Courseiva

CCNA Integrating Gcp Services Questions

65 questions · Integrating Gcp Services topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
Multi-Selecteasy

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Select 2 answers
A.By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.
B.Using a signed URL revokes the underlying object's ACL.
C.Enabling uniform bucket-level access disables encryption at rest.
D.Customer-managed encryption keys (CMEK) can be used to control the encryption keys used to protect data.
E.Bucket-level policies can restrict access to only compute instances with specific service accounts.
AnswersA, D

Cloud Storage automatically encrypts all data at rest with Google-managed keys.

Why this answer

Cloud Storage automatically encrypts all data at rest using server-side encryption with Google-managed encryption keys by default, without any additional configuration. This ensures that data is protected before it is written to disk and remains encrypted throughout its lifecycle.

Exam trap

The PCD exam often tests the misconception that uniform bucket-level access affects encryption or that signed URLs modify ACLs, when in fact these features operate on separate layers of the security model.

Practice this question →
2
Multi-Selectmedium

Which three are valid ways to authenticate a service account when using the Google Cloud client libraries? (Choose three.)

Select 3 answers
A.Attaching a service account to a Compute Engine instance and letting the metadata server provide credentials.
B.Setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a service account key file.
C.Using OAuth 2.0 client IDs for web applications.
D.Using the gcloud CLI default application credentials.
E.Using an API key in the client library initialization.
AnswersA, B, D

This is the automatic method on Compute Engine.

Why this answer

Options A, B, and D are correct. These are standard methods for Application Default Credentials (ADC). Attaching a service account to a Compute Engine instance allows the metadata server to provide credentials (A).

Setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a service account key file is another valid method (B). Using the gcloud CLI default application credentials is also a valid approach (D). Option C is incorrect because OAuth 2.0 client IDs for web applications are used for user authentication, not service account authentication.

Option E is incorrect because API keys are not used for service account authentication; they are used for simple API access without a service account.

Practice this question →
3
MCQeasy

A developer sets environment variables for a Cloud Function as shown. What is the security concern?

A.The variable name FOO is too short and does not follow naming conventions.
B.The variable DB_PASS should be set as a build variable instead.
C.There is no encryption applied to environment variables.
D.The password is exposed in plain text and should be stored in Secret Manager.
AnswerD

The password is exposed in plain text in environment variables. It should be stored in Secret Manager to prevent unauthorized access.

Why this answer

Storing a password in plain text in an environment variable exposes it to anyone with access to the function's configuration. Cloud Secret Manager should be used to store secrets securely. Option A is incorrect because the variable name FOO, while short, is syntactically valid and does not pose a security risk.

Option B is incorrect because build variables are for build-time settings, not runtime secrets, and the security concern is about exposure, not where the variable is set. Option C is incorrect because encryption at rest is not applicable; environment variables are not encrypted by default, but the main issue is visibility, not encryption.

Practice this question →
4
Multi-Selectmedium

A company is deploying a containerized application on Cloud Run that needs to connect to a Cloud SQL (MySQL) database. The database must not be accessible from the public internet. Which two steps should the company take to secure the connection?

Select 2 answers
A.Enable automatic IAM database authentication for Cloud SQL.
B.Create a Cloud NAT gateway for outbound traffic from Cloud Run.
C.Use Cloud SQL Auth proxy within the Cloud Run container.
D.Set Cloud SQL to have a private IP address only.
E.Configure a VPC Serverless Access connector and attach it to the Cloud Run service.
AnswersD, E

A private IP ensures the database is not exposed to the public internet, meeting the security requirement.

Why this answer

Setting Cloud SQL to have a private IP address only (Option D) ensures the database is accessible only within the VPC network, not from the public internet. This eliminates exposure to external threats and is a fundamental security best practice for private database access.

Exam trap

The trap here is that candidates often think Cloud SQL Auth proxy alone is sufficient for security, but it does not prevent public internet access to the database; the proxy only encrypts the connection, while the database's IP address remains publicly reachable unless explicitly set to private.

Practice this question →
5
MCQhard

A company uses Cloud Build to build Docker images and push to Artifact Registry. They want to trigger builds automatically when code is pushed to a Cloud Source Repository branch. They also need to ensure that only builds from the repository's main branch are allowed to push to the production Artifact Registry repository. What is the best way to implement this?

A.Use Cloud Source Repository webhooks and a Cloud Function to call Cloud Build
B.Use Cloud Build triggers and configure separate service accounts for each branch
C.Use Cloud Build triggers with branch filter and use IAM conditions on the Artifact Registry to restrict push based on the Cloud Build service account
D.Use Cloud Build triggers with substitution variables and separate build configurations
AnswerC

This approach allows you to create a trigger for the main branch with a dedicated service account that has write access to the production repository.

Why this answer

Cloud Build triggers with a branch filter can be set to only trigger on the main branch, and IAM conditions on the Artifact Registry can restrict push access based on the Cloud Build service account, ensuring only builds from the main branch can push to the production repository. Option A is overly complex and unnecessary. Option B does not enforce branch-level restrictions.

Option D is less direct and harder to manage.

Practice this question →
6
MCQeasy

A company has a hybrid cloud setup with on-premises applications that need to send messages to a Pub/Sub topic. The on-premises network is connected via Cloud VPN. What is the recommended way to publish messages?

A.Use a Cloud NAT instance to route traffic
B.Expose Pub/Sub publicly and use authentication via OAuth2 tokens
C.Use VPC Service Controls and Private Google Access
D.Use Cloud Router to establish BGP sessions for direct connectivity
AnswerC

Private Google Access enables on-premises to reach Google APIs via VPN, and VPC Service Controls provides security.

Why this answer

To allow on-premises access to Pub/Sub via Cloud VPN, you need to enable Private Google Access to allow traffic from on-premises to Google APIs via private IP, and VPC Service Controls to restrict data exfiltration. Option A is incorrect: Cloud NAT is for outbound internet access from private instances, not for on-premises to Google API access. Option B is incorrect: exposing Pub/Sub publicly with OAuth would not use the VPN and would be less secure.

Option D is incorrect: Cloud Router establishes BGP sessions for dynamic routing, but does not directly provide access to Pub/Sub.

Practice this question →
7
MCQmedium

A company uses Cloud SQL for PostgreSQL and wants to run periodic analytical queries on the data without impacting the transactional workload. The data is updated frequently. Which integration approach is most suitable?

A.Use Cloud Composer to schedule ETL jobs that copy data to BigQuery every minute.
B.Migrate the database to Cloud Spanner and use strong reads for analytics.
C.Export the Cloud SQL data to Cloud Storage and then load into BigQuery for analysis.
D.Create a read replica of the Cloud SQL instance and point analytical queries to the replica.
AnswerD

Read replicas handle read traffic without impacting the main database's write performance.

Why this answer

Cloud SQL read replicas provide a read-only copy of the database that is continuously updated, allowing analytical queries to be run without affecting the primary instance's performance. This is ideal for frequently updated data. Option A is incorrect because using Cloud Composer to schedule frequent ETL jobs (every minute) is unnecessarily complex and may not keep up with updates.

Option B is incorrect because migrating to Cloud Spanner is a major change and not necessary for this use case; read replicas achieve the goal with less complexity. Option C is incorrect because exporting to Cloud Storage and loading into BigQuery is a batch process that introduces latency and is not suitable for frequently updated data.

Practice this question →
8
MCQhard

You are a developer at a company that runs a critical pricing engine on Compute Engine instances in a managed instance group (MIG) behind an internal TCP load balancer. The pricing engine is a stateful application that stores state in memory and also writes to a Cloud Bigtable instance for persistence. The application uses a custom port 8080. You need to migrate this application to Cloud Run for better scalability and reduced operational overhead. The application must maintain session affinity so that requests from the same client are routed to the same instance (since the in-memory state is not yet fully externalized). The application currently uses a health check on /healthz that returns 200 OK. You have containerized the application. When you deploy to Cloud Run, you notice that traffic is not sticky; every request might go to a different revision. You also need to ensure that Bigtable writes are performed asynchronously to avoid slowing down the pricing calculations. What should you do?

A.Implement a custom health check on TCP port 8080 in Cloud Run to ensure only healthy instances receive traffic.
B.Increase the container concurrency setting to 1 to force each container to handle one request at a time.
C.Use Cloud Run with an HTTP(S) External Load Balancer and enable session affinity on the backend service.
D.Deploy the application on Cloud Run and configure an Internal TCP/UDP Load Balancer in front of it with session affinity.
AnswerC

External load balancer provides session affinity; Cloud Run itself does not.

Why this answer

Cloud Run does not natively support session affinity, but you can achieve it by placing Cloud Run behind an external HTTP(S) load balancer and enabling session affinity on the backend service. This ensures that requests from the same client are routed to the same Cloud Run revision, maintaining session stickiness for the in-memory state. Option A is incorrect because Cloud Run does not support custom TCP health checks; it only supports HTTP health checks, and Cloud Run automatically handles health checks via the /healthz endpoint.

Option B is incorrect because setting concurrency to 1 does not provide session affinity; it only limits the number of concurrent requests per container, but subsequent requests from the same client may still go to different containers without a load balancer with session affinity. Option D is incorrect because Cloud Run cannot be placed behind an internal TCP/UDP load balancer; it only supports HTTP(S) traffic and must use an external load balancer for session affinity.

Practice this question →
9
MCQhard

A company is migrating a monolithic application to microservices on Google Cloud. They have strict requirements for service-to-service communication: requests must be authenticated, authorized, and encrypted in transit. They also need to enforce fine-grained access control based on the requesting service identity. Which Google Cloud service should they use to achieve these goals?

A.Cloud Run with ingress control
B.Cloud Armor with IAM
C.Cloud Service Mesh (Anthos Service Mesh)
D.Cloud Endpoints with API keys
AnswerC

Cloud Service Mesh provides mutual TLS and policy-based access control for microservices.

