PCDOE Practice Questions

Question 1

A company uses Cloud Run for a stateless API service with concurrency set to 80. During a traffic spike, some requests return HTTP 500 errors and latency spikes. Cloud Monitoring shows container CPU utilization at 100% and memory usage at 70%. What is the most likely cause and the best first step?

Accepted Answer

Concurrency per container is too high; reduce concurrency to 10. With CPU at 100% and memory at only 70%, the bottleneck is CPU, not memory. Cloud Run containers handle requests concurrently; setting concurrency to 80 means each container processes up to 80 requests simultaneously. When CPU is saturated, requests queue up, causing latency spikes and eventual HTTP 500 errors as the container becomes unresponsive. Reducing concurrency to 10 lowers the per-container request load, allowing each request to complete before CPU saturation occurs.

Answer

Maximum instances limit is too low; increase from 10 to 100

Answer

Min idle instances is too low; set min idle to 5 to reduce cold starts

Answer

Memory limit is too low; increase memory from 256 MiB to 512 MiB

Question 2

Which TWO statements about bootstrapping a Google Cloud organization for DevOps are correct?

Accepted Answer

Cloud Asset Inventory can be used to discover all resources in the organization.. Option B is correct because Cloud Asset Inventory provides a centralized, organization-wide view of all Google Cloud resources and their metadata, making it the right tool to discover and inventory resources across every project in the organization during bootstrapping. Option E is correct because organization policies are hierarchical constraints that can be set at the organization, folder, or project level, with child nodes inheriting and able to further restrict (but not loosen) the parent policy, which is essential for enforcing governance as the org scales. Option A is wrong because enabling the cloudresourcemanager.googleapis.com API does not automatically apply any organization policies; policies must be explicitly defined and attached. Option C is wrong because projects do not automatically share a default VPC network — each project gets its own default network (or none), and shared VPC must be configured deliberately. Option D is wrong because Admin Activity audit logs are enabled by default and always on, while Data Access logs are the ones disabled by default and must be explicitly enabled per service.

Answer

After enabling the cloudresourcemanager.googleapis.com API, organization policies are automatically applied.

Answer

All projects in an organization automatically share a default VPC network.

Answer

Cloud Audit Logs are disabled by default and must be enabled for each service.

Question 3

Which TWO are best practices for implementing service monitoring strategies in Google Cloud?

Accepted Answer

Monitor the four golden signals (latency, traffic, errors, saturation) for every service.. A is correct because the four golden signals (latency, traffic, errors, saturation) are the foundational metrics recommended by Google SRE practices for monitoring any service. Monitoring these signals provides a comprehensive view of service health and user experience, enabling rapid detection of issues like high latency or resource exhaustion.

Answer

Rely solely on synthetic monitoring to measure user experience.

Answer

Use multiple monitoring tools to cover all aspects of the system.

Answer

Manually analyze logs and metrics to identify issues.

Question 4

A company uses Cloud Monitoring to track latency for a multi-region web application. The SLO is 99.9% of requests under 500ms over a 30-day rolling window. The error budget has been rapidly depleting over the last week. The operations team wants to understand the impact of recent deployments. Which approach should they use to correlate deployment changes with latency spikes?

Accepted Answer

Create a custom dashboard in Cloud Monitoring that includes latency charts and use annotation markers to indicate deployment times. Cloud Monitoring supports custom dashboards with annotation markers that can be programmatically or manually added to indicate deployment events. By overlaying these markers on latency charts, the operations team can visually correlate deployment times with latency spikes, enabling direct root-cause analysis without manual log searching or separate tools.

Answer

Use Cloud Logging to search for deployment logs and manually compare with latency metrics

Answer

Use Cloud Trace to analyze latency distributions for each deployment version

Answer

Configure Error Reporting to alert on latency threshold breaches

Question 5

Arrange the steps to recover a Google Cloud SQL instance from a point-in-time backup.

Accepted Answer

Identify time, then Clone, then Verify, then Promote, then Update connections. The correct sequence for recovering a Google Cloud SQL instance from a point-in-time backup is: first, identify the exact point-in-time to recover; second, clone the instance to that time; third, verify the cloned instance's data; fourth, promote the clone to become the primary instance; and fifth, update application connections to use the new primary. This order ensures a consistent and verifiable recovery process.

