Google PCA Practice Test 11 — 15 Questions

Question 1

A startup is building a web application that experiences unpredictable traffic spikes. They want a scalable solution that minimizes costs. Which Google Cloud service should they use to run their containerized application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Google Kubernetes Engine (GKE) with autoscaling. Google Kubernetes Engine (GKE) with autoscaling is the correct choice because it combines cluster autoscaling (which adjusts the number of nodes based on pod resource requests) with Horizontal Pod Autoscaling (which scales the number of pod replicas based on CPU/memory utilization or custom metrics). This dual-layer scaling handles unpredictable traffic spikes efficiently while minimizing costs by only provisioning resources when needed, and it is purpose-built for containerized applications.

Answer

App Engine Standard Environment

Answer

Cloud Run for Anthos

Answer

Compute Engine with managed instance groups

Question 2

What is the most likely reason the NetworkPolicy is not taking effect?

Accepted Answer

The developer used the networking.k8s.io/v1 API version instead of the Calico CRD projectcalico.org/v3.. The NetworkPolicy is not taking effect because the developer used the standard Kubernetes API version `networking.k8s.io/v1`, which defines a different schema and behavior than the Calico CRD `projectcalico.org/v3`. Calico NetworkPolicies support advanced features like order-of-precedence, global policies, and non-IP match criteria that are not available in the native Kubernetes NetworkPolicy API. When a Calico-specific policy is defined using the wrong API version, the cluster's policy engine (Calico) ignores it, resulting in no enforcement.

Answer

The cluster has a global network policy that overrides per-namespace policies.

Answer

The pod labels do not match because of a capitalization mismatch.

Answer

The NetworkPolicy is missing a spec.podSelector.matchLabels entry.

Question 3

An organization is using Shared VPC with multiple projects. They want to allow a service project to use a Cloud SQL instance created in the host project. Which step is required?

Accepted Answer

Create the Cloud SQL instance with a private IP and enable Private Services Access in the host project. When using Shared VPC, a service project can use a Cloud SQL instance with a private IP from the host project's VPC. To enable this, the Cloud SQL instance must be created with a private IP and Private Services Access must be configured in the host project. This establishes a VPC peering connection between the host project's VPC and the Google-managed Cloud SQL service network, allowing the service project's resources to communicate with the instance via internal IP.

Answer

Grant the service project's Cloud SQL service account the Cloud SQL Client role on the host project

Answer

Configure VPC peering between host and service project

Answer

Enable the Cloud SQL Admin API in the service project

Question 4

A company is using Cloud Armor with HTTP Load Balancing to protect a web application. They want to block traffic from specific IP ranges for all requests except those that include a valid reCAPTCHA token. Which Cloud Armor rule configuration should they use?

Accepted Answer

Create a deny rule for the IP ranges with a condition that the request does not contain a valid reCAPTCHA token.. Cloud Armor security rules support boolean conditions using operators like `request.path` or custom headers. By creating a deny rule for the specific IP ranges with a condition that the request does not contain a valid reCAPTCHA token (evaluated via the `hasRecaptchaToken()` function), you allow traffic from those IPs only when the token is present. This directly implements the requirement without affecting other traffic.

Answer

Use a rate-based rule to limit requests from those IP ranges and add a reCAPTCHA action.

Answer

Create a whitelist rule for the IP ranges and attach it as a deny rule with higher priority.

Answer

Use Identity-Aware Proxy (IAP) to block the IPs and reCAPTCHA for others.

Question 5

An organization is implementing a Hub-and-Spoke network topology with multiple VPCs. Which Google Cloud product is designed for centralized connectivity and policy enforcement?

