PCD practice questions 161–170

1. Question 161 · 357 in bank

   You have two Google Cloud projects, named Project A and Project B. You need to create a Cloud Function in Project A that saves the output in a Cloud Storage bucket in Project B. You want to follow the principle of least privilege. What should you do?

   • A1. Create a Google service account in Project B. 2. Deploy the Cloud Function with the service account in Project A. 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
   • B1. Create a Google service account in Project A 2. Deploy the Cloud Function with the service account in Project A. 3. Assign this service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
   • C1. Determine the default App Engine service account (PROJECT_ID@appspot.gserviceaccount.com) in Project A. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.
   • D1. Determine the default App Engine service account (PROJECT_ID@appspot.gserviceaccount.com) in Project B. 2. Deploy the Cloud Function with the default App Engine service account in Project A. 3. Assign the default App Engine service account the roles/storage.objectCreator role on the storage bucket residing in Project B.

   Show answer

   Answer: B

   Explanation

   A is not correct because you cannot run a Cloud Function with a service account that is not in the same Google Cloud project. B is correct because it follows the least privilege principle and for a Cloud Function, the service account must be created in the same project where the function is getting executed.

   Source: Adapted from community discussion — mrvergara

   References

   • Google Cloud documentation

   Next question

2. Question 162 · 357 in bank

   A governmental regulation was recently passed that affects your application. For compliance purposes, you are now required to send a duplicate of specific application logs from your application’s project to a project that is restricted to the security team. What should you do?

   • ACreate user-defined log buckets in the security team’s project. Configure a Cloud Logging sink to route your application’s logs to log buckets in the security team’s project.
   • BCreate a job that copies the logs from the _Required log bucket into the security team’s log bucket in their project.
   • CModify the _Default log bucket sink rules to reroute the logs into the security team’s log bucket.
   • DCreate a job that copies the System Event logs from the _Required log bucket into the security team’s log bucket in their project.

   Show answer

   Answer: A

   Explanation

   I choose option A because it provides a direct and automated solution for duplicating the specific application logs and sending them to the security team's project. This method uses Cloud Logging's sink feature, which is a powerful tool for routing logs to other destinations, such as log buckets or Pub/Sub topics. By using a sink, you can ensure that the duplication of logs is performed in real-time and automatically, which would minimize manual intervention and minimize the risk of errors.

   Source: Adapted from community discussion — mrvergara

   References

   • Google Cloud documentation

   Next question

3. Question 163 · 357 in bank

   You plan to deploy a new Go application to Cloud Run. The source code is stored in Cloud Source Repositories. You need to configure a fully managed, automated, continuous deployment pipeline that runs when a source code commit is made. You want to use the simplest deployment solution. What should you do?

   • AConfigure a cron job on your workstations to periodically run gcloud run deploy --source in the working directory.
   • BConfigure a Jenkins trigger to run the container build and deploy process for each source code commit to Cloud Source Repositories.
   • CConfigure continuous deployment of new revisions from a source repository for Cloud Run using buildpacks.
   • DUse Cloud Build with a trigger configured to run the container build and deploy process for each source code commit to Cloud Source Repositories.

   Show answer

   Answer: D

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 164 · 357 in bank

   Select 2

   Your team has created an application that is hosted on a Google Kubernetes Engine (GKE) cluster. You need to connect the application to a legacy REST service that is deployed in two GKE clusters in two different regions. You want to connect your application to the target service in a way that is resilient. You also want to be able to run health checks on the legacy service on a separate port. How should you set up the connection? (Choose two.)

   • AUse Traffic Director with a sidecar proxy to connect the application to the service.
   • BUse a proxyless Traffic Director configuration to connect the application to the service.
   • CConfigure the legacy service's firewall to allow health checks originating from the proxy.
   • DConfigure the legacy service's firewall to allow health checks originating from the application.
   • EConfigure the legacy service's firewall to allow health checks originating from the Traffic Director control plane.

   Show answer

   Answer: AC

   Explanation

   A. Using Traffic Director with a sidecar proxy can provide resilience for your application by allowing for failover to the secondary region in the event of an outage. The sidecar proxy can route traffic to the legacy service in either of the two GKE clusters, ensuring high availability. C. Configuring the legacy service's firewall to allow health checks originating from the proxy allows the proxy to periodically check the health of the legacy service and ensure that it is functioning properly. This helps to ensure that traffic is only routed to healthy instances of the legacy service, further improving the resilience of the setup.

   Source: Adapted from community discussion — mrvergara

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 165 · 357 in bank

   You have an application running in a production Google Kubernetes Engine (GKE) cluster. You use Cloud Deploy to automatically deploy your application to your production GKE cluster. As part of your development process, you are planning to make frequent changes to the application’s source code and need to select the tools to test the changes before pushing them to your remote source code repository. Your toolset must meet the following requirements: • Test frequent local changes automatically. • Local deployment emulates production deployment. Which tools should you use to test building and running a container on your laptop using minimal resources?

   • ADocker Compose and dockerd
   • BTerraform and kubeadm
   • CMinikube and Skaffold
   • Dkaniko and Tekton

   Show answer

   Answer: C

   Explanation

   Minikube is a tool that runs a single-node Kubernetes cluster locally on your laptop, allowing you to test and run your application on a simulated production environment. Skaffold is a command line tool that automates the process of building and deploying your application to a local or remote Kubernetes cluster. Together, Minikube and Skaffold allow you to test your frequent changes locally, with a deployment that emulates a production environment, using minimal resources. Minikube provides the simulated production environment, while Skaffold takes care of building and deploying your application, making the development process smoother and more efficient.