Answer

Clone, then Identify time, then Verify, then Promote, then Update connections

Answer

Identify time, then Clone, then Promote, then Verify, then Update connections

Answer

Clone, then Identify time, then Promote, then Verify, then Update connections

Question 6

Which TWO practices should be implemented to optimize query performance in Cloud Spanner?

Accepted Answer

Use interleaved tables to co-locate related rows.. Option C is correct because interleaved tables physically co-locate child rows with their parent rows in the same split, so parent-child joins and lookups can be executed without network hops or distributed joins, which directly reduces query latency and improves performance. Option E is correct because Cloud Spanner uses secondary indexes to satisfy predicates efficiently; defining secondary indexes on columns frequently referenced in WHERE clauses lets the optimizer perform index scans instead of full table scans, cutting the amount of data read. Option A is not appropriate because manually splitting large tables into many smaller tables breaks the relational model and does not address Spanner's automatic sharding, which already distributes data across splits. Option B is wrong because creating excessive indexes on all columns adds write amplification and storage overhead and can degrade write performance without benefiting queries. Option D is incorrect because interleaving is a parent-child locality mechanism within a database and cannot be applied globally across regions; cross-region distribution is handled by the instance configuration, not by interleaving.

Answer

Split large tables into multiple smaller tables to distribute load.

Answer

Create as many indexes as possible on all columns.

Answer

Use globally distributed interleaving across regions.

Question 7

A company uses BigQuery on-demand pricing. To control costs, they want to prevent any single query from scanning more than 1 TB of data. How can they enforce this?

Accepted Answer

Use the maximum bytes billed parameter in the query settings. The maximum bytes billed parameter is a per-query setting in BigQuery that causes the query to fail if the estimated bytes to be scanned exceed the specified limit. This directly enforces a hard cap on data scanned per query, preventing any single query from processing more than 1 TB. It is available in the query settings of the BigQuery UI, bq command-line tool, and API, and is the intended mechanism for cost control at the query level.

Answer

Set a custom cost budget with alert at 1 TB

Answer

Use BigQuery reservations with 1 TB slot capacity

Answer

Set a query quota in the GCP Console quota page

Question 8

A company is implementing CI/CD for a microservices application on Google Kubernetes Engine (GKE). The team wants to ensure that each service can be built and deployed independently without affecting other services. They also need to enforce that only successfully tested builds are deployed to production. Which CI/CD approach should they use?

Accepted Answer

Create separate Cloud Build triggers per microservice, each building a container image, and use Cloud Deploy to manage canary deployments to GKE with automated promotion after tests pass.. It uses separate Cloud Build triggers per microservice to enable independent builds, and Cloud Deploy with canary deployments and automated promotion after tests pass ensures that only successfully tested builds reach production. This approach aligns with the requirements of independent service deployment and gated promotion to production on GKE.

Answer

Use Cloud Build to build all services and deploy to Cloud Run, then use traffic splitting to promote new versions.

Answer

Create a single Cloud Build trigger that builds all services and deploys to a staging cluster, then manually promote to production.

Answer

Use Spinnaker with a single pipeline that builds all services, and configure manual judgment gates for production promotion.

Question 9

A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.. Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.

Answer

Use a user account for the CI/CD pipeline and assign it the necessary roles.

Answer

Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.

Answer

Generate a single service account key and securely distribute it to the CI/CD system.

Question 10

A company stores historical log data in Cloud Storage. The logs are accessed rarely after 30 days. They want to reduce storage costs while maintaining immediate access for occasional audits over the next year. What should they use?

Accepted Answer

Standard class storage with a lifecycle policy to transition to Nearline after 30 days and to Coldline after 90 days. It uses a lifecycle policy to automatically transition objects from Standard to Nearline after 30 days and then to Coldline after 90 days, which reduces cost as access frequency drops while still providing immediate (millisecond) access for occasional audits throughout the year. Nearline and Coldline both offer low-latency access with no retrieval delay, so the data remains available for audits. Option B (Nearline only) would not optimize costs for data older than 90 days that could move to cheaper Coldline. Option C (Coldline with deletion after 1 year) risks losing data needed for audits and does not tier from Standard. Option D (Archive) is unsuitable because Archive has retrieval latency of hours, violating the immediate-access requirement.

Answer

Nearline class storage

Answer

Coldline class storage with a lifecycle policy to delete after 1 year

Answer

Archive class storage

Question 11

Order the steps to set up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service.