Accepted Answer

Shared VPC. Shared VPC (D) is the correct answer because it allows an organization to centrally manage connectivity and enforce network policies across multiple VPCs from a single host project. By designating a host project and attaching service projects, Shared VPC enables centralized control over firewall rules, routes, and IAM policies, which is essential for a hub-and-spoke topology where the host VPC acts as the hub and service VPCs as spokes.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

Network Connectivity Center

Question 6

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

Accepted Answer

Ensure either Cloud SQL Proxy is running or a VPC connector is configured, and IAM permissions are correct.. A Cloud Function with a private IP Cloud SQL instance requires either the Cloud SQL Proxy (which uses the Cloud SQL Auth proxy to establish an encrypted connection via the public IP, but if the instance has only a private IP, the proxy must be run within the same VPC) or a VPC connector to enable private networking. Additionally, proper IAM permissions (e.g., Cloud SQL Client role) are necessary for the proxy or connector to authenticate and connect. Without both the network path and IAM permissions, the connection will fail.

Answer

Ensure the Cloud SQL Proxy is running and configured.

Answer

Verify the Cloud Function's network settings.

Answer

Configure a VPC connector for the Cloud Function.

Question 7

Which TWO of the following are benefits of using a VPC Service Controls perimeter?

Accepted Answer

Prevent data exfiltration from managed services like BigQuery and Cloud Storage. VPC Service Controls perimeters prevent data exfiltration by creating a security boundary around Google Cloud managed services (e.g., BigQuery, Cloud Storage). Within the perimeter, data can only be copied to other resources inside the same perimeter, blocking unauthorized transfers to external projects or the internet. This is achieved through context-aware access policies that enforce data access based on the client's network identity and project membership, not by inspecting packet contents.

Answer

Act as a network firewall for Compute Engine instances

Answer

Provide encryption of data in transit between on-premises and Google Cloud

Answer

Replace Identity and Access Management (IAM) for service access control

Question 8

A company has a Cloud Run service that processes images uploaded by users. The service reads the images from a Cloud Storage bucket and writes processed images to another bucket. The team recently updated the service to use a custom service account named 'image-processor-sa' with minimal permissions. After the update, the service fails with permission errors when trying to read from the source bucket. The team verified that the service account has the Storage Object Viewer role on the source bucket and Storage Object Creator role on the destination bucket. What should the architect do to resolve the issue?

Accepted Answer

Ensure the Cloud Run service uses the correct service account by redeploying with the --service-account flag set to 'image-processor-sa@project-id.iam.gserviceaccount.com'.. The error occurs because the Cloud Run service is not using the custom service account 'image-processor-sa' despite it being created and granted permissions. By default, Cloud Run uses the Compute Engine default service account unless explicitly overridden. Redeploying with the --service-account flag attaches the correct identity to the Cloud Run revision, allowing it to authenticate with Cloud Storage using the minimal permissions already assigned.

Answer

Grant the service account the Cloud Run Invoker role on the Cloud Run service.

Answer

Assign the Storage Admin role to the service account.

Answer

Enable the Cloud Storage API for the project.

Question 9

A company is designing a disaster recovery plan for their Cloud SQL for PostgreSQL instance. They want to ensure that the database can be recovered in another region within minutes with minimal data loss. Which three actions should they take? (Choose three.)

Accepted Answer

Enable point-in-time recovery. Enabling point-in-time recovery (PITR) for Cloud SQL for PostgreSQL is correct because it allows you to restore the database to any specific point in time within the backup retention period, minimizing data loss to within seconds. PITR relies on write-ahead logs (WAL) archived continuously, which are essential for recovering to a precise timestamp in a disaster scenario. This directly supports the requirement of minimal data loss during cross-region recovery.

Answer

Configure a failover replica in a different zone within the same region

Answer

Enable automated backups with a retention period of 30 days

Question 10

A healthcare SaaS provider runs workloads in Google Cloud and needs to comply with HIPAA. They use Cloud SQL for PostgreSQL and want to encrypt data at rest with customer-managed encryption keys (CMEK). Which steps must they take?

Accepted Answer

Create a Cloud KMS key ring and key, then specify the key when creating the Cloud SQL instance. Cloud SQL for PostgreSQL supports CMEK only at instance creation time. You must first create a Cloud KMS key ring and key in the same region as the instance, then specify that key when creating the Cloud SQL instance. This ensures that the data at rest is encrypted with a customer-managed key, meeting HIPAA compliance requirements for control over encryption keys.

