Free PCDOE sample questions

Correct answer: The custom Fluentd DaemonSet created a conflict with the default GKE logging agent (also Fluentd), causing the default agent to fail or be evicted.

GKE uses a managed Fluentd DaemonSet as its default logging agent on each node. When a user deploys another log-forwarding DaemonSet, especially one that also tries to read from standard log locations like `/var/log`, it can create resource contention or configuration conflicts. The most common issue is that the custom agent 'steals' the log files or interferes with the default agent's ability to read them, effectively stopping the flow of logs to Cloud Logging for that entire node.

Correct answer: Config Connector.

Config Connector is specifically designed for this use case. It is a Kubernetes addon that allows you to manage GCP resources (like Pub/Sub topics, Cloud SQL instances, etc.) as Kubernetes Custom Resource Definitions (CRDs). This enables teams familiar with `kubectl` and YAML manifests to use the same tools and workflows to manage both their applications and their underlying cloud infrastructure, fitting their existing skillset perfectly.

Correct answers: Enable Cloud Profiler on all services to analyze CPU and memory usage.; Ensure all microservices are instrumented for Cloud Trace and analyze the trace waterfalls for the checkout requests.

While Cloud Trace is excellent for inter-service latency, Cloud Profiler is crucial for intra-service latency. If a trace shows a specific service is slow, Profiler is the next step to pinpoint the exact function or code path within that service causing high CPU usage or lock contention, which are common causes of latency.

Cloud Trace is the primary tool for understanding latency in a distributed microservices architecture. By analyzing the trace waterfall for a slow request, you can visually identify which service-to-service call is taking the longest time, immediately narrowing down the scope of the investigation.

Correct answer: Cloud Storage, because it provides strong consistency and can be configured to support state locking natively with Terraform.

Cloud Storage is the recommended and standard backend for Terraform on GCP. When configured as a backend, it stores the state file centrally. Crucially, the GCS backend for Terraform natively supports state locking by creating a lock object in the bucket while an operation is in progress. This prevents other users from running `terraform apply` concurrently, thus avoiding state file corruption and conflicts.

Correct answer: False

This statement is false. An error budget is derived from the Service Level Objective (SLO), which is an internal reliability target. It is not directly tied to the Service Level Agreement (SLA), which is an external, often legally binding, contract with customers. The SLO is typically stricter than the SLA to provide a buffer. The error budget is the amount of acceptable 'unreliability' (100% - SLO) that can be 'spent' on new releases, maintenance, or unavoidable failures without alerting engineers, whereas violating an SLA has financial or contractual consequences.

Correct answer: Configure a log sink to export all logs to BigQuery. Then, create a log exclusion filter to prevent the high-volume debug logs from being stored in Cloud Logging buckets.

This approach is the most cost-effective. A log sink forwards logs to a destination like BigQuery *before* they are processed for exclusion. This means all logs, including debug logs, are sent to BigQuery for cheap, long-term storage and powerful analytical querying. The exclusion filter then prevents the expensive debug logs from being ingested and stored in the standard Cloud Logging buckets, which are optimized for real-time access and have higher storage costs. This meets both requirements efficiently.

Correct answers: Artifact Registry Writer; Cloud Run Developer; Service Account User

This role grants the necessary permissions (`artifactregistry.repositories.uploadArtifacts`) to push the newly built container image to the specified Artifact Registry repository.

This role provides permissions to create and manage Cloud Run revisions, services, and configurations, which is exactly what is needed to deploy the new image.

To deploy a new revision to Cloud Run, the deploying identity (the Cloud Build service account) needs permission to act as the runtime service account of the Cloud Run service (`iam.serviceAccounts.actAs`). This role grants that permission.

Correct answer: Create a new instance template with the recommended machine type. Use a canary release strategy to gradually roll out the change to a small subset of VMs, while closely monitoring performance SLIs.

This SRE practice balances cost optimization with reliability. Instead of a 'big bang' change, a canary release allows you to test the recommendation on a small percentage of live traffic. By creating a new instance template and performing a rolling update to a subset of the managed instance group, you can compare the performance SLIs (latency, error rate, CPU utilization) of the new machine type against the existing baseline. If performance degrades, you can easily roll back with minimal user impact.

Correct answer: Define a Cloud Deploy delivery pipeline with a target for each GKE cluster (`dev`, `staging`, `prod`). Configure the `prod` target to use a canary deployment strategy with phases for 10% and 100%, requiring a manual approval before the final phase. Modify the Jenkins job to call the Cloud Deploy API to create a new release after a successful build.

This solution directly maps all requirements to the native features of Cloud Deploy. Cloud Deploy is designed for managing multi-environment promotions. It has built-in support for canary deployment strategies, including phases, bake times, and manual approvals. It integrates with Jenkins via API calls, fulfilling the integration requirement. All actions, including promotions and approvals, are automatically captured in Cloud Audit Logs, satisfying the auditability requirement. This approach minimizes custom scripting and operational overhead.

Correct answer: False

This statement is false. Cloud Build can connect to various source code repositories, including Cloud Source Repositories, GitHub (Cloud and Enterprise), and Bitbucket (Cloud and Data Center). You can configure triggers to automatically start builds based on commits or pull requests from these external repositories.