PCD practice questions 61–70

1. Question 61 · 357 in bank

   You are designing an application that uses a microservices architecture. You are planning to deploy the application in the cloud and on-premises. You want to make sure the application can scale up on demand and also use managed services as much as possible. What should you do?

   • ADeploy open source Istio in a multi-cluster deployment on multiple Google Kubernetes Engine (GKE) clusters managed by Anthos.
   • BCreate a GKE cluster in each environment with Anthos, and use Cloud Run for Anthos to deploy your application to each cluster.
   • CInstall a GKE cluster in each environment with Anthos, and use Cloud Build to create a Deployment for your application in each cluster.
   • DCreate a GKE cluster in the cloud and install open-source Kubernetes on-premises. Use an external load balancer service to distribute traffic across the two environments.

   Show answer

   Answer: B

   Explanation

   B. Create a GKE cluster in each environment with Anthos, and use Cloud Run for Anthos to deploy your application to each cluster. Using Anthos to manage Kubernetes clusters in both cloud and on-premises environments allows for consistency in deployment and management across both environments. Deploying the application using Cloud Run for Anthos allows for easy scaling on demand and use of managed services such as Cloud SQL and Memorystore. Additionally, Cloud Run for Anthos can be deployed to both GKE clusters and on-premises Kubernetes clusters, allowing for a consistent deployment experience across environments.

   Source: Adapted from community discussion — Teraflow

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 62 · 357 in bank

   You want to migrate an on-premises container running in Knative to Google Cloud. You need to make sure that the migration doesn't affect your application's deployment strategy, and you want to use a fully managed service. Which Google Cloud service should you use to deploy your container?

   • ACloud Run
   • BCompute Engine
   • CGoogle Kubernetes Engine
   • DApp Engine flexible environment

   Show answer

   Answer: A

   References

   • Google Cloud documentation

   Next question

3. Question 63 · 357 in bank

   This architectural diagram depicts a system that streams data from thousands of devices. You want to ingest data into a pipeline, store the data, and analyze the data using SQL statements. Which Google Cloud services should you use for steps 1, 2, 3, and 4?

   

   • A1. App Engine 2. Pub/Sub 3. BigQuery 4. Firestore
   • B1. Dataflow 2. Pub/Sub 3. Firestore 4. BigQuery
   • C1. Pub/Sub 2. Dataflow 3. BigQuery 4. Firestore
   • D1. Pub/Sub 2. Dataflow 3. Firestore 4. BigQuery

   Show answer

   Answer: D

   Next question

4. Question 64 · 357 in bank

   Your company just experienced a Google Kubernetes Engine (GKE) API outage due to a zone failure. You want to deploy a highly available GKE architecture that minimizes service interruption to users in the event of a future zone failure. What should you do?

   • ADeploy Zonal clusters
   • BDeploy Regional clusters
   • CDeploy Multi-Zone clusters
   • DDeploy GKE on-premises clusters

   Show answer

   Answer: B

   Explanation

   B is the answer. https://cloud.google.com/kubernetes-engine/docs/concepts/types-of-clusters#regional_clusters A regional cluster has multiple replicas of the control plane, running in multiple zones within a given region. Nodes in a regional cluster can run in multiple zones or a single zone depending on the configured node locations. By default, GKE replicates each node pool across three zones of the control plane's region. When you create a cluster or when you add a new node pool, you can change the default configuration by specifying the zone(s) in which the cluster's nodes run. All zones must be within the same region as the control plane.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 65 · 357 in bank

   Your team develops services that run on Google Cloud. You want to process messages sent to a Pub/Sub topic, and then store them. Each message must be processed exactly once to avoid duplication of data and any data conflicts. You need to use the cheapest and most simple solution. What should you do?

   • AProcess the messages with a Dataproc job, and write the output to storage.
   • BProcess the messages with a Dataflow streaming pipeline using Apache Beam's PubSubIO package, and write the output to storage.
   • CProcess the messages with a Cloud Function, and write the results to a BigQuery location where you can run a job to deduplicate the data.
   • DRetrieve the messages with a Dataflow streaming pipeline, store them in Cloud Bigtable, and use another Dataflow streaming pipeline to deduplicate messages.

   Show answer

   Answer: B

   Explanation

   Answer is B https://cloud.google.com/blog/products/data-analytics/handling-duplicate-data-in-streaming-pipeline-using-pubsub-dataflow "...because Pub/Sub provides each message with a unique message_id, Dataflow uses it to deduplicate messages by default if you use the built-in Apache Beam PubSubIO"

   Source: Adapted from community discussion — wrakky

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 66 · 357 in bank

   You are running a containerized application on Google Kubernetes Engine. Your container images are stored in Container Registry. Your team uses CI/CD practices. You need to prevent the deployment of containers with known critical vulnerabilities. What should you do?

