Google Professional Cloud DevOps Engineer (PCDOE) — Questions 451–486

Why this answer

How to eliminate wrong answers

Option B is wrong because `roles/run.invoker` only allows invoking (calling) Cloud Run services, not deploying or managing them. Option C is wrong because `roles/cloudbuild.builds.editor` grants permissions to manage Cloud Build triggers and builds, but does not include any Cloud Run deployment permissions. Option D is wrong because `roles/iam.serviceAccountUser` allows a principal to impersonate a service account (e.g., to use its identity), but does not grant direct Cloud Run deployment permissions; it is often used in conjunction with other roles, not as a standalone deployment role.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because switching to flat-rate pricing caps the maximum cost but does not reduce the amount of data scanned; it simply changes the billing model from per-byte to a fixed monthly fee, which could be more expensive if usage is low or variable. Option C is wrong because reserving BigQuery slots for dedicated capacity provides predictable performance and cost but does not inherently reduce the amount of data scanned; it is a capacity-based pricing model that still charges for the slots regardless of query efficiency. Option D is wrong because clustering organizes data within partitions to improve query performance and reduce costs by limiting the data scanned within a partition, but it is secondary to partitioning; without partition pruning, clustering alone cannot skip entire partitions and is less effective at reducing overall data scanned.

Why this answer

How to eliminate wrong answers

Option A is wrong because `severity>=ERROR` uses a comparison operator that is not supported in Cloud Logging filtering; severity filtering requires exact match operators (`=` or `!=`), not range comparisons. Option B is wrong because `severity:"ERROR"` uses a colon operator which is for text search or has field matching in some logging systems, but Cloud Logging requires the `=` operator for exact severity field matching. Option D is wrong because `jsonPayload.severity:ERROR` references a nested field under `jsonPayload`, but the severity field is a top-level LogEntry field, not part of the JSON payload; this filter would look for a custom field and miss the standard severity logs.

Why these pairings

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the `roles/clouddeploy.jobRunner` role is used for executing deployment jobs (e.g., running Skaffold render/apply) and does not include the `clouddeploy.releases.promote` permission needed for promotion. Option B is wrong because the `roles/cloudbuild.builds.builder` role is for Cloud Build execution, not for Cloud Deploy release promotion; it does not grant `clouddeploy.releases.promote`. Option C is wrong because the `roles/clouddeploy.operator` role provides broader management permissions (e.g., creating releases, rollbacks) but does not include the `clouddeploy.releases.promote` permission, which is exclusive to the `roles/clouddeploy.approver` role.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because IAM conditions on storage buckets can restrict access based on encryption key type, but they cannot enforce the requirement that buckets must be created with CMEK; IAM conditions control access, not creation policies. Option C is wrong because Cloud Asset Inventory can identify non-compliant buckets after they are created, but it does not prevent their creation or enforce the policy proactively. Option D is wrong because Cloud Audit Logs can monitor and alert on non-CMEK usage, but they are reactive and do not enforce the requirement at the time of bucket creation.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating separate triggers for each branch would cause builds for all branches, not just master, and adds unnecessary complexity. Option C is wrong because using a custom Cloud Build step to check the branch name would still trigger the build for every branch, wasting resources and time; the branch check should happen before the build starts, not during it. Option D is wrong because using a Cloud Function to call Cloud Build for master only introduces an unnecessary intermediary, adding latency and complexity when the native branch filter in the trigger already achieves the goal directly.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because custom roles cannot enforce naming conventions at creation time; they only control permissions to call the API, not validate input parameters like the account name. Option C is wrong because organization policy constraints (e.g., `constraints/iam.allowedPolicyMemberDomains`) do not support conditions on service account names; they only restrict resource locations, domains, or specific IAM conditions, not naming patterns. Option D is wrong because folder-level attributes and policies in Google Cloud do not have a native mechanism to enforce naming conventions on service accounts; folder policies apply to resource hierarchies but cannot validate string patterns on IAM resources.