Why this answer

Cloud Service Mesh (Anthos Service Mesh) provides mutual TLS, fine-grained authorization policies, and service identity. Option A is for API management, option B is for DDoS protection, and option D is for serverless ingress control.

Practice this question →
10
MCQmedium

Refer to the exhibit. A developer runs the command and sees that the Cloud Run service is publicly accessible. The security team requires that only authenticated requests from a specific service account in the same project are allowed. What should the developer do to modify the IAM policy?

A.Add a new binding with the service account as the only member of roles/run.invoker
B.Update the IAM policy to remove the allUsers member from the roles/run.invoker binding
C.Change the service's ingress settings to "Internal and Cloud Load Balancing"
D.Remove the roles/run.viewer binding and add the service account to roles/run.invoker
AnswerB

Removing allUsers revokes public access. Then ensure the service account has invoker role.

Why this answer

Modifying the IAM policy to remove the allUsers member from the roles/run.invoker binding revokes public access, ensuring only authenticated requests are allowed. The service account can then be granted the roles/run.invoker role if it does not already have it. Option A adds the service account as an invoker but does not remove the allUsers member, so the service remains publicly accessible.

Option C changes ingress settings, which controls network-level access, not IAM authentication; it does not address the requirement for authenticated requests. Option D removes the viewer role and adds the service account to invoker, but it fails to remove the allUsers member, leaving public access intact.

Practice this question →
11
MCQeasy

A developer needs to store configuration parameters for a Cloud Run service, such as database connection strings and API keys. The values must be encrypted at rest and in transit. Which service should be used?

A.Cloud SQL
B.Cloud Storage
C.Firestore
D.Secret Manager
AnswerD

Secret Manager is a secure and convenient storage system for secrets.

Why this answer

Secret Manager is the correct service for storing configuration parameters like database connection strings and API keys, as it provides encryption at rest and in transit, along with fine-grained access control. Cloud SQL is a relational database service, not designed for secret storage. Cloud Storage is for object storage, not secrets.

Firestore is a NoSQL database and not intended for secret management.

Practice this question →
12
MCQhard

A company has a Cloud Run service that ingests messages from a Cloud Pub/Sub subscription. The service uses automatic scaling based on CPU. Recently, the team noticed that when message volume spikes, the service scales up slowly, causing a backlog. What is the most effective solution to reduce the time to scale out?

A.Increase the max instances for the Cloud Run service to 100.
B.Use Cloud Tasks to buffer messages and configure a Cloud Scheduler job to pull from the queue.
C.Set a minimum number of instances on the Cloud Run service to 5.
D.Change the subscription type from pull to push and set the Cloud Run service as the push endpoint.
AnswerD

Push subscriptions invoke the service directly upon message delivery, reducing latency and improving scaling speed.

Why this answer

Using a push subscription from Pub/Sub directly triggers Cloud Run invocations, which reduces latency compared to pull subscriptions that require polling. This improves scaling responsiveness during traffic spikes. Option A is wrong because increasing max instances does not accelerate scaling speed; it only sets an upper limit.

Option B is wrong because adding Cloud Tasks and Cloud Scheduler introduces extra latency without solving the scaling delay. Option C is wrong because setting a minimum number of instances can reduce cold starts but does not speed up scaling from zero to the minimum; it only ensures a base level of instances are always running.

Practice this question →
13
MCQmedium

An application running on GKE needs to access a Cloud SQL instance. The team wants to avoid using Cloud SQL Auth Proxy to reduce complexity. What is the most secure alternative?

A.Whitelist the GKE node external IPs in Cloud SQL authorized networks.
B.Use a Cloud SQL read replica with a public IP.
C.Use Private Service Connect to connect privately.
D.Configure Cloud SQL to allow all traffic from the VPC.
AnswerC

Private Service Connect offers secure private connectivity.

Why this answer

Private Service Connect (PSC) allows your GKE cluster to connect to Cloud SQL privately using internal IPs within the same VPC, without exposing traffic to the public internet or requiring the Cloud SQL Auth Proxy. PSC creates a private endpoint that routes traffic through Google's internal network, providing secure, low-latency connectivity while reducing operational overhead.

Exam trap

The trap here is that candidates often assume whitelisting IPs (Option A) is sufficient for security, but they overlook that private connectivity via PSC or VPC peering is the most secure method because it avoids public internet exposure entirely.

How to eliminate wrong answers

Option A is wrong because whitelisting GKE node external IPs in Cloud SQL authorized networks exposes the database to the public internet, increasing the attack surface and requiring static IP management, which is less secure than private connectivity. Option B is wrong because using a Cloud SQL read replica with a public IP still exposes the replica to the internet, and read replicas are not designed for primary application connectivity; they are for read scaling and disaster recovery. Option D is wrong because configuring Cloud SQL to allow all traffic from the VPC is not a specific feature; Cloud SQL does not support a blanket 'allow all' rule, and the correct approach is to use Private Service Connect or VPC peering for private access.

Practice this question →
14
Multi-Selecteasy

A company stores sensitive user data in Cloud Storage. They want to ensure that only authenticated users with the appropriate permissions can access the data, and that data is encrypted at rest. Which two steps should they take? (Choose TWO.)

Select 2 answers
A.Configure a Customer-Managed Encryption Key (CMEK) in Cloud KMS.
B.Enable default encryption on the bucket using Google-managed keys.
C.Use IAM roles to grant access to specific users and groups.
D.Set bucket-level public access prevention.
E.Enable VPC Service Controls to restrict data access.
AnswersB, C

Default server-side encryption is already enabled.

Why this answer

Cloud Storage buckets are encrypted at rest by default using Google-managed keys, which satisfies the requirement for data encryption without additional configuration. Option C is correct because IAM roles provide fine-grained access control, ensuring only authenticated users with appropriate permissions can access the data.

Exam trap

The PCD exam often tests the misconception that enabling default encryption or using CMEK is optional or that public access prevention alone satisfies access control, when in fact IAM is the primary mechanism for user-level authorization and default encryption is already enabled.

Practice this question →
15
MCQeasy

A developer wants to store application logs from Compute Engine instances in a centralized logging system. Which service should they use?

A.Cloud Monitoring
B.Cloud Trace
C.Cloud Debugger
D.Cloud Logging
AnswerD

Cloud Logging is designed to store, search, and analyze log data.

Why this answer

Cloud Logging. Cloud Logging is the centralized logging service in Google Cloud that collects and stores logs from various sources, including Compute Engine instances. Cloud Monitoring (A) is for monitoring metrics and alerting, not logs.

Cloud Trace (B) is a distributed tracing tool for latency analysis. Cloud Debugger (C) inspects application state at runtime, not for log storage.

Practice this question →
16
MCQmedium

You are a cloud architect at a financial services company. The company is deploying a new application on Google Kubernetes Engine (GKE) that processes sensitive financial transactions. The application must be highly available across two regions (us-central1 and europe-west1) and must fail over automatically if one region becomes unavailable. The application uses Cloud Spanner as its primary database. Additionally, the application needs to send audit logs to a centralized Cloud Storage bucket for compliance. The current design uses GKE clusters in each region with a global HTTP(S) load balancer. However, during a recent test, when the us-central1 cluster was deliberately taken down, the load balancer continued to send traffic to that region, causing errors. You need to troubleshoot and fix the issue. What is the most likely cause and the best solution?

A.The load balancer is configured with only one backend service. Solution: Create a separate backend service for each region.
B.The load balancer backend lacks a health check that marks the backend as unhealthy when the cluster is down. Solution: Configure a health check on the backend service that points to a readiness endpoint on the GKE cluster.
C.The Cloud Spanner instance is not configured with multi-region replication, causing write failures. Solution: Configure Cloud Spanner as a multi-region instance.
D.The GKE clusters are not configured as network endpoint groups (NEGs). Solution: Create NEGs for each cluster and use them as backends.
AnswerB

Health checks are required for the load balancer to stop routing traffic to unhealthy backends.

Why this answer

The issue is that the global HTTP(S) load balancer continues to send traffic to the us-central1 region because its backend service lacks a health check that can detect when the GKE cluster is down. By configuring a health check on the backend service that probes a readiness endpoint (e.g., /healthz) on the GKE cluster, the load balancer will automatically stop routing traffic to the unhealthy region and fail over to the healthy region. This ensures high availability across the two regions as required.

Exam trap

The trap here is that candidates often confuse infrastructure-level health checks (e.g., instance group health) with application-level health checks, or assume that GKE's built-in ingress controller automatically configures health checks for regional failover, when in fact the load balancer backend service must have an explicit health check configured to detect a complete regional cluster outage.

How to eliminate wrong answers

Option A is wrong because creating separate backend services for each region does not solve the problem; the load balancer already uses separate backends (one per region) via the GKE ingress, but without proper health checks, it cannot detect regional failure. Option C is wrong because the issue is about traffic routing from the load balancer, not database write failures; Cloud Spanner multi-region replication is important for database availability but does not affect load balancer traffic distribution. Option D is wrong because while NEGs are a best practice for GKE with load balancers, the core issue is the absence of health checks, not the use of NEGs; NEGs alone do not enable automatic failover without health checks.

Practice this question →
17
MCQhard

You are designing a data pipeline that ingests streaming data from IoT devices using Cloud IoT Core, processes it with Dataflow, and stores results in BigQuery. The data volume is expected to be 10 GB per day with occasional spikes. You need to minimize processing latency and cost. Which configuration should you choose for the Dataflow pipeline?

A.Use streaming mode with autoscaling and maximum workers set to 10.
B.Use Dataflow Prime for automatic optimization.
C.Use streaming mode with streaming engine enabled and 2 workers.
D.Use batch mode with a fixed number of workers to reduce cost.
AnswerC

Streaming engine reduces latency and cost for moderate throughput.

