How should I use these Integrating Google Cloud services practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Integrating Google Cloud services questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Integrating Google Cloud services domain.

PCD · topic practice

Integrating Google Cloud services practice questions

Practise Google Professional Cloud Developer Integrating Google Cloud services practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Integrating Google Cloud services

Practice 10 questions Browse domain →

What the exam tests

What to know about Integrating Google Cloud services

Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.

IaaS, PaaS and SaaS responsibilities and examples.

Public, private, hybrid and community cloud deployment models.

On-premises vs cloud trade-offs: cost, control, scalability.

How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.

Watch out for

Common Integrating Google Cloud services exam traps

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Practice set

Integrating Google Cloud services questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Integrating Cloud services explanation →

You are designing a system that ingests high-velocity event streams from IoT devices using Pub/Sub. Each event must be processed exactly once to update a Firestore database. However, due to the distributed nature, at-least-once delivery is guaranteed by Pub/Sub. Which design pattern should you use to achieve exactly-once processing?

Trap 1: Use a Cloud Function with a retry policy to ensure delivery, and…

Bigtable row keys can help but the primary pattern is idempotency.

Trap 2: Use Cloud Dataflow with exactly-once processing mode and write to…

Dataflow exactly-once still requires idempotent writes to the sink.

Trap 3: Use a Cloud Run service to pull messages and write to Firestore;…

Firestore does not automatically deduplicate based on document ID.

Study all Integrating Google Cloud services common traps →

A
Use a Cloud Function with a retry policy to ensure delivery, and deduplicate using a Cloud Bigtable row key.
Why wrong: Bigtable row keys can help but the primary pattern is idempotency.
B
Use Cloud Dataflow with exactly-once processing mode and write to Firestore using a custom sink.
Why wrong: Dataflow exactly-once still requires idempotent writes to the sink.
C
Use a Cloud Run service to pull messages and write to Firestore; rely on Firestore's built-in deduplication using document IDs.
Why wrong: Firestore does not automatically deduplicate based on document ID.
D
Make the message processor idempotent by using a unique event ID as the Firestore document ID, and perform upsert operations.
Idempotent processing with upsert ensures exactly-once effect.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Integrating Cloud services explanation →

Your application runs on Compute Engine and uses Cloud Pub/Sub to receive messages from a third-party service. Recently, the message delivery latency has increased significantly. The third-party reports no issues on their end. You notice that the Pub/Sub subscription's 'ackDeadlineSeconds' is set to 10. What is the most likely cause of the latency?

Trap 1: The topic's message retention duration is too long.

Retention duration does not affect latency.

Trap 2: The push endpoint is not responding, causing Pub/Sub to retry.

The subscription is pull, not push.

Trap 3: The subscription has an exponential backoff policy that is too…

Exponential backoff would reduce retries.

Study all Integrating Google Cloud services common traps →

A
The ackDeadlineSeconds is too short, causing frequent message redelivery.
Short ack deadline leads to redelivery before processing completes.
B
The topic's message retention duration is too long.
Why wrong: Retention duration does not affect latency.
C
The push endpoint is not responding, causing Pub/Sub to retry.
Why wrong: The subscription is pull, not push.
D
The subscription has an exponential backoff policy that is too aggressive.
Why wrong: Exponential backoff would reduce retries.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Integrating Cloud services explanation →

You are designing a data pipeline that ingests streaming data from IoT devices using Cloud IoT Core, processes it with Dataflow, and stores results in BigQuery. The data volume is expected to be 10 GB per day with occasional spikes. You need to minimize processing latency and cost. Which configuration should you choose for the Dataflow pipeline?

Trap 1: Use streaming mode with autoscaling and maximum workers set to 10.

Too many workers for 10 GB/day; increases cost.

Trap 2: Use Dataflow Prime for automatic optimization.

Dataflow Prime is for batch pipelines.

Trap 3: Use batch mode with a fixed number of workers to reduce cost.

