PCD practice questions 21–30

1. Question 21 · 357 in bank

   Your team is developing a new application using a PostgreSQL database and Cloud Run. You are responsible for ensuring that all traffic is kept private on Google Cloud. You want to use managed services and follow Google-recommended best practices. What should you do?

   • A1. Enable Cloud SQL and Cloud Run in the same project. 2. Configure a private IP address for Cloud SQL. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Configure Cloud Run to use the connector to connect to Cloud SQL.
   • B1. Install PostgreSQL on a Compute Engine virtual machine (VM), and enable Cloud Run in the same project. 2. Configure a private IP address for the VM. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Configure Cloud Run to use the connector to connect to the VM hosting PostgreSQL.
   • C1. Use Cloud SQL and Cloud Run in different projects. 2. Configure a private IP address for Cloud SQL. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Set up a VPN connection between the two projects. Configure Cloud Run to use the connector to connect to Cloud SQL.
   • D1. Install PostgreSQL on a Compute Engine VM, and enable Cloud Run in different projects. 2. Configure a private IP address for the VM. Enable private services access. 3. Create a Serverless VPC Access connector. 4. Set up a VPN connection between the two projects. Configure Cloud Run to use the connector to access the VM hosting PostgreSQL

   Show answer

   Answer: A

   Explanation

   The key here is, Google Managed services and follow Google-recommended best practices: Definitely Cloud SQL instead of Postgres SQL that is almost an unmanaged service managed by custom configurations set by customers.

   Source: Adapted from community discussion — purushi

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 22 · 357 in bank

   You are developing an application that will allow clients to download a file from your website for a specific period of time. How should you design the application to complete this task while following Google-recommended best practices?

   • AConfigure the application to send the file to the client as an email attachment.
   • BGenerate and assign a Cloud Storage-signed URL for the file. Make the URL available for the client to download.
   • CCreate a temporary Cloud Storage bucket with time expiration specified, and give download permissions to the bucket. Copy the file, and send it to the client.
   • DGenerate the HTTP cookies with time expiration specified. If the time is valid, copy the file from the Cloud Storage bucket, and make the file available for the client to download.

   Show answer

   Answer: B

   Explanation

   B. Generate and assign a Cloud Storage-signed URL for the file. Make the URL available for the client to download. The best approach is to use a Cloud Storage signed URL, which allows you to give time-limited read access to a specific file in your bucket. Once the URL is generated, it can be shared with the client to download the file. This approach provides an easy way to control access to your files, and allows you to revoke access at any time by simply invalidating the URL. It also ensures that the file is stored and served securely via Cloud Storage and is durable, highly available and performant way to serve files.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation

   Next question

3. Question 23 · 357 in bank

   Your development team has been asked to refactor an existing monolithic application into a set of composable microservices. Which design aspects should you implement for the new application? (Choose two.)

   • ADevelop the microservice code in the same programming language used by the microservice caller.
   • BCreate an API contract agreement between the microservice implementation and microservice caller.
   • CRequire asynchronous communications between all microservice implementations and microservice callers.
   • DEnsure that sufficient instances of the microservice are running to accommodate the performance requirements.
   • EImplement a versioning scheme to permit future changes that could be incompatible with the current interface.

   Show answer

   Answer: B

   Explanation

   BE is the answer. https://cloud.google.com/architecture/migrating-a-monolithic-app-to-microservices-gke#api_contracts Each microservice should be invoked only from a set of interfaces. Each interface should in turn be clearly defined by a contract that can be implemented using an API definition language like the OpenAPI Initiative specification or RAML. Having well-defined API contracts and interfaces allows you to develop tests as a main component of your solution (for example, by applying test-driven development) against these API interfaces. https://cloud.google.com/architecture/migrating-a-monolithic-app-to-microservices-gke#versioning To give you flexibility in managing updates that might break existing clients, you should implement a versioning scheme for your microservices. Versioning lets you deploy updated versions of a microservice without affecting the clients that are using an existing version.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 24 · 357 in bank

   You are planning to deploy your application in a Google Kubernetes Engine (GKE) cluster. The application exposes an HTTP-based health check at /healthz. You want to use this health check endpoint to determine whether traffic should be routed to the pod by the load balancer. Which code snippet should you include in your Pod configuration? A.

   

   B.

   

   C.

   

   D.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   For the GKE ingress controller to use your readinessProbes as health checks, the Pods for an Ingress must exist at the time of Ingress creation. If your replicas are scaled to 0, the default health check will apply.

   Source: Adapted from community discussion — syu31svc

   References

   • Kubernetes documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 25 · 357 in bank

   You deployed a new application to Google Kubernetes Engine and are experiencing some performance degradation. Your logs are being written to Cloud Logging, and you are using a Prometheus sidecar model for capturing metrics. You need to correlate the metrics and data from the logs to troubleshoot the performance issue and send real-time alerts while minimizing costs. What should you do?

   • ACreate custom metrics from the Cloud Logging logs, and use Prometheus to import the results using the Cloud Monitoring REST API.
   • BExport the Cloud Logging logs and the Prometheus metrics to Cloud Bigtable. Run a query to join the results, and analyze in Google Data Studio.
   • CExport the Cloud Logging logs and stream the Prometheus metrics to BigQuery. Run a recurring query to join the results, and send notifications using Cloud Tasks.
   • DExport the Prometheus metrics and use Cloud Monitoring to view them as external metrics. Configure Cloud Monitoring to create log-based metrics from the logs, and correlate them with the Prometheus data.

