PCD practice questions 11–20

1. Question 11 · 357 in bank

   You are developing an application that will allow users to read and post comments on news articles. You want to configure your application to store and display user-submitted comments using Firestore. How should you design the schema to support an unknown number of comments and articles?

   • AStore each comment in a subcollection of the article.
   • BAdd each comment to an array property on the article.
   • CStore each comment in a document, and add the comment's key to an array property on the article.
   • DStore each comment in a document, and add the comment's key to an array property on the user profile.

   Show answer

   Answer: A

   Explanation

   Selected: A Firestore has a “hierarchical structure”: collection contains documents, document can contain (sub)collections D does not make sense bc why do you want to link comments to the user profile instead of the article? https://stackoverflow.com/questions/48634227/limitation-to-number-of-documents-under-one-collection-in-firebase-firestore “There is no documented limit to the number of documents that can be stored in a Cloud Firestore collection. The system is designed to scale to huge data sets.”

   Source: Adapted from community discussion — p4

   Next question

2. Question 12 · 357 in bank

   You recently developed an application. You need to call the Cloud Storage API from a Compute Engine instance that doesn't have a public IP address. What should you do?

   • AUse Carrier Peering
   • BUse VPC Network Peering
   • CUse Shared VPC networks
   • DUse Private Google Access

   Show answer

   Answer: D

   Explanation

   A is not correct because Carrier Peering enables you to access Google applications, such as Google Workspace, by using a service provider to obtain enterprise-grade network services that connect your infrastructure to Google. B is not correct because VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in a private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet. C is not correct because Shared VPC allows an organization to connect resources from multiple projects to a common VPC network so that they can communicate with each other securely and efficiently using internal IPs from that network. D is correct because Private Google Access is an option available for each subnetwork. When it is enabled, instances in the subnetwork can communicate with public Google API endpoints even if the instances don't have external IP addresses.

   Source: Adapted from community discussion — telp

   References

   • Google Cloud documentation

   Next question

3. Question 13 · 357 in bank

   You need to migrate an internal file upload API with an enforced 500-MB file size limit to App Engine. What should you do?

   • AUse FTP to upload files.
   • BUse CPanel to upload files.
   • CUse signed URLs to upload files.
   • DChange the API to be a multipart file upload API.

   Show answer

   Answer: C

   Explanation

   https://cloud.google.com/appengine/docs/standard/php/googlestorage/user_upload: "Note that you must start uploading to this URL within 10 minutes of its creation. Also, you cannot change the URL in any way - it is signed and the signature is checked before your upload begins" C is the answer

   Source: Adapted from community discussion — syu31svc

   References

   • Google Cloud documentation

   Next question

4. Question 14 · 357 in bank

   You are a developer working with the CI/CD team to troubleshoot a new feature that your team introduced. The CI/CD team used HashiCorp Packer to create a new Compute Engine image from your development branch. The image was successfully built, but is not booting up. You need to investigate the issue with the CI/ CD team. What should you do?

   • ACreate a new feature branch, and ask the build team to rebuild the image.
   • BShut down the deployed virtual machine, export the disk, and then mount the disk locally to access the boot logs.
   • CInstall Packer locally, build the Compute Engine image locally, and then run it in your personal Google Cloud project.
   • DCheck Compute Engine OS logs using the serial port, and check the Cloud Logging logs to confirm access to the serial port.

   Show answer

   Answer: D

   Explanation

   Answer is D If the Compute Engine image is not booting up, one of the first steps to troubleshoot the issue would be to check the OS logs to see what might be causing the problem. Compute Engine provides access to the serial console logs of a virtual machine, which can be accessed through the Cloud Console or the gcloud command-line tool. This will allow you to see the output of the virtual machine's boot process and identify any errors or issues that might be preventing it from starting up. Additionally, you should also check the Cloud Logging logs to confirm that you have access to the serial port. It may be possible that the firewall rules or IAM permissions are blocking access to the serial port and causing the image not to boot. So, you should check the logs for any errors related to access or firewall rules. By checking the OS logs and the Cloud Logging logs, you and the CI/CD team can get a better understanding of what might be causing the issue and take steps to fix it.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 15 · 357 in bank

   You manage an application that runs in a Compute Engine instance. You also have multiple backend services executing in stand-alone Docker containers running in Compute Engine instances. The Compute Engine instances supporting the backend services are scaled by managed instance groups in multiple regions. You want your calling application to be loosely coupled. You need to be able to invoke distinct service implementations that are chosen based on the value of an HTTP header found in the request. Which Google Cloud feature should you use to invoke the backend services?

   • ATraffic Director
   • BService Directory
   • CAnthos Service Mesh
   • DInternal HTTP(S) Load Balancing

   Show answer

   Answer: A

   Explanation

   "the backend services are scaled by managed instance groups in multiple regions", the Internal load balancer is a regional service, so It's A in my opinion. - "An internal HTTP(S) load balancer routes internal traffic to the service running on the VM. Traffic Director works with Cloud Load Balancing to provide a managed ingress experience. You set up an external or internal load balancer, and then configure that load balancer to send traffic to your microservices."

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 16 · 357 in bank

   Your team is developing an ecommerce platform for your company. Users will log in to the website and add items to their shopping cart. Users will be automatically logged out after 30 minutes of inactivity. When users log back in, their shopping cart should be saved. How should you store users' session and shopping cart information while following Google-recommended best practices?