Why this answer

How to eliminate wrong answers

Option B is wrong because the user triggering the build only needs permission to start the Cloud Build execution; the actual deployment to GKE is performed by the Cloud Build service account, not the user's identity. Option C is wrong because an authorization error during the deployment step is distinct from source code repository access; if Cloud Build lacked repository permissions, the error would occur earlier during the source fetch step, not during deployment. Option D is wrong because a Docker build failure due to missing dependencies would cause a build step failure, not an authorization error; the error message specifically indicates an authorization issue, not a build failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because `roles/compute.xpnAdmin` is used for administering the Shared VPC (XPN) configuration itself, such as attaching or detaching service projects, not for granting a service account the ability to use subnets. Option B is wrong because `roles/compute.securityAdmin` provides permissions to manage firewall rules and SSL certificates, but does not include the `compute.subnetworks.use` permission required to launch instances in Shared VPC subnets. Option D is wrong because `roles/compute.networkAdmin` grants full control over network resources, including creating and deleting subnets, which is overly permissive and not the least-privilege role needed for simply using existing subnets.

Why this answer

How to eliminate wrong answers

Option A is wrong because Folder Admin allows management of folder hierarchy but not project creation or billing account linking, and Security Reviewer only provides read-only access to IAM policies, lacking the permissions needed to create projects or manage billing. Option B is wrong because Org Admin grants broad organization-level management permissions that are too permissive for a DevOps team, and Project Creator alone cannot link billing accounts without the Billing Account User role. Option D is wrong because Billing Admin provides full billing account management (including modifying billing account settings) which is excessive, and Folder Admin is not required for initial project creation; the correct role for linking billing is Billing Account User, not Billing Admin.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because switching to a premium tier network typically increases egress rates (higher performance, higher cost) and does not reduce egress costs; it may even increase them. Option B is wrong because enabling gzip compression reduces the size of responses, which can lower bandwidth usage, but it does not address the root cause of egress costs—the volume of data served from the CDN—and compression is often already applied by default or has limited impact on already-compressed content like images and video. Option C is wrong because Cloud Armor blocks malicious traffic at the edge, which can reduce some egress from attacks, but legitimate user traffic still generates egress costs; blocking malicious traffic does not significantly reduce overall egress costs for a globally distributed content delivery service.

Why this answer

How to eliminate wrong answers

Option A is wrong because using a user account violates the least-privilege model — user accounts have persistent, broad permissions and are not designed for automated pipelines, creating a security risk and auditability gap. Option B is wrong because storing service account keys in Secret Manager still requires managing a long-lived, static secret that can be compromised; the key itself is a high-value target and must be rotated, which adds operational overhead. Option C is wrong because generating a single service account key and distributing it securely still introduces a long-lived credential that can be leaked, rotated only with manual effort, and violates the principle of using short-lived, just-in-time credentials.

Why this answer

How to eliminate wrong answers

Option A is wrong because `metricRelabelings` does not add labels; it modifies or filters existing metric names or labels, and the `action: drop` specifically removes metrics, not adds. Option B is wrong because the `action: drop` with a regex that matches metrics starting with 'container_' drops those metrics, not keeps them; keeping would require `action: keep`. Option C is wrong because renaming metrics (e.g., removing a prefix) would use `action: replace` with a `replacement` field, not `action: drop`.

Why this answer

How to eliminate wrong answers

Option B is wrong because project-level perimeters require manual attachment to each project, which is inefficient and error-prone for enforcing a policy across many projects. Option C is wrong because organization policies (e.g., constraints/compute.restrictVpcPeering) cannot directly define VPC Service Controls perimeters; they are used for different types of restrictions like resource location or service usage. Option D is wrong because a custom script only monitors and alerts on non-compliance but does not enforce the perimeter, leaving a window of non-compliance and requiring additional remediation steps.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the number of instances does not diagnose the root cause of latency; it only masks the symptom and may not help if the issue is due to network congestion, load balancer configuration, or regional user distribution. Option B is wrong because VPC Flow Logs capture metadata about network flows (e.g., source/destination IP, ports, packet count) but do not provide latency or dropped packet analysis for a Network Load Balancer; they are more suited for security auditing or connection tracking, not performance diagnostics. Option C is wrong because switching to an HTTP(S) Load Balancer would change the architecture and introduce Layer 7 processing overhead, which is unnecessary for a TCP/UDP application and does not directly diagnose the existing latency issue; the current load balancer type is appropriate for the protocol, and the problem should be investigated with existing monitoring tools.