Answer

Use customer-supplied encryption keys (CSEK) by uploading your own key material

Answer

Enable CMEK in the Cloud SQL instance's settings after creation

Answer

Create a Cloud HSM key and grant the Cloud SQL service account access to it

Question 11

A company has Compute Engine instances in us-east1-a and us-east1-b zones. They want to allow communication between these instances with minimal latency and no additional cost. What is the best networking approach?

Accepted Answer

Use a single VPC network that includes both zones.. A single VPC network spans all regions and zones, allowing instances in different zones (us-east1-a and us-east1-b) to communicate using internal IP addresses with low latency and no additional cost. This is because VPC networks provide flat, global networking by default, and traffic between zones within the same VPC uses Google's internal backbone without incurring egress charges.

Answer

Configure VPC Network Peering between two separate VPC networks.

Answer

Create a new subnet in each zone and use Cloud NAT.

Answer

Set up a Cloud VPN between the zones.

Question 12

A company wants to minimize egress costs for data transferred between Compute Engine instances in the same region but different zones. What is the best practice?

Accepted Answer

Use internal IPs and ensure they are in the same VPC.. B is correct because data transfer between Compute Engine instances in the same region but different zones uses internal IP addresses within the same VPC, which incurs no egress costs. Google Cloud does not charge for traffic between instances using internal IPs within the same region, regardless of zone, as long as they are in the same VPC network. This is the most cost-effective approach for minimizing egress costs.

Answer

Use a VPN connection.

Answer

Use Cloud NAT.

Answer

Use external IPs for all instances.

Question 13

A financial institution stores sensitive customer data in Cloud Storage. They need to audit all data access and prevent unauthorized data exfiltration. They also require context-aware access controls based on user location and device. Which Google Cloud service should they configure?

Accepted Answer

VPC Service Controls with the perimeter set to the data layer. VPC Service Controls (option C) is correct because it creates a security perimeter around Google Cloud APIs, including Cloud Storage, to prevent unauthorized data exfiltration (e.g., copying data to an external project) while allowing context-aware access controls based on user location and device via Access Context Manager. This directly addresses the requirement for both audit (via Cloud Audit Logs integrated with the perimeter) and exfiltration prevention, which other services like DLP or Access Transparency alone cannot enforce.

Answer

Cloud Data Loss Prevention (DLP) for inspecting data

Answer

Cloud Audit Logs and Cloud Monitoring for alerts

Answer

Access Transparency logs for audit

Question 14

Your organization uses a Shared VPC to centrally manage network resources. A project that is not the host project needs to create a Cloud SQL instance using a private IP in the Shared VPC. What must be configured?

Accepted Answer

Enable the Service Networking API and allocate an IP range for the Cloud SQL instance. For a service project to allocate private IP in a Shared VPC, the Shared VPC host project must grant the service project the 'compute.networkUser' role on the subnetwork. Additionally, the service project needs the Service Networking API enabled and a private service access connection.

Answer

Create a VPC peering between the service project and the host project

Answer

Grant the service project the 'compute.networkUser' role on the VPC network

Answer

Use Cloud NAT to allow the Cloud SQL instance to communicate

Question 15

A company wants to grant a service account in Project A the ability to push containers to Artifact Registry in Project B. They want to follow the principle of least privilege. Which IAM roles should they assign?

Accepted Answer

Grant the service account the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. To push containers, the service account needs the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. The Storage Object Admin role is too broad. The Artifact Registry Admin role is overly permissive. The Viewer role only allows reading.

Answer

Grant the service account the Storage Object Admin role (roles/storage.objectAdmin) on Project B

Answer

Grant the service account the Artifact Registry Admin role (roles/artifactregistry.admin) on the repository in Project B

Answer

Grant the service account the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in Project B