Google PCA Practice Test 12 — 15 Questions

Question 1

A company is experiencing high latency in their VPC. They enabled VPC Flow Logs to capture metadata but need to analyze the logs for traffic patterns. Which Google Cloud service should they use to query and analyze VPC Flow Logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BigQuery. BigQuery is the correct service because VPC Flow Logs can be exported directly to BigQuery for querying and analyzing traffic patterns using SQL. BigQuery provides a serverless, highly scalable data warehouse that can handle large volumes of flow log metadata, enabling complex queries on source/destination IPs, ports, protocols, and packet counts. This allows the company to identify latency sources by analyzing traffic patterns over time.

Answer

Cloud Storage

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 2

What will happen to this instance during a Google-initiated maintenance event?

Accepted Answer

The instance will be terminated and then restarted after maintenance.. During a Google-initiated maintenance event, a standard (non-live-migratable) Compute Engine instance is terminated and then restarted on another host after the maintenance is complete. This behavior is controlled by the instance's 'onHostMaintenance' setting; when set to 'TERMINATE' (the default for instances with GPUs or certain configurations), the instance is stopped, the host undergoes maintenance, and then the instance is restarted. Option B correctly describes this termination-and-restart sequence.

Answer

The instance will be migrated and then restarted.

Answer

The instance will be preempted and deleted.

Answer

The instance will stop and remain stopped.

Answer

The instance will be live-migrated to another host.

Question 3

A company runs a microservices application on Google Kubernetes Engine (GKE). Each service is deployed as a Deployment with resource requests and limits. After deploying a new version of a service, the pods start crashing with OOMKilled. The team increased the memory limits in the Deployment manifest, but the pods still crash after a few minutes. The cluster has cluster autoscaling enabled. The node pool has sufficient capacity. What is the most likely cause of the issue?

Accepted Answer

The application has a memory leak. The pods are crashing with OOMKilled even after increasing memory limits, and the node pool has sufficient capacity. This indicates the application itself has a memory leak, where memory usage grows unbounded over time until it exceeds the new limit, causing the OOMKiller to terminate the pod. Increasing limits only delays the crash if the leak persists.

Answer

The Horizontal Pod Autoscaler is configured with a wrong target metric

Answer

The cluster autoscaler is not scaling up quickly enough

Answer

The pods are hitting the node's ephemeral storage limit

Question 4

Refer to the exhibit. A developer wants to SSH into instance-1 from their local machine. Which command should they use?

Accepted Answer

gcloud compute ssh instance-1 --zone us-central1-a. The `gcloud compute ssh` command requires the `--zone` flag when the zone is not set in the gcloud configuration or when the instance is in a different zone than the default. In this scenario, instance-1 is in zone us-central1-a, so specifying `--zone us-central1-a` ensures the SSH connection targets the correct instance. Without this flag, the command may fail or connect to the wrong instance if the default zone is different.

Answer

gcloud compute ssh instance-2

Answer

gcloud compute ssh instance-1 --project default

Answer

gcloud compute ssh instance-1 --internal-ip

Question 5

A company is migrating a large on-premises SQL Server database to Cloud SQL for SQL Server. The database is 2 TB in size and must have minimal downtime. Which approach should they use?

Accepted Answer

Use Database Migration Service (DMS) for continuous one-way replication. Database Migration Service (DMS) supports continuous one-way replication from on-premises SQL Server to Cloud SQL for SQL Server using native SQL Server transaction log shipping or Always On availability group replication. This minimizes downtime by keeping the target synchronized during the migration cutover, which is critical for a 2 TB database where a full backup/restore would cause extended downtime.

Answer

Set up a Cloud SQL HA instance and replicate on-premises using Always On availability groups

Answer

Export the database to CSV files, then import using Cloud SQL import

Answer

Perform a full backup to Cloud Storage, then restore into Cloud SQL

Question 6

An organization wants to ensure that all VMs in a project have the 'restricted-vm' tag to apply a firewall rule that allows only SSH from a bastion host. The VMs are created by multiple teams. Which approach ensures the tag is automatically applied to all new VMs?

Accepted Answer

Create a Cloud Function that listens to Compute Engine audit logs and adds the tag to new instances. OS Config can enforce OS policies, but tagging is done via instance templates or organization policies. Using a custom image with the tag is not automatic. A pre-create Cloud Function can detect VM creation and add the tag. Org policies cannot enforce tags directly.

Answer

Use a custom image that includes the tag in the instance metadata

Answer

Use an organization policy to require the tag

Answer

Configure OS Config with a software recipe to add the tag

Question 7

A DevOps team wants to automate the deployment of infrastructure on Google Cloud using a declarative configuration language. They need to support Python and Jinja templates for reusable modules. Which service should they use?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager supports YAML, Python, and Jinja templates, making it the correct choice for declarative infrastructure as code. Terraform is also declarative but uses HCL, not Python/Jinja. Cloud Build is for CI/CD pipelines, not infrastructure provisioning. Config Connector is for Kubernetes-style resource management, not Python/Jinja templates.

