PCDOE practice questions 71–80

1. Question 71 · 210 in bank

   You are configuring a CI pipeline. The build step for your CI pipeline integration testing requires access to APIs inside your private VPC network. Your security team requires that you do not expose API traffic publicly. You need to implement a solution that minimizes management overhead. What should you do?

   • AUse Cloud Build private pools to connect to the private VPC.
   • BUse Spinnaker for Google Cloud to connect to the private VPC.
   • CUse Cloud Build as a pipeline runner. Configure Internal HTTP(S) Load Balancing for API access.
   • DUse Cloud Build as a pipeline runner. Configure External HTTP(S) Load Balancing with a Google Cloud Armor policy for API access.

   Show answer

   Answer: A

   Explanation

   To implement a solution that minimizes management overhead and allows the CI pipeline integration testing to access APIs inside your private VPC network without exposing API traffic publicly, the appropriate (choice is A). Cloud Build private pools allow you to run builds in a Google Cloud environment with access to your private VPC network. This ensures that the build step for your CI pipeline can access APIs inside the private VPC without exposing API traffic to the public internet. Private pools minimize management overhead by providing a secure and controlled environment for running builds. Options B, C, and D involve different configurations, but they may introduce unnecessary complexity, security risks, or exposure of API traffic to the public internet, which contradicts the security requirements provided.

   Source: Adapted from community discussion — xhilmi

   References

   • Google Cloud documentation

   Next question

2. Question 72 · 210 in bank

   You recently migrated an ecommerce application to Google Cloud. You now need to prepare the application for the upcoming peak traffic season. You want to follow Google-recommended practices. What should you do first to prepare for the busy season?

   • AMigrate the application to Cloud Run, and use autoscaling.
   • BCreate a Terraform configuration for the application's underlying infrastructure to quickly deploy to additional regions.
   • CLoad test the application to profile its performance for scaling.
   • DPre-provision the additional compute power that was used last season, and expect growth.

   Show answer

   Answer: C

   Explanation

   Choose C. Google-recommended practices often involve load testing applications to understand their performance characteristics and determine appropriate scaling strategies. By load testing the ecommerce application, you can simulate peak traffic scenarios and identify potential bottlenecks or areas for optimization. This allows you to make informed decisions about scaling strategies, such as setting up auto-scaling policies based on the observed performance metrics. Load testing helps ensure that the application can handle the expected peak traffic efficiently and reliably. Options A, B, and D may have their relevance in different contexts, but load testing the application is typically a crucial step to gather insights into its behavior under stress and to inform scaling strategies for the upcoming peak traffic season.

   Source: Adapted from community discussion — xhilmi

   Next question

3. Question 73 · 210 in bank

   You are monitoring a service that uses n2-standard-2 Compute Engine instances that serve large files. Users have reported that downloads are slow. Your Cloud Monitoring dashboard shows that your VMs are running at peak network throughput. You want to improve the network throughput performance. What should you do?

   • AAdd additional network interface controllers (NICs) to your VMs.
   • BDeploy a Cloud NAT gateway and attach the gateway to the subnet of the VMs.
   • CChange the machine type for your VMs to n2-standard-8.
   • DDeploy the Ops Agent to export additional monitoring metrics.

   Show answer

   Answer: C

   Explanation

   https://cloud.google.com/compute/docs/general-purpose-machines#n2-standard "Neither additional virtual network interfaces (vNICs) nor additional IP addresses per vNIC increase ingress or egress bandwidth for a VM. For example, a C3 VM with 22 vCPUs is limited to 23 Gbps total egress bandwidth. If you configure the C3 VM with two vNICs, the VM is still limited to 23 Gbps total egress bandwidth, not 23 Gbps bandwidth per vNIC." https://cloud.google.com/compute/docs/network-bandwidth#vm-out-baseline:~:text=Neither%20additional%20virtual,bandwidth%20per%20vNIC.

   Source: Adapted from community discussion — alpha_canary

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 74 · 210 in bank

   Your organization is starting to containerize with Google Cloud. You need a fully managed storage solution for container images and Helm charts. You need to identify a storage solution that has native integration into existing Google Cloud services, including Google Kubernetes Engine (GKE), Cloud Run, VPC Service Controls, and Identity and Access Management (IAM). What should you do?

   • AUse Docker to configure a Cloud Storage driver pointed at the bucket owned by your organization.
   • BConfigure an open source container registry server to run in GKE with a restrictive role-based access control (RBAC) configuration.
   • CConfigure Artifact Registry as an OCI-based container registry for both Helm charts and container images.
   • DConfigure Container Registry as an OCI-based container registry for container images.

   Show answer

   Answer: C

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 75 · 210 in bank

   You need to define SLOs for a high-traffic web application. Customers are currently happy with the application performance and availability. Based on current measurement, the 90th percentile of latency is 160 ms and the 95th percentile of latency is 300 ms over a 28-day window. What latency SLO should you publish?