Batch mode is not for streaming.

Study all Integrating Google Cloud services common traps →

A
Use streaming mode with autoscaling and maximum workers set to 10.
Why wrong: Too many workers for 10 GB/day; increases cost.
B
Use Dataflow Prime for automatic optimization.
Why wrong: Dataflow Prime is for batch pipelines.
C
Use streaming mode with streaming engine enabled and 2 workers.
Streaming engine reduces latency and cost for moderate throughput.
D
Use batch mode with a fixed number of workers to reduce cost.
Why wrong: Batch mode is not for streaming.

Full breakdown with real-world context →

Question 4easymulti select

Read the full Integrating Cloud services explanation →

A company stores sensitive user data in Cloud Storage. They want to ensure that only authenticated users with the appropriate permissions can access the data, and that data is encrypted at rest. Which two steps should they take? (Choose TWO.)

Trap 1: Configure a Customer-Managed Encryption Key (CMEK) in Cloud KMS.

CMEK is optional, not required.

Trap 2: Set bucket-level public access prevention.

This prevents public access, not encryption.

Trap 3: Enable VPC Service Controls to restrict data access.

VPC SC is for perimeter security, not encryption.

Study all Integrating Google Cloud services common traps →

A
Configure a Customer-Managed Encryption Key (CMEK) in Cloud KMS.
Why wrong: CMEK is optional, not required.
B
Enable default encryption on the bucket using Google-managed keys.
Default server-side encryption is already enabled.
C
Use IAM roles to grant access to specific users and groups.
IAM controls access.
D
Set bucket-level public access prevention.
Why wrong: This prevents public access, not encryption.
E
Enable VPC Service Controls to restrict data access.
Why wrong: VPC SC is for perimeter security, not encryption.

Full breakdown with real-world context →

Question 5hardmulti select

Read the full Integrating Cloud services explanation →

You are designing a serverless application using Cloud Functions that processes events from Cloud Storage and Cloud Pub/Sub. The function must be idempotent and handle duplicate events. Which three best practices should you implement? (Choose THREE.)

Trap 1: Invoke the function synchronously to avoid duplicates.

Synchronous invocation is not supported for background functions.

Trap 2: Set the function timeout to maximum (540 seconds) to ensure…

Timeout does not prevent duplicates.

Study all Integrating Google Cloud services common traps →

A
Generate a unique idempotency key for each event and store processed keys in a database.
Idempotency keys prevent duplicate processing.
B
Invoke the function synchronously to avoid duplicates.
Why wrong: Synchronous invocation is not supported for background functions.
C
Implement a deduplication logic that checks the event's publish time against a threshold.
Timestamps can help filter duplicates.
D
Use Cloud Firestore to record the state of each processed event.
Transactional state helps idempotency.
E
Set the function timeout to maximum (540 seconds) to ensure processing completes.
Why wrong: Timeout does not prevent duplicates.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Integrating Cloud services explanation →

You need to monitor the CPU usage of a Compute Engine instance and trigger an alert when it exceeds 80% for 5 minutes. Which Google Cloud service should you use?

Trap 1: Cloud Debugger

Cloud Debugger is for inspecting code.

Trap 2: Cloud Logging

Cloud Logging is for logs.

Trap 3: Error Reporting

Error Reporting is for application errors.

Study all Integrating Google Cloud services common traps →

A
Cloud Debugger
Why wrong: Cloud Debugger is for inspecting code.
B
Cloud Monitoring
Cloud Monitoring provides metrics and alerting.
C
Cloud Logging
Why wrong: Cloud Logging is for logs.
D
Error Reporting
Why wrong: Error Reporting is for application errors.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Integrating Cloud services explanation →

Your company uses Cloud SQL for MySQL to store transactional data. You need to perform a point-in-time recovery (PITR) to recover from a logical error that occurred 30 minutes ago. Which two prerequisites must be met? (Choose TWO.)

Trap 1: High availability (HA) is configured.

