Google PCA Practice Test 11 — 15 Questions

Question 1

Which THREE are best practices for managing secrets (e.g., API keys, passwords) in Google Cloud? (Select exactly 3.)

Accepted Answer

Rotate secrets regularly and automatically where possible.. Regular, automated rotation of secrets limits the window of exposure if a secret is compromised. Secret Manager supports automatic rotation policies with a rotation period and next rotation time, and can trigger a Cloud Function or Cloud Run service to generate a new secret version, ensuring secrets are rotated without manual intervention.

Answer

Encrypt secrets and store them in source code repositories.

Answer

Pass secrets as environment variables to Compute Engine instances.

Question 2

Your company runs a critical application on Google Kubernetes Engine (GKE) with 5 nodes. The application experiences intermittent high latency every Friday afternoon. The team has ruled out infrastructure issues and suspects the application logic. You need to instrument the application to identify the root cause. Which approach should you take?

Accepted Answer

Use Cloud Monitoring to create custom metrics for application performance and investigate recent code changes.. The team has already ruled out infrastructure issues and suspects application logic. Creating custom metrics in Cloud Monitoring allows you to instrument the application with key performance indicators (e.g., request latency, error rates) and correlate them with recent code changes to pinpoint the root cause of intermittent high latency. This approach directly addresses the need to monitor application-level behavior rather than infrastructure metrics.

Answer

Increase the number of nodes in the GKE cluster to handle the load.

Answer

Enable Cloud Logging and analyze logs for error messages during the latency periods.

Answer

Configure GKE usage metering to track resource consumption by namespace.

Question 3

A company uses Cloud SQL for PostgreSQL. They want to minimize downtime during maintenance. Which feature should they enable?

Accepted Answer

High availability with a standby in another zone.. High availability (HA) with a standby in another zone ensures that Cloud SQL for PostgreSQL automatically fails over to a standby instance in a different zone if the primary zone experiences an outage. This minimizes downtime during maintenance because Cloud SQL performs a controlled failover to the standby, typically completing within a few seconds, rather than requiring a full instance restart or rebuild.

Answer

Read replicas.

Answer

Point-in-time recovery.

Answer

Automated backups.

Question 4

A multinational corporation needs to comply with data residency requirements for EU customer data. They want to ensure that data stored in Cloud Storage, BigQuery, and Cloud SQL for EU customers never leaves the European Union, even by administrators. They also want to detect and remediate any configuration drift that could violate this policy. What should they implement?

Accepted Answer

Create an organization policy constraint 'constraints/gcp.resourceLocations' with allowed values set to EU regions, and apply it at the organization level. Use Security Command Center to monitor for violations.. The organization policy constraint 'constraints/gcp.resourceLocations' is the native Google Cloud control that restricts resource creation to specified locations. Applied at the organization level, it ensures all projects inherit the EU-only restriction, preventing administrators from creating resources outside the EU. Security Command Center provides continuous monitoring and can detect any drift or violations, enabling remediation.

Answer

Deploy all workloads in EU regions and use a custom Terraform module that validates region parameters before deployment.

Answer

Configure VPC Service Controls perimeters around EU projects and use Access Context Manager to restrict access to EU-based identities.

Answer

Use Cloud KMS with EU-based key rings to encrypt all EU customer data, and rely on key location to enforce data residency.

Question 5

A company runs a large-scale data processing pipeline using Dataflow with streaming data from Pub/Sub. They notice increasing costs due to high data shuffle operations. They want to optimize the pipeline performance and cost. Which approach should they take?

Accepted Answer

Optimize the pipeline by partitioning data and using Combine transforms.. Optimizing the pipeline by partitioning data and using Combine transforms reduces the amount of data shuffled across workers. Partitioning groups related data together, and Combine performs associative reductions per key, minimizing the data that needs to be moved. This directly addresses high shuffle costs and improves performance.

Answer

Use a larger machine type for workers.

Answer

Increase the number of workers to reduce shuffle.

Answer

Switch to batch mode overnight.

Question 6

A financial services firm runs a three-tier application on Google Cloud. The security team requires that all outbound traffic from the application tier to the internet be inspected by a centralised next-generation firewall appliance, and that the application tier have no public IP addresses. The network team wants to minimise changes to the existing VPC. Which design should the architect recommend?

