Hard Difficulty Questions

Number of requests per second.

Why wrong: Request volume alone does not indicate a problem.

CPU utilization at 50%.

Why wrong: 50% utilization is not critical; might be normal.

Memory usage trend.

Why wrong: Memory trends are not immediate page triggers unless critical.

In the cloudbuild.yaml, add a condition that checks if the branch name matches 'v*.*.*'.

Why wrong: Tags are not branch names.

Create a separate cloudbuild.yaml for production and use a branch filter '^main$' to trigger it.

Why wrong: Branch filter does not match tags.

Configure a manual approval step in Cloud Build that requires a production manager to approve before running the production deployment.

Why wrong: Approval does not restrict trigger to tags.

Add more monitoring alerts.

Why wrong: Alerts detect issues but do not prevent them.

Schedule weekly meetings to review changes.

Why wrong: Weekly reviews are too infrequent to prevent rapid changes.

Use a configuration management database (CMDB).

Why wrong: A CMDB tracks configurations but does not enforce review.

Use project-level VPC Service Controls perimeters.

Why wrong: Project-level perimeters require manual configuration for each project, inefficient.

Use organization policies to set the perimeter.

Why wrong: Organization policies are for constraints, not VPC Service Controls perimeters.

Use a custom script to monitor and alert on non-compliant projects.

Why wrong: Monitoring does not enforce the perimeter; it only detects violations.

Spinnaker

Why wrong: Spinnaker is an open-source, multi-cloud continuous delivery platform, not a native Google Cloud service, thus failing the requirement for a *Google Cloud service* for orchestration. Its deployment and management on GCP would necessitate self-provisioning and operational overhead. This option is tempting because Spinnaker is a powerful tool, excelling at complex, multi-cloud deployments and advanced strategies like canary or blue/green. It would be the correct choice if the scenario prioritised a robust, vendor-agnostic, self-managed CD solution over a fully managed, native cloud offering.

Jenkins on GKE

Why wrong: Jenkins requires custom setup and doesn't have native Google Cloud integration.

Cloud Build with manual steps

Why wrong: Cloud Build lacks native approval gates and environment management.

Use Cloud Build to directly replace the revision

Why wrong: Replacing the revision causes downtime.

Set traffic to 100% on the new revision gradually using multiple updates

Why wrong: This is not gradual; it's an all-at-once switch.

Configure a rolling update strategy in Cloud Deploy

Why wrong: Cloud Deploy is for Kubernetes, not Cloud Run.

Rotate keys manually every 90 days.

Why wrong: Manual rotation is error-prone and not recommended.

Embed keys in application code.

Why wrong: Insecure.

Store keys in Cloud Storage with public access.

Why wrong: Insecure.

Reserve capacity in specific regions.

Why wrong: Reserving capacity changes pricing model but does not reduce data scanned.

Use flat-rate pricing with slots.

Why wrong: Flat-rate pricing provides predictable costs but does not reduce actual query data processing.

Use standard SQL instead of legacy SQL.

Why wrong: Query cost is based on data scanned, not SQL dialect.

Bucket lock.

Why wrong: Bucket lock protects objects from deletion, not cost optimization.

Retention policy.

Why wrong: Retention policy prevents object deletion, not automatic storage class transitions.

Object versioning.

Why wrong: Object versioning preserves previous versions but does not automatically change storage class.

Use committed use discounts.

Why wrong: Committed use discounts provide a discount but do not reduce resource usage.

Use High Availability with a standby instance.

Why wrong: High Availability adds a standby instance, increasing cost.

Use vertical scaling to increase instance size.

Why wrong: Increasing instance size raises cost.

Use Istio mTLS for all service-to-service communication

Why wrong: mTLS adds encryption overhead, increasing latency rather than reducing it.

Increase the number of nodes in the cluster

Why wrong: More nodes may help with capacity but not necessarily reduce inter-service latency; could even add hops.

Increase the number of instances behind the load balancer.

Why wrong: CPU is low; more instances may not reduce latency.

Enable VPC Flow Logs and analyze for dropped packets.

Why wrong: Flow logs show traffic but not latency.

Switch to an HTTP(S) Load Balancer for better visibility.

Why wrong: Changing load balancer type is disruptive and may not solve the issue.

Use Cloud Load Balancing with Cloud Armor to protect the origin.

Why wrong: Cloud Armor provides security, not performance.

Enable HTTP/2 on Cloud CDN and increase the TTL for video content.

Why wrong: HTTP/2 improves connection reuse but does not reduce origin latency.

Configure a custom domain on Cloud CDN with SSL and enable request collapsing.

Why wrong: Custom domain and request collapsing do not address the geographic distance to origin.

Exact code line numbers and commits that caused the incident.

Why wrong: Too detailed; focus on systemic issues.

A detailed analysis of the root cause only.

Why wrong: Also need impact and response.

An attribution of blame to the individual or team responsible.

Why wrong: Blameless culture is key.

Use legacy SQL instead of standard SQL.

Why wrong: SQL dialect does not affect data scanning efficiency.

Use flat-rate pricing.

Why wrong: Flat-rate pricing changes billing model but does not reduce data scanned.

The org_id is incorrect.

Why wrong: Would give an invalid organization error.

The organization requires that the Compute Engine API be enabled before project creation.

Why wrong: APIs are enabled after project creation.

The project ID already exists.

Why wrong: Would give ALREADY_EXISTS error.

Increase the number of replicas of the payment validation service to 10 to handle peak load.

Why wrong: The payment service has low error rate and latency within normal range; increasing replicas may not resolve the issue and is not the first step.

Enable connection pooling and retries with exponential backoff in the checkout service for the HTTP call to the payment service.

Why wrong: This can improve resilience but does not address the root cause; it may mask the problem.

Investigate the checkout service pod restarts due to liveness probe failures, as 'connection reset by peer' indicates pod instability.

Why wrong: While 'connection reset by peer' can indicate pod restarts, the latency pattern is more consistent with GC pauses; pod restarts would likely cause more frequent errors and a different latency pattern.

Use network tags and service accounts to enforce rules.

Why wrong: Tags and service accounts do not provide immutable enforcement.

Use organization policy constraints to prevent project owners from modifying firewall rules.

Why wrong: No specific constraint exists for firewall rules.

Create firewall rules at the VPC level and assign them to the folder.

Why wrong: VPC-level rules are not folder-scoped.

Use Cloud KMS to encrypt secrets before storing in Cloud Storage.

Why wrong: This adds complexity; using Secret Manager is preferred.

Base64 encode secrets and store them in Cloud Build substitutions.

Why wrong: Substitutions are visible in build logs and not secure.

Enable the Cloud Run API in the project.

Why wrong: The API must already be enabled for the pipeline to run.

Use a different service account for deployment.

Why wrong: Not a resolution; the current SA needs proper permissions.

Add the `run.routes.invoke` permission to a custom role.

Why wrong: The Invoker role already includes `run.routes.invoke`; the error is misleading but missing other permissions.