Answer

Config Connector

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 8

Your company runs a multi-region Cloud Spanner instance for a global financial application. The SLA requirement is 99.999% availability. You need to ensure that the database remains available during a regional outage. What configuration should you use?

Accepted Answer

Use a multi-region configuration (e.g., nam3) with automatic replication across multiple regions.. Cloud Spanner multi-region configurations (e.g., nam3, eur3) automatically replicate data across regions within a continent. They provide 99.999% availability SLA. A single-region configuration offers 99.99% SLA. Read replicas (as in Cloud SQL) are not a concept in Spanner. Multi-region configs use multiple read-write regions.

Answer

Use a dual-region configuration with two regions but only one for writes.

Answer

Use a single-region configuration with a read replica in another region.

Answer

Configure a single-region instance and create periodic backups to restore in another region.

Question 9

What is the networking mode of this GKE cluster?

Accepted Answer

VPC-native networking. A is correct because VPC-native networking is the default and recommended networking mode for GKE clusters, where the cluster uses alias IP ranges (RFC 6598) on the VPC network. This mode assigns pod IP addresses directly from the VPC subnet's secondary IP range, enabling native integration with VPC features like Cloud NAT, VPC Flow Logs, and firewall rules without requiring manual route management.

Answer

Hybrid networking

Answer

Standard networking

Answer

Routes-based networking

Answer

Private cluster networking

Question 10

A Cloud Run service needs to connect to a Cloud SQL MySQL instance privately without using public IP. What must be configured?

Accepted Answer

Deploy a VPC connector and attach it to the Cloud Run service. To privately connect Cloud Run to Cloud SQL, you need a Serverless VPC Access connector in the same VPC as the Cloud SQL instance, and then use the private IP of Cloud SQL. Private Google Access is for on-prem, not Cloud Run. Direct VPC is not available for Cloud Run.

Answer

Set up VPC Network Peering between Cloud Run and Cloud SQL

Answer

Enable Private Google Access on the VPC subnet

Answer

Use Cloud SQL Proxy as a sidecar container

Question 11

An engineer needs to provision a GKE cluster with a node pool that uses preemptible VMs to reduce costs. Which gcloud command should they use?

Accepted Answer

gcloud container node-pools create --preemptible. The --preemptible flag when creating a node pool makes all nodes in that pool preemptible. The other options either don't exist or are incorrect.

Answer

gcloud container clusters update --preemptible

Answer

gcloud container clusters create --preemptible-nodes

Answer

gcloud compute instances create --preemptible

Question 12

A developer wants to deploy a Cloud Function that is triggered whenever a new object is created in a Cloud Storage bucket. Which trigger type should they choose?

Accepted Answer

Cloud Storage trigger. Cloud Functions can be triggered by Cloud Storage events such as google.storage.object.finalize (object creation). HTTP triggers are for HTTP requests. Pub/Sub triggers for messages. Firestore triggers for document changes.

Answer

Firestore trigger

Answer

Pub/Sub trigger

Answer

HTTP trigger

Question 13

An organization wants to monitor and alert on custom application metrics from a GKE cluster. They also need to view logs in real-time and create metrics from log content. Which two GCP services should they use? (Choose two.)

Accepted Answer

Cloud Monitoring. Cloud Monitoring collects metrics and provides alerting. Cloud Logging collects logs and supports log-based metrics. Cloud Profiler is for profiling. Cloud Trace is for tracing. Error Reporting is for error grouping.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Trace

Question 14

A company uses Cloud Build to deploy a Java application to Artifact Registry. They want to automatically trigger a build only when changes are pushed to the 'main' branch in their Cloud Source Repository. Which configuration should they use?

Accepted Answer

Create a Cloud Build trigger with an included branch filter set to '^main$'. Cloud Build triggers can be configured with a branch filter (regex) to trigger builds only on specific branches. The trigger is set to watch the repository and fire on push events matching the branch pattern. Using a Cloud Scheduler with Pub/Sub is an alternative for scheduled builds, but not for push-based triggers.

Answer

Configure a Cloud Function that listens for Pub/Sub messages from Cloud Source Repo and calls Cloud Build API

Answer

Create a Cloud Scheduler job that runs a Pub/Sub push to Cloud Build every hour

Answer

Use a Cloud Build build step that checks the branch name and aborts if not main

Question 15

Which TWO are required to allow on-premises hosts to access Google APIs using internal IP addresses (Private Google Access)? (Choose 2)

Accepted Answer

A Cloud Interconnect or Cloud VPN connection between on-premises and VPC. A Cloud Interconnect or Cloud VPN connection is required to establish private, encrypted connectivity between on-premises hosts and a VPC network. This provides the network path for on-premises traffic to reach Google APIs using internal IP addresses, bypassing the public internet. Without this direct connection, on-premises hosts cannot leverage Private Google Access, which only applies to traffic originating within Google Cloud subnets.

Answer

A Cloud Router instance configured in the on-premises network

Answer

VPC Service Controls enabled

Answer

A private DNS zone for googleapis.com