5.7 to 8.0 introduces changes like caching_sha2_password authentication and stricter GROUP BY.

They must convert MyISAM to InnoDB and change charset to utf8mb4.

Full explanation →

488

MCQhard

A company is migrating an on-premises Oracle database to AlloyDB for PostgreSQL. They need to minimize downtime and ensure data consistency. They plan to use Database Migration Service (DMS). Which migration job type and configuration should they use?

A.Use a continuous migration job with CDC only, skipping the initial dump.

B.Use a batch migration job that exports Oracle data to CSV files and loads them into AlloyDB.

C.Use a one-time full dump migration job and then manually import the dump into AlloyDB.

D.Use a continuous migration job that performs an initial full dump followed by CDC replication.

AnswerD

Continuous migration with CDC minimises downtime and ensures consistency.

Why this answer

Database Migration Service (DMS) continuous migration jobs perform an initial full dump to establish a baseline, then use Change Data Capture (CDC) to replicate ongoing changes from the source Oracle database to AlloyDB for PostgreSQL. This approach minimizes downtime by allowing the target to stay synchronized with the source until a cutover, ensuring data consistency without requiring a separate manual import step.

Exam trap

The trap here is that candidates may confuse 'continuous migration' with 'CDC-only' (Option A), not realizing that Google DMS requires an initial full load to establish the baseline before CDC can begin, or they may incorrectly assume a batch or manual import approach (Options B and C) is suitable for minimizing downtime and ensuring consistency.

How to eliminate wrong answers

Option A is wrong because skipping the initial dump means no baseline data is migrated, leaving the target empty; CDC can only replicate changes after a full snapshot, so this would not achieve a working migration. Option B is wrong because batch migration jobs that export to CSV files are not supported by DMS for Oracle-to-AlloyDB migrations; DMS uses native replication protocols (e.g., Oracle LogMiner or XStream) for CDC, not file-based exports, and this approach would introduce significant downtime and inconsistency. Option C is wrong because a one-time full dump migration job lacks CDC replication, meaning any changes made to the source after the dump would be lost, leading to data inconsistency and requiring manual catch-up, which increases downtime.

Full explanation →

489

MCQmedium

A company is running a microservices application on Google Kubernetes Engine (GKE). They have implemented Cloud Monitoring and Cloud Logging, but recently they noticed that the Istio-proxy sidecar logs are missing from Cloud Logging. The application pods are running correctly and the sidecar containers are present. What is the most likely cause of the missing logs?

A.The Istio-proxy logs are being sent to Stackdriver but are filtered by a log sink exclusion.

B.The cluster was not created with the Istio on GKE add-on enabled, so proxy logs are not automatically collected.

C.The Cloud Logging agent is not installed on the cluster nodes.

D.The sidecar container is not configured to output logs to stdout/stderr.

AnswerB

Istio on GKE add-on enables automatic log collection for sidecar proxies.

Why this answer

When using Istio on GKE, the Istio-proxy sidecar logs are automatically collected and sent to Cloud Logging only if the cluster was created with the 'Istio on GKE' add-on enabled. Without this add-on, the sidecar logs are not automatically forwarded, even though the sidecar containers are present and the application pods are running correctly. The add-on configures the necessary logging pipeline for Istio telemetry and logs.

Exam trap

The trap here is that candidates assume all container logs, including sidecar logs, are automatically collected by GKE's default logging, but the exam tests the specific requirement that Istio-proxy logs require the 'Istio on GKE' add-on to be enabled for automatic forwarding to Cloud Logging.

How to eliminate wrong answers

Option A is wrong because a log sink exclusion would apply to all logs matching a filter, but the question states the logs are missing entirely, not that they are filtered out after being collected; also, Istio-proxy logs are not automatically sent to Cloud Logging without the add-on, so an exclusion is not the root cause. Option C is wrong because Cloud Logging on GKE uses the built-in Stackdriver Kubernetes Engine Monitoring integration, not a separate Cloud Logging agent installed on nodes; the agent is not required for GKE clusters. Option D is wrong because Istio-proxy sidecar containers are designed to output logs to stdout/stderr by default, and the question confirms the sidecar containers are present and running correctly, so this is not the issue.

Full explanation →

490

MCQmedium

An organization is migrating from Oracle to Cloud SQL for PostgreSQL using Database Migration Service. The source Oracle database has many stored procedures with PL/SQL. Which tool should be used to automate the conversion of these stored procedures to PL/pgSQL?

A.Cloud SQL Auth Proxy

B.BigQuery Data Transfer Service

C.Database Migration Service with built-in schema converter

D.Ora2Pg

AnswerD

Ora2Pg is the standard tool for Oracle-to-PostgreSQL schema and PL/SQL conversion.

Why this answer

Ora2Pg is an open-source tool that converts Oracle schemas and PL/SQL code to PostgreSQL-compatible format, including stored procedures and functions.

Full explanation →

491

MCQhard

A company is migrating a 5 TB Oracle database to AlloyDB for PostgreSQL. They need to validate the migration with a test replica without impacting the source. After testing, they plan to promote the replica to become the primary. Which migration strategy should they use?

A.Use Ora2Pg to migrate the schema, then perform a manual bulk data export/import

B.Use Database Migration Service to create a continuous migration job with a full dump and CDC, then test the replica and promote it

C.Use Datastream to replicate to AlloyDB, then promote the target

D.Use Cloud Data Fusion to create an ETL pipeline from Oracle to AlloyDB

AnswerB

DMS supports Oracle to AlloyDB migration with continuous sync and promotion.

Why this answer

Database Migration Service (DMS) with a continuous migration job using a full dump and Change Data Capture (CDC) is the correct choice because it allows you to create a fully synchronized test replica of the 5 TB Oracle database in AlloyDB for PostgreSQL without impacting the source. After validating the replica, you can promote it to become the primary with minimal downtime, as CDC ensures near-real-time consistency.

Exam trap

The trap here is that candidates confuse Datastream (a CDC streaming tool) with Database Migration Service, but Datastream cannot perform the initial full dump or promote a replica to primary in AlloyDB, making it unsuitable for this end-to-end migration scenario.