   Show answer

   Answer: D

   References

   • Google Cloud documentation

   Next question

6. Question 26 · 357 in bank

   You have been tasked with planning the migration of your company's application from on-premises to Google Cloud. Your company's monolithic application is an ecommerce website. The application will be migrated to microservices deployed on Google Cloud in stages. The majority of your company's revenue is generated through online sales, so it is important to minimize risk during the migration. You need to prioritize features and select the first functionality to migrate. What should you do?

   • AMigrate the Product catalog, which has integrations to the frontend and product database.
   • BMigrate Payment processing, which has integrations to the frontend, order database, and third-party payment vendor.
   • CMigrate Order fulfillment, which has integrations to the order database, inventory system, and third-party shipping vendor.
   • DMigrate the Shopping cart, which has integrations to the frontend, cart database, inventory system, and payment processing system.

   Show answer

   Answer: A

   Explanation

   I don't agree with option A. Google docs says: "When you plan your migration, it's tempting to start with features that are trivial to migrate. This might represent a quick win, but might not be the best learning experience for your team. Instead of going straight to the migration, you should spend time evaluating all of the features and create plans for their migration." "According to this evaluation framework, the ideal candidate for the initial migration effort should be challenging enough to be meaningful, but simple enough to minimize the risk of failure. The initial migration process should also: Require little refactoring, considering both the feature itself and the related business processes. Be stateless—that is, have no external data requirements. Have few or no dependencies." I think it's between options B & C since the third-party vendors already have a microservices architecture going on. https://cloud.google.com/architecture/migrating-a-monolithic-app-to-microservices-gke#:~:text=When%20you%20plan,for%20their%20migration.

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation

   Next question

7. Question 27 · 357 in bank

   Your team develops services that run on Google Kubernetes Engine. Your team's code is stored in Cloud Source Repositories. You need to quickly identify bugs in the code before it is deployed to production. You want to invest in automation to improve developer feedback and make the process as efficient as possible. What should you do?

   • AUse Spinnaker to automate building container images from code based on Git tags.
   • BUse Cloud Build to automate building container images from code based on Git tags.
   • CUse Spinnaker to automate deploying container images to the production environment.
   • DUse Cloud Build to automate building container images from code based on forked versions.

   Show answer

   Answer: B

   Explanation

   I would disagree with A as Spinnaker is for deployment not for building images So either B or C : C is stating to deploy to production but the question is to give feedback to developer before it goes to production So the only close answer is B but it is half answer Perhaps choice A was poorly written instead deploy build then it could be A

   Source: Adapted from community discussion — GCPCloudArchitectUser

   Next question

8. Question 28 · 357 in bank

   Your team is developing an application in Google Cloud that executes with user identities maintained by Cloud Identity. Each of your application's users will have an associated Pub/Sub topic to which messages are published, and a Pub/Sub subscription where the same user will retrieve published messages. You need to ensure that only authorized users can publish and subscribe to their own specific Pub/Sub topic and subscription. What should you do?

   

   • ABind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level.
   • BGrant the user identity the pubsub.publisher and pubsub.subscriber roles at the project level.
   • CGrant the user identity a custom role that contains the pubsub.topics.create and pubsub.subscriptions.create permissions.
   • DConfigure the application to run as a service account that has the pubsub.publisher and pubsub.subscriber roles.

   Show answer

   Answer: A

   Explanation

   A. Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level. By binding the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level, you can ensure that each user can only publish and subscribe to their specific Pub/Sub topic and subscription. This allows for granular permissions management and ensures that each user can only access the resources they are authorized to. The other options are not suitable in this case because,

   Source: Adapted from community discussion — omermahgoub

   Next question

9. Question 29 · 357 in bank

   You are evaluating developer tools to help drive Google Kubernetes Engine adoption and integration with your development environment, which includes VS Code and IntelliJ. What should you do?

   • AUse Cloud Code to develop applications.
   • BUse the Cloud Shell integrated Code Editor to edit code and configuration files.
   • CUse a Cloud Notebook instance to ingest and process data and deploy models.
   • DUse Cloud Shell to manage your infrastructure and applications from the command line.

   Show answer

   Answer: A

   Explanation

   Google Cloud code plugin can be installed on Intellij and VS code IDEs. This provides very flexibility for developer to work with GKE platform.

   Source: Adapted from community discussion — purushi

   References

   • Google Cloud documentation

   Next question

10. Question 30 · 357 in bank

    You are developing an ecommerce web application that uses App Engine standard environment and Memorystore for Redis. When a user logs into the app, the application caches the user's information (e.g., session, name, address, preferences), which is stored for quick retrieval during checkout. While testing your application in a browser, you get a 502 Bad Gateway error. You have determined that the application is not connecting to Memorystore. What is the reason for this error?

    • AYour Memorystore for Redis instance was deployed without a public IP address.
    • BYou configured your Serverless VPC Access connector in a different region than your App Engine instance.
    • CThe firewall rule allowing a connection between App Engine and Memorystore was removed during an infrastructure update by the DevOps team.
    • DYou configured your application to use a Serverless VPC Access connector on a different subnet in a different availability zone than your App Engine instance.

    Show answer

    Answer: B

    Explanation

    B is the correct answer in this case, A is wrong because according to the best practice and security purpose gcp doesn't allow public ip for redis server.

    Source: Adapted from community discussion — ParagSanyashiv

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 21. 357 questions available.