Hard — PCDE Practice Quiz

Question 1

Your data analytics team runs BigQuery workloads that have grown unpredictably. Finance reports that on-demand query costs have tripled over three months, with large spikes during monthly reporting cycles but low steady usage otherwise. A few ad-hoc analyst queries occasionally scan enormous tables and cause bill surprises. You must implement a FinOps approach that controls cost while keeping predictable baseline performance for scheduled reporting jobs. What should you do?

Accepted Answer

Purchase a baseline slot commitment (editions with autoscaling) to cover steady reporting load, assign the reporting jobs to a dedicated reservation, and leave ad-hoc analyst queries on on-demand with per-project/per-user maximum bytes-billed limits.

Answer

Move all workloads to on-demand pricing and set an organization-wide monthly billing budget alert to cap spending.

Answer

Purchase a single large flat-rate slot commitment sized to the monthly reporting peak and route every query—scheduled and ad-hoc—through that one reservation.

Answer

Export all datasets to Cloud Storage and query them with external tables to avoid BigQuery compute charges entirely.

Question 2

Your platform team runs an automated project factory using Terraform. A new business unit requests projects, and finance requires that every newly provisioned project is automatically linked to a specific billing account and cannot be moved to a different billing account by project-level users. Which approach best enforces this requirement while keeping the factory fully automated?

Accepted Answer

Have the factory's service account hold roles/billing.user on the billing account, set the billing_account in the google_project resource, and grant project users only roles/viewer so they cannot change billing linkage.

Answer

Grant each project owner the roles/billing.admin role so they can attach the correct billing account during onboarding.

Answer

Manually link billing in the Cloud Console after each Terraform apply and rely on documentation to prevent changes.

Answer

Assign the factory service account roles/billing.creator and let project teams self-manage billing linkage through org policies.

Question 3

Your FinOps team wants to catch cost overruns before they occur rather than after the fact. Each of your 40 project owners currently receives a monthly invoice but no proactive signal. Leadership requires that when a project's spending is trending toward exceeding its monthly budget, an automated workflow disables non-essential resources without any human reading an email. Which Cloud Billing budget configuration best meets this requirement?

Accepted Answer

Create a budget per project with alert thresholds based on forecasted spend, and connect the budget to a Pub/Sub topic that triggers a Cloud Function to disable non-essential resources.

Answer

Create a single organization-wide budget with email notifications to all project owners at 90% and 100% of actual spend.

Answer

Export billing data to BigQuery and schedule a daily query that emails project owners when actual spend exceeds the budget.

Answer

Configure a budget per project with alert thresholds on actual spend only, sending notifications to a Cloud Monitoring notification channel.

Question 4

Your platform team is designing a CI/CD architecture for a company with separate Google Cloud projects for dev, staging, and production. The security team mandates that a container image which is deployed to production must be the exact same artifact that was tested in staging, and that no image should be rebuilt between environments. You are using Cloud Build and Artifact Registry. Which approach best satisfies these requirements?

Accepted Answer

Build the image once, tag it with the immutable digest, and promote the same image by digest through dev, staging, and production Artifact Registry repositories using a controlled pipeline with Binary Authorization attestations.

Answer

Configure a separate Cloud Build trigger in each environment's project that rebuilds the image from the same Git commit before deploying to that environment.

Answer

Store a single mutable 'latest' tag in one shared Artifact Registry repository and have every environment pull the 'latest' tag at deploy time.

Answer

Build the image in dev, then export the container filesystem as a tarball and re-import it into staging and production registries to guarantee consistency.

Question 5

Your team uses Cloud Deploy to release a payments microservice to GKE. The delivery pipeline defines a canary strategy with three phases (10%, 50%, 100%). Compliance requires that a smoke test runs against every phase's canary before that phase's traffic percentage is applied, and the release must automatically halt if any smoke test fails. Which Cloud Deploy configuration meets these requirements?

Accepted Answer

Add a `verify` phase to the canary strategy and enable verification on each phase; Cloud Deploy runs the Skaffold-defined verify job after deploying each canary percentage and fails the rollout if it returns non-zero.

Answer

Add a `predeploy` action hook that runs the smoke tests before deploying, and configure a retry policy so failed tests reroll automatically.

Answer

Configure a Cloud Build trigger that runs smoke tests on a schedule and stops the Cloud Deploy release through the API if tests fail.

Answer

Use a `postdeploy` hook only on the final 100% phase to run all smoke tests at once, ensuring the fully deployed service is validated before promotion.

