Free PCD sample questions

Correct answer: A multi-regional Cloud Spanner instance.

Cloud Spanner is the only horizontally scalable, strongly consistent, relational database service that is specifically designed for multi-regional deployments with strong consistency. This directly meets the core requirement for strongly consistent reads across geographic regions to prevent fraud. Cloud Bigtable offers eventual consistency for multi-cluster routing. AlloyDB and Cloud SQL are regional services and cannot provide strongly consistent reads across multiple regions.

Correct answer: Implement a Binary Authorization policy that requires an attestation from a trusted authority before allowing deployment.

Binary Authorization is the Google Cloud service designed for this exact purpose. It allows you to create policies that enforce deploy-time security controls, ensuring that only trusted container images are deployed on GKE. You would create an attestor (a trusted authority) and configure your Cloud Build pipeline to create an attestation for an image only after it passes the QA vulnerability scan. The Binary Authorization policy on the GKE cluster would then check for this specific attestation at deployment time.

Correct answer: The custom metric descriptor has not been created before writing time series data.

Before you can write time series data for a custom metric, you must first create a metric descriptor, which defines the metadata for the metric, including its type, kind, and labels. The Monitoring API will silently drop data points written for a metric that does not have a corresponding descriptor. Since there are no authentication errors, this is the most probable cause.

Correct answer: Eventarc

Eventarc is designed to build event-driven architectures by creating triggers that route events from various Google Cloud sources (like Cloud Storage) to sinks (like Pub/Sub, Cloud Run, etc.). It provides a standardized way to manage the flow of events without needing to write custom code for the trigger mechanism itself.

Correct answer: A Kubernetes NetworkPolicy.

A Kubernetes NetworkPolicy is the standard way to control traffic flow at the IP address or port level (OSI layer 3 or 4) between pods in a cluster. You can define an ingress rule for the backend pods that specifically allows traffic only from pods with the frontend's label, while denying all other in-cluster traffic by default.

Correct answer: Create a custom builder image containing the tool, push it to Artifact Registry, and reference it in your `cloudbuild.yaml`.

Creating a custom builder image is the recommended best practice. This approach encapsulates the dependency within a versioned Docker image, which can be stored securely in Artifact Registry. It ensures that builds are faster (no download/install step) and more reliable and reproducible, as they always use the exact same environment.

Correct answers: Use a specific, clear prompt such as 'write a pytest unit test for this function, covering edge cases'.; Review the generated tests to ensure they cover relevant business logic and failure modes.

Correct answer: 1. `gcloud run deploy --image=[NEW_IMAGE] --no-traffic` 2. `gcloud run services update-traffic --to-revisions=NEW_REVISION=100 --migrate-gradually`

This sequence correctly implements the desired strategy. The `--no-traffic` flag deploys the new revision but does not allocate any production traffic to it, allowing for safe, isolated testing. The second command, `update-traffic`, then safely migrates traffic to the new, verified revision. The `--migrate-gradually` flag can be used to perform a gradual rollout.

Correct answer: Attach a service account with the 'Secret Manager Secret Accessor' role to the Compute Engine instance and use Application Default Credentials.

This is the most secure and recommended method. By attaching a service account to the VM instance, the application can use the Google Cloud client libraries, which automatically find and use the credentials provided by the instance's metadata server via Application Default Credentials (ADC). This completely avoids the need to handle, distribute, and rotate static key files.

Correct answer: False

False. The Cloud SQL Auth Proxy works by creating a secure tunnel using SSL/TLS over port 443 to communicate with the Cloud SQL APIs. It does not connect directly to the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). Therefore, you do not need to open the database port in any firewall rules; you only need outbound internet access on port 443.