How to eliminate wrong answers

Option A is wrong because Ora2Pg is a schema conversion tool that does not provide continuous replication or CDC, and manual bulk data export/import would require downtime and cannot create a live test replica that can be promoted without re-syncing. Option C is wrong because Datastream is designed for streaming change data capture to BigQuery, Cloud Storage, or Pub/Sub, not for direct replication to AlloyDB, and it lacks the ability to perform a full dump and promote a replica within AlloyDB. Option D is wrong because Cloud Data Fusion is an ETL tool for batch data integration and transformation, not a database migration service; it cannot perform continuous replication with CDC or promote a replica to primary.

Full explanation →

492

MCQmedium

Refer to the exhibit. A Cloud Run service is unable to connect to a Cloud SQL instance. The log entry shows the following. What is the most likely cause?

A.The Cloud Run service account lacks the Cloud SQL Client role.

B.The database user credentials are incorrect.

C.The Cloud SQL instance is in a different region than the Cloud Run service.

D.The Cloud SQL instance has a public IP assigned.

AnswerA

Without the cloudsql.client role, the VPC connector cannot authorize the connection, leading to a connection refused error.

Why this answer

The Cloud Run service needs the Cloud SQL Client role (roles/cloudsql.client) on its service account to authorize connections to Cloud SQL. Without this IAM permission, the connection attempt is denied, resulting in the 'unable to connect' error shown in the log. This is the most common cause of connectivity failures between Cloud Run and Cloud SQL.

Exam trap

The PCD exam often tests the misconception that database credentials (Option B) are the primary cause of Cloud Run-to-Cloud SQL failures, but the actual issue is almost always missing IAM permissions on the service account.

How to eliminate wrong answers

Option B is wrong because incorrect database user credentials would produce an authentication error (e.g., 'Access denied for user') rather than a connection-level failure, and the log entry does not indicate an authentication failure. Option C is wrong because Cloud Run and Cloud SQL can connect across regions using the private IP path or Cloud SQL proxy; region mismatch does not inherently block connectivity. Option D is wrong because a public IP on the Cloud SQL instance does not prevent Cloud Run from connecting — in fact, Cloud Run can connect to public IP instances via the Cloud SQL proxy or authorized networks, and the issue is about IAM permissions, not IP type.

Full explanation →

493

Multi-Selecthard

A company has a Cloud Function that processes events from Cloud Pub/Sub. The function uses HTTP client libraries to call external APIs. The team notices that the function sometimes times out during high traffic. Which THREE actions should they take to improve reliability? (Choose THREE.)

Select 3 answers

A.Increase the allocated memory to 2GB.

B.Use Cloud Tasks to queue the API call invocations and process them asynchronously from the function.

C.Implement retry logic with exponential backoff for external API calls.

D.Increase the Cloud Function timeout to 540 seconds (max).

E.Reduce the maximum number of concurrent function instances.

AnswersB, C, D

Decouples the calling logic, allowing the function to ack messages quickly and process later.

Why this answer

(Use Cloud Tasks to queue the API call invocations and process them asynchronously from the function) is correct because it decouples the external API calls from the function execution, reducing the risk of timeouts during high traffic. Option C (Implement retry logic with exponential backoff for external API calls) is correct to handle transient failures from external APIs gracefully. Option D (Increase the Cloud Function timeout to 540 seconds) is correct to allow the function more time to complete processing, especially when waiting for external responses.

Option A (Increase the allocated memory to 2GB) is incorrect because while more memory can improve performance for compute-intensive tasks, it does not directly address timeouts caused by external API dependencies. Option E (Reduce the maximum number of concurrent function instances) is incorrect because reducing concurrency would decrease throughput and could worsen latency under high load, not improve reliability.

Full explanation →

494

Drag & Dropmedium

Drag and drop the steps to configure a Cloud Storage bucket with uniform bucket-level access in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Uniform bucket-level access is configured during bucket creation by selecting the appropriate access control settings.

Full explanation →

495

Matchingmedium

Match each Cloud Logging and Monitoring concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Counts log entries matching a filter

Conditions and notifications for metrics

Target level of reliability for a service

Aggregates and analyzes application errors

Distributed tracing for latency analysis

Why these pairings

Correct matches: Cloud Logging handles log data, Cloud Monitoring provides performance insights, Log-based Metrics turn logs into metrics, Error Reporting aggregates errors. Common confusions include swapping Cloud Logging and Cloud Monitoring definitions.

Full explanation →

496

Multi-Selecteasy

A company is designing a scalable web application on Google Cloud. They expect variable traffic and want to automatically scale resources based on load. Which two services can automatically scale? (Choose two.)

Select 2 answers

A.Compute Engine unmanaged instance group

B.Cloud Run

C.Compute Engine managed instance group

D.Cloud Dataproc

E.Cloud SQL

AnswersB, C

Cloud Run automatically scales container instances from zero to a maximum based on incoming request volume.

Why this answer

Cloud Run is a fully managed serverless compute platform that automatically scales your containerized applications based on incoming traffic, including scaling to zero when there is no traffic. This autoscaling is handled by the Knative serving layer, which adjusts the number of container instances based on request concurrency and CPU utilization.

Exam trap

The trap here is that candidates often confuse unmanaged instance groups with managed instance groups, assuming both support autoscaling, but only managed instance groups have built-in autoscalers.

Full explanation →

497

MCQeasy

Which Google Cloud database service is fully serverless and can scale to zero when not in use, making it cost-effective for variable workloads?

A.Cloud SQL

B.Firestore

C.Memorystore

D.Cloud Bigtable

AnswerB

Firestore is serverless and scales to zero.

Why this answer

Firestore is serverless and scales automatically, including scaling to zero. Cloud SQL and Memorystore require provisioned capacity. Bigtable requires provisioned nodes.