Question 6

Your team uses Cloud Deploy to roll out a Cloud Run service using a canary strategy with 25% and 50% phases. Product management requires that promotion beyond the first canary phase must only occur if application-level error rates (measured via Cloud Monitoring) stay below a threshold for 15 minutes. The built-in verify step only runs a synthetic smoke test and does not evaluate this metric. What is the most appropriate way to enforce this metric-based gate within the Cloud Deploy pipeline?

Accepted Answer

Configure a deploy hook (postdeploy) that queries the Cloud Monitoring API for the error rate over 15 minutes and fails the phase if the threshold is exceeded, preventing automatic promotion.

Answer

Add an Automation rule with an 'advance' rollout automation that only promotes after a fixed 15-minute wait, assuming the metric will pass.

Answer

Enable Binary Authorization on the target so images with high error rates are blocked from promotion.

Answer

Switch the strategy to blue-green so the metric can be evaluated on the entire pool before cutting over traffic.

Question 7

Your platform team uses Google Cloud Deploy to manage progressive delivery for containerized workloads. A new business unit needs to deploy artifacts to an on-premises Kubernetes cluster that is not registered as a GKE or Anthos target and requires invoking a proprietary internal CLI to apply manifests. The team wants to keep using the same Cloud Deploy pipeline model (delivery pipeline, targets, promotion, and rollback) rather than building a separate custom tool. What should you do?

Accepted Answer

Define a custom target type in Cloud Deploy using a skaffold custom action that runs a container implementing the render and deploy operations against the on-premises cluster.

Answer

Register the on-premises cluster as a standard GKE target and let Cloud Deploy apply manifests directly with its built-in Kubernetes deployer.

Answer

Abandon Cloud Deploy for this workload and orchestrate the entire promotion and rollback flow with a set of Cloud Build triggers that call the proprietary CLI.

Answer

Use a Cloud Run target in Cloud Deploy and configure a deploy hook to shell out to the proprietary CLI after the Cloud Run service is created.

Question 8

Your team uses Cloud Deploy to release a microservice to GKE across dev, staging, and prod targets. A recent production incident was caused by a bad Kubernetes manifest that referenced a nonexistent ConfigMap; the error was only discovered after the rollout began. The manifests are generated by Skaffold using Kustomize overlays that differ per target. You want to catch rendering and manifest correctness issues for the exact production configuration BEFORE any pipeline promotion reaches the production target, without deploying to prod. What should you do?

Accepted Answer

Enable Cloud Deploy render inspection by reviewing the fully rendered manifests stored for the production target in the release, and add a Cloud Deploy verification (verify) phase in the skaffold profile that runs after deploy to each earlier target.

Answer

Add a canary deployment strategy to the production target so a small percentage of traffic validates the manifest before full rollout.

Answer

Configure Binary Authorization on the production cluster to block images that lack an attestation, preventing bad manifests from being applied.

Answer

Increase the production target's rollout timeout so failed manifests have more time to reconcile before Cloud Deploy marks the release failed.

Question 9

Your team runs a fleet of 40 Compute Engine instances behind a managed instance group serving a REST API. You create a Cloud Monitoring alerting policy on the metric compute.googleapis.com/instance/cpu/utilization to page on-call when CPU is sustained above 85%. During a real incident where several individual instances spiked to 95% while the group average stayed near 60%, the alert never fired. You inspected the policy and found it aligns the series and then applies a cross-series reducer of 'mean' before evaluating the threshold. What change will make the alert correctly detect per-instance saturation?

Accepted Answer

Remove the cross-series reducer (or set it to 'none') and group the time series by instance so the threshold is evaluated per instance rather than against a single aggregated series.

Answer

Increase the alignment period from 60s to 300s so the aligner smooths out brief per-instance spikes before evaluation.

Answer

Change the cross-series reducer from 'mean' to 'sum' so the combined utilization of all instances exceeds the 85% threshold.

Answer

Lower the threshold from 85% to 55% so the group average of 60% during the incident would trigger the alert.

Question 10

Your team runs a payments API with a 99.9% availability SLO measured over a rolling 30-day window. The on-call engineers complain that their current alert—which pages whenever the instantaneous error rate exceeds 0.1%—generates frequent noisy pages for brief, self-recovering blips, yet occasionally fails to warn them about slow, sustained degradations that quietly consume the monthly error budget. You are asked to redesign the alerting to page only when the budget is genuinely at risk. Which approach best meets this goal?

