PCDOE practice questions 11–20

1. Question 11 · 210 in bank

   Select 2

   You are creating a CI/CD pipeline in Cloud Build to build an application container image. The application code is stored in GitHub. Your company requires that production image builds are only run against the main branch and that the change control team approves all pushes to the main branch. You want the image build to be as automated as possible. What should you do? (Choose two.)

   • ACreate a trigger on the Cloud Build job. Set the repository event setting to ‘Pull request’.
   • BAdd the OWNERS file to the Included files filter on the trigger.
   • CCreate a trigger on the Cloud Build job. Set the repository event setting to ‘Push to a branch’
   • DConfigure a branch protection rule for the main branch on the repository.
   • EEnable the Approval option on the trigger.

   Show answer

   Answer: CD

   Explanation

   CD is the correct answer ,This will ensure that the image build is only triggered when a push is made to the main branch, and that the push is approved by the change control team. Explanation: Option C: Setting the repository event setting to ‘Push to a branch’ will trigger the Cloud Build job whenever a push is made to any branch in the repository. This is necessary because you want the image build to be triggered when a push is made to the main branch. Option D: Configuring a branch protection rule for the main branch on the repository will require that all pushes to the main branch be approved by the change control team. This is necessary to ensure that only approved changes are made to the main branch, which will then trigger the image build.

   Source: Adapted from community discussion — ManishKS

   Next question

2. Question 12 · 210 in bank

   You built a serverless application by using Cloud Run and deployed the application to your production environment. You want to identify the resource utilization of the application for cost optimization. What should you do?

   • AUse Cloud Trace with distributed tracing to monitor the resource utilization of the application.
   • BUse Cloud Profiler with Ops Agent to monitor the CPU and memory utilization of the application.
   • CUse Cloud Monitoring to monitor the container CPU and memory utilization of the application.
   • DUse Cloud Ops to create logs-based metrics to monitor the resource utilization of the application.

   Show answer

   Answer: C

   Explanation

   For identifying the resource utilization of a serverless application deployed on Cloud Run for cost optimization, the recommended approach is to use Cloud Monitoring, as indicated by (Option C). Cloud Monitoring provides comprehensive monitoring capabilities, allowing you to track container CPU and memory utilization effectively. Specifically tailored for containerized environments like Cloud Run, Cloud Monitoring provides insights into key metrics, enabling you to analyze resource consumption, identify potential bottlenecks, and optimize costs based on observed utilization patterns. By monitoring container CPU and memory metrics, you gain valuable data for making informed decisions about resource allocation, ensuring efficient usage, and ultimately optimizing the cost of running the serverless application in your production environment.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 13 · 210 in bank

   You support the backend of a mobile phone game that runs on a Google Kubernetes Engine (GKE) cluster. The application is serving HTTP requests from users. You need to implement a solution that will reduce the network cost. What should you do?

   • AConfigure the VPC as a Shared VPC Host project.
   • BConfigure your network services on the Standard Tier.
   • CConfigure your Kubernetes cluster as a Private Cluster.
   • DConfigure a Google Cloud HTTP Load Balancer as Ingress.

   Show answer

   Answer: B

   Explanation

   Ans is D A: No, Doest make sense B: Who says that we are using a premium tier? C: This does not help with the network cost? D: Ok :) Costs associated with a load balancer are charged to the project containing the load balancer components. Because of these benefits, container-native load balancing is the recommended solution for load balancing through Ingress. When NEGs are used with GKE Ingress, the Ingress controller facilitates the creation of all aspects of the L7 load balancer. This includes creating the virtual IP address, forwarding rules, health checks, firewall rules, and more. https://cloud.google.com/architecture/best-practices-for-running-cost-effective-kubernetes-applications-on-gke

   Source: Adapted from community discussion — francisco_guerra

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 14 · 210 in bank

   Your company is using HTTPS requests to trigger a public Cloud Run-hosted service accessible at the https://booking-engine-abcdef.a.run.app URL. You need to give developers the ability to test the latest revisions of the service before the service is exposed to customers. What should you do?