Why this answer

Streaming mode with Streaming Engine is designed for low-latency, continuous data ingestion from IoT Core, and setting 2 workers minimizes cost while handling the expected 10 GB/day volume with occasional spikes through autoscaling. Streaming Engine offloads state management to the backend, reducing worker overhead and improving latency, making it ideal for this use case. Option B (Dataflow Prime) is not optimal because, although it supports both batch and streaming pipelines and offers automatic optimization, for a small, predictable workload like 10 GB/day, the overhead of Prime's automation may not justify the cost.

Manual tuning with Streaming Engine and a small initial worker count is more cost-effective while still providing low latency. Autoscaling can handle spikes without over-provisioning, making C a better fit.

Exam trap

Google Cloud often tests the misconception that batch mode is cheaper for streaming data, but the trap here is that batch mode incurs higher latency and requires manual triggering, making it unsuitable for real-time IoT pipelines despite lower compute cost per GB.

How to eliminate wrong answers

Option A is wrong because setting maximum workers to 10 may over-provision resources for a 10 GB/day workload, increasing cost without latency benefit, and autoscaling alone doesn't guarantee the low-latency optimization that Streaming Engine provides. Option B is wrong because Dataflow Prime is a premium feature that adds cost for automatic optimization, which is unnecessary for this predictable, moderate-volume streaming workload and does not inherently minimize latency or cost compared to Streaming Engine. Option D is wrong because batch mode is designed for finite, bounded data and introduces higher latency (minutes to hours) due to windowing and triggering, which is unsuitable for real-time IoT streaming data that requires low processing latency.

Practice this question →
18
Multi-Selectmedium

A company is deploying a containerized application on Cloud Run that requires access to a Cloud SQL PostgreSQL instance. The application needs to connect to the database using private IP to minimize latency and avoid public internet exposure. The Cloud Run service and Cloud SQL instance are in the same region and project. The database user and password are stored in Secret Manager. Which two steps should the developer take to enable the connection? (Choose TWO.)

Select 2 answers
A.Grant the Cloud Run service account the Cloud SQL Client role.
B.Set the CLOUD_SQL_CONNECTION_NAME environment variable in the Cloud Run service.
C.Enable the Cloud SQL Admin API.
D.Configure the Cloud Run service to use a VPC connector and set up a private services access connection for Cloud SQL.
E.Deploy the Cloud SQL Auth proxy as a sidecar container in Cloud Run.
AnswersA, D

The Cloud Run service account needs the Cloud SQL Client role (roles/cloudsql.client) to authenticate and connect to Cloud SQL.

Why this answer

The Cloud Run service account needs the Cloud SQL Client role to authenticate with Cloud SQL. Option D is correct because Cloud Run requires a VPC connector to access resources on a VPC network, and Private Services Access must be configured to allow Cloud Run to reach the Cloud SQL private IP. Option B is incorrect because the CLOUD_SQL_CONNECTION_NAME environment variable is used with the Cloud SQL Auth proxy, not with private IP.

Option C is incorrect because enabling the Cloud SQL Admin API is a prerequisite but not a direct step for the connection itself; it is often already enabled. Option E is incorrect because the Cloud SQL Auth proxy is not needed when using private IP.

Practice this question →
19
Multi-Selectmedium

A developer is building a serverless application that processes user-uploaded images. The images are stored in Cloud Storage, and each upload should trigger a Cloud Function that performs image analysis and stores the result in Firestore. Which TWO Google Cloud services are essential for this integration? (Choose 2)

Select 2 answers
A.Cloud Pub/Sub
B.Cloud Storage
C.Cloud Tasks
D.Eventarc
E.Cloud Scheduler
AnswersA, B

Cloud Pub/Sub receives storage notifications and triggers the Cloud Function.

Why this answer

Cloud Storage is the source of events (uploaded images). Cloud Pub/Sub is used to deliver notifications from Cloud Storage to the Cloud Function. Cloud Tasks, Cloud Scheduler, and Eventarc are not required for this pattern.

Practice this question →
20
MCQeasy

You want to deploy a containerized application on Google Cloud that requires no server management and automatically scales based on HTTP traffic. Which service should you use?

A.Cloud Run.
B.Compute Engine.
C.Google Kubernetes Engine.
D.App Engine Flexible Environment.
AnswerA

Cloud Run is serverless and autoscales based on HTTP requests.

Why this answer

(Cloud Run) is correct because Cloud Run is a serverless platform that automatically scales based on HTTP traffic and requires no server management. Option B (Compute Engine) is incorrect because it requires you to manage virtual machines. Option C (Google Kubernetes Engine) is incorrect because it requires cluster management.

Option D (App Engine Flexible Environment) is incorrect because it still runs on VMs and requires more configuration than Cloud Run.

Practice this question →
21
MCQhard

You are designing a multi-region disaster recovery strategy for a Cloud Spanner database. The application requires read-your-writes consistency globally after failover. Which configuration should you choose?

A.Multi-region placement with two read-write regions and a witness.
B.Enterprise edition with multi-region configuration and default leader optimization.
C.Single region with multiple zones.
D.Multi-region placement with one read-write region and two read-only replicas.
AnswerD

This is the standard multi-region configuration for strong consistency and disaster recovery.

Why this answer

A multi-region placement with one read-write region and two read-only replicas provides strong consistency and failover capability while maintaining read-your-writes consistency globally. Option A is incorrect because two read-write regions with a witness can lead to write conflicts and does not guarantee read-your-writes consistency after failover without additional configuration. Option B is incorrect because enterprise edition with default leader optimization is a performance feature, not a disaster recovery configuration.

Option C is incorrect because a single region with multiple zones does not provide multi-region disaster recovery; it only provides zone-level redundancy within one region.

Practice this question →
22
MCQmedium

A company uses Cloud SQL for MySQL. They need to export data to Cloud Storage regularly. What is the recommended method?

A.Use Dataflow to read from Cloud SQL and write to Cloud Storage.
B.Use a cron job on Cloud SQL instance to write to Cloud Storage.
C.Use mysqldump command from a Compute Engine instance.
D.Use Cloud SQL export feature to export to Cloud Storage.
AnswerD

Cloud SQL export is the recommended method.

Why this answer

The recommended method to export data from Cloud SQL for MySQL to Cloud Storage is to use the built-in Cloud SQL export feature (Option D). This feature allows you to export data directly to Cloud Storage in formats like SQL or CSV, providing a secure and managed process without external tools. Option A (Dataflow) is not recommended for simple exports as it adds unnecessary complexity and cost.

Option B (cron job on Cloud SQL instance) is not supported; Cloud SQL does not allow running cron jobs on the instance. Option C (mysqldump from Compute Engine) is manual, requires additional security configurations, and is less efficient than the built-in export.

Practice this question →
23
Multi-Selecthard

You are designing a serverless application using Cloud Functions that processes events from Cloud Storage and Cloud Pub/Sub. The function must be idempotent and handle duplicate events. Which three best practices should you implement? (Choose THREE.)

Select 3 answers
A.Generate a unique idempotency key for each event and store processed keys in a database.
B.Invoke the function synchronously to avoid duplicates.
C.Implement a deduplication logic that checks the event's publish time against a threshold.
D.Use Cloud Firestore to record the state of each processed event.
E.Set the function timeout to maximum (540 seconds) to ensure processing completes.
AnswersA, C, D

Idempotency keys prevent duplicate processing.

Why this answer

Generating a unique idempotency key for each event and storing processed keys in a database (such as Cloud Firestore) ensures that if the same event is delivered multiple times (e.g., due to at-least-once delivery semantics in Cloud Pub/Sub or Cloud Storage notifications), the function can check the key before processing and skip duplicates. This pattern is essential for idempotent serverless functions, as Cloud Functions may be retried on failure or receive duplicate events from the source.

Exam trap

The trap here is that candidates often confuse timeout settings or synchronous invocation with duplicate prevention, but neither addresses the root cause of duplicate events from at-least-once delivery systems. In Google Cloud, Cloud Functions may receive duplicate events from Cloud Storage notifications or Pub/Sub, making idempotency keys and state tracking essential.

Practice this question →
24
Multi-Selectmedium

A team is building a microservices architecture on Google Cloud. They want services to communicate asynchronously to avoid tight coupling. They also need to guarantee at-least-once delivery of messages. Which two services should they use together? (Choose TWO.)

Select 2 answers
A.Cloud Run (HTTP)
B.Cloud Endpoints
C.Cloud Tasks
D.Cloud Pub/Sub
E.Cloud Datastore
AnswersC, D

Cloud Tasks provides asynchronous task queues with retry and at-least-once delivery.

Why this answer

To achieve asynchronous communication with at-least-once delivery, the team should use Cloud Tasks (option C) for reliable task execution with retries and Cloud Pub/Sub (option D) for asynchronous messaging with guaranteed at-least-once delivery. Cloud Run (HTTP) is synchronous, Cloud Endpoints is an API gateway, and Cloud Datastore is a database, so none of these meet the async and delivery requirements.

Practice this question →
25
MCQeasy

A team wants to use Cloud Scheduler to trigger a Cloud Function that calls an external API every hour. The Cloud Function requires an API key for the external service. How should the team securely provide the API key to the function?

A.Pass the API key as an environment variable in the function's runtime environment.
B.Store the API key in Secret Manager and access it via the Secret Manager API in the function code.
C.Hardcode the API key in the Cloud Function source code.
D.Store the key in Cloud Storage with customer-supplied encryption key (CSEK).
AnswerB

Secret Manager provides secure storage and access control for secrets.

