PCDOE — questions

Page 7 of 11 · 210 total questions.

PCDOE Question 121

Single page →

Topic 1 · Question 121

You are building an application that runs on Cloud Run. The application needs to access a third-party API by using an API key. You need to determine a secure way to store and use the API key in your application by following Google-recommended practices. What should you do?

ASave the API key in Secret Manager as a secret. Reference the secret as an environment variable in the Cloud Run application. (correct answer)
BSave the API key in Secret Manager as a secret key. Mount the secret key under the /sys/api_key directory, and decrypt the key in the Cloud Run application.
CSave the API key in Cloud Key Management Service (Cloud KMS) as a key. Reference the key as an environment variable in the Cloud Run application.
DEncrypt the API key by using Cloud Key Management Service (Cloud KMS), and pass the key to Cloud Run as an environment variable. Decrypt and use the key in Cloud Run.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Save the API key in Secret Manager as a secret. Reference the secret as an environment variable in the Cloud Run application.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. Secret Manager stores and controls access to secrets such as API keys and credentials.

PCDOE Question 122

Single page →

Topic 1 · Question 122

You are currently planning how to display Cloud Monitoring metrics for your organization’s Google Cloud projects. Your organization has three folders and six projects: You want to configure Cloud Monitoring dashboards to only display metrics from the projects within one folder. You need to ensure that the dashboards do not display metrics from projects in the other folders. You want to follow Google-recommended practices. What should you do?

ACreate a single new scoping project.
BCreate new scoping projects for each folder. (correct answer)
CUse the current app-one-prod project as the scoping project.
DUse the current app-one-dev, app-one-staging, and app-one-prod projects as the scoping project for each folder.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Create new scoping projects for each folder.

PCDOE Question 123

Single page →

Topic 1 · Question 123

Your company’s security team needs to have read-only access to Data Access audit logs in the _Required bucket. You want to provide your security team with the necessary permissions following the principle of least privilege and Google-recommended practices. What should you do?

AAssign the roles/logging.viewer role to each member of the security team.
BAssign the roles/logging.viewer role to a group with all the security team members.
CAssign the roles/logging.privateLogViewer role to each member of the security team.
DAssign the roles/logging.privateLogViewer role to a group with all the security team members. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Assign the roles/logging.privateLogViewer role to a group with all the security team members.

PCDOE Question 124

Single page →

Topic 1 · Question 124

Your team is building a service that performs compute-heavy processing on batches of data. The data is processed faster based on the speed and number of CPUs on the machine. These batches of data vary in size and may arrive at any time from multiple third-party sources. You need to ensure that third parties are able to upload their data securely. You want to minimize costs, while ensuring that the data is processed as quickly as possible. What should you do?

AProvide a secure file transfer protocol (SFTP) server on a Compute Engine instance so that third parties can upload batches of data, and provide appropriate credentials to the server.Create a Cloud Function with a google.storage.object.finalize Cloud Storage trigger. Write code so that the function can scale up a Compute Engine autoscaling managed instance groupUse an image pre-loaded with the data processing software that terminates the instances when processing completes.
BProvide a Cloud Storage bucket so that third parties can upload batches of data, and provide appropriate Identity and Access Management (IAM) access to the bucket.Use a standard Google Kubernetes Engine (GKE) cluster and maintain two services: one that processes the batches of data, and one that monitors Cloud Storage for new batches of data.Stop the processing service when there are no batches of data to process.
CProvide a Cloud Storage bucket so that third parties can upload batches of data, and provide appropriate Identity and Access Management (IAM) access to the bucket.Create a Cloud Function with a google.storage.object.finalize Cloud Storage trigger. Write code so that the function can scale up a Compute Engine autoscaling managed instance group.Use an image pre-loaded with the data processing software that terminates the instances when processing completes. (correct answer)
DProvide a Cloud Storage bucket so that third parties can upload batches of data, and provide appropriate Identity and Access Management (IAM) access to the bucket.Use Cloud Monitoring to detect new batches of data in the bucket and trigger a Cloud Function that processes the data.Set a Cloud Function to use the largest CPU possible to minimize the runtime of the processing.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Provide a Cloud Storage bucket so that third parties can upload batches of data, and provide appropriate Identity and Access Management (IAM) access to the bucket.Create a Cloud Function with a google.storage.object.f...

