PCDOE Practice Questions

Question 1

A company is setting up a new Google Cloud organization. They want to ensure that all projects inherit common IAM policies. What is the best practice?

Accepted Answer

Apply IAM policies at the organization level.. Applying policies at the organization level ensures all projects and folders inherit them, providing consistent enforcement and reducing administrative overhead.

Answer

Apply IAM policies at the folder level.

Answer

Apply IAM policies at the project level.

Answer

Use multiple organizations to isolate policies.

Question 2

You are designing alerting policies for a microservice architecture. Which TWO metrics are most suitable for triggering a page to the on-call engineer?

Accepted Answer

Latency P99 exceeding the SLO target for 5 minutes.. Error budget burn rate and high latency (P99 breaching SLO) directly indicate customer-facing issues and require immediate attention. CPU and request count are less critical.

Answer

Number of requests per second.

Answer

CPU utilization at 50%.

Answer

Memory usage trend.

Question 3

A team uses Cloud Build with a cloudbuild.yaml that deploys to multiple environments. They want to ensure that the production deployment step only runs when the build is triggered by a tag matching 'v*.*.*'. Which TWO configurations achieve this? (Choose two.)

Accepted Answer

In the cloudbuild.yaml, use a 'waitFor' condition that only runs the production step when the substitution variable $TAG_NAME matches 'v*.*.*'.. Cloud Build supports substitution variables like $TAG_NAME, which can be used in a 'waitFor' condition or as part of a step's entrypoint logic to gate execution. By checking if $TAG_NAME matches the glob pattern 'v*.*.*', the production deployment step will only run when the build is triggered by a matching tag, ensuring environment-specific control within a single cloudbuild.yaml.

Answer

In the cloudbuild.yaml, add a condition that checks if the branch name matches 'v*.*.*'.

Answer

Create a separate cloudbuild.yaml for production and use a branch filter '^main$' to trigger it.

Answer

Configure a manual approval step in Cloud Build that requires a production manager to approve before running the production deployment.

Question 4

During a post-mortem, you identify that an incident was caused by a configuration change that was not reviewed. Which of the following is the most effective preventive action?

Accepted Answer

Implement a change management process with mandatory peer review.. A change management process with mandatory peer review directly addresses the root cause: a configuration change was made without oversight. By requiring at least one additional engineer to review and approve changes before implementation, the process catches misconfigurations, policy violations, or unintended side effects before they reach production. This is a preventive control, not a detective or corrective one, and aligns with ITIL best practices for change management.

Answer

Add more monitoring alerts.

Answer

Schedule weekly meetings to review changes.

Answer

Use a configuration management database (CMDB).

Question 5

A company wants to enforce that all projects in the organization have a specific VPC Service Controls perimeter. What is the most efficient way to achieve this?

Accepted Answer

Use folder-level VPC Service Controls perimeters.. Folder-level VPC Service Controls perimeters allow you to apply a single perimeter configuration to all projects within a folder, ensuring consistent enforcement across the organization without needing to configure each project individually. This is the most efficient method because it leverages the resource hierarchy to inherit the policy, reducing administrative overhead and preventing misconfigurations.

Answer

Use project-level VPC Service Controls perimeters.

Answer

Use organization policies to set the perimeter.

Answer

Use a custom script to monitor and alert on non-compliant projects.

Question 6

A DevOps team is bootstrapping a new Google Cloud organization. They want to grant a group of engineers the ability to create and manage projects within the organization, but not to modify organization policies or folders. Which IAM role should be assigned at the organization level?

Accepted Answer

roles/resourcemanager.projectCreator. Roles/resourcemanager.projectCreator, is correct because it grants the specific permission to create and manage projects within the organization without allowing modifications to organization policies or folders. This role includes permissions like resourcemanager.projects.create and resourcemanager.projects.update, but explicitly excludes permissions for organization-level policy management (e.g., resourcemanager.organizations.setIamPolicy) or folder administration (e.g., resourcemanager.folders.update).

Answer

roles/owner

Answer

roles/resourcemanager.folderAdmin

Answer

roles/editor

Question 7

Refer to the exhibit. An App Engine application returns 504 errors. The application calls an external API and processes the result. Which change is most likely to resolve the errors?

Accepted Answer

Increase the App Engine request timeout in app.yaml to 120 seconds.. A 504 error from App Engine indicates the request exceeded the timeout limit before the application could respond. The default App Engine request timeout is 60 seconds, and since the application calls an external API and processes the result, the total time may exceed this limit. Increasing the request timeout in app.yaml to 120 seconds allows the application more time to complete the external API call and processing, resolving the 504 error.

Answer

Reduce the idle timeout in the scaling settings.

Answer

Change the scaling type from automatic to manual.

Answer

Increase the number of instances to handle the load.

Question 8

A CI/CD pipeline must deploy to multiple environments (dev, staging, prod) with manual approval required before prod deployment. Which Google Cloud service is best for orchestrating this?