Why this answer

Secret Manager is Google Cloud's recommended service for storing secrets like API keys. It integrates natively with Cloud Functions, allowing secure access without exposing the key in environment variables or code. Option A is insecure because environment variables can be visible in the function configuration.

Option C is insecure because hardcoding exposes the key in the source code. Option D is not the best practice; while Cloud Storage with CSEK provides encryption, it is not designed for secrets management and requires more complex access control.

Practice this question →
26
MCQmedium

A developer is integrating a legacy on-premises application with Cloud Storage. The application generates files that must be uploaded to a bucket. The developer cannot install any additional software on the on-premises server. Which approach should the developer use?

A.Use the gcloud CLI to copy files to the bucket.
B.Generate a signed URL and use an HTTP PUT request from the application.
C.Mount the bucket using Cloud Storage FUSE.
D.Deploy a Cloud Function that accepts file uploads and writes to the bucket.
AnswerB

A signed URL enables direct HTTP PUT uploads without any additional software on the client, meeting all requirements.

Why this answer

A signed URL allows the application to upload files directly via HTTP PUT without requiring any additional software installation on the on-premises server. The developer only needs to generate a signed URL (using Cloud Storage client libraries or gcloud CLI on another system) and then make a simple HTTP request from the application. Option A is wrong because the gcloud CLI would need to be installed on the server, which violates the constraint.

Option C is wrong because Cloud Storage FUSE requires installing a FUSE driver on the server. Option D is wrong because deploying a Cloud Function introduces extra complexity and still requires the application to send requests to the function, which would need additional logic.

Practice this question →
27
MCQeasy

A company wants to send events from a custom application to Cloud Pub/Sub, then process them with a Cloud Run service. The application runs on Compute Engine. What is the simplest way for the application to authenticate to Pub/Sub?

A.Use an API key for the Pub/Sub API.
B.Embed a service account JSON key in the application code.
C.Set up Cloud Endpoints to proxy the Pub/Sub requests.
D.Attach a service account to the Compute Engine instance with necessary Pub/Sub roles.
AnswerD

Attaching a service account to the Compute Engine instance allows automatic credential retrieval via the metadata server, making it the simplest and most secure approach.

Why this answer

Attaching a service account to the Compute Engine instance allows the application to automatically obtain credentials via the instance metadata server, which is the simplest and most secure method. Option A is wrong because API keys are not used for authentication to Pub/Sub; they lack identity-based access control. Option B is wrong because embedding a service account JSON key in the code is insecure and not best practice.

Option C is wrong because Cloud Endpoints adds unnecessary complexity for this use case and is not the simplest approach.

Practice this question →
28
Multi-Selecteasy

Which two statements are true about Cloud Load Balancing? (Choose two.)

Select 2 answers
A.All load balancers support IPv6 client traffic.
B.SSL proxy load balancer supports non-HTTP traffic.
C.Global external HTTP(S) load balancer can distribute traffic across multiple regions.
D.Internal TCP/UDP load balancer can be used for traffic within a VPC.
E.Network load balancer can only balance TCP traffic.
AnswersC, D

This is a key feature of global load balancers.

Why this answer

The global external HTTP(S) load balancer is a proxy-based, Layer 7 load balancer that uses a single anycast IP address and can distribute traffic across backend instances in multiple regions, enabling global load balancing with automatic failover. Option D is correct because the internal TCP/UDP load balancer is a regional, pass-through load balancer that operates at Layer 4 and is designed to distribute traffic among instances within the same VPC and region, using RFC 1918 private IP addresses.

Exam trap

The trap here is that candidates often assume all load balancers support IPv6 or that SSL proxy can handle any TCP traffic, but Google Cloud specifically restricts SSL proxy to TCP with SSL termination and the Network load balancer to both TCP and UDP, not just TCP.

Practice this question →
29
MCQmedium

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

A.Configure Cloud Run to only accept revisions from a specific source repository.
B.Use IAM conditions on the Cloud Run service account to allow only main branch builds.
C.Use Cloud Build triggers with a branch filter set to ^main$.
D.Create a separate Cloud Build trigger for each branch and manually disable non-main triggers.
AnswerC

Branch filters in triggers exactly match this requirement.

Why this answer

Cloud Build triggers support branch filters to control which branches trigger builds. By setting the branch filter to ^main$, only commits to the main branch will initiate the build and subsequent deployment to Cloud Run. Option A is wrong because Cloud Run does not filter revisions by source repository; it deploys whatever image is pushed.

Option B is wrong because IAM conditions control who can perform actions, not which branch triggered a build. Option D is wrong because it requires manual management and is error-prone; Cloud Build automatically handles branch filtering.

Practice this question →
30
MCQhard

A team is designing a data pipeline that uses Cloud Storage for input files, Cloud Functions to process each file, and writes results to BigQuery. The pipeline must guarantee exactly-once processing of each file, even if the function fails and retries. Which approach should the team take?

A.Use Cloud Storage triggers with event filters and configure the function to delete the file after successful processing
B.Use Cloud Pub/Sub to store file notification events and use Dataflow for processing with exactly-once guarantees
C.Use Cloud Tasks to queue file processing tasks and configure retries with deduplication
D.Use Cloud Workflows to orchestrate the pipeline and use idempotent writes to BigQuery
AnswerB

Dataflow provides exactly-once processing semantics when used with Pub/Sub.

Why this answer

Using Cloud Pub/Sub to store file notification events and Dataflow for processing provides exactly-once guarantees. Option A may lead to duplicates because Cloud Storage triggers are at-least-once. Option C with Cloud Tasks can deduplicate tasks but processing may still be at-least-once if not idempotent.

Option D with Cloud Workflows does not inherently provide exactly-once.

Practice this question →
31
MCQhard

A security audit reveals that a service account has been granted excessive permissions. The exhibit shows the IAM policy for a project. Which statement best describes the security issue?

A.The policy is missing an explicit deny for public access.
B.The service account has more permissions than necessary because objectAdmin includes all objectViewer permissions.
C.The service account should have roles/storage.admin instead.
D.The service account has both admin and viewer roles, causing a conflict.
AnswerB

The viewer role is redundant and indicates excessive permissions.

Why this answer

The objectAdmin role (roles/storage.objectAdmin) inherently includes all permissions of the objectViewer role (roles/storage.objectViewer). Granting both roles to the same service account is redundant and indicates over-permissioning. Option A is incorrect because IAM policies are allow-by-default; missing an explicit deny is not the issue here.

Option C is incorrect because roles/storage.admin would be even more permissive than the current set of roles. Option D is incorrect because there is no conflict; IAM roles are additive, not conflicting.

Practice this question →
32
MCQmedium

Refer to the exhibit. A Cloud Run service is unable to connect to a Cloud SQL instance. The log entry shows the following. What is the most likely cause?

A.The Cloud Run service account lacks the Cloud SQL Client role.
B.The database user credentials are incorrect.
C.The Cloud SQL instance is in a different region than the Cloud Run service.
D.The Cloud SQL instance has a public IP assigned.
AnswerA

Without the cloudsql.client role, the VPC connector cannot authorize the connection, leading to a connection refused error.

Why this answer

The Cloud Run service needs the Cloud SQL Client role (roles/cloudsql.client) on its service account to authorize connections to Cloud SQL. Without this IAM permission, the connection attempt is denied, resulting in the 'unable to connect' error shown in the log. This is the most common cause of connectivity failures between Cloud Run and Cloud SQL.

Exam trap

The PCD exam often tests the misconception that database credentials (Option B) are the primary cause of Cloud Run-to-Cloud SQL failures, but the actual issue is almost always missing IAM permissions on the service account.

How to eliminate wrong answers

Option B is wrong because incorrect database user credentials would produce an authentication error (e.g., 'Access denied for user') rather than a connection-level failure, and the log entry does not indicate an authentication failure. Option C is wrong because Cloud Run and Cloud SQL can connect across regions using the private IP path or Cloud SQL proxy; region mismatch does not inherently block connectivity. Option D is wrong because a public IP on the Cloud SQL instance does not prevent Cloud Run from connecting — in fact, Cloud Run can connect to public IP instances via the Cloud SQL proxy or authorized networks, and the issue is about IAM permissions, not IP type.

Practice this question →
33
Multi-Selecthard

A company has a Cloud Function that processes events from Cloud Pub/Sub. The function uses HTTP client libraries to call external APIs. The team notices that the function sometimes times out during high traffic. Which THREE actions should they take to improve reliability? (Choose THREE.)

Select 3 answers
A.Increase the allocated memory to 2GB.
B.Use Cloud Tasks to queue the API call invocations and process them asynchronously from the function.
C.Implement retry logic with exponential backoff for external API calls.
D.Increase the Cloud Function timeout to 540 seconds (max).
E.Reduce the maximum number of concurrent function instances.
AnswersB, C, D

Decouples the calling logic, allowing the function to ack messages quickly and process later.

Why this answer

(Use Cloud Tasks to queue the API call invocations and process them asynchronously from the function) is correct because it decouples the external API calls from the function execution, reducing the risk of timeouts during high traffic. Option C (Implement retry logic with exponential backoff for external API calls) is correct to handle transient failures from external APIs gracefully. Option D (Increase the Cloud Function timeout to 540 seconds) is correct to allow the function more time to complete processing, especially when waiting for external responses.

Option A (Increase the allocated memory to 2GB) is incorrect because while more memory can improve performance for compute-intensive tasks, it does not directly address timeouts caused by external API dependencies. Option E (Reduce the maximum number of concurrent function instances) is incorrect because reducing concurrency would decrease throughput and could worsen latency under high load, not improve reliability.