Accepted Answer

Configure multi-window, multi-burn-rate alerts that page on a fast-burn condition (e.g., 14.4x burn over 1 hour combined with a 5-minute short window) and a separate slow-burn condition (e.g., 6x burn over 6 hours).

Answer

Lower the SLO to 99.5% so the error budget is larger and the existing threshold alert fires less often.

Answer

Keep the instantaneous 0.1% error-rate threshold but require the condition to persist for 30 seconds before paging.

Answer

Alert only at the end of the 30-day window when the total error budget has been fully exhausted.

Question 11

A payments service reports 99.95% availability against its SLO, and the error budget shows healthy headroom for the quarter. However, the support team is fielding a steady stream of user complaints about failed checkout attempts, and executives are frustrated that the SLI dashboards look green while customers are clearly unhappy. As the SRE reviewing this discrepancy, what is the most appropriate first action?

Accepted Answer

Investigate whether the current SLI is measuring the right 'good events' from the user's perspective, since the metric may exclude the failure mode users are experiencing.

Answer

Tighten the SLO target to 99.99% so the dashboards will more accurately reflect customer dissatisfaction.

Answer

Declare a feature freeze immediately because the volume of complaints indicates the error budget must be exhausted.

Answer

Increase the alerting sensitivity on the existing SLI so on-call engineers are paged more often during the quarter.

Question 12

A retail company runs a stateless web frontend on a GKE Standard cluster. Traffic is highly variable, with sharp spikes during flash sales. The team observes that during off-peak hours the cluster keeps many partially-utilized nodes running, but during spikes the Horizontal Pod Autoscaler adds pods faster than the cluster can schedule them because CPU-based scaling reacts too slowly. Leadership wants to reduce steady-state cost while ensuring the frontend can absorb sudden spikes without request failures. What should the DevOps engineer implement?

Accepted Answer

Configure the HPA to scale on a custom requests-per-second metric with a lower target, enable the cluster autoscaler with the optimize-utilization profile, and provision a small buffer using balloon (low-priority pause) pods.

Answer

Increase the HPA target CPU utilization to 90% and disable the cluster autoscaler so nodes stay at a fixed count sized for peak traffic.

Answer

Replace the HPA with a scheduled CronJob that scales the Deployment up before known sale windows and down afterward.

Answer

Move the frontend to a single large node pool of committed-use N2 instances sized for peak load to guarantee capacity at a discount.

Question 13

A retail company runs a chatty microservices application on a regional GKE cluster spread across three zones. The finance team flags a steadily rising 'inter-zone data transfer' line item in the billing export, even though overall traffic volume is flat. The services communicate heavily via Kubernetes Services, and pods are scheduled arbitrarily across zones. You must reduce the inter-zone egress cost without sacrificing the resilience of a multi-zone deployment. What should you do?

Accepted Answer

Enable Topology Aware Routing (topology-aware hints) on the Kubernetes Services so traffic is preferentially routed to endpoints in the same zone as the client.

Answer

Migrate the cluster to a single-zone configuration so that all pod-to-pod traffic stays within one zone.

Answer

Add a node taint and pod anti-affinity rules to spread pods more evenly across all three zones.

Answer

Enable Cloud CDN in front of the internal services to cache responses and reduce backend calls.

Question 14

Your organization runs an on-premises data center and a Google Cloud environment. The platform team must bootstrap a CI/CD architecture where Cloud Build pipelines deploy artifacts to both GKE clusters on Google Cloud and Kubernetes clusters running in the on-premises data center. The on-premises clusters are not reachable over the public internet, and security policy forbids exposing them with public endpoints. Which approach lets the same Cloud Build pipeline reliably deploy to both environments?

Accepted Answer

Use Cloud Build private pools connected to your VPC, and reach the on-premises clusters over an existing Cloud VPN or Cloud Interconnect through that VPC.

Answer

Grant the Cloud Build default service account the Owner role and let the default worker pool call the on-premises cluster API over the public internet.

Answer

Deploy to GKE from Cloud Build, then manually copy the manifests to a USB drive and apply them on-premises to satisfy the no-public-endpoint policy.

Answer

Expose the on-premises Kubernetes API server through a public load balancer protected only by an IP allowlist of Google's published egress ranges.

Question 15

Your company acquired a smaller firm that runs workloads in a separate Google Cloud organization. Leadership wants to consolidate the acquired workloads under your existing organization's resource hierarchy while minimizing downtime. Several projects in the acquired org contain running Compute Engine and Cloud SQL resources with dependent IAM bindings. What is the recommended approach to bring these projects into your organization?

