PCDE practice questions and answers

Correct answer: A, B — Grant predefined or custom roles at the narrowest resource scope that works · Use IAM Recommender findings to remove unused permissions

Scoping roles as narrowly as possible and acting on recommender findings are the two mechanisms that keep permissions tight over time. Organization-wide Owner, blanket primitive roles, and a shared service account all grant far more than any workload needs.

Correct answer: A — Configure a minimum number of instances so warm capacity is always available

Minimum instances keep containers warm so incoming requests do not wait for a cold start. A longer timeout tolerates the delay rather than removing it, reducing maximum instances makes queuing worse, and registry location does not affect steady-state cold starts.

Correct answer: A — Store it in Secret Manager and reference it from the build configuration

Secret Manager holds the value encrypted with IAM-controlled access, and Cloud Build can reference it without exposing it in configuration or logs. Committing secrets, passing them as plain substitutions, and printing them to logs all leak the credential.

Correct answer: A — Committed use discounts

Committed use discounts trade a usage commitment over one or three years for a lower rate, which suits a predictable baseline. Sustained use discounts apply automatically without a commitment, Spot pricing applies to preemptible capacity, and free tier quotas are small allowances.

Correct answer: A — Publish reviewed Terraform modules and enforce their use through a pipeline with policy checks

Shared modules plus automated policy checks make the compliant path the easy path and prevent drift without a human gate. Documents rely on goodwill, broad admin access removes guardrails, and manual ticket-driven creation does not scale and still drifts.

Correct answer: A — Review and remove alerts that are not symptom-based and actionable, and page only on SLO burn

Alert fatigue is fixed by making each page correspond to user-visible harm that requires human action, which usually means alerting on SLO burn rate rather than every internal condition. More responders spreads the pain, blanket threshold changes are arbitrary, and routing pages to email means real incidents are missed.

Correct answer: A — Include the trace identifier in each structured log entry

Emitting the trace identifier in the log payload lets the platform link logs to the corresponding trace span. A separate project makes correlation harder, permanent debug logging is expensive and noisy, and disabling sampling increases cost without creating the linkage.

Correct answer: A — Traffic

Traffic is the demand placed on the system, typically requests per second. Latency is how long requests take, errors is the rate of failed requests, and saturation is how full the system's constrained resource is.

Correct answer: A — Backward-compatible schema changes applied before the code that uses them, using an expand and contract approach

Expand and contract keeps old and new code working against the same schema during the rollout window, so a partial deployment never breaks. Coupling the two changes makes rollback impossible, dropping columns immediately breaks any instance still running old code, and downtime defeats the purpose of rolling deployment.

Correct answer: A — Enable Cloud Logging for the cluster so the managed agent collects container output

GKE's managed logging agent forwards container stdout and stderr to Cloud Logging once logging is enabled for the cluster. Reading node logs by hand does not scale, files inside containers are lost when pods restart, and Trace records latency rather than log output.

Correct answer: A — Promote by immutable image digest rather than by tag, and record the digest with each release

A digest identifies exact content, so promoting by digest makes it impossible for production to run different bits from what was tested. Rebuilding can produce a different artefact, retagging changes a mutable pointer without guaranteeing content, and per-environment base images ensure the environments differ.

Correct answer: A, B — High deployment frequency · Low change failure rate

Deploying often and rarely breaking production are two of the four key DORA metrics that correlate with high performance. Long lead times, quarterly big-batch releases, and manual gates everywhere are characteristics of low-performing delivery.

Correct answer: A — A log sink exporting to Cloud Storage with lifecycle rules, and a 30-day retention on the log bucket

Keeping a short queryable window in Logging while exporting to object storage with lifecycle transitions is the cost-effective pattern for long archives. Seven-year Logging retention is far more expensive, disabling retention loses the data, and a disk copy is unmanaged and does not scale.

Correct answer: A — Early in the build stage, before any artefact is published

Cheap, fast tests belong as early as possible so a broken change fails before any artefact exists or any environment is touched. Testing after production deployment, weekly, or by hand all delay feedback until the cost of failure is much higher.

Correct answer: A — The 0.1% of requests that may fail without breaching the objective

The error budget is the allowed unreliability implied by the objective, here 0.1% of requests over the window. It is not a headcount, a spending limit, or a fixed incident count.

Correct answer: A — A folder containing the business unit's projects

Folders group projects so IAM and organization policy assignments inherit consistently to everything inside. A shared VPC provides networking, a single project removes isolation, and a bucket is a storage resource with no policy inheritance role.

Correct answer: A — Rehearsed, up-to-date runbooks combined with regular disaster testing

Response speed comes from procedures that have been exercised, so anyone on call can act. Relying on one expert creates a single point of failure, a stale document does not guide response, and disabling alerting means incidents go undetected.

Correct answer: A, B — Right-size pod resource requests based on observed usage, using Vertical Pod Autoscaler recommendations · Enable cluster autoscaler so underused nodes are removed

Requests that reflect real usage let the scheduler pack pods densely, and the cluster autoscaler then removes nodes that are no longer needed. Inflating requests, disabling horizontal autoscaling, and adding fixed headroom all increase the node count and the bill.

