Google PCA Practice Test 10 — 10 Questions

Question 1

Which Google Cloud service provides a fully managed, serverless data warehouse for petabyte-scale analytics using SQL?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, serverless data warehouse designed for petabyte-scale analytics using standard SQL. It automatically handles infrastructure scaling, partitioning, and query optimization, allowing users to run fast SQL queries on massive datasets without managing servers or clusters.

Answer

Firestore

Answer

Cloud Spanner

Answer

Cloud SQL

Question 2

A company is designing a VPC Service Controls perimeter to protect data stored in Google Cloud. They need to allow access from their on-premises network via a Cloud VPN tunnel while blocking all internet-based access. What is the most secure and manageable approach?

Accepted Answer

Configure a VPC Service Controls perimeter and create an access level that includes the on-premises CIDR range.. VPC Service Controls (VPC SC) is the only Google Cloud-native mechanism that can create a security perimeter around managed services (like Cloud Storage, BigQuery) and restrict access based on an access level that includes the on-premises CIDR range. This ensures that only traffic originating from the on-premises network (via the Cloud VPN tunnel) is allowed, while all internet-based access is blocked, even if the request uses valid credentials. Firewall rules alone cannot restrict access to Google-managed APIs, and Private Google Access does not enforce a perimeter around services.

Answer

Configure firewall rules to only allow traffic from the on-premises CIDR to the VPC.

Answer

Use Cloud VPN and Private Google Access to allow on-premises access without public IPs.

Answer

Use Cloud IAP (Identity-Aware Proxy) to restrict access based on identity and context.

Question 3

During a load test, an application running on GKE experiences high latency and errors. You suspect the issue is due to insufficient cluster resources. Which gcloud command should you use to quickly check the current resource utilization of all nodes in the cluster?

Accepted Answer

gcloud compute instances list. None of the listed gcloud commands shows current resource utilization of GKE nodes. gcloud container clusters describe shows configuration, gcloud container clusters list lists clusters, gcloud container clusters get-credentials retrieves credentials, and gcloud compute instances list only lists instances and their status. The correct command for current CPU/memory utilization is kubectl top nodes.

Answer

gcloud container clusters describe

Answer

gcloud container clusters list

Answer

gcloud container clusters get-credentials

Question 4

A company wants to ensure that all access to their Cloud Storage bucket is logged for compliance purposes. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs (Option B) are required to log every API call that reads, writes, or deletes data in a Cloud Storage bucket, such as object GETs and PUTs. Admin Activity logs only record configuration changes, not data access, so they would not capture the read/write operations needed for compliance logging.

Answer

Admin Activity audit logs

Answer

System Event audit logs

Answer

Access Transparency logs

Question 5

Which Google Cloud service automatically computes the optimal size or tier for underutilized Compute Engine instances and generates recommendations to reduce cost?

Accepted Answer

Recommender (Active Assist). Recommender (part of Active Assist) analyzes Compute Engine utilization and automatically generates rightsizing recommendations to reduce cost by resizing underutilized VMs. It is the GCP service specifically built to surface optimal machine type and size suggestions.

Answer

Cloud Monitoring

Answer

Cloud Profiler

Answer

Cost Management

Question 6

Refer to the exhibit. A cloud administrator is attempting to grant the BigQuery Data Viewer role to an external user (user@example.com) but receives the error shown. What is the most likely cause?

Accepted Answer

The organization policy constraints/iam.allowedPolicyMemberDomains blocks external domains.. The error indicates that the organization's policy constraints/iam.allowedPolicyMemberDomains is blocking the addition of an external user. This constraint restricts IAM policy bindings to only allow members from specified domains, and since user@example.com is from an external domain, the binding is denied. The error message directly references this constraint, making it the most likely cause.

Answer

The BigQuery dataset requires domain-wide delegation.

Answer

The user does not have the resourcemanager.projects.setIamPolicy permission.

Answer

The external user must first be added to a Google Group.

Question 7

Your organization runs a critical application on Google Cloud that uses Cloud SQL for PostgreSQL. The database is in us-central1. The business requires a recovery point objective (RPO) of 5 minutes and a recovery time objective (RTO) of 1 hour in case of a regional failure. What should you do?

Accepted Answer

Configure a cross-region read replica and promote it in case of regional failure.. A cross-region read replica asynchronously replicates data to a different region. In a regional failure, promoting the replica provides a recovery point close to the failure time (RPO within minutes) and can be done quickly (RTO under 1 hour). This is the standard solution for regional DR with Cloud SQL.

Answer

Use Cloud SQL point-in-time recovery (PITR) to restore to a specific time in another region.

Answer

Enable high availability (HA) for the Cloud SQL instance, which provides a standby in another zone.

Answer

Export the database to Cloud Storage every 5 minutes and import it into a new instance in another region during a disaster.

Question 8

A company needs to store secrets such as API keys and database passwords securely and access them from Compute Engine instances. Which service provides secret storage with built-in IAM integration and automatic rotation?

Accepted Answer

Secret Manager. Google Cloud Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. It provides built-in IAM integration for access control and supports automatic rotation of secrets via Cloud Functions or other mechanisms, making it the correct choice for storing and accessing secrets from Compute Engine instances.

Answer

Cloud HSM

Answer

Cloud Storage

Answer

Cloud KMS

Question 9

A company wants to allow a Kubernetes pod in GKE to authenticate to Google Cloud APIs without storing service account keys in the cluster. Which three components need to be configured to enable Workload Identity? (Choose three.)

Accepted Answer

Google Cloud service account. Workload Identity requires: (1) a Google Cloud IAM service account (GCP SA), (2) a Kubernetes service account (KSA) annotated with the GCP SA email, and (3) an IAM policy binding between the KSA and GCP SA to allow impersonation.

Answer

Firewall rule to allow traffic to metadata server

Answer

Cloud NAT for outbound access

Question 10

You want to create a log-based alert in Cloud Logging that triggers when a specific error message appears in application logs. What is the first step?

Accepted Answer

Create a logs-based metric that filters for the error message. To create a log-based alert, you first define a logs-based metric that counts occurrences of the error pattern. Then you create an alerting policy that monitors this metric and triggers when the count exceeds a threshold. Notifications are configured in the alerting policy, not the metric.

Answer

Configure a Pub/Sub notification channel for alerts

Answer

Create a log sink to export logs to Cloud Storage

Answer

Set up an alerting policy directly on the log entries without a metric