HA is not required.

Trap 2: The backup window is set to a time before the incident.

Backup window does not affect PITR capability.

Trap 3: A read replica is configured.

Read replicas are not needed.

Study all Integrating Google Cloud services common traps →

A
High availability (HA) is configured.
Why wrong: HA is not required.
B
Binary logging is enabled.
Binary logs enable PITR.
C
Automated backups are enabled.
Backups are the base for PITR.
D
The backup window is set to a time before the incident.
Why wrong: Backup window does not affect PITR capability.
E
A read replica is configured.
Why wrong: Read replicas are not needed.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Integrating Cloud services explanation →

You are designing a CI/CD pipeline using Cloud Build. You want to automatically trigger a build when code is pushed to a specific branch in Cloud Source Repositories. What is the correct configuration?

Trap 1: Create a Cloud Function that invokes Cloud Build via API when a…

Unnecessary complexity.

Trap 2: Add a build step in cloudbuild.yaml that polls the repository.

cloudbuild.yaml defines build steps, not triggers.

Trap 3: Configure a Cloud Pub/Sub topic to notify Cloud Build on push…

Cloud Build can directly listen to Cloud Source Repositories.

Study all Integrating Google Cloud services common traps →

A
Create a Cloud Function that invokes Cloud Build via API when a push event occurs.
Why wrong: Unnecessary complexity.
B
Add a build step in cloudbuild.yaml that polls the repository.
Why wrong: cloudbuild.yaml defines build steps, not triggers.
C
Configure a Cloud Pub/Sub topic to notify Cloud Build on push events.
Why wrong: Cloud Build can directly listen to Cloud Source Repositories.
D
Create a build trigger in Cloud Build with a regex pattern for the branch name.
Build triggers with branch patterns are the correct approach.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Integrating Cloud services explanation →

A company is migrating a legacy monolithic application to Google Cloud. They want to minimize code changes and operational overhead while improving scalability. The application currently uses a relational database and stores user-uploaded images on a local filesystem. Which combination of Google Cloud services should they use?

Trap 1: Cloud Spanner for the database and Cloud Storage for images

Cloud Spanner is a globally distributed database and is overkill for a monolith; would require schema changes and high costs.

Trap 2: Cloud Firestore for the database and Cloud Storage with Cloud CDN…

Firestore is NoSQL and would require code changes; not suitable for a relational database without rewriting.

Trap 3: Compute Engine with attached SSD persistent disks for both database…

This does not provide managed scalability and increases operational overhead.

Study all Integrating Google Cloud services common traps →

A
Cloud Spanner for the database and Cloud Storage for images
Why wrong: Cloud Spanner is a globally distributed database and is overkill for a monolith; would require schema changes and high costs.
B
Cloud Firestore for the database and Cloud Storage with Cloud CDN for images
Why wrong: Firestore is NoSQL and would require code changes; not suitable for a relational database without rewriting.
C
Cloud SQL for the database and Cloud Storage with Cloud CDN for images
Cloud SQL provides a managed relational database with minimal changes, and Cloud Storage with CDN serves images efficiently at scale.
D
Compute Engine with attached SSD persistent disks for both database and images
Why wrong: This does not provide managed scalability and increases operational overhead.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full Integrating Cloud services explanation →

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine (GKE). They want to automatically build and deploy each service when a new tag is pushed to its repository. They also need to run integration tests against a staging environment before promoting to production. Which service should they use to orchestrate the pipeline?

Trap 1: Deployment Manager with a template

Deployment Manager is for declarative infrastructure management, not CI/CD pipelines.

Trap 2: Cloud Deploy with a delivery pipeline

Cloud Deploy is for continuous delivery, but it requires pre-built images and does not handle build triggers.

Trap 3: Cloud Run with continuous deployment

Cloud Run is a serverless compute service, not a CI/CD orchestrator.