Full explanation →

498

Multi-Selectmedium

A global e-commerce platform uses Cloud Spanner. They need to design a schema for product inventory that supports high write throughput and avoids hotspots. Which TWO practices should they follow? (Select 2 answers)

Select 2 answers

A.Use global secondary indexes only

B.Use a single table for all products

C.Use a composite primary key with a hash prefix

D.Use interleaved tables for frequently joined data

E.Use a monotonically increasing integer as the primary key

AnswersC, D

Distributes writes across splits.

Why this answer

Using a composite key with a hash prefix distributes writes. Interleaved tables store child rows with parent, reducing cross-split operations. Monotonically increasing keys cause hotspots.

Full explanation →

499

Multi-Selectmedium

An application uses Cloud SQL MySQL for OLTP and wants to run analytics queries without impacting performance. Which TWO approaches can achieve this? (Select 2)

Select 2 answers

A.Use BigQuery federated queries to query Cloud SQL directly

B.Use Cloud Spanner for OLTP instead

C.Create a Cloud SQL read replica and run analytics on it

D.Use BigQuery Omni

E.Enable Cloud SQL automatic storage increase

AnswersA, C

Federated queries allow analytics without data movement.

Why this answer

BigQuery federated queries allow you to query Cloud SQL MySQL in real time using BigQuery's SQL engine, without moving data. This enables analytics on live OLTP data while offloading the query processing to BigQuery, thus avoiding performance impact on the Cloud SQL instance. Option C is correct because a Cloud SQL read replica is a separate read-only copy of the primary instance; running analytics queries on the replica prevents resource contention with OLTP write operations.

Exam trap

Candidates often mistakenly think that any BigQuery feature (like Omni) can query Cloud SQL, or that Cloud Spanner is a suitable analytics target, when the correct approaches are limited to read replicas and federated queries for direct, non-disruptive analytics.

Full explanation →

500

MCQhard

A Cloud Spanner instance is configured with 1000 processing units. The workload has unpredictable traffic spikes. To ensure consistent performance, the team wants to automatically adjust capacity based on a high-priority CPU target of 60%. What should they configure?

A.Set up Cloud Spanner autoscaling with min=500, max=2000 processing units and high-priority CPU target=0.6.

B.Configure compute capacity with a fixed number of nodes.

C.Enable Bigtable autoscaling for the Spanner instance.

D.Manually adjust nodes when CPU exceeds 60%.

AnswerA

Autoscaling based on high-priority CPU target automatically adjusts capacity.

Why this answer

Cloud Spanner’s autoscaler can automatically adjust processing units based on CPU utilization. Setting min and max processing units with a high-priority CPU target enables autoscaling. Node count is older, processing units are granular.

Compute capacity is not the same as autoscaling. Bigtable autoscaler is for Bigtable.

Full explanation →

501

MCQhard

An application running on GKE uses a custom metric to track order processing time. The metric is exported via Prometheus and ingested by Cloud Monitoring using the Managed Service for Prometheus. The team wants to create an alert when the 95th percentile latency exceeds 2 seconds over a 5-minute window. Which PromQL query should be used?

A.avg(rate(order_processing_duration_seconds_sum[5m])) / avg(rate(order_processing_duration_seconds_count[5m]))

B.histogram_quantile(0.95, sum(rate(order_processing_duration_seconds_bucket[5m])))

C.histogram_quantile(0.95, order_processing_duration_seconds_bucket)

D.histogram_quantile(0.95, rate(order_processing_duration_seconds_bucket[5m]))

AnswerD

Correct function to compute percentile from histogram.

Why this answer

`histogram_quantile(0.95, rate(order_processing_duration_seconds_bucket[5m]))` computes the 95th percentile latency over a 5-minute window using Prometheus histogram buckets. The `rate()` function calculates the per-second increase of each bucket, which is required for accurate quantile estimation from cumulative histograms, and the result directly gives the latency threshold below which 95% of requests fall.

Exam trap

Google Cloud often tests the requirement to use `rate()` with `histogram_quantile` for time-windowed percentile calculations, and the trap here is that candidates mistakenly omit `rate()` (option C) or incorrectly aggregate with `sum()` before quantile (option B), thinking they need to combine all series first.

How to eliminate wrong answers

Option A is wrong because it computes the average latency (mean) using `avg(rate(...sum))/avg(rate(...count))`, not the 95th percentile, and the division of two separate averages is not a valid PromQL pattern for histograms. Option B is wrong because it applies `sum()` to the rate of buckets, which aggregates across all label dimensions (e.g., all pods) before quantile calculation, losing the per-instance distribution and producing an incorrect overall quantile. Option C is wrong because it uses raw bucket counts without `rate()`, ignoring the time window and the per-second normalization required for a 5-minute window; this would compute the quantile over the entire cumulative count, not the recent 5-minute rate.

Full explanation →

502

MCQeasy

A developer wants to store secrets (e.g., API keys) for use in Cloud Functions without exposing them in the source code. Which Google Cloud service should they use?

A.Store secrets in a Cloud Storage bucket with encrypted objects and load them at runtime

B.Use Secret Manager to store secrets and reference them via secret environment variables

C.Use Firestore to store secrets in a secure document and access it via the Firestore SDK

D.Use Cloud Key Management Service (Cloud KMS) to create and manage secrets

AnswerB

Secret Manager is designed for secrets and integrates with Cloud Functions.

Why this answer

Secret Manager is the dedicated Google Cloud service for storing sensitive data like API keys, passwords, and certificates. It provides built-in versioning, access control via IAM, and native integration with Cloud Functions through secret environment variables, ensuring secrets are never exposed in source code or configuration files.

Exam trap

The PCD exam often tests the distinction between a service that stores secrets (Secret Manager) and a service that manages encryption keys (Cloud KMS), leading candidates to confuse key management with secret storage.

How to eliminate wrong answers

Option A is wrong because storing secrets in Cloud Storage, even with encryption, requires managing access policies and encryption keys separately, and loading them at runtime adds latency and complexity without the native secret rotation and audit logging that Secret Manager offers. Option C is wrong because Firestore is a NoSQL document database designed for application data, not for managing secrets; it lacks built-in secret versioning, automatic encryption at rest with customer-managed keys, and IAM roles specific to secret access. Option D is wrong because Cloud KMS is a key management service for creating and managing cryptographic keys, not for storing secrets; it can be used to encrypt secrets stored elsewhere, but it does not provide a native secret storage or retrieval API like Secret Manager.