Accepted Answer

Use the project migration process to move each project from the source organization to a target folder in your organization, after ensuring org policies and IAM prerequisites are satisfied in both organizations.

Answer

Recreate each project from scratch in your organization, redeploy the resources with Terraform, and delete the old projects once traffic is cut over.

Answer

Merge the two organizations by contacting Google Cloud support to combine the two Cloud Identity accounts into a single organization node.

Answer

Move the projects to the 'No organization' state first, then attach them individually to your organization's root node using gcloud projects create.

Question 16

Your platform team runs a CI/CD pipeline in a dedicated 'ci-tools' project. The pipeline must deploy resources into multiple environment projects (dev, staging, prod), each in different folders. Security policy forbids downloading or storing service account JSON key files anywhere, and each environment must have distinct permissions that can be audited. How should you configure the service accounts so the CI/CD workload can deploy across the environment projects?

Accepted Answer

Grant the CI/CD workload's identity the Service Account Token Creator role on a per-environment deployer service account in each project, and use short-lived impersonation tokens to deploy.

Answer

Create one service account per environment project and generate long-lived JSON keys, storing them as encrypted secrets in the CI/CD system for each deployment target.

Answer

Add the single ci-tools service account as an Owner at the organization level so it inherits deploy permissions on all environment projects.

Answer

Create a shared service account in the ci-tools project and grant it Editor across all three environment projects using a group binding at the folder level.

Question 17

An SRE team runs a payments API with a well-defined availability SLO. Recently, on-call engineers are paged frequently for brief blips that recover within a minute and never threaten the error budget, causing alert fatigue. Meanwhile, a slow, sustained burn last quarter went unnoticed until users complained. The team wants to redesign paging so that engineers are only woken up when a problem meaningfully threatens the SLO, while still tracking slower degradations. What should they implement?

Accepted Answer

Configure multi-window, multi-burn-rate error budget alerts: a fast-burn condition (e.g., 2% budget in 1 hour) that pages, and a slow-burn condition (e.g., 10% budget in several hours) that files a ticket.

Answer

Lower the SLO target so fewer events count as violations, reducing the number of pages the on-call receives.

Answer

Add a single threshold alert on raw request error count that pages whenever more than 5 errors occur in any 60-second window.

Answer

Increase the alert duration window on the existing per-minute error-rate alert to 30 minutes so short blips are ignored entirely.

Question 18

Your SRE team is preparing a new payments API for general availability. The product team has committed to an availability SLO of 99.9% measured over a rolling 28-day window. During load testing, the service handles 2,000 requests per second at target latency, but at 2,600 requests per second, the p99 latency doubles and error rates climb above the SLO threshold. Marketing projects a launch-day peak of 2,400 requests per second, with sustained growth afterward. As part of the service lifecycle and launch-readiness review, what should the team do BEFORE approving GA?

Accepted Answer

Provision and validate enough capacity headroom (with autoscaling and load-shedding safeguards) to serve well beyond the projected 2,400 RPS peak while meeting the SLO, then approve GA.

Answer

Lower the SLO to 99.5% so the projected launch traffic stays within the error budget, then approve GA immediately.

Answer

Approve GA as-is since the projected peak of 2,400 RPS is below the 2,600 RPS point where the SLO was breached in testing.

Answer

Delay defining any SLO until after launch so real production traffic can inform the availability target.

Question 19

Your team runs a checkout service with a 99.9% monthly availability SLO. The checkout service depends on a downstream payments API that another team operates and that has a published SLO of 99.5% availability. During your reliability review, an engineer proposes that your team can safely commit to a 99.95% SLO because your own code has been very stable this quarter. What is the most accurate reliability principle to apply here?

Accepted Answer

A service's achievable SLO is generally capped by the reliability of its critical dependencies, so a 99.95% target is unrealistic while the payments API only promises 99.5%.

Answer

Because your own code is stable, you can commit to 99.95% and rely on retries to fully compensate for any downstream failures.

Answer

You should set your SLO to match the payments API exactly at 99.5%, since dependencies and dependents must always share identical SLO targets.

Answer

SLOs are internal targets only, so the downstream dependency's SLO has no bearing on what your team can promise to users.

Question 20

Your team runs a checkout API. A single user-facing 'complete purchase' journey involves three internal calls: cart validation, payment authorization, and order confirmation. Leadership set a 99.9% SLO for the overall purchase journey, but your current SLIs measure availability of each of the three backend services independently, and each individually reports around 99.9%. Users still complain that purchases frequently fail. What is the most appropriate SRE action to align your measurement with the user experience?