Accepted Answer

Deploy the firewall appliance as a managed instance group in the application VPC and use a custom route with the appliance as the next hop for the default route.. Centralised inspection of internet-bound traffic requires the traffic to traverse the firewall appliance. By deploying the appliance in the same VPC and setting a custom default route whose next hop is the appliance, all egress from the application tier is forced through it. Instances remain private, and the existing VPC is preserved. Cloud NAT, VPC peering, and Private Service Connect do not insert an inspection middlebox into the egress path.

Answer

Enable Private Google Access on the application subnet and use Private Service Connect for all external destinations.

Answer

Configure a Cloud NAT gateway on the application subnet and route all egress through it.

Answer

Create a separate VPC for the firewall appliance and use VPC peering to connect it to the application VPC.

Question 7

Refer to the exhibit. An engineer deployed this Terraform configuration and can SSH to the instance using the external IP. However, they notice that the instance has a public IP address even though they intended to have no public IP. What change should be made to the configuration to ensure the instance does not get a public IP?

Accepted Answer

Remove the entire access_config block from the network_interface configuration.. The `access_config` block in a Terraform `google_compute_instance` resource is what assigns a public (external) IP address to the instance's network interface. By removing the entire `access_config` block, the instance will only receive a private IP address, fulfilling the requirement of no public IP. Leaving the block empty (as in option C) still creates an ephemeral external IP by default, so it does not solve the problem.

Answer

Change the metadata key enable-oslogin to FALSE.

Answer

Set access_config = [] instead of leaving it empty.

Answer

Set the network to a custom VPC that does not have external internet access.

Question 8

A service account needs to be able to start and stop Compute Engine instances in a specific project. Which IAM role should be assigned at the project level?

Accepted Answer

roles/compute.instanceAdmin.v1. Roles/compute.instanceAdmin.v1, because this role grants the necessary permissions to start, stop, and manage Compute Engine instances, including operations like instances.start and instances.stop, at the project level. This role is specifically designed for managing compute resources without granting broader project-level access like editing all resources.

Answer

roles/iam.serviceAccountUser

Answer

roles/editor

Answer

roles/compute.viewer

Question 9

A company needs to protect an HTTPS load-balanced web application from OWASP Top 10 attacks, including SQL injection and cross-site scripting. Which GCP service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS protection service that provides protection against OWASP Top 10 attacks, including SQL injection and cross-site scripting. It integrates with external HTTP(S) load balancers to filter malicious traffic at the edge. Enabling Cloud Armor security policies allows you to block or allow requests based on preconfigured WAF rules.

Answer

Cloud NAT

Answer

Cloud CDN

Answer

Identity-Aware Proxy

Question 10

Your company uses Cloud VPN (HA VPN) to connect to Google Cloud. You need to achieve a 99.99% SLA for the VPN connection. What configuration is required?

Accepted Answer

Two VPN gateways, each with two tunnels, totaling four tunnels. To achieve the 99.99% SLA for HA VPN, Google Cloud requires two VPN gateways, each with two tunnels, for a total of four tunnels. This configuration provides redundancy across both gateways and tunnels, satisfying the availability requirement defined by Google's HA VPN SLA. A single gateway, even with multiple tunnels, cannot meet the 99.99% SLA.

Answer

One VPN gateway with four tunnels to different on-premises devices

Answer

Two VPN gateways, each with one tunnel, using two different edge availability domains

Answer

One VPN gateway with two tunnels to the same on-premises device

Question 11

A financial services company runs workloads on GKE and wants to ensure only container images that have been approved by the security team can be deployed. The approval process involves signing images after vulnerability scanning. Which GCP service should be integrated with GKE to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization is a GCP service that enforces deploy-time security policies on GKE clusters. It ensures that only container images that have been signed by trusted authorities (after vulnerability scanning) are deployed. By integrating Binary Authorization with GKE, the company can enforce that only approved images are deployed.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 12

Refer to the exhibit. All five nginx pods are scheduled on the same node (default-pool-1). What is the most likely reason?

Accepted Answer

The other nodes have taints that the pods do not tolerate.. Taints on nodes prevent pods from being scheduled unless the pods have corresponding tolerations. If the other nodes have taints that the nginx pods do not tolerate, the scheduler will only place them on nodes without those taints, which in this case is default-pool-1. This is a common scenario when nodes are dedicated to specific workloads or have special hardware.

