PCD practice questions 81–90

1. Question 81 · 357 in bank

   You are developing an application that consists of several microservices running in a Google Kubernetes Engine cluster. One microservice needs to connect to a third-party database running on-premises. You need to store credentials to the database and ensure that these credentials can be rotated while following security best practices. What should you do?

   • AStore the credentials in a sidecar container proxy, and use it to connect to the third-party database.
   • BConfigure a service mesh to allow or restrict traffic from the Pods in your microservice to the database.
   • CStore the credentials in an encrypted volume mount, and associate a Persistent Volume Claim with the client Pod.
   • DStore the credentials as a Kubernetes Secret, and use the Cloud Key Management Service plugin to handle encryption and decryption.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets By default, Google Kubernetes Engine (GKE) encrypts customer content stored at rest, including Secrets. GKE handles and manages this default encryption for you without any additional action on your part. Application-layer secrets encryption provides an additional layer of security for sensitive data, such as Secrets, stored in etcd. Using this functionality, you can use a key managed with Cloud KMS to encrypt data at the application layer. This encryption protects against attackers who gain access to an offline copy of etcd.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

2. Question 82 · 357 in bank

   You manage your company's ecommerce platform's payment system, which runs on Google Cloud. Your company must retain user logs for 1 year for internal auditing purposes and for 3 years to meet compliance requirements. You need to store new user logs on Google Cloud to minimize on-premises storage usage and ensure that they are easily searchable. You want to minimize effort while ensuring that the logs are stored correctly. What should you do?

   • AStore the logs in a Cloud Storage bucket with bucket lock turned on.
   • BStore the logs in a Cloud Storage bucket with a 3-year retention period.
   • CStore the logs in Cloud Logging as custom logs with a custom retention period.
   • DStore the logs in a Cloud Storage bucket with a 1-year retention period. After 1 year, move the logs to another bucket with a 2-year retention period.

   Show answer

   Answer: C

   Explanation

   The requirements say that the logs should be easily searchable. This is not easily achieved in Cloud Storage, so that eliminates A,B and D. That leaves C and the valid option. Note, that it's possible to configure Cloud Logging with a custom retention period. https://cloud.google.com/logging/docs/buckets#custom-retention

   Source: Adapted from community discussion — micoams

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 83 · 357 in bank

   Select 2

   Your company has a new security initiative that requires all data stored in Google Cloud to be encrypted by customer-managed encryption keys. You plan to use Cloud Key Management Service (KMS) to configure access to the keys. You need to follow the "separation of duties" principle and Google-recommended best practices. What should you do? (Choose two.)

   • AProvision Cloud KMS in its own project.
   • BDo not assign an owner to the Cloud KMS project.
   • CProvision Cloud KMS in the project where the keys are being used.
   • DGrant the roles/cloudkms.admin role to the owner of the project where the keys from Cloud KMS are being used.
   • EGrant an owner role for the Cloud KMS project to a different user than the owner of the project where the keys from Cloud KMS are being used.

   Show answer

   Answer: AB

   Explanation

   AB should be correct instead. https://cloud.google.com/kms/docs/separation-of-duties#using_separate_project Instead, to allow for a separation of duties, you could run Cloud KMS in its own project, for example your-key-project. Then, depending on the strictness of your separation requirements, you could either: - (recommended) Create your-key-project without an owner at the project level, and designate an Organization Admin granted at the organization-level. Unlike an owner, an Organization Admin can't manage or use keys directly. They are restricted to setting IAM policies, which restrict who can manage and use keys. Using an organization-level node, you can further restrict permissions for projects in your organization.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

4. Question 84 · 357 in bank

   You need to migrate a standalone Java application running in an on-premises Linux virtual machine (VM) to Google Cloud in a cost-effective manner. You decide not to take the lift-and-shift approach, and instead you plan to modernize the application by converting it to a container. How should you accomplish this task?

   • AUse Migrate for Anthos to migrate the VM to your Google Kubernetes Engine (GKE) cluster as a container.
   • BExport the VM as a raw disk and import it as an image. Create a Compute Engine instance from the Imported image.
   • CUse Migrate for Compute Engine to migrate the VM to a Compute Engine instance, and use Cloud Build to convert it to a container.
   • DUse Jib to build a Docker image from your source code, and upload it to Artifact Registry. Deploy the application in a GKE cluster, and test the application.

   Show answer

   Answer: D

   Explanation

   Jib is a tool that builds Docker images from Java code without the need for a Dockerfile. This makes it easy to containerize Java applications, even if you don't have any experience with Docker.

   Source: Adapted from community discussion — __rajan__

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 85 · 357 in bank

   Your organization has recently begun an initiative to replatform their legacy applications onto Google Kubernetes Engine. You need to decompose a monolithic application into microservices. Multiple instances have read and write access to a configuration file, which is stored on a shared file system. You want to minimize the effort required to manage this transition, and you want to avoid rewriting the application code. What should you do?

   • ACreate a new Cloud Storage bucket, and mount it via FUSE in the container.
   • BCreate a new persistent disk, and mount the volume as a shared PersistentVolume.
   • CCreate a new Filestore instance, and mount the volume as an NFS PersistentVolume.
   • DCreate a new ConfigMap and volumeMount to store the contents of the configuration file.