Accepted Answer

Cloud Deploy with promotion. Cloud Deploy provides a delivery pipeline with sequential stages and manual approval gates, making it ideal for multi-environment deployments.

Answer

Spinnaker

Answer

Jenkins on GKE

Answer

Cloud Build with manual steps

Question 9

A company is using Cloud Build to build a Go application. The build fails with an error 'no Go files in /workspace'. What is the most likely cause?

Accepted Answer

The build step is running in the wrong directory.. Cloud Build copies the repository contents to /workspace. If the Go source files are in a subdirectory, the build step might be pointing to the wrong directory.

Answer

The repository has no Go files.

Answer

The Go module is not properly initialized.

Answer

Cloud Build is unable to clone the repository.

Question 10

A DevOps engineer notices that the monthly compute cost is higher than expected for a Kubernetes Engine cluster. They want to identify which namespaces or workloads are contributing most to the cost. What should they do?

Accepted Answer

Enable GKE Usage Metering and export to BigQuery.. GKE Usage Metering exports detailed per-cluster resource consumption data (CPU, memory, storage, and network) to BigQuery, enabling cost attribution by namespace, label, or workload. This is the only option that directly provides granular cost breakdowns for Kubernetes resources, allowing the engineer to identify which namespaces or workloads drive compute costs.

Answer

Enable Logging for all containers and analyze logs.

Answer

Use Cloud Monitoring dashboards with Kubernetes metrics.

Answer

Add labels to nodes and use Cost Table reports.

Question 11

A team wants to ensure zero-downtime deployments for a Cloud Run service. They plan to gradually shift traffic from the current revision to the new one. What should they configure?

Accepted Answer

Use Cloud Run's traffic splitting feature to slowly increase traffic to the new revision. Cloud Run supports traffic splitting, allowing you to gradually send a percentage of traffic to the new revision to monitor health before fully switching.

Answer

Use Cloud Build to directly replace the revision

Answer

Set traffic to 100% on the new revision gradually using multiple updates

Answer

Configure a rolling update strategy in Cloud Deploy

Question 12

A team wants to receive a notification when their monthly spending exceeds 80% of the budget. Which GCP feature should they configure?

Accepted Answer

Budget alert with threshold rule at 0.8.. Budget alerts with threshold rules trigger notifications when spending reaches specified percentages, such as 80%.

Answer

Committed use discounts.

Answer

Cloud Storage bucket for cost exports.

Answer

Cloud Monitoring cost insights dashboard.

Question 13

Which TWO are valid methods to manage service account keys securely? (Select exactly 2)

Accepted Answer

Automate key rotation using a Cloud Function.. Automating key rotation with a Cloud Function ensures service account keys are rotated on a schedule without manual intervention, reducing the risk of key exposure. This aligns with Google Cloud's best practices for key management, as it enforces rotation policies programmatically and can integrate with Secret Manager to securely store and version keys.

Answer

Rotate keys manually every 90 days.

Answer

Embed keys in application code.

Answer

Store keys in Cloud Storage with public access.

Question 14

A site reliability engineer is defining SLOs for a microservice application running on Google Kubernetes Engine. The application serves user-facing API requests. Which TWO approaches should the engineer take to effectively monitor the service's performance?

Accepted Answer

Monitor the 99th percentile of request latency directly using Cloud Monitoring custom metrics.. Monitoring the 99th percentile (p99) of request latency directly captures the experience of the slowest 1% of users, which is critical for user-facing APIs where tail latency directly impacts user satisfaction. Cloud Monitoring custom metrics allow the engineer to instrument the application to emit precise latency distributions, enabling accurate SLO tracking rather than relying on averages that mask outliers.

Answer

Monitor average latency because it is most representative of typical user experience.

Answer

Monitor container CPU utilization as a proxy for application latency.

Answer

Use the number of running pods as the primary SLO indicator.

Question 15

A company uses Compute Engine with committed use discounts for 1-year. They need to reduce costs further. What should they do?

Accepted Answer

Rightsize their VMs based on recommender recommendations.. Rightsizing based on recommender recommendations reduces resource usage without changing pricing model, offering immediate cost savings.

Answer

Use sustained use discounts instead.

Answer

Use preemptible VMs for all workloads.

Answer

Increase committed use discount term to 3 years.

Google Professional Cloud DevOps Engineer PCDOE practice test

Three ways to study

Study PCDOE by domain

Study PCDOE by topic

Bootstrapping a Google Cloud organization for DevOps practice questions

Applying site reliability engineering practices practice questions

Optimizing performance and cost practice questions

Building and implementing CI/CD pipelines practice questions

Implementing service monitoring strategies practice questions

Optimizing service performance practice questions

PCDOE fundamentals practice questions

PCDOE scenario practice questions

PCDOE troubleshooting practice questions

Top PCDOE questions

Google Professional Cloud DevOps Engineer practice questions

How to use these PCDOE questions

Quick answer