Study all Integrating Google Cloud services common traps →

A
Deployment Manager with a template
Why wrong: Deployment Manager is for declarative infrastructure management, not CI/CD pipelines.
B
Cloud Deploy with a delivery pipeline
Why wrong: Cloud Deploy is for continuous delivery, but it requires pre-built images and does not handle build triggers.
C
Cloud Build with a build trigger on tag push
Cloud Build can be triggered by a tag push, build the container, and deploy to GKE. It also supports running tests.
D
Cloud Run with continuous deployment
Why wrong: Cloud Run is a serverless compute service, not a CI/CD orchestrator.

Full breakdown with real-world context →

Question 11easymulti select

Read the full Integrating Cloud services explanation →

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Trap 1: Using a signed URL revokes the underlying object's ACL.

Signed URLs provide temporary access without changing ACLs; ACLs remain unchanged.

Trap 2: Enabling uniform bucket-level access disables encryption at rest.

Uniform bucket-level access controls access but does not affect encryption.

Trap 3: Bucket-level policies can restrict access to only compute instances…

Bucket policies can restrict access based on service accounts, but not specific VMs; it's based on identity, not machine.

Study all Integrating Google Cloud services common traps →

A
By default, data in Cloud Storage is encrypted at rest using Google-managed encryption keys.
Cloud Storage automatically encrypts all data at rest with Google-managed keys.
B
Using a signed URL revokes the underlying object's ACL.
Why wrong: Signed URLs provide temporary access without changing ACLs; ACLs remain unchanged.
C
Enabling uniform bucket-level access disables encryption at rest.
Why wrong: Uniform bucket-level access controls access but does not affect encryption.
D
Customer-managed encryption keys (CMEK) can be used to control the encryption keys used to protect data.
CMEK allows customers to manage their own encryption keys via Cloud KMS.
E
Bucket-level policies can restrict access to only compute instances with specific service accounts.
Why wrong: Bucket policies can restrict access based on service accounts, but not specific VMs; it's based on identity, not machine.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Integrating Cloud services explanation →

You are a cloud architect at a financial services company. The company is deploying a new application on Google Kubernetes Engine (GKE) that processes sensitive financial transactions. The application must be highly available across two regions (us-central1 and europe-west1) and must fail over automatically if one region becomes unavailable. The application uses Cloud Spanner as its primary database. Additionally, the application needs to send audit logs to a centralized Cloud Storage bucket for compliance. The current design uses GKE clusters in each region with a global HTTP(S) load balancer. However, during a recent test, when the us-central1 cluster was deliberately taken down, the load balancer continued to send traffic to that region, causing errors. You need to troubleshoot and fix the issue. What is the most likely cause and the best solution?

Trap 1: The load balancer is configured with only one backend service

A single backend service can have multiple backends; the issue is health checks.

Trap 2: The Cloud Spanner instance is not configured with multi-region…

Cloud Spanner multi-region replication is for database availability, not load balancing traffic routing.

Trap 3: The GKE clusters are not configured as network endpoint groups…

NEGs are likely already in use; the issue is health checks, not NEGs.

Study all Integrating Google Cloud services common traps →

A
The load balancer is configured with only one backend service. Solution: Create a separate backend service for each region.
Why wrong: A single backend service can have multiple backends; the issue is health checks.
B
The load balancer backend lacks a health check that marks the backend as unhealthy when the cluster is down. Solution: Configure a health check on the backend service that points to a readiness endpoint on the GKE cluster.
Health checks are required for the load balancer to stop routing traffic to unhealthy backends.
C
The Cloud Spanner instance is not configured with multi-region replication, causing write failures. Solution: Configure Cloud Spanner as a multi-region instance.
Why wrong: Cloud Spanner multi-region replication is for database availability, not load balancing traffic routing.
D
The GKE clusters are not configured as network endpoint groups (NEGs). Solution: Create NEGs for each cluster and use them as backends.
Why wrong: NEGs are likely already in use; the issue is health checks, not NEGs.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Integrating Cloud services explanation →

A company is running a critical application on Google Kubernetes Engine (GKE) that stores state in a Cloud SQL PostgreSQL instance. The application's latency-sensitive frontend needs to read data from Cloud SQL with minimal latency. The team wants to reduce read latency and offload read traffic from the primary database. What should they do?