   • ARun the gcloud run deploy booking-engine --no-traffic --tag dev command. Use the https://dev--booking-engine-abcdef.a.run.app URL for testing.
   • BRun the gcloud run services update-traffic booking-engine --to-revisions LATEST=1 command. Use the https://booking-engine-abcdef.a.run.app URL for testing.
   • CPass the curl –H “Authorization:Bearer $(gcloud auth print-identity-token)” auth token. Use the https://booking-engine-abcdef.a.run.app URL to test privately.
   • DGrant the roles/run.invoker role to the developers testing the booking-engine service. Use the https://booking-engine-abcdef.private.run.app URL for testing.

   Show answer

   Answer: A

   Explanation

   To enable developers to test the latest revisions of a Cloud Run-hosted service before exposing it to customers, the recommended approach is to use the --no-traffic flag during deployment, as outlined in (Option A). By running the command gcloud run deploy booking-engine --no-traffic --tag dev, you deploy the service with no traffic routed to it initially. Subsequently, developers can test the latest revisions using the URL https://dev--booking-engine-abcdef.a.run.app. This allows for a controlled and private testing environment where developers can validate the service's functionality and behavior before making it publicly accessible. Utilizing a dedicated URL with the --tag option ensures that developers can interact with the specific version intended for testing, facilitating a smooth and secure testing process.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 15 · 210 in bank

   You are configuring connectivity across Google Kubernetes Engine (GKE) clusters in different VPCs. You notice that the nodes in Cluster A are unable to access the nodes in Cluster B. You suspect that the workload access issue is due to the network configuration. You need to troubleshoot the issue but do not have execute access to workloads and nodes. You want to identify the layer at which the network connectivity is broken. What should you do?

   • AInstall a toolbox container on the node in Cluster Confirm that the routes to Cluster B are configured appropriately.
   • BUse Network Connectivity Center to perform a Connectivity Test from Cluster A to Cluster B.
   • CUse a debug container to run the traceroute command from Cluster A to Cluster B and from Cluster B to Cluster A. Identify the common failure point.
   • DEnable VPC Flow Logs in both VPCs, and monitor packet drops.

   Show answer

   Answer: B

   Explanation

   I suspect that there is a mistake in the issue and that the Network Intelligence Center is correct, not the Network Connectivity Center. https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/concepts/overview

   Source: Adapted from community discussion — YushiSato

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 16 · 210 in bank

   You manage an application that runs in Google Kubernetes Engine (GKE) and uses the blue/green deployment methodology. Extracts of the Kubernetes manifests are shown below:

   

   The Deployment app-green was updated to use the new version of the application. During post-deployment monitoring, you notice that the majority of user requests are failing. You did not observe this behavior in the testing environment. You need to mitigate the incident impact on users and enable the developers to troubleshoot the issue. What should you do?

   • AUpdate the Deployment app-blue to use the new version of the application.
   • BUpdate the Deployment app-green to use the previous version of the application.
   • CChange the selector on the Service app-svc to app: my-app.
   • DChange the selector on the Service app-svc to app: my-app, version: blue.

   Show answer

   Answer: D

   Explanation

   To mitigate the impact of the incident on users and facilitate troubleshooting, the recommended action is to change the selector on the Service app-svc to app: my-app, version: blue, as stated in (Option D). This adjustment allows the Service to route traffic specifically to the previous version of the application (app-blue). By changing the selector to include the version label, you effectively roll back the traffic to the working version, providing a quick and effective solution to address the user request failures observed after the update to app-green. This enables developers to investigate and troubleshoot the issue in a controlled manner without affecting user experience, and it serves as an interim solution while further investigation and remediation are carried out.

   Source: Adapted from community discussion — xhilmi

   Next question

7. Question 17 · 210 in bank

   You are running a web application deployed to a Compute Engine managed instance group. Ops Agent is installed on all instances. You recently noticed suspicious activity from a specific IP address. You need to configure Cloud Monitoring to view the number of requests from that specific IP address with minimal operational overhead. What should you do?

   • AConfigure the Ops Agent with a logging receiver. Create a logs-based metric. B Create a script to scrape the web server log. Export the IP address request metrics to the Cloud Monitoring API.
   • BUpdate the application to export the IP address request metrics to the Cloud Monitoring API.
   • CConfigure the Ops Agent with a metrics receiver.