Answer

The node auto-scaler has not created additional nodes yet, but the other nodes are present.

Answer

The pods have a nodeSelector that matches only default-pool-1.

Answer

The resource requests are too high, so the scheduler packed pods onto one node due to resource constraints on the others.

Question 13

A company is designing a highly available web application on Google Cloud. The application consists of stateless compute instances behind a global HTTP(S) Load Balancer. The compute instances must be able to handle sudden spikes in traffic. Which TWO strategies should the company implement? (Choose two.)

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization.. Option B is correct because a managed instance group (MIG) with autoscaling based on CPU utilization automatically adds or removes VM instances in response to traffic spikes, which directly satisfies the requirement that stateless compute instances handle sudden load increases. Option D is correct because a global HTTP(S) Load Balancer with backends in multiple regions distributes traffic across regional MIGs, providing high availability and resilience if one region fails, and it is the appropriate front end for stateless instances. Option A is not correct because Cloud CDN caches content at edge locations but does not by itself provide compute autoscaling or high availability for dynamic application responses, and caching all responses is not a general HA strategy. Option C is not correct because a single instance in a single zone is a single point of failure and cannot scale horizontally. Option E is not correct because vertical scaling (larger machine type) has limits, requires downtime or restart, and does not provide the elasticity or multi-zone availability needed for sudden traffic spikes.

Answer

Use Cloud CDN to cache all responses from the application servers.

Answer

Use a single Compute Engine instance in a single zone with a large machine type.

Answer

Use vertical scaling by selecting a machine type with more vCPUs and memory.

Question 14

A company runs a web application on App Engine Standard environment. The application experiences downtime during deployments due to traffic shifting. Which two strategies should they implement to improve reliability? (Choose two.)

Accepted Answer

Use traffic splitting to gradually migrate traffic to the new version.. Option C is correct because App Engine traffic splitting lets you migrate user traffic to a new version gradually (for example, by IP address, cookie, or random percentage), so the new version can be validated with a small share of requests before full cutover, avoiding the all-at-once downtime caused by abrupt traffic shifting. Option D is correct because deploying the new code as a separate App Engine version keeps the currently serving version live and healthy, and then you shift traffic to the new version via the App Engine console or gcloud commands (such as gcloud app services set-traffic), which is the standard zero-downtime deployment pattern. Option A is not appropriate because Cloud Endpoints is an API management layer for authentication, monitoring, and quotas, not a mechanism for shifting App Engine version traffic during deployments. Option B is not appropriate because idle instances only reduce instance startup latency; they do not prevent downtime caused by traffic shifting between versions. Option E is not appropriate because manual scaling disables autoscaling and does not address the deployment traffic-shifting problem, and could actually reduce reliability under load.

Answer

Use Cloud Endpoints to manage API traffic and route deployments.

Answer

Increase the number of idle instances to handle traffic during deployment.

Answer

Set manual scaling to avoid autoscaling delays.

Question 15

Your organization is moving a legacy monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single virtual machine with a local MySQL database. You need to design a cloud-native architecture that improves scalability and reliability. Which two actions should you take? (Choose TWO.)

Accepted Answer

Refactor the application into microservices and deploy each as a separate deployment in GKE.. Option B is correct because refactoring the monolith into microservices and deploying each as a separate Deployment in GKE enables independent scaling, rolling updates, and fault isolation, which directly improves scalability and reliability in a cloud-native architecture. Option D is correct because moving the local MySQL database to Cloud SQL for MySQL provides a managed, highly available, and automatically backed-up database service, decoupling state from the cluster and allowing the application tier to scale independently. Option A is not appropriate because a single large container on a custom machine type preserves the monolithic scaling and single-point-of-failure limitations rather than adopting cloud-native elasticity. Option C is not the best choice because a basic LoadBalancer Service only provides L4 round-robin distribution and does not by itself deliver the architectural scalability and reliability improvements required. Option E is incorrect because a single Pod with multiple containers communicating via localhost tightly couples the components, prevents independent scaling, and keeps the database co-located with the application, undermining reliability.

Answer

Deploy the entire application in a single container with a large custom machine type to handle load.

Answer

Expose the application using a simple Service of type LoadBalancer with round-robin distribution.

Answer

Use a single Pod with multiple containers that communicate via localhost to reduce latency.