Accepted Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Define delivery pipeline → Step 4: Push code → Step 5: Promote. The correct order for setting up a CI/CD pipeline using Cloud Build and Cloud Deploy for a Cloud Run service begins with creating a build configuration file (cloudbuild.yaml) that specifies how to build and test the application. Next, you set a trigger (e.g., on push to a branch) in Cloud Build to automatically start builds. Then, you define a delivery pipeline in Cloud Deploy with targets (e.g., staging, production) and approval gates. After that, you push code to the repository, which triggers the build and, if successful, creates a release in the delivery pipeline. Finally, you promote the release through the stages (e.g., from staging to production) either automatically or after manual approval. This order ensures each prerequisite is in place before the next step, enabling a seamless automated workflow.

Answer

Step 1: Create build config → Step 2: Set trigger → Step 3: Push code → Step 4: Define delivery pipeline → Step 5: Promote

Answer

Step 1: Define delivery pipeline → Step 2: Create build config → Step 3: Set trigger → Step 4: Push code → Step 5: Promote

Answer

Step 1: Push code → Step 2: Create build config → Step 3: Set trigger → Step 4: Define delivery pipeline → Step 5: Promote

Question 12

An organization uses Cloud Deploy with Skaffold to manage progressive delivery on GKE. After a rollout, the new revision shows a higher error rate in Stackdriver, but the Cloud Deploy pipeline did not automatically roll back. What is the most likely cause?

Accepted Answer

The Cloud Deploy pipeline does not have a stackdriverMetrics verification job defined to check error rates.. Cloud Deploy does not automatically roll back based on error rates unless a verification job (such as a Stackdriver metrics check) is explicitly defined in the pipeline. Without a verification step that monitors error rates and fails the rollout, Cloud Deploy will continue advancing through phases even if the new revision is unhealthy. Therefore, the absence of a stackdriverMetrics verification job is the most likely cause.

Answer

The rollout strategy includes a manual approval step before advancing to the next phase.

Answer

The release was created with a '--disable-rollback' flag.

Answer

The rollout has not yet reached 100% traffic, so Cloud Deploy waits for full completion before evaluating health.

Question 13

A DevOps engineer is setting up a Cloud Build trigger that deploys to Cloud Run. The build succeeds but the deployment fails with 'Permission denied on the Cloud Run service'. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the roles/run.admin role.. The Cloud Build service account (typically the Compute Engine default service account or a user-specified service account) requires the roles/run.admin role to deploy to Cloud Run. This role grants permission to create, update, and manage Cloud Run services. Without it, the deployment step fails with a 'Permission denied' error, even though the build itself succeeds.

Answer

The Cloud Run service account lacks the roles/cloudbuild.builds.builder role.

Answer

The trigger is missing the required deployment configuration.

Answer

The cloudbuild.yaml file has an incorrect image tag.

Question 14

Which Cloud Monitoring feature can directly correlate this error with the associated trace and VM instance?

Accepted Answer

Error Reporting. Error Reporting in Google Cloud automatically groups errors from Cloud Logging and can directly correlate an error with the associated trace ID and VM instance metadata. This is because Error Reporting ingests structured log entries that contain the `@type` field set to `type.googleapis.com/google.devtools.clouderrorreporting.v1beta1.ReportedErrorEvent` and parses the `serviceContext` and `context` fields to link the error to the specific trace and resource (e.g., VM instance).

Answer

Log-based metrics

Answer

Metrics Explorer

Answer

Alerting policies

Question 15

A company wants to monitor custom application metrics in real-time and trigger alerts when a metric exceeds a threshold. Which Google Cloud service should they use?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver Monitoring) is the correct service because it is designed to ingest custom application metrics via the Monitoring API or OpenTelemetry, create dashboards for real-time visualization, and configure alerting policies that trigger notifications when a metric exceeds a defined threshold. This directly meets the requirement for real-time monitoring and threshold-based alerts.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

Cloud Error Reporting

Google Professional Cloud DevOps Engineer PCDOE practice test

Three ways to study

Study PCDOE by domain

Study PCDOE by topic

Bootstrapping a Google Cloud organization for DevOps practice questions

Applying site reliability engineering practices practice questions

Optimizing performance and cost practice questions

Building and implementing CI/CD pipelines practice questions

Implementing service monitoring strategies practice questions

Optimizing service performance practice questions

PCDOE fundamentals practice questions

PCDOE scenario practice questions

PCDOE troubleshooting practice questions

Top PCDOE questions

Google Professional Cloud DevOps Engineer practice questions