PCD practice questions 171–180

1. Question 171 · 357 in bank

   You work for a financial services company that has a container-first approach. Your team develops microservices applications. A Cloud Build pipeline creates the container image, runs regression tests, and publishes the image to Artifact Registry. You need to ensure that only containers that have passed the regression tests are deployed to Google Kubernetes Engine (GKE) clusters. You have already enabled Binary Authorization on the GKE clusters. What should you do next?

   • ACreate an attestor and a policy. After a container image has successfully passed the regression tests, use Cloud Build to run Kritis Signer to create an attestation for the container image.
   • BDeploy Voucher Server and Voucher Client components. After a container image has successfully passed the regression tests, run Voucher Client as a step in the Cloud Build pipeline.
   • CSet the Pod Security Standard level to Restricted for the relevant namespaces. Use Cloud Build to digitally sign the container images that have passed the regression tests.
   • DCreate an attestor and a policy. Create an attestation for the container images that have passed the regression tests as a step in the Cloud Build pipeline.

   Show answer

   Answer: A

   Explanation

   A. For folks wonder what differences between Kritis Signer and Voucher Server Voucher Client, I asked Google Bard about it. Bard stated Kritis Signer is a command-line tools, whereas Voucher Server Voucher Client is a web-based tool. I then tried to verify that with Google search and Google image search (search "voucher server voucher client" then click Images). It seems Bard report correctly. Someone even wrote a Kritis Signer integrated pipeline with terraform (https://xebia.com/blog/how-to-automate-the-kritis-signer-on-google-cloud-platform/) . Also, yes, both Kritis Signer and Voucher Server Voucher Client have Google official documentations. However, if you look carefully on Voucher Server Voucher Client Google official doc, they use curl to the Voucher Server address, which indirectly prove Vouch Server Vouch Client is a web-based tool.

   Source: Adapted from community discussion — zanhsieh

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 172 · 357 in bank

   You are reviewing and updating your Cloud Build steps to adhere to best practices. Currently, your build steps include: 1. Pull the source code from a source repository. 2. Build a container image 3. Upload the built image to Artifact Registry. You need to add a step to perform a vulnerability scan of the built container image, and you want the results of the scan to be available to your deployment pipeline running in Google Cloud. You want to minimize changes that could disrupt other teams’ processes. What should you do?

   • AEnable Binary Authorization, and configure it to attest that no vulnerabilities exist in a container image.
   • BUpload the built container images to your Docker Hub instance, and scan them for vulnerabilities.
   • CEnable the Container Scanning API in Artifact Registry, and scan the built container images for vulnerabilities.
   • DAdd Artifact Registry to your Aqua Security instance, and scan the built container images for vulnerabilities.

   Show answer

   Answer: C

   Explanation

   Enabling the Container Scanning API in Artifact Registry and scanning the built container images is a best practice because it allows you to perform security scans within the same environment where the built images are stored. This helps minimize the changes that could disrupt other teams' processes, as the images are already in Artifact Registry, and the scanning results can be easily accessed by the deployment pipeline in Google Cloud. Additionally, the Container Scanning API integrates with Google Cloud security and governance tools, allowing you to enforce security policies and manage vulnerabilities in a centralized and automated way.

   Source: Adapted from community discussion — mrvergara

   References

   • Google Cloud documentation

   Next question

3. Question 173 · 357 in bank

   You are developing an online gaming platform as a microservices application on Google Kubernetes Engine (GKE). Users on social media are complaining about long loading times for certain URL requests to the application. You need to investigate performance bottlenecks in the application and identify which HTTP requests have a significantly high latency span in user requests. What should you do?

   • AConfigure GKE workload metrics using kubectl. Select all Pods to send their metrics to Cloud Monitoring. Create a custom dashboard of application metrics in Cloud Monitoring to determine performance bottlenecks of your GKE cluster.
   • BUpdate your microservices to log HTTP request methods and URL paths to STDOUT. Use the logs router to send container logs to Cloud Logging. Create filters in Cloud Logging to evaluate the latency of user requests across different methods and URL paths.
   • CInstrument your microservices by installing the OpenTelemetry tracing package. Update your application code to send traces to Trace for inspection and analysis. Create an analysis report on Trace to analyze user requests.
   • DInstall tcpdump on your GKE nodes. Run tcpdump to capture network traffic over an extended period of time to collect data. Analyze the data files using Wireshark to determine the cause of high latency.