Practice this question →
34
MCQhard

A retail company processes customer orders through a pipeline. New orders are written to a Cloud Storage bucket as JSON files. A Cloud Function (currently triggered directly by Cloud Storage finalize events) parses the order and sends it to a third-party fulfillment service via an HTTP POST. As order volume grows, the team observes that the Cloud Function often times out (60s default) because the fulfillment service is slow. The team wants to decouple the processing to improve reliability. The order must be attempted at least once, and if the fulfillment service fails, retries should be exponential with a maximum of 5 attempts. Which solution should the team implement?

A.Use Cloud Tasks to create a queue that targets the Cloud Function. Configure the queue with exponential backoff and max retries of 5. Set the Cloud Function trigger to be HTTP instead of Cloud Storage.
B.Keep the Cloud Storage trigger, but increase the Cloud Function timeout to 540 seconds and add retry logic in the function code.
C.Use Pub/Sub notifications from Cloud Storage to a Pub/Sub topic, with a subscription that pushes to the Cloud Function. Enable dead letter topics for failed deliveries.
D.Replace the Cloud Function with a Cloud Run job that polls Cloud Storage for new files and sends orders to the fulfillment service. Use Cloud Scheduler to run the job every 5 minutes.
AnswerA

Cloud Tasks provides configurable retries, decouples the processing, and ensures at-least-once delivery. The HTTP-triggered function processes tasks from the queue.

Why this answer

Cloud Tasks provides the exact retry semantics required: exponential backoff and a maximum of 5 retry attempts. By using an HTTP-triggered Cloud Function and a Cloud Tasks queue, the order processing is decoupled from the Cloud Storage event, allowing the function to return quickly and rely on Cloud Tasks to handle retries if the fulfillment service is slow or fails. This ensures at-least-once delivery with controlled retries.

Option B is incorrect because increasing the timeout does not provide retries; the function would still block for up to 540 seconds without retrying on failure. Option C is suboptimal because Pub/Sub's push delivery retry configuration is less flexible than Cloud Tasks for HTTP endpoints, and it lacks built-in exponential backoff with a configurable max attempts without additional setup. Option D is inefficient because polling every 5 minutes introduces latency and does not provide real-time processing.

Practice this question →
35
Drag & Dropmedium

Drag and drop the steps to troubleshoot a failed Cloud Build in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Troubleshooting involves reviewing logs and configuration, then fixing and re-running.

Practice this question →
36
MCQhard

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They want to automatically build and deploy each service when a new tag is pushed to its repository. They also need to run integration tests against a staging environment before promoting to production. Which service should they use to orchestrate the pipeline?

A.Deployment Manager with a template
B.Cloud Deploy with a delivery pipeline
C.Cloud Build with a build trigger on tag push
D.Cloud Run with continuous deployment
AnswerC

Cloud Build can be triggered by a tag push, build the container, and deploy to GKE. It also supports running tests.

Why this answer

Cloud Build with a build trigger on tag push is the correct choice because it natively supports event-driven pipelines triggered by Git tags, enabling automatic build and deployment of each microservice. Combined with Cloud Build's ability to run integration tests in a staging environment and then promote to production, it provides a complete CI/CD solution for GKE without additional orchestration services.

Exam trap

Google Cloud often tests the distinction between CI/CD orchestration (Cloud Build) and delivery/rollout management (Cloud Deploy), leading candidates to choose Cloud Deploy because it sounds like a pipeline orchestrator, but it requires an external CI trigger to start the process.

How to eliminate wrong answers

Option A is wrong because Deployment Manager is an infrastructure-as-code tool for provisioning GCP resources, not a CI/CD pipeline orchestrator; it cannot trigger builds or deployments based on Git tag pushes. Option B is wrong because Cloud Deploy is a continuous delivery service that manages rollout strategies (e.g., canary, blue/green) but relies on an external CI system like Cloud Build to trigger the pipeline; it does not natively handle build triggers on tag push. Option D is wrong because Cloud Run with continuous deployment is designed for serverless container deployments, not for orchestrating multi-service CI/CD pipelines on GKE, and it lacks native support for tag-based triggers and staging-to-production promotion workflows.

Practice this question →
37
MCQmedium

A company is migrating a legacy monolithic application to Google Cloud. They want to minimize code changes and operational overhead while improving scalability. The application currently uses a relational database and stores user-uploaded images on a local filesystem. Which combination of Google Cloud services should they use?

A.Cloud Spanner for the database and Cloud Storage for images
B.Cloud Firestore for the database and Cloud Storage with Cloud CDN for images
C.Cloud SQL for the database and Cloud Storage with Cloud CDN for images
D.Compute Engine with attached SSD persistent disks for both database and images
AnswerC

Cloud SQL provides a managed relational database with minimal changes, and Cloud Storage with CDN serves images efficiently at scale.

Why this answer

Cloud SQL provides a fully managed relational database that requires minimal code changes when migrating from an existing relational database, while Cloud Storage with Cloud CDN handles user-uploaded images with scalable object storage and low-latency content delivery. This combination minimizes operational overhead by eliminating the need to manage database servers or file servers, and improves scalability through automatic replication and global edge caching.

Exam trap

Google Cloud often tests the misconception that any fully managed database (like Spanner or Firestore) is suitable for a legacy relational migration, but the trap here is that candidates overlook the requirement to minimize code changes and choose a NoSQL or globally distributed database that forces significant application rewrites.

How to eliminate wrong answers

Option A is wrong because Cloud Spanner is a globally distributed, horizontally scalable database designed for high-availability and strong consistency across regions, which introduces unnecessary complexity and cost for a legacy application that likely does not require global scale; it also requires significant code changes to adapt to Spanner's specific SQL dialect and consistency model. Option B is wrong because Cloud Firestore is a NoSQL document database that does not support relational queries, joins, or ACID transactions in the same way as a traditional relational database, forcing major application rewrites. Option D is wrong because Compute Engine with attached SSD persistent disks requires manual management of database software, backups, and failover, and does not provide the scalability or operational simplicity of managed services; it also lacks a CDN for image delivery, leading to higher latency and operational overhead.

Practice this question →
38
MCQhard

Refer to the exhibit. A team is deploying a Cloud Function that needs to connect to a Cloud SQL instance in a VPC. They have set up a VPC connector. After deployment, the function fails to connect to the database. What is the most likely cause?

A.The VPC connector is in a different region than the function
B.The function's service account does not have permissions to use the VPC connector
C.The environment variable DB_HOST is misspelled
D.The database firewall rules do not allow traffic from the VPC connector's subnet
AnswerA

The VPC connector and Cloud Function must be in the same region.

Why this answer

The VPC connector must be in the same region as the Cloud Function. If they are in different regions, the function cannot use the connector to reach resources in the VPC. Option B is incorrect because the service account needs the 'roles/cloudfunctions.serviceAgent' role to use the VPC connector, but this is usually granted automatically; the more common issue is region mismatch.

Option C is incorrect because a misspelled environment variable would cause a connection failure, but it is not the most likely cause given the setup shown in the exhibit. Option D is incorrect because Cloud SQL private IP connections are managed by VPC peering, not by database firewall rules; firewall rules would apply to public IP, not private IP via VPC connector.

Practice this question →
39
MCQeasy

A developer is deploying a 2nd gen Cloud Function that needs to connect to a Cloud SQL MySQL instance. The Cloud SQL instance is configured with a private IP only. The Cloud Function is deployed with a VPC connector that is connected to the same VPC network as the Cloud SQL instance. The developer has granted the Cloud Function's service account the Cloud SQL Client role. However, when the function is invoked, connection attempts to the Cloud SQL instance time out. The Cloud Function code uses the MySQL connector with the private IP address of the Cloud SQL instance. The developer has verified that the VPC connector is healthy and that the Cloud SQL instance is running. Which additional configuration is most likely required?

A.Modify the connection string to require SSL/TLS.
B.Deploy the Cloud SQL Auth proxy as an additional container in the Cloud Function.
C.Configure Private Services Access to establish a VPC peering between the VPC network and the Cloud SQL service network.
D.Assign a public IP to the Cloud SQL instance and configure the function to use it.
AnswerC

Private Services Access creates the necessary route for the VPC connector to reach the Cloud SQL private IP range.

Why this answer

Even though the VPC connector is on the same VPC network as Cloud SQL, the Cloud SQL private IP address is allocated from a private services access range that is not automatically routed. You must set up Private Services Access to create a route from the VPC to the Cloud SQL private IP range. Without this, traffic from the VPC connector cannot reach the Cloud SQL instance.

Option A is incorrect because modifying the connection string to require SSL/TLS would not resolve the routing issue; it would only affect encryption. Option B is incorrect because the Cloud SQL Auth proxy is not required for private IP connections; it is typically used for connections without private IP or for IAM authentication, but it cannot fix a routing problem. Option D is incorrect because assigning a public IP would defeat the purpose of using private IP and is not necessary if the routing is properly configured.

Practice this question →
40
MCQhard

A developer is integrating an App Engine standard environment app with Cloud Storage. The app needs to read objects from a bucket that is in a different project. The developer has granted the App Engine service account the Storage Object Viewer role on the bucket. However, the app still gets a 403 error when trying to read objects. What is the most likely cause?

A.The service account needs to be downloaded as a JSON key and added to the app configuration.
B.The bucket has uniform bucket-level access disabled, so ACLs may override IAM permissions.
C.The bucket is in a VPC Service Controls perimeter that blocks access from the App Engine service account.
D.The service account is from the app's project, not the bucket's project, and the bucket's IAM policy may not include the service account.
AnswerD

Cross-project IAM requires adding the service account from the source project to the bucket's IAM policy in the destination project.

Why this answer

The App Engine service account belongs to the app's project, not the bucket's project. Cross-project access requires the service account to be explicitly granted the Storage Object Viewer role in the bucket's IAM policy. If the role was granted but the policy hasn't propagated or is misconfigured, a 403 error can still occur.