Trap 1: Migrate the database to Cloud Spanner for better read scalability.

Migrating to Cloud Spanner introduces horizontal read scaling and strong consistency across regions, but it does not address the primary requirement of reducing read latency for a latency-sensitive frontend; Spanner’s distributed architecture adds network hops compared to a local read replica. This option is tempting because Spanner excels at global transactional scalability and would be correct if the goal were to serve reads across multiple geographic regions with strong consistency, rather than minimising latency from a single frontend.

Trap 2: Use Memorystore for Redis as a cache layer between the application…

While caching can help, read replicas are specifically designed to offload read traffic and reduce latency for database reads.

Trap 3: Use Cloud CDN to cache database responses.

Cloud CDN caches static content, not dynamic database queries.

Study all Integrating Google Cloud services common traps →

A
Migrate the database to Cloud Spanner for better read scalability.
Why wrong: Migrating to Cloud Spanner introduces horizontal read scaling and strong consistency across regions, but it does not address the primary requirement of reducing read latency for a latency-sensitive frontend; Spanner’s distributed architecture adds network hops compared to a local read replica. This option is tempting because Spanner excels at global transactional scalability and would be correct if the goal were to serve reads across multiple geographic regions with strong consistency, rather than minimising latency from a single frontend.
B
Use Memorystore for Redis as a cache layer between the application and Cloud SQL.
Why wrong: While caching can help, read replicas are specifically designed to offload read traffic and reduce latency for database reads.
C
Create a read replica of the Cloud SQL instance and direct read traffic to the replica.
Read replicas handle read-only queries, reducing load on the primary and improving read latency.
D
Use Cloud CDN to cache database responses.
Why wrong: Cloud CDN caches static content, not dynamic database queries.

Full breakdown with real-world context →

Question 14hardmulti select

Read the full Integrating Cloud services explanation →

A company is deploying a microservices application on Google Cloud. They want to securely store and access secrets (e.g., API keys, database passwords) across multiple services. They need to minimize operational overhead and ensure secrets are automatically rotated. Which TWO approaches should they use?

Trap 1: Store secrets in Cloud Storage buckets encrypted with Cloud KMS…

While secure, Cloud Storage does not provide automatic rotation or fine-grained access control per secret.

Trap 2: Store secrets in a Cloud SQL database and use Cloud Scheduler to…

Cloud SQL is a database, not a secrets manager; this approach lacks integrated access control and versioning.

Trap 3: Store secrets in Cloud Firestore and use Firestore triggers to…

Firestore is a NoSQL database, not a secrets manager; managing rotation this way increases complexity.

Study all Integrating Google Cloud services common traps →

A
Use Secret Manager with a Cloud Function that automatically rotates secrets on a schedule.
Secret Manager's built-in rotation can be used with Cloud Functions to implement custom rotation logic.
B
Store secrets in Cloud Storage buckets encrypted with Cloud KMS (CMEK).
Why wrong: While secure, Cloud Storage does not provide automatic rotation or fine-grained access control per secret.
C
Use Secret Manager to store secrets and enable automatic rotation.
Secret Manager supports automatic rotation and is the recommended service for managing secrets.
D
Store secrets in a Cloud SQL database and use Cloud Scheduler to rotate them.
Why wrong: Cloud SQL is a database, not a secrets manager; this approach lacks integrated access control and versioning.
E
Store secrets in Cloud Firestore and use Firestore triggers to rotate them.
Why wrong: Firestore is a NoSQL database, not a secrets manager; managing rotation this way increases complexity.