Full explanation →

503

Multi-Selecthard

Which THREE are valid approaches for automating testing in a Cloud Build CI pipeline?

Select 3 answers

A.Use Cloud Build to ship test results to Cloud Monitoring.

B.Use Cloud Build triggers to run tests on every push to a branch.

C.Use Cloud Build to run tests only after manual approval.

D.Use Cloud Build to run tests in parallel across multiple steps.

E.Run tests in a build step using a custom builder.

AnswersB, D, E

Automatically triggers tests on code changes.

Why this answer

Cloud Build triggers can be configured to automatically start a build (including test steps) on specific events, such as a push to a branch. This enables continuous integration by validating every code change as soon as it is committed, without manual intervention.

Exam trap

The PCD exam often tests the distinction between automating test execution (triggers, parallel steps, custom builders) and related but non-automation features like monitoring or manual gates, leading candidates to select options that describe observability or approval workflows instead of actual test automation.

Full explanation →

504

Multi-Selectmedium

A team uses Google Kubernetes Engine (GKE) with Node Auto-Provisioning. They want to optimize cost while maintaining high availability across zones. Which two strategies should they implement? (Select exactly 2.)

Select 2 answers

A.Use cluster autoscaler with appropriate min and max node counts

B.Spread node pools across multiple zones

C.Use preemptible VMs for all node pools

D.Disable cluster autoscaler to prevent scaling

E.Use sole-tenant nodes for high availability

AnswersA, B

The cluster autoscaler automatically adjusts node count based on demand, optimizing cost.

Why this answer

Node Auto-Provisioning (NAP) in GKE works in conjunction with the cluster autoscaler to automatically create and delete node pools based on workload demands. By setting appropriate minimum and maximum node counts, you ensure the cluster can scale down to zero when idle (saving cost) and scale up to handle peak load, while avoiding runaway scaling that could increase costs unexpectedly.

Exam trap

The trap here is that candidates often confuse preemptible VMs (cost-saving but low availability) with high availability, or assume that disabling the autoscaler prevents cost spikes, when in fact it leads to either over-provisioning or under-provisioning, both of which harm the dual goal of cost optimization and high availability.

Full explanation →

505

MCQeasy

A team wants to deploy infrastructure as code on Google Cloud. They need a declarative language that supports modularity and state management. Which tool should they choose?

A.Cloud Deployment Manager.

B.Cloud Shell.

C.Terraform.

D.gcloud commands.

AnswerC

Correct. Terraform is a declarative IaC tool with modularity and state management.

Why this answer

Terraform is the correct choice because it is a declarative infrastructure-as-code tool that supports modularity through reusable modules and state management via state files (local or remote backends like Cloud Storage). It allows teams to define Google Cloud resources in HashiCorp Configuration Language (HCL) and track resource changes over time, enabling safe, incremental updates.

Exam trap

Google often tests the distinction between declarative and imperative tools, and the trap here is that candidates may confuse Cloud Deployment Manager’s declarative templates with Terraform’s superior state management and modularity, or mistakenly think Cloud Shell or gcloud commands are suitable for infrastructure-as-code workflows.

How to eliminate wrong answers

Option A is wrong because Cloud Deployment Manager uses a declarative template syntax (YAML or Python) but lacks built-in state management; it relies on Google Cloud's live state, which can lead to drift detection issues and does not support the same level of modularity as Terraform. Option B is wrong because Cloud Shell is a browser-based command-line environment, not an infrastructure-as-code tool; it provides a terminal for running commands but does not offer declarative language, modularity, or state management. Option D is wrong because gcloud commands are imperative, not declarative; they execute individual API calls without state tracking or modular reuse, making them unsuitable for managing infrastructure as code with desired-state reconciliation.

Full explanation →

506

MCQhard

You are troubleshooting a web application deployed on Compute Engine instances behind a target pool. Users report intermittent timeouts when accessing the application via the forwarding rule's IP address. Based on the exhibit, what is the most likely cause of the issue?

A.The forwarding rule is missing a backend service.

B.The target pool lacks health checks, causing traffic to be sent to unhealthy instances.

C.The port range is set to 80-80, which restricts traffic to port 80 only.

D.The forwarding rule should use a backend service instead of a target pool for HTTP traffic.

AnswerB

Target pools rely on health checks to stop routing to unhealthy instances; without them, traffic may be routed to failed instances.

Why this answer

The target pool in a legacy HTTP(S) load balancer does not automatically perform health checks unless they are explicitly configured. Without health checks, the load balancer continues to send traffic to all instances in the pool, including those that are unhealthy or unresponsive. This causes intermittent timeouts when users hit an unhealthy instance, as the forwarding rule distributes connections across the entire pool without verifying instance health.

Exam trap

The PCD exam often tests the misconception that a forwarding rule's port range or the use of a target pool versus a backend service is the root cause of intermittent timeouts, when in fact the absence of health checks is the critical missing component.

How to eliminate wrong answers

Option A is wrong because the forwarding rule in this legacy setup is correctly configured with a target pool; a backend service is used only with the newer HTTP(S) load balancer (using instance groups), not with target pools. Option C is wrong because setting the port range to 80-80 is a valid configuration that restricts traffic to port 80, which is the intended behavior for an HTTP application, and does not cause intermittent timeouts. Option D is wrong because while using a backend service is a modern approach, the question describes a target pool configuration which is still valid for legacy HTTP load balancing; the issue is not the type of load balancer but the missing health checks.

Full explanation →

507

Multi-Selectmedium

A company is designing a disaster recovery strategy for a global e-commerce platform using Cloud Spanner. They need to ensure that the system can survive a regional outage with minimal data loss and automatic failover. Which TWO configurations should they choose? (Choose 2.)

