πŸ”

PCD β€” questions

Page 11 of 18 Β· 359 total questions.

Topic 1 Β· Question 201

Your company uses Cloud Logging to manage large volumes of log data. You need to build a real-time log analysis architecture that pushes logs to a third-party application for processing. What should you do?

  • ACreate a Cloud Logging log export to Pub/Sub. (correct answer)
  • BCreate a Cloud Logging log export to BigQuery.
  • CCreate a Cloud Logging log export to Cloud Storage.
  • DCreate a Cloud Function to read Cloud Logging log entries and send them to the third-party application.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Cloud Logging log export to Pub/Sub.

Explanation

Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams. Cloud Logging centralizes, stores, and analyzes logs across services. This option meets the real-time / low-latency performance requirement.

Topic 1 Β· Question 202

You are developing a new public-facing application that needs to retrieve specific properties in the metadata of users’ objects in their respective Cloud Storage buckets. Due to privacy and data residency requirements, you must retrieve only the metadata and not the object data. You want to maximize the performance of the retrieval process. How should you retrieve the metadata?

  • AUse the patch method.
  • BUse the compose method.
  • CUse the copy method.
  • DUse the fields request parameter. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the fields request parameter.

Topic 1 Β· Question 203 Β· Select all that apply

You are deploying a microservices application to Google Kubernetes Engine (GKE) that will broadcast livestreams. You expect unpredictable traffic patterns and large variations in the number of concurrent users. Your application must meet the following requirements: β€’ Scales automatically during popular events and maintains high availability β€’ Is resilient in the event of hardware failures How should you configure the deployment parameters? (Choose two.)

  • ADistribute your workload evenly using a multi-zonal node pool. (correct answer)
  • BDistribute your workload evenly using multiple zonal node pools.
  • CUse cluster autoscaler to resize the number of nodes in the node pool, and use a Horizontal Pod Autoscaler to scale the workload. (correct answer)
  • DCreate a managed instance group for Compute Engine with the cluster nodes. Configure autoscaling rules for the managed instance group.
  • ECreate alerting policies in Cloud Monitoring based on GKE CPU and memory utilization. Ask an on-duty engineer to scale the workload by executing a script when CPU and memory usage exceed predefined thresholds.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Distribute your workload evenly using a multi-zonal node pool. Option C: Use cluster autoscaler to resize the number of nodes in the node pool, and use a Horizontal Pod Autoscaler to scale the workload. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Topic 1 Β· Question 204

You work at a rapidly growing financial technology startup. You manage the payment processing application written in Go and hosted on Cloud Run in the Singapore region (asia-southeast1). The payment processing application processes data stored in a Cloud Storage bucket that is also located in the Singapore region. The startup plans to expand further into the Asia Pacific region. You plan to deploy the Payment Gateway in Jakarta, Hong Kong, and Taiwan over the next six months. Each location has data residency requirements that require customer data to reside in the country where the transaction was made. You want to minimize the cost of these deployments. What should you do?

  • ACreate a Cloud Storage bucket in each region, and create a Cloud Run service of the payment processing application in each region. (correct answer)
  • BCreate a Cloud Storage bucket in each region, and create three Cloud Run services of the payment processing application in the Singapore region.
  • CCreate three Cloud Storage buckets in the Asia multi-region, and create three Cloud Run services of the payment processing application in the Singapore region.
  • DCreate three Cloud Storage buckets in the Asia multi-region, and create three Cloud Run revisions of the payment processing application in the Singapore region.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Cloud Storage bucket in each region, and create a Cloud Run service of the payment processing application in each region.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. Cloud Storage provides durable, scalable object storage that is fully managed.

Topic 1 Β· Question 205

You recently joined a new team that has a Cloud Spanner database instance running in production. Your manager has asked you to optimize the Spanner instance to reduce cost while maintaining high reliability and availability of the database. What should you do?

  • AUse Cloud Logging to check for error logs, and reduce Spanner processing units by small increments until you find the minimum capacity required.
  • BUse Cloud Trace to monitor the requests per sec of incoming requests to Spanner, and reduce Spanner processing units by small increments until you find the minimum capacity required.
  • CUse Cloud Monitoring to monitor the CPU utilization, and reduce Spanner processing units by small increments until you find the minimum capacity required. (correct answer)
  • DUse Snapshot Debugger to check for application errors, and reduce Spanner processing units by small increments until you find the minimum capacity required.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Cloud Monitoring to monitor the CPU utilization, and reduce Spanner processing units by small increments until you find the minimum capacity required.

Explanation

Cloud Spanner is a horizontally scalable, strongly consistent relational database with global reach. Cloud Monitoring collects metrics, dashboards, and alerts to observe system health. This option delivers the requirement at the lowest cost.