Correct answer: A, B — Independent IAM boundaries and blast radius containment · Separate quota and billing attribution per workload

Projects are the natural isolation, quota, and billing boundary in Google Cloud. Splitting projects does not reduce latency, does not replicate data, and IAM policies remain required inside every project.

Correct answer: A — Canary deployment

Sending a small traffic slice to the new version and gating full rollout on measured health is the canary pattern. Recreate replaces everything at once, big bang is an unstaged cutover, and shadow sends duplicated traffic without serving its responses to users.

Correct answer: A, B — Cloud Audit Logs admin activity entries · Cloud Asset Inventory resource history

Admin activity audit logs record the principal and the API call, and asset inventory history shows the resource state before and after. Profiler samples, CDN metrics, and application debug logs say nothing about who invoked a control plane deletion.

Correct answer: A — Controlled fault injection experiments against a defined steady state in a pre-production or carefully scoped environment

Deliberately injecting latency and observing whether the steady state holds is the only option that produces evidence about degradation behaviour. Reading documentation is not a test, extra replicas do not change how a slow dependency is handled, and a longer timeout makes the symptom worse.

Correct answer: A — Service monitoring with SLOs defined against SLIs

Cloud Monitoring's service monitoring lets you define SLIs and SLOs and displays compliance and remaining error budget. A raw request count metric does not express an objective, a single uptime check is a narrow probe, and instance groups are a compute construct.

Correct answer: A — Artifact Registry

Artifact Registry is the managed repository for container images and language packages, with integrated scanning and IAM. Cloud Storage and Filestore store objects and files without registry semantics, and Source Repositories hosts source code.

Correct answer: A — Manual, repetitive, automatable work that scales linearly with service growth and adds no enduring value

Toil is specifically operational work that is manual, repetitive, automatable, and grows with scale without leaving lasting improvement behind. Difficulty alone is not toil, and design work and postmortems produce durable value.

Correct answer: A — Build once, tag the image with the commit SHA, and promote the same digest through environments

Building once and promoting the identical digest guarantees that what was tested is what runs. Per-environment rebuilds can differ subtly, the latest tag is mutable and untraceable, and per-environment branches mean the environments run different code.

Correct answer: A — Workload Identity Federation with an external identity provider

Workload Identity Federation exchanges the external system's own token for short-lived Google Cloud credentials, so no key ever exists. Stored keys, shared passwords, and broad API keys are all long-lived secrets that can be exfiltrated.

Correct answer: A — A burn rate alert on the SLO with multiple windows and thresholds

Burn rate alerting compares the current error rate to the budget consumption pace and uses short and long windows to balance precision and detection time. Per-error alerts create noise, CPU thresholds do not reflect user impact, and a daily email is far too slow for an active incident.

Correct answer: A — Cloud Profiler

Cloud Profiler continuously samples CPU and heap usage in production and attributes it to functions. Trace measures request latency across services, Error Reporting groups exceptions, and Audit Logs record administrative activity.

Correct answer: A — Traffic splitting between revisions, shifting all traffic back to the previous revision

Cloud Run keeps previous revisions, so shifting traffic back is near instantaneous and requires no rebuild. Rebuilding takes minutes, deleting and recreating causes an outage, and scaling to zero stops serving entirely.

Correct answer: A — Cloud Deploy

Cloud Deploy models a delivery pipeline with ordered targets, promotion, approvals, and rollback. Scheduler runs cron jobs, Tasks manages asynchronous work queues, and Artifact Registry stores build artefacts.

Correct answer: A — Cloud Trace

Cloud Trace collects distributed traces with spans per service hop, which is exactly a per-hop latency breakdown. Logging holds discrete events, uptime checks probe availability from outside, and Profiler samples CPU and memory usage inside a process.

Correct answer: A — A terraform plan stage whose output is posted for review before the apply stage runs

A plan stage produces the exact set of creates, updates, and destroys for reviewers to approve before anything changes. Auto-approve removes the review, console edits create drift, and disabling state locking risks corrupting the state file.

Correct answer: A — The proportion of successful requests served under a defined latency threshold

A good SLI measures what users experience, which for a request service is the fraction of requests that succeed quickly enough. CPU, instance counts, and image size are internal implementation details that users never feel directly.

Correct answer: A — The organization policy constraint that disables service account key creation

A boolean organization policy constraint prevents key creation across the hierarchy regardless of IAM grants, which is what mandatory means here. Removing Editor does not cover every role that can create keys, an alert is detective, and labels carry no enforcement.

Correct answer: A — Vertex AI Pipelines

Vertex AI Pipelines orchestrates ML workflow steps with artefact lineage and metadata tracking, which is what reproducible retraining requires. Scheduler only triggers, an HTTP function has no pipeline semantics, and scheduled queries move data without model lifecycle support.

Correct answer: A — A log-based metric

Log-based metrics count or extract values from matching log entries and expose them as metrics for charts and alerts. A BigQuery sink exports for analysis, retention policies control storage duration, and exclusion filters discard entries.