Select 1 answer

A.Multi-region configuration with read-write replicas in at least two regions

B.Regional configuration with a single replica

C.Set up scheduled exports and imports using Cloud Storage

D.Enable transactional replication to a second Cloud Spanner instance

E.Use point-in-time recovery with daily backups

AnswersA

Correct. A multi-region configuration with read-write replicas in at least two regions ensures automatic failover and strong consistency across regions, meeting the requirement for minimal data loss and automatic failover.

Why this answer

A multi-region configuration with read-write replicas in at least two regions provides automatic failover and strong consistency with minimal data loss, meeting the DR requirements. Scheduled exports (C) and point-in-time recovery with daily backups (E) are manual processes that do not provide automatic failover and have higher data loss potential. Transactional replication to a second Cloud Spanner instance (D) is not a built-in feature of Cloud Spanner.

Full explanation →

508

MCQmedium

A company runs a Java microservice on GKE that processes financial transactions. The service is critical and must meet a 99.9% availability SLO. They have set up Cloud Monitoring alerting policies based on request latency and error rate. Recently, the team noticed that the alerting policy for high latency fires too frequently with false positives, causing alert fatigue. They want to reduce false positives without compromising real issues. The latency metric is collected from the application's custom metric via Prometheus. Which approach should they take?

A.Change the metric to use median instead of average.

B.Increase the alert threshold to a higher latency value.

C.Disable the alert and rely on manual checks.

D.Increase the alert duration to require sustained latency over a longer period.

AnswerD

Longer duration ensures alerts fire only for persistent latency issues, reducing false positives.

Why this answer

Increasing the alert duration requires the high latency to be sustained over a longer period, which filters out transient spikes that cause false positives. This approach preserves the ability to detect genuine, prolonged performance degradation that could impact the 99.9% availability SLO, without raising the threshold and risking missed real issues.

Exam trap

The trap here is that candidates often confuse reducing false positives with simply raising thresholds or changing aggregation methods, when the correct approach is to adjust the alert duration to filter transient noise while maintaining sensitivity to sustained issues.

How to eliminate wrong answers

Option A is wrong because using median instead of average does not address the root cause of false positives from transient spikes; median can still be affected by sustained high latency and may mask the severity of outliers. Option B is wrong because increasing the alert threshold to a higher latency value reduces sensitivity and may cause the team to miss real performance degradation that violates the SLO. Option C is wrong because disabling the alert eliminates automated detection entirely, which is unacceptable for a critical service with a 99.9% availability SLO and would rely on fallible manual checks.

Full explanation →

509

MCQhard

Your Cloud Run service experiences high latency during traffic spikes. You need to reduce p95 latency without over-provisioning. Which action should you take?

A.Set max-instances to a low number to ensure consistent resources.

B.Reduce the max-concurrency per container to 1.

C.Disable CPU throttling to always allocate CPU.

D.Set min-instances to at least 5 for consistent baseline capacity.

AnswerD

Eliminates cold start latency for baseline traffic.

Why this answer

Setting min-instances to at least 5 ensures that a baseline number of container instances are always warm and ready to handle incoming requests. This eliminates cold starts and reduces latency during traffic spikes because new requests can be immediately served by pre-warmed instances, rather than waiting for new containers to spin up. This approach directly reduces p95 latency without over-provisioning, as you only pay for the baseline instances when they are idle.

Exam trap

The PCD exam often tests the misconception that reducing concurrency or capping instances improves latency, when in fact the correct approach is to pre-warm instances using min-instances to avoid cold starts during traffic spikes.

How to eliminate wrong answers

Option A is wrong because setting max-instances to a low number artificially caps the service's ability to scale out during traffic spikes, which can cause request queuing and increased latency, not reduction. Option B is wrong because reducing max-concurrency per container to 1 severely limits throughput, forcing Cloud Run to create many more container instances to handle the same load, which increases latency due to cold starts and resource contention. Option C is wrong because disabling CPU throttling is not a supported configuration in Cloud Run; the platform manages CPU allocation automatically, and this option would not address the root cause of latency during spikes.

Full explanation →

510

Multi-Selecteasy

A developer is using Firestore in Native mode for a mobile app. They want to secure data access based on user authentication. Which TWO mechanisms should they use? (Choose two)

Select 2 answers

A.Firestore Security Rules

B.Cloud Armor

C.SSL/TLS encryption in transit

D.Cloud Identity and Access Management (IAM) roles

E.Firebase Authentication

AnswersA, E

Security Rules allow per-document access control based on user auth.

Why this answer

Firestore Security Rules allow granular access control. Firebase Authentication integrates with Firestore for user identity. IAM roles are for project-level access, not per-document.

Cloud Armor is for network security. SSL/TLS is always enabled.

Full explanation →

511

MCQeasy

A company wants to run hybrid transactional/analytical processing (HTAP) workloads on a PostgreSQL-compatible database with built-in columnar engine for faster analytical queries. Which Google Cloud database should they choose?

A.AlloyDB

B.Cloud SQL for PostgreSQL

C.Cloud Spanner

D.BigQuery

AnswerA

AlloyDB’s built-in columnar engine, accessed via the `google_columnar_engine` extension, automatically offloads analytical queries from the row-oriented storage, enabling HTAP without data duplication. This satisfies the stem’s requirement for a PostgreSQL-compatible database with native columnar acceleration, whereas standard Cloud SQL lacks such a hybrid engine and relies solely on row-based processing.

Why this answer

AlloyDB is a PostgreSQL-compatible database service with a built-in columnar engine that accelerates analytical queries by storing data in columns rather than rows, enabling HTAP workloads without needing to move data between separate transactional and analytical systems. Its architecture decouples compute from storage and uses a columnar cache to deliver up to 100x faster analytical queries than standard PostgreSQL, making it the correct choice for HTAP on Google Cloud.

Exam trap

The trap here is that candidates often confuse Cloud SQL for PostgreSQL as capable of HTAP because it supports read replicas and some analytical extensions, but it lacks a native columnar engine, so it cannot handle mixed workloads efficiently without performance degradation.