   Show answer

   Answer: A

   Explanation

   To efficiently monitor the number of requests from a specific IP address in a web application deployed to a Compute Engine managed instance group with Ops Agent installed, the recommended approach is to configure the Ops Agent with a logging receiver and create a logs-based metric, as outlined in (Option A). By configuring the Ops Agent with a logging receiver, it can collect and forward relevant log data to Cloud Monitoring. Subsequently, creating a logs-based metric allows you to define a metric based on the extracted information from the logs, specifically focusing on the number of requests from the suspicious IP address. This setup minimizes operational overhead by leveraging existing infrastructure and provides a streamlined way to monitor and analyze the targeted metric related to the suspicious activity, aiding in swift detection and response to potential security issues.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

8. Question 18 · 210 in bank

   Your organization is using Helm to package containerized applications. Your applications reference both public and private charts. Your security team flagged that using a public Helm repository as a dependency is a risk. You want to manage all charts uniformly, with native access control and VPC Service Controls. What should you do?

   • AStore public and private charts in OCI format by using Artifact Registry.
   • BStore public and private charts by using GitHub Enterprise with Google Workspace as the identity provider.
   • CStore public and private charts by using Git repository. Configure Cloud Build to synchronize contents of the repository into a Cloud Storage bucket. Connect Helm to the bucket by using https://[bucket].storage-googleapis.com/[helmchart] as the Helm repository.
   • DConfigure a Helm chart repository server to run in Google Kubernetes Engine (GKE) with Cloud Storage bucket as the storage backend.

   Show answer

   Answer: A

   Explanation

   To address security concerns and maintain consistent access controls for Helm charts, it's recommended to store both public and private charts in the Open Container Initiative (OCI) format using Google Cloud's Artifact Registry, as suggested in (Option A). Artifact Registry provides a centralized, secure repository for Helm charts with native access control features and integration capabilities with VPC Service Controls. Storing charts in OCI format ensures a standardized approach to packaging, and Artifact Registry offers a robust solution for organizing and securing container artifacts. This approach improves security by centralizing both public and private charts, aligning with best practices for Helm chart management in containerized applications.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

9. Question 19 · 210 in bank

   You use Terraform to manage an application deployed to a Google Cloud environment. The application runs on instances deployed by a managed instance group. The Terraform code is deployed by using a CI/CD pipeline. When you change the machine type on the instance template used by the managed instance group, the pipeline fails at the terraform apply stage with the following error message:

   

   You need to update the instance template and minimize disruption to the application and the number of pipeline runs. What should you do?

   • ADelete the managed instance group, and recreate it after updating the instance template.
   • BAdd a new instance template, update the managed instance group to use the new instance template, and delete the old instance template.
   • CRemove the managed instance group from the Terraform state file, update the instance template, and reimport the managed instance group.
   • DSet the create_before_destroy meta-argument to true in the lifecycle block on the instance template.

   Show answer

   Answer: D

   Explanation

   Answer B suggests a manual change, but we should use terraform in a CI/CD pipeline. Answer D is the good one, it does the same thing than B, but with terraform automatically, as the default behaviour of terraform is to destroy resources before recreating it when it cannot be updated we have to tune the lifecycle parameter.

   Source: Adapted from community discussion — florian_cartron

   References

   • HashiCorp documentation
   • Google Cloud documentation

   Next question

10. Question 20 · 210 in bank

    Your company operates in a highly regulated domain that requires you to store all organization logs for seven years. You want to minimize logging infrastructure complexity by using managed services. You need to avoid any future loss of log capture or stored logs due to misconfiguration or human error. What should you do?

    • AUse Cloud Logging to configure an aggregated sink at the organization level to export all logs into a BigQuery dataset.
    • BUse Cloud Logging to configure an aggregated sink at the organization level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.
    • CUse Cloud Logging to configure an export sink at each project level to export all logs into a BigQuery dataset
    • DUse Cloud Logging to configure an export sink at each project level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock.

    Show answer

    Answer: B

    Explanation

    To ensure long-term retention of logs and minimize complexity while complying with regulatory requirements, the recommended approach is (Option B). By using Cloud Logging to configure an aggregated sink at the organization level to export all logs into Cloud Storage with a seven-year retention policy and Bucket Lock, you establish a centralized and secure storage solution. This setup leverages Cloud Storage's features, such as retention policies and Bucket Lock, to prevent accidental or intentional deletion of logs, reducing the risk of data loss due to misconfiguration or human error. It provides a robust and managed solution for storing logs over the required seven-year period, ensuring compliance with regulatory standards.

    Source: Adapted from community discussion — xhilmi

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDOE practice, question 11. 210 questions available.