PCDOE practice questions 31–40

1. Question 31 · 210 in bank

   You work for a global organization and are running a monolithic application on Compute Engine. You need to select the machine type for the application to use that optimizes CPU utilization by using the fewest number of steps. You want to use historical system metrics to identify the machine type for the application to use. You want to follow Google-recommended practices. What should you do?

   • AUse the Recommender API and apply the suggested recommendations.
   • BCreate an Agent Policy to automatically install Ops Agent in all VMs.
   • CInstall the Ops Agent in a fleet of VMs by using the gcloud CLI.
   • DReview the Cloud Monitoring dashboard for the VM and choose the machine type with the lowest CPU utilization.

   Show answer

   Answer: A

   Explanation

   The recommended approach for optimizing CPU utilization based on historical system metrics in a global organization running a monolithic application on Compute Engine is (option A). Utilizing the Recommender API allows you to leverage Google Cloud's machine learning algorithms to analyze historical data and provide specific recommendations for resource optimization. This method is proactive and can automatically suggest appropriate changes to improve efficiency, aligning with Google-recommended practices. By incorporating the insights provided by the Recommender API, you can make informed decisions to select the most suitable machine type for the application, ensuring optimal CPU utilization with minimal manual intervention.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

2. Question 32 · 210 in bank

   You deployed an application into a large Standard Google Kubernetes Engine (GKE) cluster. The application is stateless and multiple pods run at the same time. Your application receives inconsistent traffic. You need to ensure that the user experience remains consistent regardless of changes in traffic and that the resource usage of the cluster is optimized. What should you do?

   • AConfigure a cron job to scale the deployment on a schedule
   • BConfigure a Horizontal Pod Autoscaler.
   • CConfigure a Vertical Pod Autoscaler
   • DConfigure cluster autoscaling on the node pool.

   Show answer

   Answer: B

   Explanation

   The recommended approach to ensure a consistent user experience and optimize resource usage for a stateless application with inconsistent traffic in a large Standard Google Kubernetes Engine (GKE) cluster is (option B) Configure a Horizontal Pod Autoscaler (HPA). HPA automatically adjusts the number of replica pods based on observed CPU utilization or other custom metrics. In the context of varying traffic patterns, HPA dynamically scales the number of pods to meet demand, ensuring that there are enough instances to handle increased traffic and scaling down during periods of lower demand. This helps maintain consistent performance while optimizing resource utilization in response to changing workloads.

   Source: Adapted from community discussion — xhilmi

   Next question

3. Question 33 · 210 in bank

   You need to deploy a new service to production. The service needs to automatically scale using a managed instance group and should be deployed across multiple regions. The service needs a large number of resources for each instance and you need to plan for capacity. What should you do?

   • AMonitor results of Cloud Trace to determine the optimal sizing.
   • BUse the n2-highcpu-96 machine type in the configuration of the managed instance group.
   • CDeploy the service in multiple regions and use an internal load balancer to route traffic.
   • DValidate that the resource requirements are within the available project quota limits of each region.

   Show answer

   Answer: D

   Explanation

   I don't agree with C, since it only mentions multi-region but doesn't do anything to cope with scalability. D although doesn't directly mention multi-region but it is the prereq to achieve large scale resource provisioning

   Source: Adapted from community discussion — lelele2023

   Next question

4. Question 34 · 210 in bank

   You are performing a semi-annual capacity planning exercise for your flagship service. You expect a service user growth rate of 10% month-over-month over the next six months. Your service is fully containerized and runs on Google Cloud Platform (GCP), using a Google Kubernetes Engine (GKE) Standard regional cluster on three zones with cluster autoscaler enabled. You currently consume about 30% of your total deployed CPU capacity, and you require resilience against the failure of a zone. You want to ensure that your users experience minimal negative impact as a result of this growth or as a result of zone failure, while avoiding unnecessary costs. How should you prepare to handle the predicted growth?