How to eliminate wrong answers

Option B (Cloud SQL for PostgreSQL) is wrong because it lacks a built-in columnar engine and is optimized for OLTP workloads only, not for hybrid transactional/analytical processing. Option C (Cloud Spanner) is wrong because it is a globally distributed, strongly consistent relational database designed for horizontal scalability and high availability, but it does not include a columnar engine for analytical queries and is not PostgreSQL-compatible. Option D (BigQuery) is wrong because it is a serverless data warehouse with a columnar storage engine for analytics, but it is not PostgreSQL-compatible and is not designed for transactional workloads (OLTP), making it unsuitable for HTAP.

Full explanation →

512

MCQhard

An administrator runs the above command to create a Compute Engine instance. However, the nginx service does not start. What is the most likely cause?

A.The instance has no external IP address and cannot reach the internet to download packages.

B.The metadata key is misspelled; it should be 'startup-script-url'.

C.The instance does not have the compute.instance.update permission.

D.The startup script runs before the boot disk is fully mounted.

AnswerA

By default, instances are created without an external IP unless --no-address is not specified. The command does not specify --no-address, but if the project's default is to not assign external IPs, the instance may lack internet access. However, in newer GCP projects, the default is to assign an ephemeral external IP. Actually, the default behavior depends on the project's VPC configuration. Without an external IP and without Cloud NAT, the instance cannot access the internet, causing apt-get to fail.

Why this answer

The command likely creates a Compute Engine instance without specifying an external IP address (e.g., using `--no-address` or omitting `--address`). Without an external IP, the instance cannot reach the internet to download the nginx package from repositories, causing the startup script that installs and starts nginx to fail. This is the most direct cause of the nginx service not starting.

Exam trap

The PCD exam often tests the nuance that startup scripts execute after the boot disk is mounted and that missing external IP prevents internet-dependent operations, leading candidates to incorrectly blame script syntax or permissions.

How to eliminate wrong answers

Option B is wrong because the metadata key 'startup-script-url' is valid for specifying a startup script stored in Cloud Storage; the question does not indicate a misspelling, and the script itself could be correct. Option C is wrong because the instance does not need the 'compute.instance.update' permission to run startup scripts; that permission is for modifying the instance metadata, not for executing scripts. Option D is wrong because the boot disk is fully mounted before the startup script runs; Compute Engine ensures the root filesystem is available before executing startup scripts.

Full explanation →

513

MCQhard

You are deploying a Python Cloud Function using the Google Cloud CLI. The deployment fails with 'ERROR: (gcloud.functions.deploy) ResponseError: status=[404], code=[OK], message=[The function ... does not exist]' but the function already exists. What is the most likely cause?

A.The function was already deployed with the same name, causing a conflict.

B.The gcloud config's region does not match the region where the function was deployed.

C.The Python runtime version is not supported in that region.

D.The Cloud Functions API is not enabled.

AnswerB

The default region might be unset or different.

Why this answer

The 404 error indicates the deployment command cannot locate the function in the specified region. When you deploy a Cloud Function using the gcloud CLI, the command uses the default region set in your gcloud configuration (or the --region flag). If the function was originally deployed in a different region, the CLI will look for it in the wrong region and fail with a 404, even though the function exists elsewhere.

This is the most common cause of this specific error message.

Exam trap

A common mistake is assuming a 404 error always means the resource does not exist. In Google Cloud Functions, if the region in your gcloud config does not match the region where the function was deployed, the CLI will return a 404 even though the function exists elsewhere.

How to eliminate wrong answers

Option A is wrong because deploying a function with the same name does not cause a 404 error; it would trigger an update or a conflict error (e.g., 409 Conflict) if the function already exists in the same region. Option C is wrong because an unsupported Python runtime version would produce a different error, such as 'Runtime version not supported' or a 400 Bad Request, not a 404. Option D is wrong because if the Cloud Functions API were not enabled, the error would be a 403 Forbidden or a message about the API not being enabled, not a 404 indicating the function resource is not found.

Full explanation →

514

Multi-Selecteasy

A developer is deploying a Node.js application to App Engine flexible environment. They need to install custom dependencies and run startup scripts. Which two configuration elements should they define in the app.yaml? (Choose two.)

Select 2 answers

A.entrypoint

B.runtime

C.env_variables

D.manual_scaling

E.network

AnswersA, B

Specifies the command to start the application.

Why this answer

A is correct because the `entrypoint` element in app.yaml for App Engine flexible environment specifies the command to run your application, allowing you to execute custom startup scripts and install dependencies before the main process starts. This is essential for Node.js apps that require custom build steps or runtime initialization beyond the default `npm start`.

Exam trap

The PCD exam often tests the misconception that `env_variables` or `manual_scaling` can handle startup scripts, but only `entrypoint` (and `runtime` to define the base environment) directly control the command executed at container startup.

Full explanation →

515

MCQhard

A Cloud Bigtable instance is experiencing high read latency on a table storing time-series data. The row key is a concatenation of metric_type, timestamp, and device_id. Most queries filter by metric_type and a time range. Which row key redesign would MOST improve read performance?

A.Use a salted key by prepending a hash of the metric_type

B.Use a separate column family for the timestamp

C.Promote metric_type to the first part of the row key

D.Reverse the timestamp portion of the key to distribute writes

AnswerC

Placing metric_type first allows efficient scans over contiguous rows for a given metric and time range.

Why this answer

Field promotion moves the most frequently filtered column to the start of the row key. Since queries filter by metric_type and time range, placing metric_type first allows Bigtable to efficiently scan a contiguous range of rows.

Full explanation →

516

MCQeasy

A developer needs to connect to a Cloud SQL for PostgreSQL instance from a Compute Engine VM without adding the VM's IP to an authorized networks list. Which method should they use?

A.Connect via Cloud Shell

B.Configure direct IP connection with SSL

C.Use Cloud SQL Auth Proxy

D.Set up VPC peering and use private IP

AnswerC

Cloud SQL Auth Proxy uses IAM for authentication and does not require IP allowlisting.