Option A is incorrect because downloading a JSON key is unnecessary and insecure; service accounts can be used across projects without key files. Option B is incorrect because uniform bucket-level access being disabled relates to ACLs, but IAM permissions still apply; the issue is cross-project IAM, not ACL/ IAM conflict. Option C is incorrect while VPC Service Controls can block access, the typical error is different and would involve the perimeter, not just a 403 on object reads; the question describes a simple cross-project permission issue.

Exam trap

Candidates often think the error is due to missing ACLs or VPC perimeters, but the real issue is that the IAM role was granted at the project level rather than the bucket level, or the service account is not in the bucket's IAM policy.

Practice this question →
41
MCQeasy

You need to monitor the CPU usage of a Compute Engine instance and trigger an alert when it exceeds 80% for 5 minutes. Which Google Cloud service should you use?

A.Cloud Debugger
B.Cloud Monitoring
C.Cloud Logging
D.Error Reporting
AnswerB

Cloud Monitoring provides metrics and alerting.

Why this answer

Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it provides metrics, dashboards, and alerting policies for Compute Engine instances. You can create a metric-based alert condition that triggers when the CPU utilization metric exceeds 80% for a duration of 5 minutes, using the MQL or policy builder.

Exam trap

The trap here is that candidates confuse Cloud Logging with Cloud Monitoring because both are part of the Google Cloud operations suite, but Logging handles logs while Monitoring handles metrics and alerts.

How to eliminate wrong answers

Option A is wrong because Cloud Debugger is used to inspect the state of a running application in production without stopping it, not for monitoring CPU usage or triggering alerts. Option C is wrong because Cloud Logging collects and stores log data (e.g., application logs, system logs), but it does not natively support metric-based alerting on CPU utilization thresholds over time. Option D is wrong because Error Reporting aggregates and analyzes application errors (e.g., stack traces), not system-level metrics like CPU usage.

Practice this question →
42
MCQmedium

Your organization runs a multi-region application on Cloud Run that serves an API. The API is consumed by clients worldwide. You want to reduce latency by routing users to the nearest regional Cloud Run service. Currently, all traffic goes to a single Cloud Run service in us-central1. You have set up additional Cloud Run services in europe-west1 and asia-east1. Each service is fronted by an external HTTPS load balancer with a regional backend. You want to use a single global anycast IP address that automatically directs users to the closest healthy backend. You also need to support HTTPS with a custom domain and a Google-managed certificate. What should you do?

A.Create a global external HTTPS load balancer with serverless NEGs pointing to each regional Cloud Run service, and attach a Google-managed certificate.
B.Enable anycast on the Cloud Run service by selecting the 'global' setting in the Cloud Run region selection.
C.Use Cloud DNS with geo-routing policy to point users to the appropriate regional load balancer IP based on their location.
D.Configure Cloud CDN in front of the Cloud Run services to cache responses at edge locations.
AnswerA

The global load balancer uses anycast IP and routes to the closest healthy backend, and serverless NEGs integrate with Cloud Run.

Why this answer

A global external HTTPS load balancer with serverless NEGs (Network Endpoint Groups) can route traffic to the nearest healthy backend (Cloud Run service) via a single anycast IP address, leveraging Google Front Ends (GFEs) for global anycast. This also supports a Google-managed certificate attached to the load balancer for HTTPS with a custom domain. Option B is incorrect because Cloud Run itself does not support anycast; it is a regional service.

Option C is incorrect because geo-routing DNS does not provide a single anycast IP; it returns different IPs based on location, which can cause issues with client DNS caching and doesn't provide true anycast routing. Option D is incorrect because Cloud CDN is for caching content, not for routing traffic based on proximity.

Practice this question →
43
MCQeasy

A developer is building a microservices application on Cloud Run. One service needs to make authenticated HTTP requests to another Cloud Run service in the same project. What is the best practice for authentication?

A.Use API keys
B.Use Cloud Run's built-in service-to-service authentication with the default compute service account
C.Use OAuth2 client credentials
D.Use IAM roles on the target service and call it with the appropriate identity token from the metadata server
AnswerD

This is the recommended approach: use a service account with the roles/run.invoker role on the target service and obtain an identity token from the metadata server.

Why this answer

Cloud Run service-to-service authentication is best done using an identity token from the metadata server and setting IAM on the target service. Option A is not recommended as API keys are for external clients. Option B uses the default compute service account, which may have broader permissions than needed and is not the best practice for service-to-service auth.

Option C uses OAuth2 client credentials, which are for external applications, not for internal service-to-service calls.

Practice this question →
44
Multi-Selectmedium

A company is integrating a legacy application with Google Cloud using Cloud VPN. The application must be accessed from multiple remote offices over the internet. Which TWO technologies should the company use to ensure secure and reliable connectivity? (Choose TWO.)

Select 1 answer
A.Cloud Interconnect
B.Private Google Access
C.Cloud NAT
D.Direct Peering
E.Cloud VPN
AnswersE

Cloud VPN creates encrypted tunnels over the internet, meeting both security and reliability requirements for multiple remote offices.

Why this answer

Cloud VPN (Option E) is correct because it creates secure site-to-site VPN tunnels over the internet, allowing encrypted communication from each remote office. This meets the requirement for connectivity over the internet. Cloud Interconnect (Option A) is incorrect because it provides dedicated private connections, not over the internet, and does not satisfy the 'over the internet' requirement.

Option B (Private Google Access) enables on-premises hosts to use private IPs to reach Google APIs, not for inter-site connectivity. Option C (Cloud NAT) enables outbound internet access from private instances, not for site-to-site. Option D (Direct Peering) provides direct connection between on-prem and Google but is not designed for hub-spoke topologies across multiple offices and also does not operate over the internet.

Exam trap

Candidates often assume Cloud Interconnect works over the internet, but it is a dedicated private connection. The question explicitly states 'over the internet,' so only Cloud VPN qualifies.

Practice this question →
45
MCQeasy

A developer wants to allow a Compute Engine instance to send messages to a Pub/Sub topic. What is the recommended way to grant permissions?

A.Generate an API key for the instance and include it in HTTP requests.
B.Create a service account and assign the Pub/Sub Publisher role; attach the service account to the instance.
C.Use the instance's default Compute Engine service account and assign the Pub/Sub Publisher role to it.
D.Store the service account key file directly on the instance.
AnswerC

The default service account is convenient and secure.

Why this answer

The default Compute Engine service account is automatically created for each project and attached to instances by default. By assigning the Pub/Sub Publisher role to this service account, the instance can authenticate and publish messages to a Pub/Sub topic without managing keys or credentials, following Google Cloud's recommended IAM best practices.

Exam trap

A common trap is to assume that a dedicated, custom service account must be created for each instance. However, the default Compute Engine service account is pre-configured and sufficient for many use cases, simplifying credential management. Option B is a valid approach but is not the *recommended* default; option C is simpler and follows best practices.

How to eliminate wrong answers

Option A is wrong because API keys are used for identifying projects calling APIs that do not require a user or service account, but they are not suitable for authenticating a Compute Engine instance to a Pub/Sub topic; they lack the granularity and security of IAM roles. Option B is wrong because while creating a dedicated service account and assigning the Pub/Sub Publisher role is a valid approach, it is not the recommended way when a default service account already exists and can be used; the question asks for the recommended way, which leverages the existing default service account to avoid unnecessary overhead. Option D is wrong because storing a service account key file directly on the instance introduces security risks (key exposure, rotation complexity) and violates the principle of using instance metadata and IAM roles for authentication; the recommended approach is to use the instance's attached service account without downloading keys.

Practice this question →
46
MCQmedium

A company is running a critical application on Google Kubernetes Engine (GKE) that stores state in a Cloud SQL PostgreSQL instance. The application's latency-sensitive frontend needs to read data from Cloud SQL with minimal latency. The team wants to reduce read latency and offload read traffic from the primary database. What should they do?

A.Migrate the database to Cloud Spanner for better read scalability.
B.Use Memorystore for Redis as a cache layer between the application and Cloud SQL.
C.Create a read replica of the Cloud SQL instance and direct read traffic to the replica.
D.Use Cloud CDN to cache database responses.
AnswerC

Read replicas handle read-only queries, reducing load on the primary and improving read latency.

Why this answer

Creating a read replica of the Cloud SQL PostgreSQL instance allows read-heavy, latency-sensitive traffic to be offloaded from the primary database. The replica handles SELECT queries independently, reducing load on the primary and lowering read latency for the frontend, as replicas are typically in the same region and can serve data with minimal additional delay.

Exam trap

The PCD exam often tests the misconception that caching (Memorystore or CDN) is the only way to reduce read latency, but the question specifically asks to offload read traffic from the primary database, which a read replica achieves directly without introducing cache coherence complexity.

How to eliminate wrong answers

Option A is wrong because migrating to Cloud Spanner would introduce unnecessary complexity and cost for a workload that only needs read offloading; Spanner is designed for global, strongly consistent transactions, not simply reducing read latency from a single-region PostgreSQL instance. Option B is wrong because Memorystore for Redis adds a caching layer that requires application code changes to manage cache invalidation and consistency, and it does not directly offload read traffic from Cloud SQL—it caches data, but stale reads can occur if not carefully managed. Option D is wrong because Cloud CDN caches static content at edge locations and is not designed to cache dynamic database query responses; it would not reduce read latency for application-level database reads and would introduce staleness issues.

Practice this question →
47
MCQeasy

A company wants to trigger a Cloud Run job every time a new file is uploaded to a Cloud Storage bucket. Which integration should be used?

A.Use Cloud Pub/Sub notifications from the bucket and create a push subscription to the Cloud Run job.
B.Use Cloud Scheduler to poll the bucket and invoke the Cloud Run job every minute.
C.Use Eventarc to create a trigger that routes Cloud Storage events to the Cloud Run job.
D.Use Cloud Functions to listen for storage events and then call the Cloud Run job via HTTP.
AnswerC

Eventarc listens to events and delivers them to Cloud Run jobs.