Explanation

A managed instance group provides autoscaling, autohealing, and rolling updates for VMs. Compute Engine provides configurable virtual machines when you need full control of the OS. Google Cloud Batch schedules and runs batch jobs at scale without managing infrastructure. This option delivers the requirement at the lowest cost.

PCDOE Question 125

Single page →

Topic 1 · Question 125 · Select all that apply

You are reviewing your deployment pipeline in Google Cloud Deploy. You must reduce toil in the pipeline, and you want to minimize the amount of time it takes to complete an end-to-end deployment. What should you do? (Choose two.)

ACreate a trigger to notify the required team to complete the next step when manual intervention is required.
BDivide the automation steps into smaller tasks. (correct answer)
CUse a script to automate the creation of the deployment pipeline in Google Cloud Deploy.
DAdd more engineers to finish the manual steps.
EAutomate promotion approvals from the development environment to the test environment. (correct answer)

Reveal answer & explanation

Correct answer: B, E

The correct answer is B, E. Option B: Divide the automation steps into smaller tasks. Option E: Automate promotion approvals from the development environment to the test environment.

PCDOE Question 126

Single page →

Topic 1 · Question 126

You work for a global organization and are running a monolithic application on Compute Engine. You need to select the machine type for the application to use that optimizes CPU utilization by using the fewest number of steps. You want to use historical system metrics to identify the machine type for the application to use. You want to follow Google-recommended practices. What should you do?

AUse the Recommender API and apply the suggested recommendations. (correct answer)
BCreate an Agent Policy to automatically install Ops Agent in all VMs.
CInstall the Ops Agent in a fleet of VMs by using the gcloud CLI.
DReview the Cloud Monitoring dashboard for the VM and choose the machine type with the lowest CPU utilization.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Use the Recommender API and apply the suggested recommendations.

PCDOE Question 127

Single page →

Topic 1 · Question 127

You deployed an application into a large Standard Google Kubernetes Engine (GKE) cluster. The application is stateless and multiple pods run at the same time. Your application receives inconsistent traffic. You need to ensure that the user experience remains consistent regardless of changes in traffic and that the resource usage of the cluster is optimized. What should you do?

AConfigure a cron job to scale the deployment on a schedule
BConfigure a Horizontal Pod Autoscaler. (correct answer)
CConfigure a Vertical Pod Autoscaler
DConfigure cluster autoscaling on the node pool.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Configure a Horizontal Pod Autoscaler.

PCDOE Question 128

Single page →

Topic 1 · Question 128

You need to deploy a new service to production. The service needs to automatically scale using a managed instance group and should be deployed across multiple regions. The service needs a large number of resources for each instance and you need to plan for capacity. What should you do?

AMonitor results of Cloud Trace to determine the optimal sizing.
BUse the n2-highcpu-96 machine type in the configuration of the managed instance group.
CDeploy the service in multiple regions and use an internal load balancer to route traffic.
DValidate that the resource requirements are within the available project quota limits of each region. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Validate that the resource requirements are within the available project quota limits of each region.

PCDOE Question 129

Single page →

Topic 1 · Question 129 · Select all that apply

You are analyzing Java applications in production. All applications have Cloud Profiler and Cloud Trace installed and configured by default. You want to determine which applications need performance tuning. What should you do? (Choose two.)

AExamine the wall-clock time and the CPU time of the application. If the difference is substantial increase the CPU resource allocation.
BExamine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the memory resource allocation.
CExamine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the local disk storage allocation.
DExamine the latency time the wall-clock time and the CPU time of the application. If the latency time is slowly burning down the error budget, and the difference between wall-clock time and CPU time is minimal mark the application for optimization. (correct answer)
EExamine the heap usage of the application. If the usage is low, mark the application for optimization. (correct answer)

Reveal answer & explanation

Correct answer: D, E

The correct answer is D, E. Option D: Examine the latency time the wall-clock time and the CPU time of the application. If the latency time is slowly burning down the error budget, and the difference between wall-clock time and CPU time is minimal mark th... Option E: Examine the heap usage of the application. If the usage is low, mark the application for optimization.

