PCD practice questions 1–10

1. Question 1 · 357 in bank

   You want to upload files from an on-premises virtual machine to Google Cloud Storage as part of a data migration. These files will be consumed by Cloud DataProc Hadoop cluster in a GCP environment. Which command should you use?

   • Agsutil cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/
   • Bgcloud cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/
   • Chadoop fs cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/
   • Dgcloud dataproc cp [LOCAL_OBJECT] gs://[DESTINATION_BUCKET_NAME]/

   Show answer

   Answer: A

   Explanation

   Took the exam 2 weeks and got pass, however, NOT A SINGLE question is from here! Although it is still good for practice purpose, DO NOT just remember these questions to take the exam. -- My comment above is still waiting approval after two weeks, it seems someone doesn't want it to be published.

   Source: Adapted from community discussion — i896ii

   References

   • Google Cloud documentation

   Next question

2. Question 2 · 357 in bank

   Select 2

   Your company wants to expand their users outside the United States for their popular application. The company wants to ensure 99.999% availability of the database for their application and also wants to minimize the read latency for their users across the globe. Which two actions should they take? (Choose two.)

   • ACreate a multi-regional Cloud Spanner instance with "nam-asia-eur1" configuration.
   • BCreate a multi-regional Cloud Spanner instance with "nam3" configuration.
   • CCreate a cluster with at least 3 Spanner nodes.
   • DCreate a cluster with at least 1 Spanner node.
   • ECreate a minimum of two Cloud Spanner instances in separate regions with at least one node.
   • FCreate a Cloud Dataflow pipeline to replicate data across different databases.

   Show answer

   Answer: AC

   Explanation

   https://cloud.google.com/spanner/docs/instances Above link supports A for "users across the globe" as per qn https://cloud.google.com/spanner/docs/latency Above link supports C for "minimize the read latency "

   Source: Adapted from community discussion — syu31svc

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 3 · 357 in bank

   Your development team is using Cloud Build to promote a Node.js application built on App Engine from your staging environment to production. The application relies on several directories of photos stored in a Cloud Storage bucket named webphotos-staging in the staging environment. After the promotion, these photos must be available in a Cloud Storage bucket named webphotos-prod in the production environment. You want to automate the process where possible. What should you do?

   • AManually copy the photos to webphotos-prod.
   • BAdd a startup script in the application's app.yami file to move the photos from webphotos-staging to webphotos-prod.
   • CAdd a build step in the cloudbuild.yaml file before the promotion step with the arguments:
   • DAdd a build step in the cloudbuild.yaml file before the promotion step with the arguments:

   Show answer

   Answer: C

   Explanation

   C.Add a build step in the cloudbuild.yaml file before the promotion step with the arguments: -name: gcr.io/cloud-builders/gsutil args: ['cp','-r','gs://webphotos-staging','gs://webphotos-prod'] waitFor: ['-'] You should add a build step in the cloudbuild.yaml file before the promotion step with the arguments shown above. This build step will use the gsutil tool to copy the photos from the webphotos-staging bucket to the webphotos-prod bucket. The -r flag tells gsutil to copy all files in the bucket recursively, and the waitFor parameter tells Cloud Build to wait for this step to complete before continuing with the promotion step.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation

   Next question

4. Question 4 · 357 in bank

   You are developing a web application that will be accessible over both HTTP and HTTPS and will run on Compute Engine instances. On occasion, you will need to SSH from your remote laptop into one of the Compute Engine instances to conduct maintenance on the app. How should you configure the instances while following Google-recommended best practices?

   • ASet up a backend with Compute Engine web server instances with a private IP address behind a TCP proxy load balancer.
   • BConfigure the firewall rules to allow all ingress traffic to connect to the Compute Engine web servers, with each server having a unique external IP address.
   • CConfigure Cloud Identity-Aware Proxy API for SSH access. Then configure the Compute Engine servers with private IP addresses behind an HTTP(s) load balancer for the application web traffic.
   • DSet up a backend with Compute Engine web server instances with a private IP address behind an HTTP(S) load balancer. Set up a bastion host with a public IP address and open firewall ports. Connect to the web instances using the bastion host.

   Show answer

   Answer: C

   Explanation

   D. is a recommended way to configure the instances while following Google-recommended best practices. This approach provides several benefits: The web server instances are only accessible through the load balancer and not directly via their private IP addresses, which improves security. The bastion host acts as a secure jump box that allows you to SSH into the web server instances, while only allowing incoming SSH connections on a specific IP address (the bastion host's public IP). The firewall rules on the web server instances can be configured to only allow connections from the bastion host's IP, further reducing the attack surface. It is a more recommended to have a bastion host that is authorized by your organization to connect to private instances this way it can provide a better security to your instances. And also in terms of compliance, it will also follow the best practices of your organization.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 5 · 357 in bank

   You have a mixture of packaged and internally developed applications hosted on a Compute Engine instance that is running Linux. These applications write log records as text in local files. You want the logs to be written to Cloud Logging. What should you do?

   • APipe the content of the files to the Linux Syslog daemon.
   • BInstall a Google version of fluentd on the Compute Engine instance.
   • CInstall a Google version of collectd on the Compute Engine instance.
   • DUsing cron, schedule a job to copy the log files to Cloud Storage once a day.