   Show answer

   Answer: C

   Explanation

   This is the best way to investigate performance bottlenecks in a microservices application. By using OpenTelemetry, you can collect traces from all of your microservices and analyze them in Trace. This will allow you to identify which requests are taking the longest and where the bottlenecks are occurring.

   Source: Adapted from community discussion — Writer

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 174 · 357 in bank

   You need to load-test a set of REST API endpoints that are deployed to Cloud Run. The API responds to HTTP POST requests. Your load tests must meet the following requirements: • Load is initiated from multiple parallel threads. • User traffic to the API originates from multiple source IP addresses. • Load can be scaled up using additional test instances. You want to follow Google-recommended best practices. How should you configure the load testing?

   • ACreate an image that has cURL installed, and configure cURL to run a test plan. Deploy the image in a managed instance group, and run one instance of the image for each VM.
   • BCreate an image that has cURL installed, and configure cURL to run a test plan. Deploy the image in an unmanaged instance group, and run one instance of the image for each VM.
   • CDeploy a distributed load testing framework on a private Google Kubernetes Engine cluster. Deploy additional Pods as needed to initiate more traffic and support the number of concurrent users.
   • DDownload the container image of a distributed load testing framework on Cloud Shell. Sequentially start several instances of the container on Cloud Shell to increase the load on the API.

   Show answer

   Answer: C

   Explanation

   Option D, which involves starting several instances of a load testing framework container on Cloud Shell, may not be a recommended approach for several reasons: Cloud Shell is a shell environment for managing resources hosted on Google Cloud and does not provide a scalable infrastructure for running load tests. Starting several instances of a container on Cloud Shell is not a highly available or scalable solution for load testing, and may not provide sufficient parallelism or control over the source IP addresses of the traffic. Using a private Google Kubernetes Engine cluster to deploy a distributed load testing framework allows for scaling up the load testing by deploying additional Pods, which can provide more control over the number of concurrent users and the source IP addresses of the traffic, and can provide a more robust and scalable infrastructure for load testing.

   Source: Adapted from community discussion — mrvergara

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 175 · 357 in bank

   Your team is creating a serverless web application on Cloud Run. The application needs to access images stored in a private Cloud Storage bucket. You want to give the application Identity and Access Management (IAM) permission to access the images in the bucket, while also securing the services using Google-recommended best practices. What should you do?

   • AEnforce signed URLs for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
   • BEnforce public access prevention for the desired bucket. Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account.
   • CEnforce signed URLs for the desired bucket. Create and update the Cloud Run service to use a user-managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account.
   • DEnforce public access prevention for the desired bucket. Create and update the Cloud Run service to use a user-managed service account. Grant the Storage Object Viewer IAM role on the bucket to the service account.

   Show answer

   Answer: D

   Explanation

   D is right. 1) Create service account with role of viewing the objects under Cloud storage bucket 2) Create policies to prevent public access to the bucket. A and C: Neither of these are close to the solution. B is somewhat closer but the statement "Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account" is wrong since we need to create service account for the application and not for VM.

   Source: Adapted from community discussion — purushi

   Next question

6. Question 176 · 357 in bank

   You are using Cloud Run to host a global ecommerce web application. Your company’s design team is creating a new color scheme for the web app. You have been tasked with determining whether the new color scheme will increase sales. You want to conduct testing on live production traffic. How should you design the study?

   • AUse an external HTTP(S) load balancer to route a predetermined percentage of traffic to two different color schemes of your application. Analyze the results to determine whether there is a statistically significant difference in sales.
   • BUse an external HTTP(S) load balancer to route traffic to the original color scheme while the new deployment is created and tested. After testing is complete, reroute all traffic to the new color scheme. Analyze the results to determine whether there is a statistically significant difference in sales.
   • CUse an external HTTP(S) load balancer to mirror traffic to the new version of your application. Analyze the results to determine whether there is a statistically significant difference in sales.
   • DEnable a feature flag that displays the new color scheme to half of all users. Monitor sales to see whether they increase for this group of users.

   Show answer

   Answer: A

   Explanation

   Correct answer is A. This is classic A/B testing. Since you already have a new version, built into an image, all you need do is to use the load balancer to split traffic going to old version and new version. See: https://cloud.google.com/load-balancing/docs/l7-internal/traffic-management#traffic_actions_weight-based_traffic_splitting. Note that global load balancers can route to serverless services. https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless

   Source: Adapted from community discussion — theereechee

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 177 · 357 in bank

   You are a developer at a large corporation. You manage three Google Kubernetes Engine clusters on Google Cloud. Your team’s developers need to switch from one cluster to another regularly without losing access to their preferred development tools. You want to configure access to these multiple clusters while following Google-recommended best practices. What should you do?