Full breakdown with real-world context →

Question 15mediumdrag order

Read the full Integrating Cloud services explanation →

Drag and drop the steps to set up a Cloud SQL instance with a private IP in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Create VPC network, Create private services access connection,…

This order is incorrect because you cannot create the private services access connection before allocating the IP range. The connection requires an IP range to be defined first.

Trap 2: Allocate IP range for private services access, Create VPC network,…

This order is incorrect because you must have a VPC network before allocating an IP range for that VPC. The IP range is associated with a VPC.

Trap 3: Create Cloud SQL instance with private IP, Create VPC network,…

This order is incorrect because the Cloud SQL instance with private IP requires that the VPC, IP range, and private services access connection are already set up. You cannot create the instance first.

Study all Integrating Google Cloud services common traps →

A
Create VPC network, Allocate IP range for private services access, Create private services access connection, Create Cloud SQL instance with private IP
This order is correct because you must first have a VPC, then allocate an IP range for Google services, then establish the private services access connection, and finally create the Cloud SQL instance using the private IP.
B
Create VPC network, Create private services access connection, Allocate IP range for private services access, Create Cloud SQL instance with private IP
Why wrong: This order is incorrect because you cannot create the private services access connection before allocating the IP range. The connection requires an IP range to be defined first.
C
Allocate IP range for private services access, Create VPC network, Create private services access connection, Create Cloud SQL instance with private IP
Why wrong: This order is incorrect because you must have a VPC network before allocating an IP range for that VPC. The IP range is associated with a VPC.
D
Create Cloud SQL instance with private IP, Create VPC network, Allocate IP range for private services access, Create private services access connection
Why wrong: This order is incorrect because the Cloud SQL instance with private IP requires that the VPC, IP range, and private services access connection are already set up. You cannot create the instance first.

Full breakdown with real-world context →

Question 16mediumdrag order

Read the full Integrating Cloud services explanation →

Drag and drop the steps to troubleshoot a failed Cloud Build in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Re-run the build first, then check logs, then examine…

This is incorrect because re-running without investigation is unlikely to resolve the issue and wastes time; logs should be checked first to understand the failure.

Trap 2: Examine build configuration first, then re-run the build, then…

This is incorrect because examining configuration without logs may miss runtime errors; logs provide the specific error pointing to what went wrong.

Trap 3: Fix issues first, then check logs, then examine configuration, then…

This is incorrect because fixing issues without understanding the failure (logs/configuration) is guesswork; you must diagnose before attempting a fix.

Study all Integrating Google Cloud services common traps →

A
Check Cloud Build logs first, then examine build configuration, then fix identified issues, then re-run the build.
This is the correct order because logs provide the immediate error details, then configuration review helps identify misconfigurations, fixing addresses the root cause, and re-running validates the solution.
B
Re-run the build first, then check logs, then examine configuration, then fix issues.
Why wrong: This is incorrect because re-running without investigation is unlikely to resolve the issue and wastes time; logs should be checked first to understand the failure.
C
Examine build configuration first, then re-run the build, then check logs, then fix issues.
Why wrong: This is incorrect because examining configuration without logs may miss runtime errors; logs provide the specific error pointing to what went wrong.
D
Fix issues first, then check logs, then examine configuration, then re-run.
Why wrong: This is incorrect because fixing issues without understanding the failure (logs/configuration) is guesswork; you must diagnose before attempting a fix.

Full breakdown with real-world context →

Question 17mediummatching

Read the full Integrating Cloud services explanation →

Match each Kubernetes resource to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Declares desired state for pods and ReplicaSets

Stable network endpoint to access pods

HTTP(S) load balancer for external access

Store non-sensitive configuration data

Store sensitive data like passwords or keys

Trap 1: ConfigMap: Stores sensitive data such as passwords, OAuth tokens,…

Incorrect — this describes a Secret, not a ConfigMap. ConfigMap stores non-confidential configuration data.

Trap 2: Secret: Manages external access to the services in a cluster,…

Incorrect — this describes an Ingress, not a Secret. Secrets store sensitive data.