   Show answer

   Answer: C

   Explanation

   A is incorrect, because Cloud Storage FUSE does not support concurrency and file locking. B is incorrect, because a persistent disk PersistentVolume is not read-write-many. It can only be read-write once or read-many. C is correct, because it’s the only managed, supported read-write-many storage option available for file-system access in Google Kubernetes Engine. D is incorrect, because the ConfigMap cannot be written to from the Pods. https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes https://cloud.google.com/filestore/docs/accessing-fileshares https://cloud.google.com/storage/docs/gcs-fuse

   Source: Adapted from community discussion — x_cath

   References

   • Kubernetes documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Kubernetes documentation

   Next question

6. Question 86 · 357 in bank

   Your development team has built several Cloud Functions using Java along with corresponding integration and service tests. You are building and deploying the functions and launching the tests using Cloud Build. Your Cloud Build job is reporting deployment failures immediately after successfully validating the code. What should you do?

   • ACheck the maximum number of Cloud Function instances.
   • BVerify that your Cloud Build trigger has the correct build parameters.
   • CRetry the tests using the truncated exponential backoff polling strategy.
   • DVerify that the Cloud Build service account is assigned the Cloud Functions Developer role.

   Show answer

   Answer: D

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 87 · 357 in bank

   You manage a microservices application on Google Kubernetes Engine (GKE) using Istio. You secure the communication channels between your microservices by implementing an Istio AuthorizationPolicy, a Kubernetes NetworkPolicy, and mTLS on your GKE cluster. You discover that HTTP requests between two Pods to specific URLs fail, while other requests to other URLs succeed. What is the cause of the connection issue?

   • AA Kubernetes NetworkPolicy resource is blocking HTTP traffic between the Pods.
   • BThe Pod initiating the HTTP requests is attempting to connect to the target Pod via an incorrect TCP port.
   • CThe Authorization Policy of your cluster is blocking HTTP requests for specific paths within your application.
   • DThe cluster has mTLS configured in permissive mode, but the Pod's sidecar proxy is sending unencrypted traffic in plain text.

   Show answer

   Answer: C

   Explanation

   A is not correct because Kubernetes NetworkPolicy resources allow you to block HTTP traffic between groups of pods but not for selected paths. (https://kubernetes.io/docs/concepts/services-networking/network-policies/). B is not correct because if the client pod is using an incorrect port to communicate with the server, pod requests will time out for all URL paths. C is correct because an Istio Authorization policy allows you to block HTTP methods between pods for specific URL paths (https://istio.io/latest/docs/tasks/security/authorization/authz-http/). D is not correct because mTLS configuration using Istio should not cause HTTP requests to fail. In permissive mode (default configuration), a service can accept both plain text and mTLS encrypted traffic (https://istio.io/latest/docs/tasks/security/authentication/mtls-migration/).

   Source: Adapted from community discussion — telp

   References

   • Kubernetes documentation
   • Google Cloud documentation

   Next question

8. Question 88 · 357 in bank

   You recently migrated an on-premises monolithic application to a microservices application on Google Kubernetes Engine (GKE). The application has dependencies on backend services on-premises, including a CRM system and a MySQL database that contains personally identifiable information (PII). The backend services must remain on-premises to meet regulatory requirements. You established a Cloud VPN connection between your on-premises data center and Google Cloud. You notice that some requests from your microservices application on GKE to the backend services are failing due to latency issues caused by fluctuating bandwidth, which is causing the application to crash. How should you address the latency issues?

   • AUse Memorystore to cache frequently accessed PII data from the on-premises MySQL database
   • BUse Istio to create a service mesh that includes the microservices on GKE and the on-premises services
   • CIncrease the number of Cloud VPN tunnels for the connection between Google Cloud and the on-premises services
   • DDecrease the network layer packet size by decreasing the Maximum Transmission Unit (MTU) value from its default value on Cloud VPN

   Show answer

   Answer: C

   Explanation

   A, B, and D can be eliminated A. Caching PII (Personally Identifiable Information) is never a good practice B. Using Istio is not going to improve the latency (the network hops remain the same) D. Reducing the packet size, has the effect of more packets being sent across which is counter productive That leaves C as the valid option GCP does support having multiple VPN Tunnels on the same gateway https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing#route-alignment

   Source: Adapted from community discussion — micoams

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 89 · 357 in bank

   Your company has deployed a new API to a Compute Engine instance. During testing, the API is not behaving as expected. You want to monitor the application over 12 hours to diagnose the problem within the application code without redeploying the application. Which tool should you use?

   • ACloud Trace
   • BCloud Monitoring
   • CCloud Debugger logpoints
   • DCloud Debugger snapshots

   Show answer

   Answer: C

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 90 · 357 in bank

    You are building an API that will be used by Android and iOS apps. The API must: * Support HTTPs * Minimize bandwidth cost * Integrate easily with mobile apps Which API architecture should you use?

    • ARESTful APIs
    • BMQTT for APIs
    • CgRPC-based APIs
    • DSOAP-based APIs

    Show answer

    Answer: C

    Explanation

    To support HTTPS, minimize bandwidth cost, and integrate easily with mobile apps, you should use gRPC-based APIs (C). gRPC (gRPC Remote Procedure Calls) is a modern, high-performance, open-source remote procedure call (RPC) framework that can be used to build APIs. It uses HTTP/2 as the underlying transport protocol and Protocol Buffers as the encoding format. gRPC is designed to be low-bandwidth, low-latency, and easily integrable with mobile apps. It also supports HTTPs out of the box. RESTful APIs (A) are a popular choice for building APIs, but they may not be as efficient as gRPC in terms of bandwidth usage, especially for APIs that transfer large amounts of data. MQTT (B) is a lightweight messaging protocol that is often used in IoT applications, but it may not be as well-suited for building APIs as gRPC. SOAP-based APIs (D) are an older style of API that has largely been replaced by more modern alternatives like gRPC.

    Source: Adapted from community discussion — omermahgoub

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCD practice, question 81. 357 questions available.