Why this answer

The Cloud SQL Auth Proxy is the recommended method for securely connecting to a Cloud SQL instance from a Compute Engine VM without adding the VM's IP to an authorized networks list. It uses mutual TLS (mTLS) to authenticate and encrypt traffic, and it handles IAM-based authorization, so the VM only needs the Cloud SQL Client role and outbound access to the Cloud SQL API (port 443). This avoids exposing the database to the public internet or requiring static IP management.

Exam trap

Google Cloud often tests the distinction between 'authorized networks' (which only apply to public IP connections) and private IP connectivity; the trap here is that candidates may assume VPC peering (Option D) is required for private access, but the Cloud SQL Auth Proxy works with both public and private IP and is the simplest way to avoid managing IP whitelists.

How to eliminate wrong answers

Option A is wrong because Cloud Shell is an interactive browser-based terminal that runs on a temporary VM; it cannot be used as a persistent connection method from a Compute Engine VM, and it still requires the Cloud Shell's ephemeral IP to be authorized. Option B is wrong because configuring a direct IP connection with SSL still requires the VM's IP address to be added to the authorized networks list, which the question explicitly states must be avoided. Option D is wrong because setting up VPC peering and using private IP is a valid approach for private connectivity, but it requires the Cloud SQL instance to be configured with a private IP and the VPC networks to be peered, which is a more complex networking setup; the question asks for the method to use without adding the VM's IP to authorized networks, and the Cloud SQL Auth Proxy is the simplest and most secure solution that works with both public and private IP configurations.

Full explanation →

517

MCQeasy

A developer is setting up a Cloud Build configuration file for a Node.js application. They want to ensure that build steps are executed only when changes are pushed to the 'main' branch. What is the correct approach?

A.Use a script in the build step to check the branch name

B.Use Cloud Scheduler to trigger builds based on time intervals

C.Use a condition in the build config file

D.Use a build trigger with a branch filter

AnswerD

Cloud Build triggers allow filtering by branch, making this the intended solution.

Why this answer

Cloud Build triggers can be configured with a branch filter (e.g., `^main$`) that ensures builds are only initiated when changes are pushed to the specified branch. This is the native, declarative way to control build execution based on Git branch events, without requiring custom scripting or external scheduling.

Exam trap

The PCD exam often tests the distinction between trigger-level configuration (branch filters) and build-step-level logic, leading candidates to incorrectly think they can use conditional statements in the build config file itself.

How to eliminate wrong answers

Option A is wrong because using a script to check the branch name inside a build step is an anti-pattern; the build would still be triggered for all branches, wasting resources and time, and it does not prevent the trigger from firing. Option B is wrong because Cloud Scheduler triggers builds based on time intervals, not Git push events, so it cannot conditionally execute builds only when changes are pushed to the 'main' branch. Option C is wrong because Cloud Build's build config file (cloudbuild.yaml) does not support conditional execution based on branch names; branch filtering must be configured at the trigger level, not within the build steps.

Full explanation →

518

MCQhard

A company deploys a microservice on Google Kubernetes Engine (GKE) with a Cloud Deploy delivery pipeline. The application uses a custom container image stored in Artifact Registry. After a successful deployment to a staging cluster, the production deployment fails with 'ImagePullErr: image not found'. The staging and production clusters are in different projects. What is the most likely cause?

A.The Cloud Deploy service account lacks permission to create pods in the production cluster.

B.Cloud Deploy is not configured to use Artifact Registry and still references Container Registry.

C.The production cluster's node pool has not been granted access to pull images from Artifact Registry in the staging project.

D.The container image tag used in production is different from the staging tag.

AnswerC

Cross-project image pulling requires appropriate IAM on the registry.

Why this answer

The production cluster's node pool, which runs in a different project, does not have the necessary permissions to pull the custom container image from Artifact Registry in the staging project. By default, GKE node pools use the Compute Engine default service account, which only has access to images in the same project. To pull images across projects, the node pool's service account must be granted the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in the staging project.

Exam trap

The PCD exam often tests the misconception that Cloud Deploy handles cross-project image access automatically, when in reality the node pool's service account must be explicitly granted permissions on the Artifact Registry repository in the source project.

How to eliminate wrong answers

Option A is wrong because the Cloud Deploy service account does not need permission to create pods; Cloud Deploy creates a release and rollout, which triggers a Kubernetes manifest apply via the GKE cluster's credentials, not by directly creating pods. Option B is wrong because Cloud Deploy does not have a configuration to switch between Artifact Registry and Container Registry; it references the image path as specified in the manifest, and if the path uses Artifact Registry, it will use it regardless of Cloud Deploy settings. Option D is wrong because the question states the same application is deployed, and a different tag would cause a different error (e.g., 'ErrImagePull' for a non-existent tag) or a successful deployment with a different version, not 'ImagePullErr: image not found' which indicates the image location is inaccessible.

Full explanation →

519

MCQeasy

A developer notices that a Cloud Function is timing out after 60 seconds. The function makes an external API call that occasionally takes longer than the timeout. What is the best practice to handle this?

A.Implement retry logic without changing the timeout

B.Increase the timeout for all Cloud Functions in the project

C.Increase the timeout for the specific Cloud Function to a higher value

D.Decrease the timeout to fail fast and implement retry logic

AnswerC

Adjusting the timeout for the specific function allows the external call to complete.

Why this answer

Cloud Functions have a configurable timeout per function (up to 540 seconds for HTTP functions). Increasing the timeout for the specific function that makes the slow external API call directly addresses the timeout issue without affecting other functions or introducing unnecessary retry overhead. This is the most targeted and efficient solution.

Exam trap

Google Cloud often tests the misconception that retry logic alone can solve timeout issues, but the trap here is that retries do not extend the execution window—the function must complete within the configured timeout for any single invocation to succeed.

How to eliminate wrong answers

Option A is wrong because retry logic does not prevent the function from timing out; if the function times out after 60 seconds, retries will also fail unless the timeout is increased. Option B is wrong because increasing the timeout for all Cloud Functions in the project is unnecessarily broad and could mask performance issues in other functions, violating the principle of least privilege and granular configuration. Option D is wrong because decreasing the timeout to fail fast would cause the function to fail even more frequently, and implementing retry logic would not help if the external API call inherently takes longer than the reduced timeout.