Trap 3: Ingress: Allows you to decouple configuration artifacts from image…

Incorrect — this describes a ConfigMap, not an Ingress. Ingress manages external HTTP/HTTPS access.

Study all Integrating Google Cloud services common traps →

A
Pod: The smallest and simplest Kubernetes object. It represents a single instance of a running process in your cluster.
A Pod is the smallest deployable unit in Kubernetes that runs containers.
B
Service: An abstraction that defines a logical set of Pods and a policy to access them.
A Service provides a stable IP and DNS name to access a set of Pods.
C
Deployment: Provides declarative updates to Pods and ReplicaSets.
Deployments manage rolling updates and scaling of Pods.
D
ConfigMap: Stores sensitive data such as passwords, OAuth tokens, and ssh keys.
Why wrong: Incorrect — this describes a Secret, not a ConfigMap. ConfigMap stores non-confidential configuration data.
E
Secret: Manages external access to the services in a cluster, typically HTTP.
Why wrong: Incorrect — this describes an Ingress, not a Secret. Secrets store sensitive data.
F
Ingress: Allows you to decouple configuration artifacts from image content to keep containerized applications portable.
Why wrong: Incorrect — this describes a ConfigMap, not an Ingress. Ingress manages external HTTP/HTTPS access.

Full breakdown with real-world context →

Question 18mediummatching

Read the full Integrating Cloud services explanation →

Match each Firebase feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

NoSQL document database with real-time sync

Backend service for user sign-in

Send push notifications across platforms

Change app behavior without publishing updates

Measure app performance from the user's perspective

Trap 1: Cloud Firestore: A relational database with SQL queries for…

Cloud Firestore is NoSQL, not relational. This describes a traditional SQL database.

Trap 2: Firebase Hosting: A Firebase feature for running backend code in…

Firebase Hosting is for hosting web apps, not running backend code. That's Cloud Functions.

Study all Integrating Google Cloud services common traps →

A
Cloud Firestore: A NoSQL document database for storing and syncing data in real time.
Cloud Firestore is a flexible, scalable NoSQL document database.
B
Firebase Authentication: Provides backend services, easy-to-use SDKs, and ready-made UI libraries to authenticate users to your app.
Firebase Authentication supports email/password, social logins, and more.
C
Cloud Functions: Lets you run backend code in response to events triggered by Firebase features and HTTPS requests.
Cloud Functions is a serverless framework for extending Firebase behavior.
D
Cloud Firestore: A relational database with SQL queries for structured data.
Why wrong: Cloud Firestore is NoSQL, not relational. This describes a traditional SQL database.
E
Firebase Hosting: A Firebase feature for running backend code in response to events.
Why wrong: Firebase Hosting is for hosting web apps, not running backend code. That's Cloud Functions.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Integrating Cloud services explanation →

A company is using Cloud Functions (2nd gen) to process files uploaded to Cloud Storage. The function needs to access a Cloud SQL (PostgreSQL) database. What is the most secure way to store and provide the database password to the function?

Trap 1: Use Cloud KMS to encrypt the password and store it in environment…

KMS encrypts data but does not provide a secure storage mechanism; you still need to manage the ciphertext.

Trap 2: Hardcode the password in the function code.

Hardcoding is insecure and violates best practices.

Trap 3: Store the password in a Cloud Storage bucket and read it at startup.

Cloud Storage is not designed for secrets; bucket permissions may be too broad.

Study all Integrating Google Cloud services common traps →

A
Use Cloud KMS to encrypt the password and store it in environment variables.
Why wrong: KMS encrypts data but does not provide a secure storage mechanism; you still need to manage the ciphertext.
B
Hardcode the password in the function code.
Why wrong: Hardcoding is insecure and violates best practices.
C
Use Secret Manager and access it via the Secret Manager API within the function.
Secret Manager is the secure way to store and access secrets with fine-grained IAM.
D
Store the password in a Cloud Storage bucket and read it at startup.
Why wrong: Cloud Storage is not designed for secrets; bucket permissions may be too broad.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full Integrating Cloud services explanation →

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

Trap 1: Configure Cloud Run to only accept revisions from a specific source…

Cloud Run does not have such a filter.