Why this answer

Eventarc can route Cloud Storage events (like object finalize) to Cloud Run jobs via CloudEvents. Option A is wrong because Cloud Scheduler is time-based, not event-based. Option B is wrong because Cloud Functions can be triggered by storage events, but the question asks for Cloud Run job.

Option D is wrong because Pub/Sub alone cannot directly trigger a Cloud Run job without a subscription or push endpoint.

Practice this question →
48
MCQhard

Refer to the exhibit. A developer configured a Pub/Sub push subscription to a Cloud Run service. Messages are not being delivered to the Cloud Run service. The developer verified that the service is running and the IAM permissions are correct. What is the most likely issue?

A.The service account does not have the pubsub.publisher role
B.The OIDC token audience does not match the Cloud Run service's URL
C.The push endpoint URL is not a valid HTTPS endpoint
D.The ackDeadlineSeconds is too short for the Cloud Run service to process messages
AnswerB

Correct. The OIDC token audience must exactly match the Cloud Run service's URL. If the audience in the push subscription configuration differs from the service URL, authentication fails and messages are not delivered.

Why this answer

The most likely issue is that the OIDC token audience does not match the Cloud Run service's URL (Option B). For push subscriptions with OIDC authentication, the audience must exactly match the service URL. Option A is incorrect because the service account needs the token creator role, not the pubsub.publisher role.

Option C is incorrect because the endpoint shown is HTTPS. Option D is incorrect because ackDeadlineSeconds affects processing time, not delivery; messages not being delivered indicates an authentication or endpoint issue.

Practice this question →
49
MCQhard

A company runs a microservices application on Cloud Run. One service, `order-processor`, is invoked asynchronously via a Cloud Tasks queue. The Cloud Tasks queue is configured with an HTTP target pointing to the `order-processor` service URL. The service requires authentication (no unauthenticated invocations). The service account used by Cloud Tasks to invoke the service is `cloud-tasks-system@project.iam.gserviceaccount.com`. After deploying a new revision of `order-processor` using Cloud Build and Cloud Deploy, the team notices that tasks are failing with a 403 status. The Cloud Run service logs show the requests are reaching the service but returning 403. The previous revision worked fine. What is the most likely cause?

A.The IAM policy binding granting the Cloud Tasks service account the Cloud Run Invoker role was removed during the deployment.
B.The new revision has a bug causing a permission denied error when processing tasks.
C.The Cloud Tasks queue needs to be configured with an OIDC token and audience for the new revision.
D.The Cloud Tasks queue's HTTP target URL needs to be updated to point to the new revision's specific URL.
AnswerA

If the deployment pipeline modifies IAM policies, the binding for the Cloud Tasks service account may have been removed, causing 403 errors.

Why this answer

When Cloud Run requires authentication, the invoker's service account must be granted the roles/run.invoker role on the Cloud Run service. Deploying a new revision with Cloud Build and Cloud Deploy may overwrite IAM policy bindings if the deployment pipeline includes IAM policy updates or uses a different service account. In this scenario, the IAM binding for the Cloud Tasks service account was likely removed or not applied to the new revision, causing the 403 error.

Option B is incorrect because the service works correctly; the 403 is returned before the service processes the request, indicating an authorization failure, not an internal bug. Option C is incorrect because the OIDC token configuration on the queue is independent of the revision and does not affect IAM permissions. Option D is incorrect because the Cloud Tasks queue's HTTP target URL points to the Cloud Run service, not a specific revision, so it does not need to be updated.

Practice this question →
50
Matchingmedium

Match each Firebase feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

NoSQL document database with real-time sync

Backend service for user sign-in

Send push notifications across platforms

Change app behavior without publishing updates

Measure app performance from the user's perspective

Why these pairings

Firebase features include Cloud Firestore (NoSQL database), Authentication (user login), and Cloud Functions (backend code). Common confusions: mixing NoSQL vs relational, and hosting vs functions.

Practice this question →
51
MCQeasy

A company is using Cloud Functions (2nd gen) to process files uploaded to Cloud Storage. The function needs to access a Cloud SQL (PostgreSQL) database. What is the most secure way to store and provide the database password to the function?

A.Use Cloud KMS to encrypt the password and store it in environment variables.
B.Hardcode the password in the function code.
C.Use Secret Manager and access it via the Secret Manager API within the function.
D.Store the password in a Cloud Storage bucket and read it at startup.
AnswerC

Secret Manager is the secure way to store and access secrets with fine-grained IAM.

Why this answer

Secret Manager is the recommended service for storing secrets with IAM controls. Option A is wrong because Cloud Storage buckets may have broader access and are not designed for secrets. Option B is wrong because hardcoding is insecure.

Option D is wrong because KMS encrypts data but Secret Manager provides a simpler and more integrated secret storage solution.

Practice this question →
52
Multi-Selecthard

A company is deploying a microservices application on Google Cloud. They want to securely store and access secrets (e.g., API keys, database passwords) across multiple services. They need to minimize operational overhead and ensure secrets are automatically rotated. Which TWO approaches should they use?

Select 2 answers
A.Use Secret Manager with a Cloud Function that automatically rotates secrets on a schedule.
B.Store secrets in Cloud Storage buckets encrypted with Cloud KMS (CMEK).
C.Use Secret Manager to store secrets and enable automatic rotation.
D.Store secrets in a Cloud SQL database and use Cloud Scheduler to rotate them.
E.Store secrets in Cloud Firestore and use Firestore triggers to rotate them.
AnswersA, C

Secret Manager's built-in rotation can be used with Cloud Functions to implement custom rotation logic.

Why this answer

Secret Manager is Google Cloud's native service for storing and managing secrets with built-in support for automatic rotation. By enabling automatic rotation on a secret, you eliminate the need for custom infrastructure like Cloud Functions to handle the rotation logic, thereby minimizing operational overhead. Option A is correct because it uses Secret Manager with a Cloud Function for rotation, which is a valid approach, but Option C is more aligned with the requirement to minimize overhead since automatic rotation is a native feature.

Exam trap

The trap here is that candidates may think a custom rotation mechanism (like a Cloud Function) is always required, overlooking Secret Manager's native automatic rotation feature, which directly reduces operational overhead.

Practice this question →
53
Multi-Selectmedium

Your company uses Cloud SQL for MySQL to store transactional data. You need to perform a point-in-time recovery (PITR) to recover from a logical error that occurred 30 minutes ago. Which two prerequisites must be met? (Choose TWO.)

Select 2 answers
A.High availability (HA) is configured.
B.Binary logging is enabled.
C.Automated backups are enabled.
D.The backup window is set to a time before the incident.
E.A read replica is configured.
AnswersB, C

Binary logs enable PITR.

Why this answer

Point-in-time recovery (PITR) for Cloud SQL for MySQL relies on binary logs to replay transactions up to a specific timestamp. Binary logging must be enabled because it records all changes to the database, allowing you to restore to any point within the retention period. Automated backups are also required because PITR uses the most recent full backup as a base, then applies binary logs from that backup to the target time.

Without automated backups, there is no base image to start the recovery process.

Exam trap

Google Cloud often tests the misconception that high availability or read replicas are required for point-in-time recovery, when in fact only binary logging and automated backups are necessary.

Practice this question →
54
MCQhard

You are deploying a stateful application on GKE that requires persistent storage with high IOPS. You need to ensure that each pod can failover to a different node and still access the same data. Which volume type should you use?

A.ConfigMap.
B.PersistentVolumeClaim with ReadWriteMany.
C.EmptyDir.
D.PersistentVolumeClaim with ReadWriteOnce.
AnswerB

ReadWriteMany allows access from multiple nodes, enabling failover.

Why this answer

A PersistentVolumeClaim with ReadWriteMany (RWX) is correct because it allows multiple pods to mount the same volume simultaneously, enabling pod failover to different nodes while maintaining access to the same persistent data. This is essential for stateful applications requiring high IOPS, as RWX volumes (e.g., backed by Filestore or Cloud Filestore) provide shared, concurrent read-write access across nodes in GKE.

Exam trap

The trap here is that candidates often confuse ReadWriteOnce (RWO) with the ability to failover in Google Kubernetes Engine (GKE), but RWO locks the volume to a single node, preventing cross-node access, while ReadWriteMany (RWX) is required for multi-node failover.

How to eliminate wrong answers

Option A is wrong because ConfigMaps are used for storing non-sensitive configuration data as key-value pairs, not for persistent storage with high IOPS; they are ephemeral and cannot provide block or file storage. Option C is wrong because EmptyDir volumes are ephemeral and tied to a pod's lifecycle; data is lost when the pod is deleted or rescheduled, making failover impossible. Option D is wrong because PersistentVolumeClaim with ReadWriteOnce (RWO) restricts access to a single node at a time, preventing pod failover to a different node while retaining access to the same data.

Practice this question →
55
MCQmedium

Your application runs on Compute Engine and uses Cloud Pub/Sub to receive messages from a third-party service. Recently, the message delivery latency has increased significantly. The third-party reports no issues on their end. You notice that the Pub/Sub subscription's 'ackDeadlineSeconds' is set to 10. What is the most likely cause of the latency?

A.The ackDeadlineSeconds is too short, causing frequent message redelivery.
B.The topic's message retention duration is too long.
C.The push endpoint is not responding, causing Pub/Sub to retry.
D.The subscription has an exponential backoff policy that is too aggressive.
AnswerA

Short ack deadline leads to redelivery before processing completes.

Why this answer

A is correct because a 10-second ackDeadlineSeconds is very short. If your subscriber cannot process and acknowledge messages within 10 seconds, Pub/Sub will consider them unacknowledged and redeliver them. This redelivery causes duplicate processing and increases overall latency as messages are repeatedly sent back to the subscriber, delaying their final consumption.