   • A• Use Web Security Scanner to automatically crawl your application • Review your application logs for scan results, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed
   • B• Use Web Security Scanner to automatically crawl your application • Review the scan results in the scan details page in the Cloud Console, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed
   • C• Enable the Container Scanning API to perform vulnerability scanning • Review vulnerability reporting in Container Registry in the Cloud Console, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed
   • D• Enable the Container Scanning API to perform vulnerability scanning • Programmatically review vulnerability reporting through the Container Scanning API, and provide an attestation that the container is free of known critical vulnerabilities • Use Binary Authorization to implement a policy that forces the attestation to be provided before the container is deployed

   Show answer

   Answer: D

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 67 · 357 in bank

   You have an on-premises application that authenticates to the Cloud Storage API using a user-managed service account with a user-managed key. The application connects to Cloud Storage using Private Google Access over a Dedicated Interconnect link. You discover that requests from the application to access objects in the Cloud Storage bucket are failing with a 403 Permission Denied error code. What is the likely cause of this issue?

   • AThe folder structure inside the bucket and object paths have changed.
   • BThe permissions of the service account’s predefined role have changed.
   • CThe service account key has been rotated but not updated on the application server.
   • DThe Interconnect link from the on-premises data center to Google Cloud is experiencing a temporary outage.

   Show answer

   Answer: C

   Explanation

   Option B: The permissions of the service account’s predefined role have changed. If the permissions of the service account's role were altered, it could indeed result in a 403 Permission Denied error. However, such changes are typically deliberate and should be documented. If you have not altered the permissions, this might be less likely. Option C: The service account key has been rotated but not updated on the application server. This option is plausible because if the application is still using an old, invalid key after a rotation, it would result in a 403 Permission Denied error. Key rotation is a common practice for security, and forgetting to update the key on the application server is a frequent oversight.

   Source: Adapted from community discussion — Popa

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 68 · 357 in bank

   You are deploying your application to a Compute Engine virtual machine instance. Your application is configured to write its log files to disk. You want to view the logs in Stackdriver Logging without changing the application code. What should you do?

   • AInstall the Stackdriver Logging Agent and configure it to send the application logs.
   • BUse a Stackdriver Logging Library to log directly from the application to Stackdriver Logging.
   • CProvide the log file folder path in the metadata of the instance to configure it to send the application logs.
   • DChange the application to log to /var/log so that its logs are automatically sent to Stackdriver Logging.

   Show answer

   Answer: A

   Explanation

   https://cloud.google.com/logging/docs/agent/logging/installation: "The Logging agent streams logs from your VM instances and from selected third-party software packages to Cloud Logging" A is correct

   Source: Adapted from community discussion — syu31svc

   References

   • Google Cloud documentation

   Next question

9. Question 69 · 357 in bank

   You are using the Cloud Client Library to upload an image in your application to Cloud Storage. Users of the application report that occasionally the upload does not complete and the client library reports an HTTP 504 Gateway Timeout error. You want to make the application more resilient to errors. What changes to the application should you make?

   • AWrite an exponential backoff process around the client library call.
   • BWrite a one-second wait time backoff process around the client library call.
   • CDesign a retry button in the application and ask users to click if the error occurs.
   • DCreate a queue for the object and inform the users that the application will try again in 10 minutes.

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 70 · 357 in bank

    You are building a mobile application that will store hierarchical data structures in a database. The application will enable users working offline to sync changes when they are back online. A backend service will enrich the data in the database using a service account. The application is expected to be very popular and needs to scale seamlessly and securely. Which database and IAM role should you use?

    • AUse Cloud SQL, and assign the roles/cloudsql.editor role to the service account.
    • BUse Bigtable, and assign the roles/bigtable.viewer role to the service account.
    • CUse Firestore in Native mode and assign the roles/datastore.user role to the service account.
    • DUse Firestore in Datastore mode and assign the roles/datastore.viewer role to the service account.

    Show answer

    Answer: C

    Explanation

    C is the answer. https://firebase.google.com/docs/firestore/manage-data/enable-offline Cloud Firestore supports offline data persistence. This feature caches a copy of the Cloud Firestore data that your app is actively using, so your app can access the data when the device is offline. You can write, read, listen to, and query the cached data. When the device comes back online, Cloud Firestore synchronizes any local changes made by your app to the Cloud Firestore backend.

    Source: Adapted from community discussion — zellck

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 61. 357 questions available.