Correct answer: A — Cloud Billing reports and budgets, with billing data exported to BigQuery for deeper analysis

Billing reports break spend down by project, service, and label, budgets forecast and alert, and BigQuery export supports custom analysis. Monitoring, Logging, and Trace describe system behaviour rather than cost.

Correct answer: A — Cloud Asset Inventory

Cloud Asset Inventory keeps a searchable record of resources and IAM policies across the organisation, including historical state. Logging stores log entries, Trace records request latency, and Scheduler runs cron jobs.

Correct answer: A — A project lien

A lien blocks project deletion until it is explicitly removed, which is the intended guard against accidental teardown. Firewall rules govern traffic, labels are metadata with no enforcement, and uptime checks monitor availability.

Correct answer: A — GitOps with a controller such as Config Sync continuously reconciling the cluster to the repository

GitOps makes the repository the source of truth and a controller continuously reconciles the live cluster to it, so manual drift is corrected automatically. Laptop-driven applies, nightly rebuilds, and console edits all leave the cluster and the repository able to diverge.

Correct answer: A — Attach a service account to the instance and grant it the required IAM role

An attached service account lets the metadata server issue short-lived tokens, so no key file exists to leak or rotate. Downloaded JSON keys are exactly the long-lived credential being avoided, shared passwords destroy attribution, and public buckets expose data to everyone.

Correct answer: A, B — It focuses on systemic causes rather than individual fault · It produces concrete, owned action items with due dates

Blameless postmortems examine the conditions that allowed the failure and end with tracked remediation. Assigning blame suppresses honest reporting, keeping them private prevents shared learning, and restricting them to revenue-impacting incidents loses most of the learning opportunities.

Correct answer: A — Pause feature releases and prioritise reliability work until the budget recovers

An exhausted error budget is the agreed signal to shift effort from features to reliability. Redefining the target to hide the problem, stopping measurement, and shipping faster without addressing the cause all defeat the purpose of the budget.

Correct answer: A, B — Binary Authorization with attestations required before deployment · Vulnerability scanning in Artifact Registry with the pipeline gated on findings

Binary Authorization enforces that only attested images run, and registry scanning with a pipeline gate keeps vulnerable images from ever being attested. Pulling from arbitrary public registries, relying on mutable latest tags, and disabling signature checks all weaken supply chain assurance.

Correct answer: A — Examine tail latency percentiles and sample traces from the slow requests

A regression affecting a small fraction of traffic hides in the mean but shows clearly in high percentiles, and traces from those specific slow requests identify the responsible hop. Mean latency, request counts, and pod counts do not isolate a tail problem.

Correct answer: A, B — Exponential backoff with jitter between retries · A cap on total retry attempts and a circuit breaker

Backoff with jitter spreads retry traffic out and a retry cap with a circuit breaker stops clients hammering a failing dependency. Tight retry loops and very long timeouts increase load and hold resources, and removing error handling makes failures worse.

Correct answer: A — An organization policy constraint on resource locations applied at the organization node

Organization policy constraints restrict what may be configured and inherit down the resource hierarchy, so a resource location constraint blocks creation elsewhere. IAM controls who may act rather than which regions are allowed, firewall rules govern network traffic, and alerts only notify after the fact.

Correct answer: A — Spot VMs

Interruption-tolerant batch work is the canonical Spot VM case and gives the deepest discount. Leaving on-demand instances running pays for 22 idle hours, long commitments suit steady baseline usage rather than short nightly jobs, and sole-tenant nodes are for isolation and licensing.

Correct answer: A — Private pools

Private pools give Cloud Build workers network access into a peered VPC so builds can reach private endpoints. Triggers start builds, substitutions parameterise them, and timeouts bound how long they may run.

Correct answer: A — Error Reporting

Error Reporting aggregates stack traces into distinct error groups, counts occurrences, and can notify when a new group appears. Trace covers latency, Asset Inventory tracks resources, and Cloud Deploy manages releases.

Correct answer: A — Shared VPC with a host project and attached service projects

Shared VPC keeps subnets and firewall rules in a host project under the networking team's control while service projects deploy workloads into them. Full mesh peering scales badly, per-project VPN tunnels are unnecessary overhead, and separate default networks give no shared connectivity or central control.

Correct answer: A, B — Fields can be queried and filtered directly without regular expressions · Severity and trace correlation fields are parsed automatically

JSON payloads let you filter on named fields and let the platform pick up severity and trace identifiers for correlation. Structured logs are not inherently smaller, they do not replace metrics for aggregate signals, and encryption at rest applies to both.

Correct answer: A, B — Partition and cluster the tables so queries scan only the relevant data · Materialise the dashboard aggregates into summary tables refreshed on a schedule

Partitioning and clustering cut the bytes each query scans, and precomputed summary tables mean dashboards read a tiny aggregate rather than the raw data. Selecting all columns scans more, refreshing more often multiplies cost, and disabling caching forces repeated scans.

Correct answer: A — Terraform configurations stored in a repository and applied through an automated pipeline

Infrastructure as code applied through a pipeline gives review, history, and reproducibility, which is the whole point of bootstrapping an organisation. Console clicks, ad hoc commands, and personal scripts all produce environments no one can recreate or audit.