Exam trap

Google Cloud often tests the distinction between push and pull subscriptions; the trap here is that candidates may incorrectly assume a push endpoint issue (Option C) without recognizing that the question implies a pull subscription by stating 'receives messages' rather than 'receives pushed messages'.

How to eliminate wrong answers

Option B is wrong because the topic's message retention duration affects how long unacknowledged messages are stored, not delivery latency; a longer retention does not cause delays. Option C is wrong because the question states the application runs on Compute Engine and uses Pub/Sub to receive messages, implying a pull subscription, not a push subscription; a non-responsive push endpoint would cause retries, but the scenario describes a pull-based setup. Option D is wrong because Pub/Sub does not have a configurable exponential backoff policy on subscriptions; the backoff behavior is built into the client libraries and is not a subscription-level setting that would cause latency.

Practice this question →
56
Drag & Dropmedium

Drag and drop the steps to set up a Cloud SQL instance with a private IP in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Setting up private IP Cloud SQL requires a VPC, private services access, and creating the instance with private IP.

Practice this question →
57
Matchingmedium

Match each Kubernetes resource to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Declares desired state for pods and ReplicaSets

Stable network endpoint to access pods

HTTP(S) load balancer for external access

Store non-sensitive configuration data

Store sensitive data like passwords or keys

Why these pairings

These are fundamental Kubernetes objects for running containerized applications.

Practice this question →
58
Multi-Selecthard

You are designing a CI/CD pipeline using Cloud Build. Which three features can be used to secure the pipeline and enforce compliance? (Choose three.)

Select 3 answers
A.Using Cloud Build's inline substitution variables to inject secrets.
B.Configuring Cloud Build to only run builds from approved source repositories via VPC-SC.
C.Adding approval gates via Cloud Build's built-in approval mechanism.
D.Integrating with Cloud Build's vulnerability scanning for container images.
E.Using Cloud Build worker pools with private IP and service perimeter.
AnswersB, C, E

VPC Service Controls help enforce source restrictions.

Why this answer

Options B, C, and E are correct. B is correct because VPC Service Controls (VPC-SC) can restrict Cloud Build to only run builds from approved source repositories, enforcing compliance. C is correct because Cloud Build provides a built-in approval mechanism (manual approval gates) that adds a review step before a build proceeds.

E is correct because using Cloud Build worker pools with private IP and within a service perimeter enhances security by isolating build execution. A is incorrect: inline substitution variables are not secure for secrets; use Secret Manager instead. D is incorrect: vulnerability scanning for container images is a feature of Artifact Analysis, not Cloud Build itself.

Practice this question →
59
Multi-Selectmedium

A company is using Cloud Build for CI/CD. They want to automatically trigger builds when code is pushed to a Cloud Source Repository and store the resulting Docker images in a secure, immutable artifact store. Which TWO services should they use? (Choose 2)

Select 2 answers
A.Cloud Source Repository
B.Cloud Storage
C.Artifact Registry
D.Cloud Functions
E.Container Registry
AnswersA, C

Cloud Source Repository is a Git repository that can trigger Cloud Build.

Why this answer

Cloud Source Repository hosts the code and can trigger Cloud Build. Artifact Registry is the recommended immutable artifact store for Docker images. Container Registry is deprecated.

Cloud Storage and Cloud Functions are not directly involved.

Practice this question →
60
MCQmedium

A developer ran the following command: `gcloud compute instances list --filter='labels.env=prod'`. The command returned no instances even though there are instances with label env=prod. What is the most likely reason?

A.Instances are in a different project.
B.The user lacks compute.instances.list permission.
C.The filter syntax is incorrect; should use `labels.env:prod`.
D.The instances are stopped.
AnswerC

The equals sign is not the correct delimiter for label filters in gcloud.

Why this answer

The correct filter syntax for labels uses a colon (:) instead of an equals sign. The proper filter is `labels.env:prod`. Option A is wrong because if the project were different, a different error would appear.

Option B is wrong because permission errors produce a different message. Option D is wrong because stopped instances are still listed.

Practice this question →
61
MCQmedium

You are building a data pipeline that ingests streaming data from thousands of IoT devices. The devices send JSON payloads to a Cloud Pub/Sub topic. You want to process the data in near real-time and store the results in BigQuery for analytics. You also need to handle occasional schema changes in the incoming data (new fields added) without manual intervention. You have set up a Dataflow streaming pipeline using Apache Beam to read from Pub/Sub and write to BigQuery. The pipeline uses the `WriteToBigQuery` transform with `createDisposition=CREATE_NEVER` and `writeDisposition=WRITE_APPEND`. Recently, a batch of devices started sending a new field `temperature_celsius` that does not exist in the BigQuery schema. The pipeline logs errors and the data is not written. You need to modify the pipeline to automatically handle such schema evolution. What should you do?

A.Change `createDisposition` to `CREATE_IF_NEEDED` and ensure the BigQuery table schema has `autodetect=true` or is updated to allow new fields.
B.Manually update the BigQuery table schema to include the new field and then restart the pipeline.
C.Write the raw JSON payloads to Cloud Storage and use a Cloud Function to load them into BigQuery every 10 minutes with schema autodetect.
D.Use a `ParDo` transform to flatten all JSON fields into a fixed schema by ignoring unknown fields.
AnswerA

`CREATE_IF_NEEDED` will add new columns automatically if the schema is flexible.

Why this answer

With `createDisposition=CREATE_IF_NEEDED`, BigQuery will automatically add new fields if the schema allows updates. This is the simplest approach. Option B is wrong because manually updating the schema and restarting the pipeline defeats the purpose of automation and requires manual intervention.

Option C is wrong because storing raw data in Cloud Storage and using Cloud Functions loses real-time capability and adds complexity. Option D is wrong because using a `ParDo` to flatten or ignore unknown fields discards data and does not handle schema evolution properly.

Practice this question →
62
MCQmedium

You are designing a CI/CD pipeline using Cloud Build. You want to automatically trigger a build when code is pushed to a specific branch in Cloud Source Repositories. What is the correct configuration?

A.Create a Cloud Function that invokes Cloud Build via API when a push event occurs.
B.Add a build step in cloudbuild.yaml that polls the repository.
C.Configure a Cloud Pub/Sub topic to notify Cloud Build on push events.
D.Create a build trigger in Cloud Build with a regex pattern for the branch name.
AnswerD

Build triggers with branch patterns are the correct approach.

Why this answer

Cloud Build natively supports build triggers that can be configured to automatically start a build when code is pushed to a specific branch in Cloud Source Repositories. The trigger uses a regex pattern to match the branch name, and Cloud Build listens for repository push events directly without requiring additional services.

Exam trap

The PCD exam often tests the misconception that Cloud Pub/Sub is always required for event-driven triggers, but Cloud Build has a native trigger integration with Cloud Source Repositories that bypasses Pub/Sub entirely.

How to eliminate wrong answers

Option A is wrong because creating a Cloud Function to invoke Cloud Build via API is an unnecessary workaround; Cloud Build already has built-in trigger functionality for Cloud Source Repositories. Option B is wrong because adding a build step that polls the repository is inefficient and violates the event-driven design of CI/CD; Cloud Build triggers are event-driven, not polling-based. Option C is wrong because while Cloud Pub/Sub can be used with Cloud Build, it is not required for Cloud Source Repositories; Cloud Build directly integrates with Cloud Source Repositories via its own trigger system without needing a Pub/Sub topic.

Practice this question →
63
Multi-Selectmedium

A company is building a data processing pipeline that needs to ingest events from multiple sources, process them in order, and handle failures with retry. They also need to schedule periodic tasks. Which THREE services should they use? (Choose 3)

Select 3 answers
A.Cloud Scheduler
B.Cloud Tasks
C.Cloud Workflows
D.Cloud Pub/Sub
E.Cloud Logging
AnswersA, B, D

Cloud Scheduler can trigger periodic tasks.

Why this answer

Cloud Pub/Sub for ingesting events with ordering, Cloud Tasks for retry handling, and Cloud Scheduler for scheduling periodic tasks. Cloud Workflows is for orchestration, Cloud Logging is for logs.

Practice this question →
64
MCQeasy

An application running on Compute Engine needs to publish messages to a Pub/Sub topic. The VPC does not have external internet access. What must be configured to allow the instance to publish?

A.Cloud NAT
B.VPC Peering with Pub/Sub
C.Cloud Router with BGP
D.Private Google Access
AnswerD

Private Google Access allows VM instances to use Google APIs via internal IPs.

Why this answer

Private Google Access enables instances without external IP addresses to call Google APIs and services (including Pub/Sub) using internal IPs. Option A is for NAT to internet, option B is for peering, and option C is for dynamic routing.

Practice this question →
65
MCQmedium

An organization uses Cloud SQL for MySQL and wants to set up a read replica in a different region to improve read latency for global users. What is the recommended way to configure network connectivity between the primary and replica?

A.Use a Cloud Interconnect
B.Use Cloud VPN with dynamic routing
C.Use VPC peering between the regions
D.Use Private Services Access
AnswerD

Private Services Access allows the Cloud SQL service producer VPC to be peered with the customer VPC.

Why this answer

Private Services Access. Cross-region Cloud SQL read replicas require Private Services Access to establish private connectivity between the peered VPC and the Cloud SQL service. Private Services Access allows the primary and replica to communicate privately without traversing the public internet.

Cloud Interconnect (A) provides dedicated connectivity but is unnecessary for this use case. Cloud VPN (B) is typically used for hybrid connectivity, not for Cloud SQL replication. VPC peering (C) is used for connecting VPCs directly but does not provide the service-level networking required for Cloud SQL.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Integrating Gcp Services questions.

Start 20-question session