Why this answer

How to eliminate wrong answers

Option A is wrong because Cloud Load Balancing with Cloud Armor provides DDoS protection and traffic distribution, but does not address the low cache hit ratio or reduce latency for Asian users; it does not change the origin location or caching behavior. Option B is wrong because enabling HTTP/2 and increasing TTL for video content can improve performance generally, but HTTP/2 does not fix the fundamental issue of a distant origin, and longer TTLs only help if content is already cached; they do not improve cache hit ratio for a region with a faraway origin. Option C is wrong because configuring a custom domain with SSL and enabling request collapsing improves security and reduces origin load by collapsing concurrent requests, but does not address the geographic distance between Asian users and the us-central1 origin, so cache misses still suffer high latency.

Why this answer

How to eliminate wrong answers

Option A is wrong because Cloud Deployment Manager is an infrastructure-as-code service for managing Google Cloud resources using declarative templates (YAML/Python), not a Git repository service. Option C is wrong because Cloud Storage is an object storage service for storing unstructured data (blobs) via HTTP/S, not a Git repository with version control or CI integration. Option D is wrong because Container Registry is a private container image registry for storing and managing Docker images, not a Git repository; it integrates with Cloud Build for building images from source, but it does not host Git repositories.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because pod anti-affinity controls pod placement (e.g., spreading pods across nodes) but does not address the root cause of data loss from ephemeral local SSD; it would not prevent CrashLoopBackOff if the data is missing. Option C is wrong because increasing the node pool size adds more nodes but does not solve the problem of ephemeral storage being tied to a failed node; pods would still fail on new nodes if they rely on local SSD that is not replicated. Option D is wrong because a DaemonSet runs one pod per node, but it does not provide persistent storage; if the node fails, the pod is rescheduled on another node without the local SSD data, leading to the same CrashLoopBackOff issue.

Why this answer

How to eliminate wrong answers

Option A is wrong because read-only replicas in Spanner are used for improving read latency for stale reads (non-strong reads) and do not reduce CPU utilization on the primary nodes; they also cannot serve strong reads, which are common in read-heavy workloads. Option B is wrong because splitting frequently read tables into smaller tables does not inherently reduce CPU utilization or read latency; it may increase complexity and cross-table joins, and Spanner already partitions data into splits automatically. Option C is wrong because simply increasing the number of nodes without ensuring even distribution of read requests can leave hot spots unresolved; the key issue is uneven load, not just insufficient capacity.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting the minimum number of instances of the new revision to 0 does not stop traffic from reaching it; it only affects scaling behavior, and the revision would still serve requests if it receives traffic. Option B is wrong because redeploying the previous version from the container registry is unnecessary and slower; Cloud Run already retains the previous revision, so you can simply shift traffic to it. Option C is wrong because modifying ingress settings to restrict traffic to the new revision would block all incoming traffic to that revision, but it does not automatically route traffic to the previous revision, leaving users with no service until you manually adjust routing.

Why this answer

How to eliminate wrong answers

Option A is wrong because PagerDuty is an external incident management tool that integrates with Cloud Monitoring via notification channels, but it is not a built-in feature of Cloud Monitoring itself; the question asks for a feature of Cloud Monitoring, not an external tool. Option C is wrong because a webhook notification channel simply sends HTTP POST requests to a specified URL when an alert fires; it does not inherently support escalation logic or acknowledgment tracking. Option D is wrong because an alerting policy condition defines the metric or log criteria that trigger an alert, not the escalation behavior after the alert fires; acknowledgment and escalation are handled by the notification channel's configuration, not the policy condition.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Cloud Console Cost Table is not a GCP tool; it is a generic term and does not exist as a specific service for rightsizing recommendations. Option B is wrong because Cloud Monitoring focuses on collecting metrics, logs, and setting alerts, but it does not generate rightsizing recommendations; it provides data that could be used manually but lacks the automated analysis. Option C is wrong because Cloud Billing Reports provide cost breakdowns and usage trends, but they do not offer specific VM rightsizing suggestions; they are for historical cost analysis, not proactive optimization.

Why this answer