Topic 1 Β· Question 206

You recently deployed a Go application on Google Kubernetes Engine (GKE). The operations team has noticed that the application's CPU usage is high even when there is low production traffic. The operations team has asked you to optimize your application's CPU resource consumption. You want to determine which Go functions consume the largest amount of CPU. What should you do?

  • ADeploy a Fluent Bit daemonset on the GKE cluster to log data in Cloud Logging. Analyze the logs to get insights into your application code’s performance.
  • BCreate a custom dashboard in Cloud Monitoring to evaluate the CPU performance metrics of your application.
  • CConnect to your GKE nodes using SSH. Run the top command on the shell to extract the CPU utilization of your application.
  • DModify your Go application to capture profiling data. Analyze the CPU metrics of your application in flame graphs in Profiler. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Modify your Go application to capture profiling data. Analyze the CPU metrics of your application in flame graphs in Profiler.

Topic 1 Β· Question 207

Your team manages a Google Kubernetes Engine (GKE) cluster where an application is running. A different team is planning to integrate with this application. Before they start the integration, you need to ensure that the other team cannot make changes to your application, but they can deploy the integration on GKE. What should you do?

  • AUsing Identity and Access Management (IAM), grant the Viewer IAM role on the cluster project to the other team.
  • BCreate a new GKE cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team.
  • CCreate a new namespace in the existing cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team.
  • DCreate a new namespace in the existing cluster. Using Kubernetes role-based access control (RBAC), grant the Admin role on the new namespace to the other team. (correct answer)
Reveal answer & explanation
Correct answer: D

Create a new namespace in the existing cluster and use Kubernetes role-based access control (RBAC) to grant the other team the admin role scoped to that namespace (D). This lets them deploy their integration in their own namespace while preventing changes to your application's namespace. Project-level IAM Editor/Viewer roles (A, B, C) are too broad or too restrictive and don't provide namespace-level isolation.

Topic 1 Β· Question 208

You have recently instrumented a new application with OpenTelemetry, and you want to check the latency of your application requests in Trace. You want to ensure that a specific request is always traced. What should you do?

  • AWait 10 minutes, then verify that Trace captures those types of requests automatically.
  • BWrite a custom script that sends this type of request repeatedly from your dev project.
  • CUse the Trace API to apply custom attributes to the trace.
  • DAdd the X-Cloud-Trace-Context header to the request with the appropriate parameters. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add the X-Cloud-Trace-Context header to the request with the appropriate parameters.

Topic 1 Β· Question 209

You are trying to connect to your Google Kubernetes Engine (GKE) cluster using kubectl from Cloud Shell. You have deployed your GKE cluster with a public endpoint. From Cloud Shell, you run the following command: You notice that the kubectl commands time out without returning an error message. What is the most likely cause of this issue?

Exhibit 1 for question 209
  • AYour user account does not have privileges to interact with the cluster using kubectl.
  • BYour Cloud Shell external IP address is not part of the authorized networks of the cluster. (correct answer)
  • CThe Cloud Shell is not part of the same VPC as the GKE cluster.
  • DA VPC firewall is blocking access to the cluster’s endpoint.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Your Cloud Shell external IP address is not part of the authorized networks of the cluster.

Topic 1 Β· Question 210

You are developing a web application that contains private images and videos stored in a Cloud Storage bucket. Your users are anonymous and do not have Google Accounts. You want to use your application-specific logic to control access to the images and videos. How should you configure access?

  • ACache each web application user's IP address to create a named IP table using Google Cloud Armor. Create a Google Cloud Armor security policy that allows users to access the backend bucket.
  • BGrant the Storage Object Viewer IAM role to allUsers. Allow users to access the bucket after authenticating through your web application.
  • CConfigure Identity-Aware Proxy (IAP) to authenticate users into the web application. Allow users to access the bucket after authenticating through IAP.
  • DGenerate a signed URL that grants read access to the bucket. Allow users to access the URL after authenticating through your web application. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Generate a signed URL that grants read access to the bucket. Allow users to access the URL after authenticating through your web application.

Topic 1 Β· Question 211

You need to configure a Deployment on Google Kubernetes Engine (GKE). You want to include a check that verifies that the containers can connect to the database. If the Pod is failing to connect, you want a script on the container to run to complete a graceful shutdown. How should you configure the Deployment?