PCDOE Question 130

Single page →

Topic 1 · Question 130

Your organization stores all application logs from multiple Google Cloud projects in a central Cloud Logging project. Your security team wants to enforce a rule that each project team can only view their respective logs and only the operations team can view all the logs. You need to design a solution that meets the security team s requirements while minimizing costs. What should you do?

AGrant each project team access to the project _Default view in the central logging project. Grant togging viewer access to the operations team in the central logging project.
BCreate Identity and Access Management (IAM) roles for each project team and restrict access to the _Default log view in their individual Google Cloud project. Grant viewer access to the operations team in the central logging project.
CCreate log views for each project team and only show each project team their application logs. Grant the operations team access to the _AllLogs view in the central logging project. (correct answer)
DExport logs to BigQuery tables for each project team. Grant project teams access to their tables. Grant logs writer access to the operations team in the central logging project.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create log views for each project team and only show each project team their application logs. Grant the operations team access to the _AllLogs view in the central logging project.

PCDOE Question 131

Single page →

Topic 1 · Question 131

Your company uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices. What should you do?

AConfirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions. (correct answer)
BUse the Terraform module so that Secret Manager can retrieve credentials.
CCreate a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE_CREDENTIALS environment variable on the Jenkins server.
DAdd the gcloud auth application-default login command as a step in Jenkins before running the Terraform commands.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCDOE Question 132

Single page →

Topic 1 · Question 132

You encounter a large number of outages in the production systems you support. You receive alerts for all the outages, the alerts are due to unhealthy systems that are automatically restarted within a minute. You want to set up a process that would prevent staff burnout while following Site Reliability Engineering (SRE) practices. What should you do?

AEliminate alerts that are not actionable (correct answer)
BRedefine the related SLO so that the error budget is not exhausted
CDistribute the alerts to engineers in different time zones
DCreate an incident report for each of the alerts

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Eliminate alerts that are not actionable.

PCDOE Question 133

Single page →

Topic 1 · Question 133

As part of your company's initiative to shift left on security, the InfoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the deployment of trusted and approved images. You need to determine how to satisfy the InfoSec team's goal of shifting left on security. What should you do?

AEnable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images
BUse Binary Authorization to attest images during your CI/CD pipeline (correct answer)
CConfigure Identity and Access Management (IAM) policies to create a least privilege model on your GKE clusters.
DDeploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Use Binary Authorization to attest images during your CI/CD pipeline.

PCDOE Question 134

Single page →

Topic 1 · Question 134

Your company operates in a highly regulated domain. Your security team requires that only trusted container images can be deployed to Google Kubernetes Engine (GKE). You need to implement a solution that meets the requirements of the security team while minimizing management overhead. What should you do?

AConfigure Binary Authorization in your GKE clusters to enforce deploy-time security policies. (correct answer)
BGrant the roles/artifactregistry.writer role to the Cloud Build service account. Confirm that no employee has Artifact Registry write permission.
CUse Cloud Run to write and deploy a custom validator. Enable an Eventarc trigger to perform validations when new images are uploaded.
DConfigure Kritis to run in your GKE clusters to enforce deploy-time security policies.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Configure Binary Authorization in your GKE clusters to enforce deploy-time security policies.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads.

PCDOE Question 135

Single page →

Topic 1 · Question 135 · Select all that apply

Your CTO has asked you to implement a postmortem policy on every incident for internal use. You want to define what a good postmortem is to ensure that the policy is successful at your company. What should you do? (Choose two.)

AEnsure that all postmortems include what caused the incident, identify the person or team responsible for causing the incident, and how to prevent a future occurrence of the incident.
BEnsure that all postmortems include what caused the incident, how the incident could have been worse, and how to prevent a future occurrence of the incident.
CEnsure that all postmortems include the severity of the incident, how to prevent a future occurrence of the incident, and what caused the incident without naming internal system components. (correct answer)
DEnsure that all postmortems include how the incident was resolved and what caused the incident without naming customer information.
EEnsure that all postmortems include all incident participants in postmortem authoring and share postmortems as widely as possible. (correct answer)

Reveal answer & explanation

Correct answer: C, E

The correct answer is C, E. Option C: Ensure that all postmortems include the severity of the incident, how to prevent a future occurrence of the incident, and what caused the incident without naming internal system components. Option E: Ensure that all postmortems include all incident participants in postmortem authoring and share postmortems as widely as possible.

