Scenario practice questions

A team uses Cloud SQL for PostgreSQL. They receive an alert that the database's CPU utilization is above 95% for the past 30 minutes. Queries are taking longer than usual. They want to investigate without causing further impact. What should they do first?

Trap 1: Increase the number of vCPUs of the Cloud SQL instance

Scaling up is a mitigation but should be done after understanding the cause.

Trap 2: Restart the Cloud SQL instance to clear the cache

Restarting causes downtime and does not fix the root cause.

Trap 3: Migrate the database to Cloud Spanner

Migration is a long-term project, not an immediate investigation step.

A
Increase the number of vCPUs of the Cloud SQL instance
Why wrong: Scaling up is a mitigation but should be done after understanding the cause.
B
Restart the Cloud SQL instance to clear the cache
Why wrong: Restarting causes downtime and does not fix the root cause.
C
Migrate the database to Cloud Spanner
Why wrong: Migration is a long-term project, not an immediate investigation step.
D
Use Cloud SQL Query Insights to find the most time-consuming queries
Query Insights shows top queries by CPU and latency.

Read the full NAT/PAT explanation →

Question 2hardmultiple choice

You manage a production environment with a web service deployed on Compute Engine instances behind a HTTP(S) Load Balancer. The service has a health check configured on the load balancer, probing a health endpoint every 10 seconds. After a recent configuration change, you observe that all instances are marked as unhealthy and traffic is failing. The health check response is 200 OK from the instances, but the load balancer still marks them unhealthy. The health check configuration: protocol: HTTP, port: 80, request path: /health, interval: 10s, timeout: 5s, unhealthy threshold: 2. The instances are running a custom web server. What is the most likely cause?

Trap 1: The load balancer is misconfigured with an incorrect protocol…

If protocol mismatch, health check would not get 200.

Trap 2: The health check port is incorrectly configured as 80 but the…

The question states the service is on port 80.

Trap 3: The health check timeout is greater than the interval, causing…

Timeout 5s, interval 10s, so no overlap.

A
The load balancer is misconfigured with an incorrect protocol (HTTPS instead of HTTP).
Why wrong: If protocol mismatch, health check would not get 200.
B
The health check port is incorrectly configured as 80 but the service is listening on 8080.
Why wrong: The question states the service is on port 80.
C
The health check response is coming from a different server (e.g., a reverse proxy) that returns 200 but does not represent the actual service health.
If the response is from a different process, the load balancer may mark the instance unhealthy because the health check's interpretation of health is not satisfied.
D
The health check timeout is greater than the interval, causing overlapping probes.
Why wrong: Timeout 5s, interval 10s, so no overlap.

Question 3mediummultiple choice

A team deploys a microservice on Google Kubernetes Engine (GKE) that processes user uploads. The service latency has increased over time. Monitoring shows that CPU utilization is low, but memory usage is high and garbage collection (GC) pauses are frequent. Which action is most likely to reduce latency?

Trap 1: Scale out the deployment by increasing the number of replicas.

CPU is low, so more replicas won't reduce GC pauses.

Trap 2: Reduce the number of replicas to concentrate load.

Fewer replicas increase load per pod, worsening GC.

Trap 3: Increase the CPU limit to allow faster processing.

CPU is not the bottleneck.

A
Scale out the deployment by increasing the number of replicas.
Why wrong: CPU is low, so more replicas won't reduce GC pauses.
B
Reduce the number of replicas to concentrate load.
Why wrong: Fewer replicas increase load per pod, worsening GC.
C
Increase the CPU limit to allow faster processing.
Why wrong: CPU is not the bottleneck.
D
Increase the memory limit and requests for the container.
More memory reduces GC frequency and pauses.

Question 4hardmultiple choice

Your team uses a canary deployment strategy on Google Kubernetes Engine (GKE). During a rollback, you notice that the rollback caused a brief period of downtime because the previous version's readiness probe was not properly configured. Which of the following best prevents this issue in the future?

Trap 1: Perform a gradual rollback with a managed instance group.

MIGs are not used in GKE; this is not applicable.

Trap 2: Use a blue/green deployment instead.

Blue/green also relies on probes; the same issue could occur.

Trap 3: Use a Kubernetes Job to run a post-deployment validation.

Post-deployment validation is good but does not prevent the initial issue during rollback.

A
Perform a gradual rollback with a managed instance group.
Why wrong: MIGs are not used in GKE; this is not applicable.
B
Use a blue/green deployment instead.
Why wrong: Blue/green also relies on probes; the same issue could occur.
C
Ensure that the readiness probe is tested as part of the pre-deployment validation.
Validating probes before deployment ensures both new and old versions are ready.
D
Use a Kubernetes Job to run a post-deployment validation.
Why wrong: Post-deployment validation is good but does not prevent the initial issue during rollback.

Question 5hardmultiple choice

A company is bootstrapping their organization using Terraform and wants to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which of the following is the best practice for securing the state file?

Trap 1: Use a bucket with fine-grained access and grant…

objectCreator allows creating but not reading or updating existing objects.

Trap 2: Use a bucket with object versioning and enable VPC Service Controls.

VPC SC adds network security but does not control access to the state file itself.

Trap 3: Use a bucket with uniform access and grant…

ObjectViewer is read-only; Terraform needs write access.

A
Use a bucket with fine-grained access and grant roles/storage.objectCreator to the Terraform service account.
Why wrong: objectCreator allows creating but not reading or updating existing objects.
B
Use a bucket with object versioning and enable VPC Service Controls.
Why wrong: VPC SC adds network security but does not control access to the state file itself.
C
Use a bucket with a CMEK key and grant roles/storage.objectAdmin to the Terraform service account.
CMEK encrypts the state file, and objectAdmin allows full object control.
D
Use a bucket with uniform access and grant roles/storage.objectViewer to the Terraform service account.
Why wrong: ObjectViewer is read-only; Terraform needs write access.

Question 6mediummultiple choice

A team is running a stateful application on Compute Engine VMs. They notice that the application performance degrades over time as the disk fills up. They want to proactively alert before performance degrades. Which metric should they monitor?

Trap 1: Disk read/write latency

Latency increases after disk is nearly full, but it's a symptom, not a proactive indicator.

Trap 2: Network sent bytes

Network traffic is unrelated to disk usage.

Trap 3: CPU utilization

CPU doesn't indicate disk fullness.

A
Disk usage percentage
Monitors disk capacity, enabling early alerts.
B
Disk read/write latency
Why wrong: Latency increases after disk is nearly full, but it's a symptom, not a proactive indicator.
C
Network sent bytes
Why wrong: Network traffic is unrelated to disk usage.
D
CPU utilization
Why wrong: CPU doesn't indicate disk fullness.