Google PCA Practice Test 2 — 10 Questions

Question 1

A company deploys a microservices application on Google Kubernetes Engine (GKE). Pods in one deployment are frequently OOMKilled. The team sets memory requests and limits, but pods still crash. What is the most likely remaining cause?

Accepted Answer

The application has a memory leak that eventually exceeds the limit.. Option D is correct because OOMKilled errors occur when a container exceeds its memory limit. Setting memory requests and limits prevents unbounded usage, but if the application has a memory leak, it will continue to consume memory until it hits the configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the pod. The fact that pods still crash after setting limits indicates the application itself is the root cause, not resource configuration.

Answer

CPU requests are too low, causing throttling and eventual crash.

Answer

The node pool is too small, causing memory pressure on the node.

Answer

Memory limits are set higher than the node's allocatable memory.

Question 2

A company deploys a critical application on Google Kubernetes Engine (GKE) and wants to ensure high availability during cluster upgrades. Which TWO practices should they follow?

Accepted Answer

Use multiple node pools across different zones within the cluster.. Option B is correct because deploying multiple node pools across different zones ensures that if one zone fails or is taken down for maintenance, the application can continue serving from the other zones. This aligns with GKE's best practice for high availability by distributing workloads across failure domains. Option C is correct because PodDisruptionBudgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions like cluster upgrades, preventing the upgrade from taking down too many replicas at once.

Answer

Use a single-zone node pool with multiple replicas.

Answer

Enable cluster autoscaling to add nodes during upgrades.

Answer

Enable regional clusters for multi-zone control plane.

Question 3

Which TWO of the following are valid methods to securely access Google Cloud APIs from a Compute Engine instance without managing service account keys?

Accepted Answer

Attach a custom service account to the instance using the gcloud command. The default service account and attaching a custom service account to the instance both provide access via metadata server, no key management. Using a service account key file (B) requires key management. Using Cloud KMS (D) is for encrypting keys, not accessing APIs. IAM roles (E) are permissions, not method of access.

Answer

Download a service account key file and store it on the instance

Answer

Grant the appropriate IAM roles to the instance's service account

Answer

Use a Cloud KMS key to generate temporary credentials

Question 4

A company is deploying a web application on Compute Engine. They want to automatically scale the number of instances based on CPU utilization. Which two components are required to set up autoscaling? (Choose two.)

Accepted Answer

Instance template. An instance template is required because it defines the machine configuration (machine type, boot disk image, network tags, etc.) for all VMs created by the autoscaler. Without a template, the managed instance group would have no blueprint to provision new instances when scaling out.

Answer

Cloud Functions

Answer

Cloud Load Balancing

Answer

Cloud Monitoring

Question 5

A cloud architect is implementing a CI/CD pipeline for a microservices-based application on Google Kubernetes Engine (GKE). The team needs to deploy new versions of the services with zero downtime and the ability to quickly roll back if issues are detected. Which two strategies should the architect consider? (Choose two.)

Accepted Answer

Blue/green deployment. Blue/green deployment (A) and canary deployment (C) are two strategies that provide zero downtime and quick rollback. Blue/green deploys new version to a separate environment and switches traffic; canary gradually shifts traffic and allows easy rollback. Rolling update (B) also provides zero downtime but rollback requires a new update, not immediate. Shadow deployment (D) mirrors traffic for analysis but doesn't serve users. A/B testing (E) is a method for comparing features but not a deployment strategy.

Answer

Shadow deployment

Answer

Rolling update

Answer

A/B testing deployment

Question 6

A global e-commerce platform is experiencing intermittent latency spikes during flash sales. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster. The architecture includes a frontend service, a product catalog service using Cloud Spanner, and an order processing service using Cloud Pub/Sub. During high load, the catalog service shows increased query latency, and some requests time out. What should the architect prioritize to address the issue?

Accepted Answer

Enable Cloud Spanner interleaved tables and add secondary indexes for common query filters.. The correct answer is C because the issue is specifically with Cloud Spanner query latency under high load. Enabling interleaved tables and adding secondary indexes optimizes data locality and query performance, reducing the need for expensive cross-table joins and full table scans. This directly addresses the root cause of increased latency and timeouts in the catalog service.

Answer

Use Cloud CDN to cache product catalog responses.

Answer

Increase the number of nodes in the GKE node pool.

Answer

Migrate the catalog service from Cloud Spanner to Cloud Bigtable for better read performance.

Question 7

A financial services company is designing a multi-region disaster recovery architecture for a critical application. The application runs on Compute Engine with a stateful backend using Cloud Spanner. The Recovery Time Objective (RTO) is 1 hour, and the Recovery Point Objective (RPO) is 15 minutes. What architecture meets these requirements cost-effectively?

Accepted Answer

Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.. Option A is correct because it uses Cloud Spanner's multi-region configuration, which provides synchronous replication across regions with automatic failover, meeting an RPO of 15 minutes (typically seconds) and an RTO of 1 hour. Active-active traffic load balancing with Compute Engine ensures that the application can immediately route traffic to the healthy region, minimizing downtime without the need for manual failover or backup/restore operations.

Answer

Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.

Answer

Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.

Answer

Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.

Question 8

A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?

Accepted Answer

Use Cloud SQL with private IP and SSL/TLS, and enable Cloud Key Management Service (KMS) to create a key ring and customer-managed encryption key (CMEK). Option D is correct because it meets all PCI DSS requirements: Cloud SQL with private IP ensures the database tier is not exposed to the public internet, restricting access to only the application tier within the same VPC. SSL/TLS encrypts data in transit, and using Cloud KMS with a customer-managed encryption key (CMEK) provides control over encryption keys for data at rest, which is often required for compliance.

Answer

Use Cloud Spanner with private IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud SQL with public IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud Datastore with secure WebSocket connections and enable customer-managed encryption keys

Question 9

A startup is developing a real-time analytics dashboard that ingests data from IoT devices. The data volume is unpredictable but can spike to millions of events per second. The dashboard must display near real-time aggregations with sub-second latency. Which Google Cloud architecture should the architect recommend?

Accepted Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataflow, store in Cloud Bigtable, and query from the dashboard.. Option D is correct because Cloud Pub/Sub provides scalable, asynchronous ingestion for unpredictable IoT data spikes, Cloud Dataflow enables stream processing for near real-time aggregations with sub-second latency, and Cloud Bigtable offers low-latency, high-throughput storage ideal for serving aggregated results directly to a dashboard. This combination meets the requirements of unpredictable volume, real-time processing, and low-latency queries.

Answer

Ingest via Cloud IoT Core directly to Cloud Bigtable, then query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in Cloud Storage, and query with BigQuery.

Answer

Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use Cloud SQL for aggregations.

Question 10

A company is migrating its on-premises application to Google Cloud. The application requires low-latency access to a shared filesystem that can be mounted by multiple Compute Engine instances across different zones. Which storage solution should they use?

Accepted Answer

Provision a Filestore instance and mount it on the instances.. Filestore provides a fully managed, NFS-based shared filesystem that can be mounted by multiple Compute Engine instances across different zones with low-latency access. It supports the required multi-writer, multi-mount scenario natively, making it the ideal choice for shared storage in a zonal-distributed architecture.

Answer

Create a Persistent Disk and attach it to all instances.

Answer

Attach Local SSD to each instance and replicate data between them.

Answer

Use Cloud Storage FUSE to mount a bucket on each instance.