PCDOE Question 136

Single page →

Topic 1 · Question 136

You are developing reusable infrastructure as code modules. Each module contains integration tests that launch the module in a test project. You are using GitHub for source control. You need to continuously test your feature branch and ensure that all code is tested before changes are accepted. You need to implement a solution to automate the integration tests. What should you do?

AUse a Jenkins server for CI/CD pipelines. Periodically run all tests in the feature branch.
BAsk the pull request reviewers to run the integration tests before approving the code.
CUse Cloud Build to run the tests. Trigger all tests to run after a pull request is merged.
DUse Cloud Build to run tests in a specific folder. Trigger Cloud Build for every GitHub pull request. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Use Cloud Build to run tests in a specific folder. Trigger Cloud Build for every GitHub pull request.

Explanation

Cloud Build runs managed CI pipelines to build, test, and package code.

PCDOE Question 137

Single page →

Topic 1 · Question 137

Your company processes IoT data at scale by using Pub/Sub, App Engine standard environment, and an application written in Go. You noticed that the performance inconsistently degrades at peak load. You could not reproduce this issue on your workstation. You need to continuously monitor the application in production to identify slow paths in the code. You want to minimize performance impact and management overhead. What should you do?

AUse Cloud Monitoring to assess the App Engine CPU utilization metric.
BInstall a continuous profiling tool into Compute Engine. Configure the application to send profiling data to the tool.
CPeriodically run the go tool pprof command against the application instance. Analyze the results by using flame graphs.
DConfigure Cloud Profiler, and initialize the cloud.google.com/go/profiler library in the application. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Configure Cloud Profiler, and initialize the cloud.google.com/go/profiler library in the application.

Explanation

Cloud Profiler continuously analyzes CPU and memory usage of production code.

PCDOE Question 138

Single page →

Topic 1 · Question 138

Your company runs services by using Google Kubernetes Engine (GKE). The GKE dusters in the development environment run applications with verbose logging enabled. Developers view logs by using the kubectl logs command and do not use Cloud Logging. Applications do not have a uniform logging structure defined. You need to minimize the costs associated with application logging while still collecting GKE operational logs. What should you do?

ARun the gcloud container clusters update --logging=SYSTEM command for the development cluster. (correct answer)
BRun the gcloud container clusters update --logging=WORKLOAD command for the development cluster.
CRun the gcloud logging sinks update _Default --disabled command in the project associated with the development environment.
DAdd the severity >= DEBUG resource.type = "k8s_container" exclusion filter to the _Default logging sink in the project associated with the development environment.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Run the gcloud container clusters update --logging=SYSTEM command for the development cluster.

PCDOE Question 139

Single page →

Topic 1 · Question 139

You have deployed a fleet of Compute Engine instances in Google Cloud. You need to ensure that monitoring metrics and logs for the instances are visible in Cloud Logging and Cloud Monitoring by your company's operations and cyber security teams. You need to grant the required roles for the Compute Engine service account by using Identity and Access Management (IAM) while following the principle of least privilege. What should you do?

AGrant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service accounts. (correct answer)
BGrant the logging.admin and monitoring.editor roles to the Compute Engine service accounts.
CGrant the logging.editor and monitoring.metricWriter roles to the Compute Engine service accounts.
DGrant the logging.logWriter and monitoring.editor roles to the Compute Engine service accounts.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Grant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service accounts.

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS. A service account provides an identity for workloads to access Google Cloud APIs securely.

PCDOE Question 140

Single page →

Topic 1 · Question 140

You are the Site Reliability Engineer responsible for managing your company's data services and products. You regularly navigate operational challenges, such as unpredictable data volume and high cost, with your company's data ingestion processes. You recently learned that a new data ingestion product will be developed in Google Cloud. You need to collaborate with the product development team to provide operational input on the new product. What should you do?

ADeploy the prototype product in a test environment, run a load test, and share the results with the product development team.
BWhen the initial product version passes the quality assurance phase and compliance assessments, deploy the product to a staging environment. Share error logs and performance metrics with the product development team.
CWhen the new product is used by at least one internal customer in production, share error logs and monitoring metrics with the product development team.
DReview the design of the product with the product development team to provide feedback early in the design phase. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Review the design of the product with the product development team to provide feedback early in the design phase.

Showing questions 121–140 of 210 · Page 7 of 11