   • AVerify the maximum node pool size, enable a horizontal pod autoscaler, and then perform a load test to verify your expected resource needs.
   • BBecause you are deployed on GKE and are using a cluster autoscaler, your GKE cluster will scale automatically, regardless of growth rate.
   • CBecause you are at only 30% utilization, you have significant headroom and you won't need to add any additional capacity for this rate of growth.
   • DProactively add 60% more node capacity to account for six months of 10% growth rate, and then perform a load test to make sure you have enough capacity.

   Show answer

   Answer: A

   Explanation

   A: Correct. The Horizontal Pod Autoscaler changes the shape of your Kubernetes workload by automatically increasing or decreasing the number of Pods in response to the workload's CPU or memory consumption B: Incorrect. It is not based on the CPU its based on the workload C: No, Hope is not an strategy D: No, have more resource than needed

   Source: Adapted from community discussion — francisco_guerra

   References

   • Google Cloud documentation

   Next question

5. Question 35 · 210 in bank

   Select 2

   You are analyzing Java applications in production. All applications have Cloud Profiler and Cloud Trace installed and configured by default. You want to determine which applications need performance tuning. What should you do? (Choose two.)

   • AExamine the wall-clock time and the CPU time of the application. If the difference is substantial increase the CPU resource allocation.
   • BExamine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the memory resource allocation.
   • CExamine the wall-clock time and the CPU time of the application. If the difference is substantial, increase the local disk storage allocation.
   • DExamine the latency time the wall-clock time and the CPU time of the application. If the latency time is slowly burning down the error budget, and the difference between wall-clock time and CPU time is minimal mark the application for optimization.
   • EExamine the heap usage of the application. If the usage is low, mark the application for optimization.

   Show answer

   Answer: DE

   Explanation

   I asked Google's Gemini AI and this is what it answered. Here's why these options are correct: D: Latency time: High latency directly impacts user experience and can negatively affect your error budget. Wall-clock time: This represents the elapsed time from start to finish of a request. A large difference with CPU time indicates bottlenecks outside the CPU, requiring optimization. CPU time: This represents the actual CPU processing time used by the application. Minimal difference with wall-clock time suggests inefficient use of CPU, potentially needing optimization. E: Heap usage: Low heap usage can indicate under-provisioning or potential memory leaks. Either way, it implies inefficient resource utilization and deserves investigation.

   Source: Adapted from community discussion — alpha_canary

   References

   • Google Cloud documentation

   Next question

6. Question 36 · 210 in bank

   Your organization stores all application logs from multiple Google Cloud projects in a central Cloud Logging project. Your security team wants to enforce a rule that each project team can only view their respective logs and only the operations team can view all the logs. You need to design a solution that meets the security team s requirements while minimizing costs. What should you do?

   • AGrant each project team access to the project _Default view in the central logging project. Grant togging viewer access to the operations team in the central logging project.
   • BCreate Identity and Access Management (IAM) roles for each project team and restrict access to the _Default log view in their individual Google Cloud project. Grant viewer access to the operations team in the central logging project.
   • CCreate log views for each project team and only show each project team their application logs. Grant the operations team access to the _AllLogs view in the central logging project.
   • DExport logs to BigQuery tables for each project team. Grant project teams access to their tables. Grant logs writer access to the operations team in the central logging project.

   Show answer

   Answer: C

   Explanation

   Choose (option C). Creating log views for each project team allows you to tailor access to only show each team their relevant application logs. This fine-grained control ensures that project teams can access their own logs while maintaining isolation from logs of other teams. Granting the operations team access to the _AllLogs view in the central logging project provides them with the necessary visibility across all logs. This approach not only satisfies the security requirements but also minimizes costs by efficiently organizing and restricting access to the logs based on project teams' needs.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

7. Question 37 · 210 in bank

   Your company uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices. What should you do?

   • AConfirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.
   • BUse the Terraform module so that Secret Manager can retrieve credentials.
   • CCreate a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE_CREDENTIALS environment variable on the Jenkins server.
   • DAdd the gcloud auth application-default login command as a step in Jenkins before running the Terraform commands.