Accepted Answer

Define a journey-level SLI that measures the success rate of the end-to-end purchase request as experienced by the user, rather than relying only on per-service availability.

Answer

Raise each backend service's individual SLO target to 99.99% so the combined availability mathematically reaches 99.9%.

Answer

Average the three per-service SLIs together and report that mean as the journey SLI.

Answer

Add more replicas to each backend service until user complaints stop, then keep the existing per-service SLIs.

Question 21

Your team runs a payment API and has defined an availability SLO measured from server-side HTTP response codes at the load balancer. During a recent incident, users reported widespread payment failures for nearly 20 minutes, yet your SLI dashboard showed availability well within the SLO the entire time. Investigation revealed the load balancer returned HTTP 200 responses containing application-level error payloads generated when a downstream fraud-check dependency timed out. What is the most appropriate change to make your SLI reflect the actual user experience?

Accepted Answer

Redefine the 'good event' criteria for the SLI to count only responses that are both HTTP 200 and contain a successful application-level status, measured as close to the user as possible.

Answer

Lower the SLO target to a smaller number of nines so that the error budget is consumed faster and alerts fire sooner during similar incidents.

Answer

Add more load balancer instances and enable connection draining so that timeouts to the fraud-check dependency no longer occur.

Answer

Switch the SLI measurement source from the load balancer to raw CPU and memory utilization metrics of the payment API pods.

Question 22

Your organization is adopting Infrastructure as Code and you must create the very first Terraform bootstrap configuration that will provision the foundational resource hierarchy (folders, shared VPC host project, and org-level policies) for a brand-new Google Cloud organization. No projects, service accounts, or remote state backends exist yet. Following Google's recommended bootstrapping approach, how should you initially execute this first Terraform run and set up ongoing automation?

Accepted Answer

Run the first apply locally using a highly privileged human identity with Organization Administrator, then have Terraform create a dedicated seed project, a bootstrap service account, and a GCS remote state bucket, and migrate state and future runs to CI/CD using that service account.

Answer

Create a seed project manually in the console and grant the Compute Engine default service account org-level Owner, then configure Terraform Cloud to run all applies as that default service account from the start.

Answer

Store the initial Terraform state on the local workstation permanently and continue running all org-level applies from an engineer's laptop to avoid the complexity of a remote backend.

Answer

Enable Config Controller first at the organization node and let it provision the seed project and hierarchy automatically, since Terraform cannot create org-level resources before any project exists.

Question 23

Your platform team runs all infrastructure changes through a Terraform pipeline in Cloud Build. Auditors require that no human can directly apply changes to production, that every production apply is preceded by a reviewed plan, and that the credentials used to apply have only the permissions needed for the target resources. Developers currently trigger builds by pushing to a shared branch, and the Cloud Build service account holds Owner on the production project. Which change best satisfies all three requirements?

Accepted Answer

Split the pipeline into a plan stage triggered on pull requests and an apply stage gated by a manual approval, and have the apply stage impersonate a dedicated service account granted only the specific roles required for the production resources.

Answer

Keep the single build trigger but add a Terraform 'prevent_destroy' lifecycle rule to all production resources and leave the Cloud Build service account as Owner.

Answer

Grant each developer the roles/owner on the production project so they can review and apply their own changes, and enable Cloud Build audit logging.

Answer

Store the Terraform state in a bucket with object versioning and require developers to run 'terraform apply' from their laptops after peer review in the pull request.

Question 24

Your platform team runs Terraform from a Cloud Build pipeline in a dedicated CI/CD project. The Terraform configuration needs a database password to provision a Cloud SQL instance, and this password must never appear in the Terraform state that is stored in a GCS remote backend, in build logs, or in the repository. Your security team also requires that the secret be centrally rotated. Which approach best meets all these requirements?

Accepted Answer

Store the password in Secret Manager, grant the Cloud Build service account the Secret Manager Secret Accessor role, and reference the secret at runtime using the availableSecrets field so it is injected as an environment variable during the build.

Answer

Define the password as a Terraform variable with a default value in a variables.tf file committed to the repository, and mark the variable as sensitive = true so it is redacted from logs.

Answer

Pass the password to Terraform via a TF_VAR environment variable defined directly in the cloudbuild.yaml file so it is available to every build step.

Answer

Store the password as a Terraform output value and rely on the GCS backend encryption at rest to protect it from unauthorized access.