GCP-PCD Sample Questions & Answers
Building apps that perform well, stay secure, and feel cloud-native, plus how they store and reach data, dominates the weighting, next to setting up a dev environment, writing and checking code, pushing to Cloud Run or GKE, and hooking into Google Cloud services.
Launch the full GCP-PCD simulator →Free GCP-PCD Sample Questions with Answers
Real questions from the Google Cloud Professional Cloud Developer practice test — answers and explanations included. Showing 6 of 12 free samples.
- Question 1Intermediate
Designing Highly Scalable, Available, and Reliable Cloud-Native Applications · Designing secure applications
A financial services company needs to securely store API keys and database credentials. The security team mandates that these secrets must be rotated automatically every 30 days and accessed only by authorized applications via IAM. Which combination of services fulfills these requirements?
Show answer & explanation
Correct answer: B
Secret Manager is the dedicated service for storing sensitive data like API keys. It supports automatic rotation by triggering a Cloud Function (via Pub/Sub) that executes the logic to change the credential in the external system and update the Secret Manager version.
- Question 2Beginner
Designing Highly Scalable, Available, and Reliable Cloud-Native Applications · Designing high-performing applications and APIs
You are designing an API for a retail application hosted on Cloud Run. The API must support high-volume reads for product catalog data. To improve performance and reduce latency, you decide to implement a caching layer. The cache should be fully managed and support Redis data structures. Which service should you integrate?
Show answer & explanation
Correct answer: B
Memorystore for Redis is Google Cloud's fully managed in-memory data store service. It provides sub-millisecond latency and is compatible with the Redis protocol, making it the ideal choice for a caching layer in this scenario.
- Question 3Advanced
Designing Highly Scalable, Available, and Reliable Cloud-Native Applications · Designing secure applications
A development team is building a microservices application on GKE. Service A needs to call Service B. Both services are in the same cluster but different namespaces. The security team requires that Service B only accepts traffic from Service A and denies all other internal traffic. What Kubernetes native resource should you configure?
Show answer & explanation
Correct answer: C
Kubernetes NetworkPolicies enable you to control traffic flow at the IP address or port level (OSI layer 3 or 4). By creating a NetworkPolicy that selects Service B's pods and defines an Ingress rule allowing traffic only from Service A's pods (using podSelector or namespaceSelector), you can enforce the required traffic isolation within the cluster.
- Question 4Intermediate
Building and Testing Applications · Building
You are configuring a Cloud Build pipeline to deploy a container image to Cloud Run. You need to ensure that the image is only deployed if it has been signed by a trusted attestor after passing a vulnerability scan. Which Google Cloud service should you use to enforce this policy at deployment time?
Show answer & explanation
Correct answer: B
Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed. It integrates with Cloud Build and Artifact Registry to verify attestations (signatures) before allowing a deployment to GKE or Cloud Run.
- Question 5Beginner
Building and Testing Applications · Setting up your development environment
A developer needs to test a Cloud Function locally that interacts with Pub/Sub and Firestore. They want to avoid affecting production data or incurring costs during the initial development phase. What is the recommended approach?
Show answer & explanation
Correct answer: B
The Google Cloud CLI (gcloud) provides local emulators for services like Pub/Sub, Firestore, Bigtable, and Spanner. Using these emulators allows developers to test code locally without internet access, costs, or risk to production data.
- Question 6Intermediate
Deploying Applications · Deploying applications to Cloud Run
You are deploying a new version of an API to Cloud Run. You want to release the new version to only 10% of the traffic initially to monitor for errors before rolling it out to all users. How should you configure this?
Show answer & explanation
Correct answer: A
Cloud Run natively supports traffic splitting between revisions. You can deploy a new revision and explicitly set the traffic percentage (e.g., 10%) to go to that new revision while the remaining 90% goes to the current stable revision. This enables gradual rollouts (canary deployments).
Ready for the real thing?
The full GCP-PCD simulator has every exam-style question, timed mode, and instant scoring.