Google PCA Practice Test 10 — 10 Questions

Question 1

A company has deployed a critical application on Google Kubernetes Engine (GKE) with a Regional cluster (us-central1). The application uses a Cloud SQL for PostgreSQL database with a cross-region replica for disaster recovery. The SRE team needs to ensure that the application can survive a regional outage with minimal data loss. Which TWO actions should the team take to improve the reliability of the solution?

Accepted Answer

Configure the application to automatically promote the Cloud SQL cross-region replica to a primary instance when the primary region is unavailable.. Option A is correct because promoting a Cloud SQL cross-region replica to a primary instance is the standard procedure for disaster recovery when the primary region fails. This operation is supported by Cloud SQL and can be automated using Cloud Functions or Cloud Run triggers, ensuring minimal manual intervention and reduced RTO. The cross-region replica maintains a near-synchronous copy of the data, so data loss is limited to the replication lag.

Answer

Configure Cloud SQL cross-region replication to be synchronous to ensure zero data loss during failover.

Answer

Deploy a secondary GKE cluster in the same region as the primary to provide a hot standby that can take over immediately.

Answer

Use a TCP/UDP load balancer to route traffic to both regions based on latency.

Question 2

A company uses Cloud KMS to encrypt sensitive data. They need to ensure that encryption key usage is audited and that keys are rotated automatically every 30 days. Which two actions should they take? (Choose two.)

Accepted Answer

Enable Data Access audit logs for the Cloud KMS API. Option A is correct because enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.

Answer

Create a Cloud Trigger to manually rotate the key every month

Answer

Enable Cloud Key Management Service's key usage monitoring

Answer

Use Cloud External Key Manager to rotate keys externally

Question 3

A company stores sensitive customer data in Cloud Storage buckets. They want to ensure that access to these buckets is only allowed from within their VPC network. Which configuration should they use?

Accepted Answer

VPC Service Controls with a service perimeter. VPC Service Controls can restrict access to Cloud Storage to authorized VPC networks, preventing data exfiltration and public internet access. IAM alone does not enforce network restrictions; Private Google Access is for on-prem; Cloud Armor is for HTTP LB.

Answer

Bucket IAM policies with condition on service account

Answer

Cloud Armor WAF rules

Answer

Private Google Access for on-premises

Question 4

A company is designing a data processing pipeline in Google Cloud that must be HIPAA compliant. Which three security features should they implement? (Choose three.)

Accepted Answer

Encrypt data in transit using TLS. HIPAA requires encryption of data in transit and at rest. Using Cloud HSM for CMEK provides strong encryption at rest. VPC Service Controls help restrict data access. DLP is useful for identifying PHI but not mandatory; CDN is not a security feature.

Answer

Enable Data Loss Prevention (DLP) for data classification

Answer

Use Cloud CDN for faster delivery

Question 5

A multinational corporation must comply with GDPR and requires that all customer data stored in BigQuery be encrypted using customer-managed encryption keys (CMEK) and that the keys are stored in a specific region. Which combination of steps should they take?

Accepted Answer

Create a Cloud KMS key ring and crypto key in the desired region, then associate the BigQuery dataset with the CMEK key using DDL. BigQuery CMEK requires creating a Cloud KMS key in the desired region and associating it with the dataset using DDL. Default encryption uses Google-managed keys; Cloud DLP is for de-identification; EKM is for on-prem key integration.

Answer

Enable default encryption at rest in BigQuery and use Organization Policies to restrict key location

Answer

Create a Cloud HSM key, then use Cloud DLP to automatically encrypt the data before loading into BigQuery

Answer

Use Cloud External Key Manager (EKM) to integrate with an on-premises key management system

Question 6

What is the effective access of the service account sa@project.iam.gserviceaccount.com to the bucket?

Accepted Answer

Full admin access to objects. The service account is a member of roles/storage.objectAdmin, which grants full control (read, write, delete) over objects. It is not in the viewer or owner roles.

Answer

Owner access

Answer

Read-only access

Answer

No access

Question 7

A startup wants to grant a new employee read-only access to view all Compute Engine instances in a project. What is the minimum IAM role they should assign?

Accepted Answer

roles/compute.viewer. roles/compute.viewer provides read-only access to Compute Engine resources. compute.admin is full access; iam.securityReviewer gives read access to a wider set of resources; owner has full control.

Answer

roles/owner

Answer

roles/iam.securityReviewer

Answer

roles/compute.admin

Question 8

Which traffic will this rule allow?

Accepted Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to instances with tag 'web-server'. The rule allows inbound TCP on ports 80 and 443 from the specified IP ranges to instances tagged 'web-server'. It does not apply to all instances and is not outbound.

Answer

Outbound TCP traffic on ports 80 and 443 from instances with tag 'web-server' to IP ranges

Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to all instances

Answer

Inbound TCP traffic on ports 80 and 443 from any IP address to instances with tag 'web-server'

Question 9

A company runs a Kubernetes cluster on GKE. They need to ensure that pods cannot access Google Cloud APIs unless explicitly allowed through a service account. Which GKE feature should they use?

Accepted Answer

Workload Identity. Workload Identity allows each pod to have its own IAM service account, preventing use of the node's default service account. Pod Security Policies control container security contexts; Network Policies control pod traffic; Audit Logs are for tracking.

Answer

Network Policies

Answer

Pod Security Policies

Answer

Cloud Audit Logs

Question 10

When will the key be automatically rotated?

Accepted Answer

Every 90 days. The rotationPeriod is 7776000 seconds, which equals 90 days. The nextRotationTime is set to 2024-04-01, 90 days after creation, confirming automatic rotation every 90 days.

Answer

Every 180 days

Answer

Only when manually triggered

Answer

Every 30 days