   • A90th percentile - 150 ms 95th percentile - 290 ms
   • B90th percentile - 160 ms 95th percentile - 300 ms
   • C90th percentile - 190 ms 95th percentile - 330 ms
   • D90th percentile - 300 ms 95th percentile - 450 ms

   Show answer

   Answer: C

   Next question

6. Question 76 · 210 in bank

   Your company runs applications in Google Kubernetes Engine (GKE). Application developers frequently create cloud resources to support their applications. You need to give developers the ability to manage infrastructure as code while adhering to Google-recommended practices. You want to manage infrastructure as code through Kubernetes Custom Resource Definitions (CRDs) and ensure that your chosen setup can be supported by the Google Cloud Support Portal. What should you do?

   • AConfigure Cloud Build with a Terraform builder to execute the terraform plan and terraform apply commands.
   • BInstall and configure Crossplane in GKE.
   • CConfigure a GitHub Action with a Terraform builder to execute the terraform plan and terraform apply commands as part of the pull request process.
   • DInstall and configure Config Connector in GKE.

   Show answer

   Answer: D

   Next question

7. Question 77 · 210 in bank

   Your company runs services on Google Cloud. Each team runs their applications in a dedicated project. New teams and projects are created regularly. Your security team requires that all logs are processed by a security information and event management (SIEM) system. The SIEM ingests logs by using Pub/Sub. You must ensure that all existing and future logs are scanned by the SIEM. What should you do?

   • ACreate an organization-level aggregated sink with a siem log bucket as the destination. Set an inclusion filter to include all logs.
   • BCreate a folder-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each folder.
   • CCreate an organization-level aggregated sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs.
   • DCreate a project-level logging sink with a siem Pub/Sub topic as the destination. Set an inclusion filter to include all logs. Repeat for each project.

   Show answer

   Answer: C

   Next question

8. Question 78 · 210 in bank

   You support an e-commerce application that runs on a large Google Kubernetes Engine (GKE) cluster deployed on-premises and on Google Cloud Platform. The application consists of microservices that run in containers. You want to identify containers that are using the most CPU and memory. What should you do?

   • AUse Stackdriver Kubernetes Engine Monitoring.
   • BUse Prometheus to collect and aggregate logs per container, and then analyze the results in Grafana.
   • CUse the Stackdriver Monitoring API to create custom metrics, and then organize your containers using groups.
   • DUse Stackdriver Logging to export application logs to BigQuery, aggregate logs per container, and then analyze CPU and memory consumption.

   Show answer

   Answer: A

   Explanation

   * https://cloud.google.com/anthos/clusters/docs/on-prem GKE on-prem is also called Anthos clusters on VMware * https://cloud.google.com/anthos/clusters/docs/on-prem/concepts/logging-and-monitoring You have several logging and monitoring options for your Anthos clusters on VMware: + Cloud Logging and Cloud Monitoring, enabled by in-cluster agents deployed with Anthos clusters on VMware. + Prometheus and Grafana, disabled by default. + Validated configurations with third-party solutions. => it means, if not a special situation, the correct should be using the first option: Logging and Monitoring. In this case, we want metrics, so Monitoring (aka. Cloud Monitoring, Stackdriver Monitoring) should be used. We are talking about GKE, so we will use Kubernetest Engine Monitoring (https://cloud.google.com/kubernetes-engine-monitoring). Obviously, A is correct.

   Source: Adapted from community discussion — danchoif2

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 79 · 210 in bank

   Your company allows teams to self-manage Google Cloud projects, including project-level Identity and Access Management (IAM). You are concerned that the team responsible for the Shared VPC project might accidentally delete the project, so a lien has been placed on the project. You need to design a solution to restrict Shared VPC project deletion to those with the resourcemanager.projects.updateLiens permission at the organization level. What should you do?

   • AInstruct teams to only perform IAM permission management as code with Terraform.
   • BEnable VPC Service Controls for the container.googleapis.com API service.
   • CRevoke the resourcemanager.projects.updateLiens permission from all users associated with the project.
   • DEnable the compute.restrictXpnProjectLienRemoval organization policy constraint.

   Show answer

   Answer: D

   Next question

10. Question 80 · 210 in bank

    Your company runs an ecommerce business. The application responsible for payment processing has structured JSON logging with the following schema:

    

    Capture and access of logs from the payment processing application is mandatory for operations, but the jsonPayload.user_email field contains personally identifiable information (PII). Your security team does not want the entire engineering team to have access to PII. You need to stop exposing PII to the engineering team and restrict access to security team members only. What should you do?

    • AApply the conditional role binding resource.name.extract("locations/global/buckets/{bucket}/") == "_Default" to the _Default bucket.
    • BApply a jsonPayload.user_email restricted field to the _Default bucket. Grant the Log Field Accessor role to the security team members.
    • CApply a jsonPayload.user_email exclusion filter to the _Default bucket.
    • DModify the application to toggle inclusion of user_email when the LOG_USER_EMAIL environment variable is set to true. Restrict the engineering team members who can change the production environment variable by using the CODEOWNERS file.

    Show answer

    Answer: B

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDOE practice, question 71. 210 questions available.