   Source: Adapted from community discussion — mrvergara

   Next question

6. Question 166 · 357 in bank

   You are deploying a Python application to Cloud Run using Cloud Source Repositories and Cloud Build. The Cloud Build pipeline is shown below:

   

   You want to optimize deployment times and avoid unnecessary steps. What should you do?

   • ARemove the step that pushes the container to Artifact Registry.
   • BDeploy a new Docker registry in a VPC, and use Cloud Build worker pools inside the VPC to run the build pipeline.
   • CStore image artifacts in a Cloud Storage bucket in the same region as the Cloud Run instance.
   • DAdd the --cache-from argument to the Docker build step in your build config file.

   Show answer

   Answer: D

   References

   • Google Cloud documentation

   Next question

7. Question 167 · 357 in bank

   You are developing an event-driven application. You have created a topic to receive messages sent to Pub/Sub. You want those messages to be processed in real time. You need the application to be independent from any other system and only incur costs when new messages arrive. How should you configure the architecture?

   • ADeploy the application on Compute Engine. Use a Pub/Sub push subscription to process new messages in the topic.
   • BDeploy your code on Cloud Functions. Use a Pub/Sub trigger to invoke the Cloud Function. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
   • CDeploy the application on Google Kubernetes Engine. Use the Pub/Sub API to create a pull subscription to the Pub/Sub topic and read messages from it.
   • DDeploy your code on Cloud Functions. Use a Pub/Sub trigger to handle new messages in the topic.

   Show answer

   Answer: D

   Explanation

   Selected Answer:D https://cloud.google.com/functions/docs/calling/pubsub We selected D based on our experience with Cloud Functions and the material at the URL above. Since messages can be obtained from Cloud Functions arguments, we are not aware of the description of Subscription. "only incur costs when new messages arrive." so it's OK to process on the trigger. I don't think real time means so strictly. For the life of me, I can't find any reason why D is wrong, and it seems to me that B is an error because of the extra processing.

   Source: Adapted from community discussion — NewComer200

   References

   • Google Cloud documentation

   Next question

8. Question 168 · 357 in bank

   You want to notify on-call engineers about a service degradation in production while minimizing development time. What should you do?

   • AUse Cloud Function to monitor resources and raise alerts.
   • BUse Cloud Pub/Sub to monitor resources and raise alerts.
   • CUse Stackdriver Error Reporting to capture errors and raise alerts.
   • DUse Stackdriver Monitoring to monitor resources and raise alerts.

   Show answer

   Answer: D

   Explanation

   I don't think the correct answer is A) Cloud Functions are not about monitoring at all, but I have found one mention of using cloud functions for monitoring: https://cloud.google.com/solutions/serverless-web-performance-monitoring-using-cloud-functions . But the mentioned article is about WEB page performance and it does require a lot of efforts. The question does not have info about the kind of service to monitor, so I think the answer should be D) - "Use Stackdriver Monitoring to monitor resources and raise alerts"

   Source: Adapted from community discussion — emmet

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 169 · 357 in bank

   You have an application running on Google Kubernetes Engine (GKE). The application is currently using a logging library and is outputting to standard output. You need to export the logs to Cloud Logging, and you need the logs to include metadata about each request. You want to use the simplest method to accomplish this. What should you do?

   • AChange your application’s logging library to the Cloud Logging library, and configure your application to export logs to Cloud Logging.
   • BUpdate your application to output logs in JSON format, and add the necessary metadata to the JSON.
   • CUpdate your application to output logs in CSV format, and add the necessary metadata to the CSV.
   • DInstall the Fluent Bit agent on each of your GKE nodes, and have the agent export all logs from /var/log.

   Show answer

   Answer: A

   Explanation

   The answer is B since GKE is integrated with Cloud Logging by default. "By default, GKE clusters are natively integrated with Cloud Logging (and Monitoring). When you create a GKE cluster, both Monitoring and Cloud Logging are enabled by default." "GKE deploys a per-node logging agent that reads container logs, adds helpful metadata, and then sends the logs to the logs router, which sends the logs to Cloud Logging and any of the Logging sink destinations that you have configured. Cloud Logging stores logs for the duration that you specify or 30 days by default. Because Cloud Logging automatically collects standard output and error logs for containerized processes, you can start viewing your logs as soon as your application is deployed." Source: https://cloud.google.com/blog/products/management-tools/using-logging-your-apps-running-kubernetes-engine

   Source: Adapted from community discussion — aldi22

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 170 · 357 in bank

    You are working on a new application that is deployed on Cloud Run and uses Cloud Functions. Each time new features are added, new Cloud Functions and Cloud Run services are deployed. You use ENV variables to keep track of the services and enable interservice communication, but the maintenance of the ENV variables has become difficult. You want to implement dynamic discovery in a scalable way. What should you do?

    • AConfigure your microservices to use the Cloud Run Admin and Cloud Functions APIs to query for deployed Cloud Run services and Cloud Functions in the Google Cloud project.
    • BCreate a Service Directory namespace. Use API calls to register the services during deployment, and query during runtime.
    • CRename the Cloud Functions and Cloud Run services endpoint is using a well-documented naming convention.
    • DDeploy Hashicorp Consul on a single Compute Engine instance. Register the services with Consul during deployment, and query during runtime.

    Show answer

    Answer: B

    Explanation

    Service Directory provides a scalable way to manage the registration and discovery of services. By creating a namespace, you can use API calls to register your Cloud Run and Cloud Functions services, and query them during runtime. This allows for dynamic discovery and eliminates the need for manually updating environment variables. Service Directory also provides features such as service health checks and metadata, which can be used to further improve the reliability and scalability of your application.

    Source: Adapted from community discussion — mrvergara

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 161. 357 questions available.