   • AStore the session information in Pub/Sub, and store the shopping cart information in Cloud SQL.
   • BStore the shopping cart information in a file on Cloud Storage where the filename is the SESSION ID.
   • CStore the session and shopping cart information in a MySQL database running on multiple Compute Engine instances.
   • DStore the session information in Memorystore for Redis or Memorystore for Memcached, and store the shopping cart information in Firestore.

   Show answer

   Answer: D

   References

   • Google Cloud documentation

   Next question

7. Question 17 · 357 in bank

   Select 2

   You are designing a resource-sharing policy for applications used by different teams in a Google Kubernetes Engine cluster. You need to ensure that all applications can access the resources needed to run. What should you do? (Choose two.)

   • ASpecify the resource limits and requests in the object specifications.
   • BCreate a namespace for each team, and attach resource quotas to each namespace.
   • CCreate a LimitRange to specify the default compute resource requirements for each namespace.
   • DCreate a Kubernetes service account (KSA) for each application, and assign each KSA to the namespace.
   • EUse the Anthos Policy Controller to enforce label annotations on all namespaces. Use taints and tolerations to allow resource sharing for namespaces.

   Show answer

   Answer: BC

   Explanation

   BC is the answer. https://kubernetes.io/docs/concepts/policy/resource-quotas/ A resource quota, defined by a ResourceQuota object, provides constraints that limit aggregate resource consumption per namespace. It can limit the quantity of objects that can be created in a namespace by type, as well as the total amount of compute resources that may be consumed by resources in that namespace. https://kubernetes.io/docs/concepts/policy/limit-range/ A LimitRange is a policy to constrain the resource allocations (limits and requests) that you can specify for each applicable object kind (such as Pod or PersistentVolumeClaim) in a namespace.

   Source: Adapted from community discussion — zellck

   References

   • Kubernetes documentation
   • Kubernetes documentation
   • Google Cloud documentation

   Next question

8. Question 18 · 357 in bank

   You are developing a new application that has the following design requirements: ✑ Creation and changes to the application infrastructure are versioned and auditable. ✑ The application and deployment infrastructure uses Google-managed services as much as possible. ✑ The application runs on a serverless compute platform. How should you design the application's architecture?

   • A1. Store the application and infrastructure source code in a Git repository. 2. Use Cloud Build to deploy the application infrastructure with Terraform. 3. Deploy the application to a Cloud Function as a pipeline step.
   • B1. Deploy Jenkins from the Google Cloud Marketplace, and define a continuous integration pipeline in Jenkins. 2. Configure a pipeline step to pull the application source code from a Git repository. 3. Deploy the application source code to App Engine as a pipeline step.
   • C1. Create a continuous integration pipeline on Cloud Build, and configure the pipeline to deploy the application infrastructure using Deployment Manager templates. 2. Configure a pipeline step to create a container with the latest application source code. 3. Deploy the container to a Compute Engine instance as a pipeline step.
   • D1. Deploy the application infrastructure using gcloud commands. 2. Use Cloud Build to define a continuous integration pipeline for changes to the application source code. 3. Configure a pipeline step to pull the application source code from a Git repository, and create a containerized application. 4. Deploy the new container on Cloud Run as a pipeline step.

   Show answer

   Answer: A

   Explanation

   A is the correct choice. B - use Jenkins as the deployment tool instead of Cloud Build (The application and deployment infrastructure uses Google-managed services as much as possible). C - uses Compute Engine to run containers. CE is not serverless. D - we can't version gcloud commands

   Source: Adapted from community discussion — morenocasado

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 19 · 357 in bank

   You are creating and running containers across different projects in Google Cloud. The application you are developing needs to access Google Cloud services from within Google Kubernetes Engine (GKE). What should you do?

   • AAssign a Google service account to the GKE nodes.
   • BUse a Google service account to run the Pod with Workload Identity.
   • CStore the Google service account credentials as a Kubernetes Secret.
   • DUse a Google service account with GKE role-based access control (RBAC).

   Show answer

   Answer: B

   Explanation

   In summary, using Workload Identity allows you to authenticate your application to Google Cloud services using the same identity that runs the application, this makes it simple to manage the access and permissions to resources, and also ensures that your application only has the necessary permissions to access the services.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation

   Next question

10. Question 20 · 357 in bank

    You have containerized a legacy application that stores its configuration on an NFS share. You need to deploy this application to Google Kubernetes Engine (GKE) and do not want the application serving traffic until after the configuration has been retrieved. What should you do?

    • AUse the gsutil utility to copy files from within the Docker container at startup, and start the service using an ENTRYPOINT script.
    • BCreate a PersistentVolumeClaim on the GKE cluster. Access the configuration files from the volume, and start the service using an ENTRYPOINT script.
    • CUse the COPY statement in the Dockerfile to load the configuration into the container image. Verify that the configuration is available, and start the service using an ENTRYPOINT script.
    • DAdd a startup script to the GKE instance group to mount the NFS share at node startup. Copy the configuration files into the container, and start the service using an ENTRYPOINT script.

    Show answer

    Answer: B

    Explanation

    It's not necessary to mount NFS to each node in GKE. Just create PVC point to shared NFS, mount to container, and use configuration in ENTRYPOINT. Vote B

    Source: Adapted from community discussion — Ksamilosb

    References

    • Google Cloud documentation
    • Kubernetes documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 11. 357 questions available.