   Show answer

   Answer: B

   References

   • Google Cloud documentation

   Next question

6. Question 6 · 357 in bank

   You want to create `fully baked` or `golden` Compute Engine images for your application. You need to bootstrap your application to connect to the appropriate database according to the environment the application is running on (test, staging, production). What should you do?

   • AEmbed the appropriate database connection string in the image. Create a different image for each environment.
   • BWhen creating the Compute Engine instance, add a tag with the name of the database to be connected. In your application, query the Compute Engine API to pull the tags for the current instance, and use the tag to construct the appropriate database connection string.
   • CWhen creating the Compute Engine instance, create a metadata item with a key of ג€DATABASEג€ and a value for the appropriate database connection string. In your application, read the ג€DATABASEג€ environment variable, and use the value to connect to the appropriate database.
   • DWhen creating the Compute Engine instance, create a metadata item with a key of ג€DATABASEג€ and a value for the appropriate database connection string. In your application, query the metadata server for the ג€DATABASEג€ value, and use the value to connect to the appropriate database.

   Show answer

   Answer: D

   Explanation

   Thanks HotSpa27 it is indeed D Every VM stores its metadata on a metadata server. Use these instructions to query these metadata values. You can only query the metadata server programmatically from within a VM

   Source: Adapted from community discussion — GCPCloudArchitectUser

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 7 · 357 in bank

   You are developing a microservice-based application that will be deployed on a Google Kubernetes Engine cluster. The application needs to read and write to a Spanner database. You want to follow security best practices while minimizing code changes. How should you configure your application to retrieve Spanner credentials?

   • AConfigure the appropriate service accounts, and use Workload Identity to run the pods.
   • BStore the application credentials as Kubernetes Secrets, and expose them as environment variables.
   • CConfigure the appropriate routing rules, and use a VPC-native cluster to directly connect to the database.
   • DStore the application credentials using Cloud Key Management Service, and retrieve them whenever a database connection is made.

   Show answer

   Answer: A

   Explanation

   https://cloud.google.com/blog/products/containers-kubernetes/introducing-workload-identity-better-authentication-for-your-gke-applications A Cloud IAM service account is an identity that an application can use to make requests to Google APIs. As an application developer, you could generate individual IAM service accounts for each application, and then download and store the keys as a Kubernetes secret that you manually rotate. Not only is this process burdensome, but service account keys only expire every 10 years (or until you manually rotate them). In the case of a breach or compromise, an unaccounted-for key could mean prolonged access for an attacker. This potential blind spot, plus the management overhead of key inventory and rotation, makes using service account keys as secrets a less than ideal method for authenticating GKE workloads.

   Source: Adapted from community discussion — kinoko1330

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Kubernetes documentation

   Next question

8. Question 8 · 357 in bank

   You are deploying your application on a Compute Engine instance that communicates with Cloud SQL. You will use Cloud SQL Proxy to allow your application to communicate to the database using the service account associated with the application's instance. You want to follow the Google-recommended best practice of providing minimum access for the role assigned to the service account. What should you do?

   • AAssign the Project Editor role.
   • BAssign the Project Owner role.
   • CAssign the Cloud SQL Client role.
   • DAssign the Cloud SQL Editor role.

   Show answer

   Answer: C

   References

   • Google Cloud documentation

   Next question

9. Question 9 · 357 in bank

   Your team develops stateless services that run on Google Kubernetes Engine (GKE). You need to deploy a new service that will only be accessed by other services running in the GKE cluster. The service will need to scale as quickly as possible to respond to changing load. What should you do?

   • AUse a Vertical Pod Autoscaler to scale the containers, and expose them via a ClusterIP Service.
   • BUse a Vertical Pod Autoscaler to scale the containers, and expose them via a NodePort Service.
   • CUse a Horizontal Pod Autoscaler to scale the containers, and expose them via a ClusterIP Service.
   • DUse a Horizontal Pod Autoscaler to scale the containers, and expose them via a NodePort Service.

   Show answer

   Answer: C

   Explanation

   Horizontal Pod Autoscaler (HPA) scales the number of pod replicas based on CPU usage or other select metrics, which is suitable for quick scaling with load changes. ClusterIP is appropriate for services only accessible within the cluster. This combination seems to meet all the requirements.

   Source: Adapted from community discussion — plutonians123

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 10 · 357 in bank

    You recently migrated a monolithic application to Google Cloud by breaking it down into microservices. One of the microservices is deployed using Cloud Functions. As you modernize the application, you make a change to the API of the service that is backward-incompatible. You need to support both existing callers who use the original API and new callers who use the new API. What should you do?

    • ALeave the original Cloud Function as-is and deploy a second Cloud Function with the new API. Use a load balancer to distribute calls between the versions.
    • BLeave the original Cloud Function as-is and deploy a second Cloud Function that includes only the changed API. Calls are automatically routed to the correct function.
    • CLeave the original Cloud Function as-is and deploy a second Cloud Function with the new API. Use Cloud Endpoints to provide an API gateway that exposes a versioned API.
    • DRe-deploy the Cloud Function after making code changes to support the new API. Requests for both versions of the API are fulfilled based on a version identifier included in the call.

    Show answer

    Answer: C

    Explanation

    Based on the link … where it says for backward incompatible strategy use two separate deployments/instances v1 and v2 and only C option is inline with the link

    Source: Adapted from community discussion — GCPCloudArchitectUser

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 1. 357 questions available.