PCD practice questions 101–110

1. Question 101 · 357 in bank

   Your application takes an input from a user and publishes it to the user's contacts. This input is stored in a table in Cloud Spanner. Your application is more sensitive to latency and less sensitive to consistency. How should you perform reads from Cloud Spanner for this application?

   • APerform Read-Only transactions.
   • BPerform stale reads using single-read methods.
   • CPerform strong reads using single-read methods.
   • DPerform stale reads using read-write transactions.

   Show answer

   Answer: B

   Explanation

   As mentioned here https://cloud.google.com/spanner/docs/reference/rest/v1/TransactionOptions read-write transaction type has no options, and there is no way to make stale reads with this transaction type, so D) is definitely wrong. In the question, low latency is more critical than consistency, so C) is not an option. Read-Only transactions can do stale reads as well as Single Read methods, but in the documentation https://cloud.google.com/spanner/docs/transactions#read-only_transactions , they encourage to use SingleRead methods where possible. My vote is B)

   Source: Adapted from community discussion — emmet

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 102 · 357 in bank

   You are writing from a Go application to a Cloud Spanner database. You want to optimize your application’s performance using Google-recommended best practices. What should you do?

   • AWrite to Cloud Spanner using Cloud Client Libraries.
   • BWrite to Cloud Spanner using Google API Client Libraries
   • CWrite to Cloud Spanner using a custom gRPC client library.
   • DWrite to Cloud Spanner using a third-party HTTP client library.

   Show answer

   Answer: A

   Explanation

   A is correct BC are part of A D idk “Cloud Client Libraries are the recommended option for accessing Cloud APIs programmatically, where available. Cloud Client Libraries use the latest client library models” https://cloud.google.com/apis/docs/client-libraries-explained https://cloud.google.com/go/docs/reference

   Source: Adapted from community discussion — melisargh

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google developer documentation

   Next question

3. Question 103 · 357 in bank

   You have an application deployed in Google Kubernetes Engine (GKE). You need to update the application to make authorized requests to Google Cloud managed services. You want this to be a one-time setup, and you need to follow security best practices of auto-rotating your security keys and storing them in an encrypted store. You already created a service account with appropriate access to the Google Cloud service. What should you do next?

   • AAssign the Google Cloud service account to your GKE Pod using Workload Identity.
   • BExport the Google Cloud service account, and share it with the Pod as a Kubernetes Secret.
   • CExport the Google Cloud service account, and embed it in the source code of the application.
   • DExport the Google Cloud service account, and upload it to HashiCorp Vault to generate a dynamic service account for your application.

   Show answer

   Answer: A

   Explanation

   Service account with proper IAM configurations already exists. We should link the existing service account with GKE pod as workload identity. This applies to all the pods running within a cluster.

   Source: Adapted from community discussion — purushi

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 104 · 357 in bank

   You are planning to deploy hundreds of microservices in your Google Kubernetes Engine (GKE) cluster. How should you secure communication between the microservices on GKE using a managed service?

   • AUse global HTTP(S) Load Balancing with managed SSL certificates to protect your services
   • BDeploy open source Istio in your GKE cluster, and enable mTLS in your Service Mesh
   • CInstall cert-manager on GKE to automatically renew the SSL certificates.
   • DInstall Anthos Service Mesh, and enable mTLS in your Service Mesh.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://cloud.google.com/service-mesh/docs/overview#security_benefits - Ensures encryption in transit. Using mTLS for authentication also ensures that all TCP communications are encrypted in transit.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 105 · 357 in bank

   Select 2

   You are developing an application that will store and access sensitive unstructured data objects in a Cloud Storage bucket. To comply with regulatory requirements, you need to ensure that all data objects are available for at least 7 years after their initial creation. Objects created more than 3 years ago are accessed very infrequently (less than once a year). You need to configure object storage while ensuring that storage cost is optimized. What should you do? (Choose two.)

   • ASet a retention policy on the bucket with a period of 7 years.
   • BUse IAM Conditions to provide access to objects 7 years after the object creation date.
   • CEnable Object Versioning to prevent objects from being accidentally deleted for 7 years after object creation.
   • DCreate an object lifecycle policy on the bucket that moves objects from Standard Storage to Archive Storage after 3 years.
   • EImplement a Cloud Function that checks the age of each object in the bucket and moves the objects older than 3 years to a second bucket with the Archive Storage class. Use Cloud Scheduler to trigger the Cloud Function on a daily schedule.

   Show answer

   Answer: AD

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 106 · 357 in bank

   You are developing an application using different microservices that must remain internal to the cluster. You want the ability to configure each microservice with a specific number of replicas. You also want the ability to address a specific microservice from any other microservice in a uniform way, regardless of the number of replicas the microservice scales to. You plan to implement this solution on Google Kubernetes Engine. What should you do?