Full explanation →

520

MCQmedium

During an Oracle to PostgreSQL migration using Database Migration Service (DMS), the continuous replication fails with an error about unsupported data types. The source table uses Oracle's RAW data type. How should this be handled?

A.Convert RAW to VARCHAR2 before migration using a trigger.

B.Raw data type is not supported by DMS; you must drop the column and re-add as BYTEA after migration.

C.Verify DMS supports RAW to BYTEA mapping; if not, use a manual export/import for that table.

D.Use Cloud Dataflow to transform the data as it streams.

AnswerC

DMS does support this mapping, but if it fails, manual intervention may be needed.

Why this answer

Oracle RAW type maps to PostgreSQL BYTEA. DMS should handle this conversion automatically. If it fails, it may be due to version incompatibility or configuration.

The correct action is to check DMS logs and ensure the mapping is correct; if DMS cannot handle it, a manual workaround is to convert RAW to BYTEA using a custom script.

Full explanation →

521

MCQeasy

A developer is writing unit tests for a Cloud Function that reads from Firestore. They want to avoid real Firestore calls in tests. Which approach is best?

A.Use Cloud Functions local emulator with Firestore emulator

B.Create a test project with real Firestore and use real calls

C.Mock the Firestore client library in the test code

D.Use Firestore emulator for tests

AnswerC

Mocking isolates the function code and is the standard unit testing approach.

Why this answer

Mocking the Firestore client library allows testing the function logic without dependencies on external services, which is the essence of unit testing.

Full explanation →

522

MCQeasy

A developer deployed the above Cloud Run service YAML. The service deploys successfully but any request fails with a 503 error. What is the most likely cause?

A.The container is not listening on the expected port.

B.The service has no ingress setting.

C.The container image has a different entrypoint.

D.containerConcurrency is set too high.

AnswerA

Cloud Run requires the container to listen on the port specified by the PORT environment variable (default 8080). If the container listens on a different port, requests time out or fail.

Why this answer

A 503 error from Cloud Run indicates that the service is failing to respond to health checks or requests. The most common cause is that the container is not listening on the port specified in the `containerPort` field of the YAML (default 8080). Cloud Run sends requests to that port, and if the application is bound to a different port (e.g., 3000 or 80), the request never reaches the application, resulting in a 503.

Exam trap

The PCD exam often tests the distinction between a container that fails to start (which would show a different error) and a container that runs but is unreachable on the expected port (which causes 503 errors).

How to eliminate wrong answers

Option B is wrong because Cloud Run services have a default ingress setting of 'all' (allowing all traffic) when not explicitly set, so missing ingress does not cause a 503. Option C is wrong because a different entrypoint would cause the container to fail to start or crash, resulting in a different error (e.g., 'Container failed to start' or 'CrashLoopBackOff'), not a 503 response. Option D is wrong because setting `containerConcurrency` too high (e.g., 80 or more) could cause performance degradation or timeouts under load, but it would not cause every request to fail with a 503; the service would still respond to some requests.

Full explanation →

523

MCQmedium

A team is deploying a containerized application to Google Kubernetes Engine using a Deployment and a Service of type LoadBalancer. The application is a web server that should be accessible on port 80. After deployment, the external IP is assigned, but when they try to access http://<EXTERNAL_IP>:80, they get a connection timeout. The pods are running, and the logs show the web server is listening on port 8080. The team has verified that the cluster firewall rules allow traffic on port 80. They have also confirmed that the pods are healthy and no network policies are in place. What is the most likely cause?

A.The cluster has a network policy that blocks incoming traffic.

B.The Deployment's containerPort is set to 8080, but the Service's port is set to 80 and targetPort is not specified.

C.The Service is missing the externalTrafficPolicy: Local setting.

D.The Service's targetPort is set to 80 instead of 8080.

AnswerB

Without targetPort, the Service forwards to the same port number, causing mismatch.

Why this answer

If the Service's targetPort is not specified, it defaults to the same value as the port (80). However, the container is listening on port 8080, so traffic forwarded to port 80 on the pod results in a connection timeout. Option A is incorrect because the team verified that no network policies are in place, and firewall rules allow traffic on port 80.

Option C is incorrect because externalTrafficPolicy: Local affects client IP preservation, not basic connectivity. Option D is incorrect because the team did not explicitly set targetPort; it defaults to 80. If it were set to 80, that would also cause the timeout, but the issue is the default behavior.

Full explanation →

524

Multi-Selectmedium

A company is building a polyglot persistence architecture. They need to choose the correct Google Cloud databases for the following requirements: (1) ACID transactions for financial orders, (2) high-throughput time-series sensor data, and (3) real-time session cache. Which THREE databases should they choose? (Choose 3)

Select 3 answers

A.Memorystore

B.Cloud Spanner

C.Cloud SQL

D.Cloud Bigtable

E.Firestore

AnswersA, B, D

Memorystore (Redis) is ideal for session caching.

Why this answer

Cloud Spanner provides ACID transactions globally, Bigtable for time-series, and Memorystore for caching. Firestore is document-oriented, not ideal for time-series.

Full explanation →

525

MCQeasy

A company is migrating an on-premises MySQL 8.0 OLTP application to Google Cloud. The application requires high availability with automatic failover and zero RPO. Which Google Cloud database and configuration should they use?

A.Cloud Spanner with multi-region configuration

B.Cloud SQL for MySQL with read replicas

C.AlloyDB for PostgreSQL with HA

D.Cloud SQL for MySQL with HA configuration

AnswerD

HA configuration uses synchronous replication to a standby in the same zone/region, automatic failover, and zero RPO.

Why this answer

Cloud SQL for MySQL with HA configuration provides synchronous replication to a standby instance in the same region, automatic failover, and zero RPO.

Full explanation →

Page 7 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCD by domain

Target a specific domain to shore up weak areas.

Designing highly scalable, available, and reliable cloud-native applications Building and testing applications Deploying applications Integrating Google Cloud services

See all domains with question counts →