Trap 2: Use IAM conditions on the Cloud Run service account to allow only…

IAM conditions do not apply to build branches.

Trap 3: Create a separate Cloud Build trigger for each branch and manually…

Manual management is not reliable or scalable.

Study all Integrating Google Cloud services common traps →

A
Configure Cloud Run to only accept revisions from a specific source repository.
Why wrong: Cloud Run does not have such a filter.
B
Use IAM conditions on the Cloud Run service account to allow only main branch builds.
Why wrong: IAM conditions do not apply to build branches.
C
Use Cloud Build triggers with a branch filter set to ^main$.
Branch filters in triggers exactly match this requirement.
D
Create a separate Cloud Build trigger for each branch and manually disable non-main triggers.
Why wrong: Manual management is not reliable or scalable.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Integrating Google Cloud services sessions

Start a Integrating Google Cloud services only practice session

Every question in these sessions is drawn from the Integrating Google Cloud services domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Integrating Google Cloud services questions →Mixed PCD session

Frequently asked questions

What does the PCD exam test about Integrating Google Cloud services?: Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Integrating Google Cloud services questions in a focused session?: Yes — the session launcher on this page draws every question from the Integrating Google Cloud services domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCD topics?: Use the topic links above to move to related areas, or go back to the PCD question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCD exam covers. They are not copied from any real exam or dump site.

Integrating Google Cloud services only

10 questions 20 questions 30 questions 50 questions

Mixed PCD session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCD questions Integrating Google Cloud services domain overview PCD exam guide

Exam traps to avoid

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Integrating Google Cloud services practice questions

What to know about Integrating Google Cloud services

Common Integrating Google Cloud services exam traps

Integrating Google Cloud services questions

A company stores sensitive user data in Cloud Storage. They want to ensure that only authenticated users with the appropriate permissions can access the data, and that data is encrypted at rest. Which two steps should they take? (Choose TWO.)

You are designing a serverless application using Cloud Functions that processes events from Cloud Storage and Cloud Pub/Sub. The function must be idempotent and handle duplicate events. Which three best practices should you implement? (Choose THREE.)

You need to monitor the CPU usage of a Compute Engine instance and trigger an alert when it exceeds 80% for 5 minutes. Which Google Cloud service should you use?

Your company uses Cloud SQL for MySQL to store transactional data. You need to perform a point-in-time recovery (PITR) to recover from a logical error that occurred 30 minutes ago. Which two prerequisites must be met? (Choose TWO.)

You are designing a CI/CD pipeline using Cloud Build. You want to automatically trigger a build when code is pushed to a specific branch in Cloud Source Repositories. What is the correct configuration?

A company is using Cloud Storage to store sensitive customer data. They need to ensure data is encrypted at rest and access is controlled. Which TWO statements are true regarding data protection in Cloud Storage? (Choose two.)

Drag and drop the steps to set up a Cloud SQL instance with a private IP in the correct order.

Drag and drop the steps to troubleshoot a failed Cloud Build in the correct order.

Match each Kubernetes resource to its function.

Match each Firebase feature to its description.

A company is using Cloud Functions (2nd gen) to process files uploaded to Cloud Storage. The function needs to access a Cloud SQL (PostgreSQL) database. What is the most secure way to store and provide the database password to the function?

A team uses Cloud Build to deploy a microservice to Cloud Run. They want to enforce that only builds from the main branch trigger deployments to the production Cloud Run service. What is the best approach?

Track your progress over time

Start a Integrating Google Cloud services only practice session

Related PCD topic practice pages

Designing highly scalable, available, and reliable cloud-native applications practice questions

Building and testing applications practice questions

Deploying applications practice questions