   • ADeploy each microservice as a Deployment. Expose the Deployment in the cluster using a Service, and use the Service DNS name to address it from other microservices within the cluster.
   • BDeploy each microservice as a Deployment. Expose the Deployment in the cluster using an Ingress, and use the Ingress IP address to address the Deployment from other microservices within the cluster.
   • CDeploy each microservice as a Pod. Expose the Pod in the cluster using a Service, and use the Service DNS name to address the microservice from other microservices within the cluster.
   • DDeploy each microservice as a Pod. Expose the Pod in the cluster using an Ingress, and use the Ingress IP address to address the Pod from other microservices within the cluster.

   Show answer

   Answer: A

   Explanation

   A Is correct because the Service will have a DNS entry inside the cluster that other microservices can use to address the pods of the Deployment that the Service is targetting. B Is not correct because an Ingress exposes a Service using an external or internal HTTP(s) load balancer, and it does not apply directly to a Deployment. C is not correct because a Pod is a single instance of the microservice, whereas a Deployment can be configured with a number of replicas. D is not correct because it combines the mistakes of options B and C.

   Source: Adapted from community discussion — telp

   Next question

7. Question 107 · 357 in bank

   You are building an application that uses a distributed microservices architecture. You want to measure the performance and system resource utilization in one of the microservices written in Java. What should you do?

   • AInstrument the service with Cloud Profiler to measure CPU utilization and method-level execution times in the service.
   • BInstrument the service with Debugger to investigate service errors.
   • CInstrument the service with Cloud Trace to measure request latency.
   • DInstrument the service with OpenCensus to measure service latency, and write custom metrics to Cloud Monitoring.

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 108 · 357 in bank

   Your team is responsible for maintaining an application that aggregates news articles from many different sources. Your monitoring dashboard contains publicly accessible real-time reports and runs on a Compute Engine instance as a web application. External stakeholders and analysts need to access these reports via a secure channel without authentication. How should you configure this secure channel?

   • AAdd a public IP address to the instance. Use the service account key of the instance to encrypt the traffic.
   • BUse Cloud Scheduler to trigger Cloud Build every hour to create an export from the reports. Store the reports in a public Cloud Storage bucket.
   • CAdd an HTTP(S) load balancer in front of the monitoring dashboard. Configure Identity-Aware Proxy to secure the communication channel.
   • DAdd an HTTP(S) load balancer in front of the monitoring dashboard. Set up a Google-managed SSL certificate on the load balancer for traffic encryption.

   Show answer

   Answer: D

   Explanation

   A is incorrect. A service account cannot be used to encrypt HTTPS traffic. B is incorrect. Periodical export would not meet the real-time requirement. C is incorrect. IAP is not securing the communication channel, it authenticates the user. Technically Cloud Load Balancing already secures the channel but without an appropriate certificate. D is correct. This provides an external HTTPS endpoint, and uses Google-managed services and a valid SSL certificate.

   Source: Adapted from community discussion — x_cath

   References

   • Google Cloud documentation

   Next question

9. Question 109 · 357 in bank

   You are planning to add unit tests to your application. You need to be able to assert that published Pub/Sub messages are processed by your subscriber in order. You want the unit tests to be cost-effective and reliable. What should you do?

   • AImplement a mocking framework.
   • BCreate a topic and subscription for each tester.
   • CAdd a filter by tester to the subscription.
   • DUse the Pub/Sub emulator.

   Show answer

   Answer: D

   Explanation

   Option B, creating a topic and subscription for each tester, would be costly and time-consuming as it would require creating and managing a large number of topics and subscriptions. Additionally, it would not ensure that messages are processed in order, as messages may be delivered out of order to different subscriptions. Option D, using the Pub/Sub emulator, would be cost-effective and reliable as it allows you to test your application's Pub/Sub functionality locally without incurring any costs. Additionally, the emulator allows you to easily assert that messages are processed in order by using the same topic and subscription for all unit tests.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation

   Next question

10. Question 110 · 357 in bank

    You have an application deployed in Google Kubernetes Engine (GKE) that reads and processes Pub/Sub messages. Each Pod handles a fixed number of messages per minute. The rate at which messages are published to the Pub/Sub topic varies considerably throughout the day and week, including occasional large batches of messages published at a single moment. You want to scale your GKE Deployment to be able to process messages in a timely manner. What GKE feature should you use to automatically adapt your workload?

    • AVertical Pod Autoscaler in Auto mode
    • BVertical Pod Autoscaler in Recommendation mode
    • CHorizontal Pod Autoscaler based on an external metric
    • DHorizontal Pod Autoscaler based on resources utilization

    Show answer

    Answer: C

    Explanation

    Custom and external metrics allow workloads to adapt to conditions besides the workload itself. Consider an application that pulls tasks from a queue and completes them. An external metric is reported from an application or service not running on your cluster, but whose performance impacts your Kubernetes application. For information, the metric could be reported from Cloud Monitoring or Pub/Sub. D isn't the answer, before selecting an answer , please do a thorough research and understand concepts and the key words in a question, D cant be the answer in this case. https://cloud.google.com/kubernetes-engine/docs/concepts/custom-and-external-metrics

    Source: Adapted from community discussion — TNT87

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 101. 357 questions available.