  • ACreate two jobs: one that checks whether the container can connect to the database, and another that runs the shutdown script if the Pod is failing.
  • BCreate the Deployment with a livenessProbe for the container that will fail if the container can't connect to the database. Configure a Prestop lifecycle handler that runs the shutdown script if the container is failing. (correct answer)
  • CCreate the Deployment with a PostStart lifecycle handler that checks the service availability. Configure a PreStop lifecycle handler that runs the shutdown script if the container is failing.
  • DCreate the Deployment with an initContainer that checks the service availability. Configure a Prestop lifecycle handler that runs the shutdown script if the Pod is failing.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create the Deployment with a livenessProbe for the container that will fail if the container can't connect to the database. Configure a Prestop lifecycle handler that runs the shutdown script if the container is failing.

Topic 1 Β· Question 212

You are responsible for deploying a new API. That API will have three different URL paths: β€’ https://yourcompany.com/students β€’ https://yourcompany.com/teachers β€’ https://yourcompany.com/classes You need to configure each API URL path to invoke a different function in your code. What should you do?

  • ACreate one Cloud Function as a backend service exposed using an HTTPS load balancer.
  • BCreate three Cloud Functions exposed directly.
  • CCreate one Cloud Function exposed directly.
  • DCreate three Cloud Functions as three backend services exposed using an HTTPS load balancer. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create three Cloud Functions as three backend services exposed using an HTTPS load balancer.

Explanation

Cloud Functions runs event-driven code without managing servers and scales automatically. A load balancer distributes traffic across healthy backends in multiple zones for availability and scale.

Topic 1 Β· Question 213

You are deploying a microservices application to Google Kubernetes Engine (GKE). The application will receive daily updates. You expect to deploy a large number of distinct containers that will run on the Linux operating system (OS). You want to be alerted to any known OS vulnerabilities in the new containers. You want to follow Google-recommended best practices. What should you do?

  • AUse the gcloud CLI to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.
  • BEnable Container Analysis, and upload new container images to Artifact Registry. Review the vulnerability results before each deployment. (correct answer)
  • CEnable Container Analysis, and upload new container images to Artifact Registry. Review the critical vulnerability results before each deployment.
  • DUse the Container Analysis REST API to call Container Analysis to scan new container images. Review the vulnerability results before each deployment.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Container Analysis, and upload new container images to Artifact Registry. Review the vulnerability results before each deployment.

Explanation

Artifact Registry stores and manages container images and language packages.

Topic 1 Β· Question 214

You are a developer at a large organization. You have an application written in Go running in a production Google Kubernetes Engine (GKE) cluster. You need to add a new feature that requires access to BigQuery. You want to grant BigQuery access to your GKE cluster following Google-recommended best practices. What should you do?

  • ACreate a Google service account with BigQuery access. Add the JSON key to Secret Manager, and use the Go client library to access the JSON key.
  • BCreate a Google service account with BigQuery access. Add the Google service account JSON key as a Kubernetes secret, and configure the application to use this secret.
  • CCreate a Google service account with BigQuery access. Add the Google service account JSON key to Secret Manager, and use an init container to access the secret for the application to use.
  • DCreate a Google service account and a Kubernetes service account. Configure Workload Identity on the GKE cluster, and reference the Kubernetes service account on the application Deployment. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a Google service account and a Kubernetes service account. Configure Workload Identity on the GKE cluster, and reference the Kubernetes service account on the application Deployment.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys. A service account provides an identity for workloads to access Google Cloud APIs securely.

Topic 1 Β· Question 215

You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant access to your application following the principle of least privilege. What should you do?

  • ACreate a user-managed service account with a custom Identity and Access Management (IAM) role. (correct answer)
  • BCreate a user-managed service account with the Storage Admin Identity and Access Management (IAM) role.
  • CCreate a user-managed service account with the Project Editor Identity and Access Management (IAM) role.
  • DUse the default service account linked to the Cloud Run revision in production.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a user-managed service account with a custom Identity and Access Management (IAM) role.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

Topic 1 Β· Question 216

Your team is developing unit tests for Cloud Function code. The code is stored in a Cloud Source Repositories repository. You are responsible for implementing the tests. Only a specific service account has the necessary permissions to deploy the code to Cloud Functions. You want to ensure that the code cannot be deployed without first passing the tests. How should you configure the unit testing process?

  • AConfigure Cloud Build to deploy the Cloud Function. If the code passes the tests, a deployment approval is sent to you.
  • BConfigure Cloud Build to deploy the Cloud Function, using the specific service account as the build agent. Run the unit tests after successful deployment.
  • CConfigure Cloud Build to run the unit tests. If the code passes the tests, the developer deploys the Cloud Function.
  • DConfigure Cloud Build to run the unit tests, using the specific service account as the build agent. If the code passes the tests, Cloud Build deploys the Cloud Function. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Cloud Build to run the unit tests, using the specific service account as the build agent. If the code passes the tests, Cloud Build deploys the Cloud Function.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud Build runs managed CI pipelines to build, test, and package code.