   • AAsk the developers to use Cloud Shell and run gcloud container clusters get-credential to switch to another cluster.
   • BIn a configuration file, define the clusters, users, and contexts. Share the file with the developers and ask them to use kubect1 contig to add cluster, user, and context details.
   • CAsk the developers to install the gcloud CLI on their workstation and run gcloud container clusters get-credentials to switch to another cluster.
   • DAsk the developers to open three terminals on their workstation and use kubect1 config to configure access to each cluster.

   Show answer

   Answer: B

   Explanation

   Option B is the best solution because it is secure, convenient, and time-efficient. By using a configuration file, you can define the clusters, users, and contexts that you want to use. You can then share the file with the developers, who can use it to add the cluster, user, and context details to their kubeconfig file. Once the developers have added the cluster, user, and context details to their kubeconfig file, they can switch to another cluster by using the following command: kubectl config use

   Source: Adapted from community discussion — Writer

   References

   • Kubernetes documentation

   Next question

8. Question 178 · 357 in bank

   You are a lead developer working on a new retail system that runs on Cloud Run and Firestore. A web UI requirement is for the user to be able to browse through all products. A few months after go-live, you notice that Cloud Run instances are terminated with HTTP 500: Container instances are exceeding memory limits errors during busy times. This error coincides with spikes in the number of Firestore queries. You need to prevent Cloud Run from crashing and decrease the number of Firestore queries. You want to use a solution that optimizes system performance. What should you do?

   • AModify the query that returns the product list using cursors with limits.
   • BCreate a custom index over the products.
   • CModify the query that returns the product list using integer offsets.
   • DModify the Cloud Run configuration to increase the memory limits.

   Show answer

   Answer: A

   Explanation

   A cursor is a pointer to a specific location in a Firestore database. By using cursors with limits, you can control the number of documents that are returned in a query. This can help to reduce the number of Firestore queries that are made, which can improve performance and prevent Cloud Run from crashing.

   Source: Adapted from community discussion — Writer

   Next question

9. Question 179 · 357 in bank

   You are writing a single-page web application with a user-interface that communicates with a third-party API for content using XMLHttpRequest. The data displayed on the UI by the API results is less critical than other data displayed on the same web page, so it is acceptable for some requests to not have the API data displayed in the UI. However, calls made to the API should not delay rendering of other parts of the user interface. You want your application to perform well when the API response is an error or a timeout. What should you do?

   • ASet the asynchronous option for your requests to the API to false and omit the widget displaying the API results when a timeout or error is encountered.
   • BSet the asynchronous option for your request to the API to true and omit the widget displaying the API results when a timeout or error is encountered.
   • CCatch timeout or error exceptions from the API call and keep trying with exponential backoff until the API response is successful.
   • DCatch timeout or error exceptions from the API call and display the error response in the UI widget.

   Show answer

   Answer: B

   Explanation

   Answer is B. Api should not delay rendering: asynchronous Application perform well when Api error or timeout: omit the widget

   Source: Adapted from community discussion — [Removed]

   Next question

10. Question 180 · 357 in bank

    You are a developer at a large organization. Your team uses Git for source code management (SCM). You want to ensure that your team follows Google-recommended best practices to manage code to drive higher rates of software delivery. Which SCM process should your team use?

    • AEach developer commits their code to the main branch before each product release, conducts testing, and rolls back if integration issues are detected.
    • BEach group of developers copies the repository, commits their changes to their repository, and merges their code into the main repository before each product release.
    • CEach developer creates a branch for their own work, commits their changes to their branch, and merges their code into the main branch daily.
    • DEach group of developers creates a feature branch from the main branch for their work, commits their changes to their branch, and merges their code into the main branch after the change advisory board approves it.

    Show answer

    Answer: D

    Explanation

    Use a centralized repository. A centralized repository is a single location where all of your team's code is stored. This makes it easy for everyone to access the latest code, and it also helps to prevent conflicts. Use branches. Branches are a way to create a separate version of the code for development purposes. This allows developers to work on new features or bug fixes without affecting the main branch of the code.

    Source: Adapted from community discussion — Writer

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 171. 357 questions available.