   Show answer

   Answer: A

   Explanation

   Downloading and setting Env Variable has potential to expose such high-level access to users . where as a dedicated SA attached to VM does not expose any credentials at all. running tf by default would use SA attached to VM.

   Source: Adapted from community discussion — shashankrathore

   Next question

8. Question 38 · 210 in bank

   You encounter a large number of outages in the production systems you support. You receive alerts for all the outages, the alerts are due to unhealthy systems that are automatically restarted within a minute. You want to set up a process that would prevent staff burnout while following Site Reliability Engineering (SRE) practices. What should you do?

   • AEliminate alerts that are not actionable
   • BRedefine the related SLO so that the error budget is not exhausted
   • CDistribute the alerts to engineers in different time zones
   • DCreate an incident report for each of the alerts

   Show answer

   Answer: A

   Explanation

   Choose option A. Eliminating alerts that are not actionable helps streamline the alerting process and ensures that engineers are only notified when their intervention is necessary. This approach aligns with the SRE principle of reducing alert fatigue and focuses the attention of the engineering team on meaningful and actionable alerts. By eliminating non-actionable alerts, you not only prevent unnecessary disruptions to the team but also allow them to concentrate on addressing critical issues, contributing to a more efficient and sustainable incident response process.

   Source: Adapted from community discussion — xhilmi

   Next question

9. Question 39 · 210 in bank

   As part of your company's initiative to shift left on security, the InfoSec team is asking all teams to implement guard rails on all the Google Kubernetes Engine (GKE) clusters to only allow the deployment of trusted and approved images. You need to determine how to satisfy the InfoSec team's goal of shifting left on security. What should you do?

   • AEnable Container Analysis in Artifact Registry, and check for common vulnerabilities and exposures (CVEs) in your container images
   • BUse Binary Authorization to attest images during your CI/CD pipeline
   • CConfigure Identity and Access Management (IAM) policies to create a least privilege model on your GKE clusters.
   • DDeploy Falco or Twistlock on GKE to monitor for vulnerabilities on your running Pods

   Show answer

   Answer: B

   Explanation

   To satisfy the goal of shifting left on security and implement guardrails to only allow the deployment of trusted and approved images on Google Kubernetes Engine (GKE) clusters, the recommended approach is (option B) Use Binary Authorization to attest images during your CI/CD pipeline. Binary Authorization allows you to define and enforce policies that determine which container images can run in your GKE environment based on image signatures. By integrating Binary Authorization into your CI/CD pipeline, you can ensure that only trusted and approved images, with the correct attestations, are deployed to the GKE clusters. This proactive security measure aligns with the concept of shifting security left, as it establishes controls early in the development and deployment process, minimizing the risk of deploying compromised or unapproved images in production.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

10. Question 40 · 210 in bank

    Your company operates in a highly regulated domain. Your security team requires that only trusted container images can be deployed to Google Kubernetes Engine (GKE). You need to implement a solution that meets the requirements of the security team while minimizing management overhead. What should you do?

    • AConfigure Binary Authorization in your GKE clusters to enforce deploy-time security policies.
    • BGrant the roles/artifactregistry.writer role to the Cloud Build service account. Confirm that no employee has Artifact Registry write permission.
    • CUse Cloud Run to write and deploy a custom validator. Enable an Eventarc trigger to perform validations when new images are uploaded.
    • DConfigure Kritis to run in your GKE clusters to enforce deploy-time security policies.

    Show answer

    Answer: A

    Explanation

    Choose Ooption A: Configure Binary Authorization in your GKE clusters to enforce deploy-time security policies. Binary Authorization allows you to define and enforce policies that determine which container images can be deployed based on image signatures. By configuring Binary Authorization, you can enforce deploy-time security policies, ensuring that only trusted and verified container images are allowed to run in your GKE clusters. This approach provides a robust security mechanism without requiring additional custom validators or complex configurations, minimizing management overhead while meeting the stringent security requirements of a highly regulated domain.

    Source: Adapted from community discussion — xhilmi

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDOE practice, question 31. 210 questions available.