Topic 1 Β· Question 217

Your team detected a spike of errors in an application running on Cloud Run in your production project. The application is configured to read messages from Pub/Sub topic A, process the messages, and write the messages to topic B. You want to conduct tests to identify the cause of the errors. You can use a set of mock messages for testing. What should you do?

  • ADeploy the Pub/Sub and Cloud Run emulators on your local machine. Deploy the application locally, and change the logging level in the application to DEBUG or INFO. Write mock messages to topic A, and then analyze the logs. (correct answer)
  • BUse the gcloud CLI to write mock messages to topic A. Change the logging level in the application to DEBUG or INFO, and then analyze the logs.
  • CDeploy the Pub/Sub emulator on your local machine. Point the production application to your local Pub/Sub topics. Write mock messages to topic A, and then analyze the logs.
  • DUse the Google Cloud console to write mock messages to topic A. Change the logging level in the application to DEBUG or INFO, and then analyze the logs.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy the Pub/Sub and Cloud Run emulators on your local machine. Deploy the application locally, and change the logging level in the application to DEBUG or INFO. Write mock messages to topic A, and then analyze the...

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams. This option decouples the components so they scale independently and absorb load spikes.

Topic 1 Β· Question 218

You are developing a Java Web Server that needs to interact with Google Cloud services via the Google Cloud API on the user's behalf. Users should be able to authenticate to the Google Cloud API using their Google Cloud identities. Which workflow should you implement in your web application?

  • A1. When a user arrives at your application, prompt them for their Google username and password.2. Store an SHA password hash in your application's database along with the user's username.3. The application authenticates to the Google Cloud API using HTTPs requests with the user's username and password hash in the Authorization request header.
  • B1. When a user arrives at your application, prompt them for their Google username and password.2. Forward the user's username and password in an HTTPS request to the Google Cloud authorization server, and request an access token.3. The Google server validates the user's credentials and returns an access token to the application.4. The application uses the access token to call the Google Cloud API.
  • C1. When a user arrives at your application, route them to a Google Cloud consent screen with a list of requested permissions that prompts the user to sign in with SSO to their Google Account.2. After the user signs in and provides consent, your application receives an authorization code from a Google server.3. The Google server returns the authorization code to the user, which is stored in the browser's cookies.4. The user authenticates to the Google Cloud API using the authorization code in the cookie.
  • D1. When a user arrives at your application, route them to a Google Cloud consent screen with a list of requested permissions that prompts the user to sign in with SSO to their Google Account.2. After the user signs in and provides consent, your application receives an authorization code from a Google server.3. The application requests a Google Server to exchange the authorization code with an access token.4. The Google server responds with the access token that is used by the application to call the Google Cloud API. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: 1. When a user arrives at your application, route them to a Google Cloud consent screen with a list of requested permissions that prompts the user to sign in with SSO to their Google Account.2. After the user signs in...

Topic 1 Β· Question 219 Β· Select all that apply

You recently developed a new application. You want to deploy the application on Cloud Run without a Dockerfile. Your organization requires that all container images are pushed to a centrally managed container repository. How should you build your container using Google Cloud services? (Choose two.)

  • APush your source code to Artifact Registry.
  • BSubmit a Cloud Build job to push the image.
  • CUse the pack build command with pack CLI. (correct answer)
  • DInclude the --source flag with the gcloud run deploy CLI command. (correct answer)
  • EInclude the --platform=kubernetes flag with the gcloud run deploy CLI command.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Use the pack build command with pack CLI. Option D: Include the --source flag with the gcloud run deploy CLI command.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead.

Topic 1 Β· Question 220

You work for an organization that manages an online ecommerce website. Your company plans to expand across the world; however, the estore currently serves one specific region. You need to select a SQL database and configure a schema that will scale as your organization grows. You want to create a table that stores all customer transactions and ensure that the customer (CustomerId) and the transaction (TransactionId) are unique. What should you do?

  • ACreate a Cloud SQL table that has TransactionId and CustomerId configured as primary keys. Use an incremental number for the TransactionId.
  • BCreate a Cloud SQL table that has TransactionId and CustomerId configured as primary keys. Use a random string (UUID) for the Transactionid.
  • CCreate a Cloud Spanner table that has TransactionId and CustomerId configured as primary keys. Use a random string (UUID) for the TransactionId. (correct answer)
  • DCreate a Cloud Spanner table that has TransactionId and CustomerId configured as primary keys. Use an incremental number for the TransactionId.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a Cloud Spanner table that has TransactionId and CustomerId configured as primary keys. Use a random string (UUID) for the TransactionId.

Explanation

Cloud Spanner is a horizontally scalable, strongly consistent relational database with global reach.

Showing questions 201–220 of 359 Β· Page 11 of 18