Google PCA Practice Test 13 — 15 Questions

Question 1

A company runs batch analytics workloads each night on Compute Engine VMs. The workloads are fault-tolerant and can be interrupted. The finance team wants to reduce compute costs. Which Compute Engine pricing model should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preemptible VMs. Preemptible VMs are short-lived, heavily discounted Compute Engine instances (up to ~80% off) that can be terminated by Google at any time with a 30-second notice. They are ideal for fault-tolerant, interruptible batch workloads like nightly analytics jobs, which is exactly the scenario described.

Answer

Committed use discounts (1-year or 3-year)

Answer

Sustained use discounts

Answer

Sole-tenant nodes

Question 2

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

Accepted Answer

Attach an IAM policy to an organization. Option A is correct because IAM policies can be attached at the organization node in the resource hierarchy, allowing centralized control over all projects, folders, and resources beneath it. Option B is correct because IAM policies can be attached to a project, which is a fundamental resource container in Google Cloud where allow policies bind principals to roles. Options C and E are incorrect because IAM policies are attached to resources (like organizations, folders, projects, and individual resources), not directly to users or service accounts; users and service accounts are principals that appear inside a policy binding. Option D is incorrect because IAM roles are not assigned directly to a user as a standalone object; instead, a role is granted to a principal through a policy binding on a resource.

Answer

Attach an IAM policy to a user

Answer

Assign an IAM role directly to a user

Answer

Attach an IAM policy to a service account

Question 3

A company wants to set up monitoring and alerting for their application running on GKE. They need to receive alerts via email and also trigger an automated remediation workflow. Which TWO components should they use? (Choose two.)

Accepted Answer

Notification channels (email). Option A, Notification channels (email), is correct because in Cloud Monitoring a notification channel defines the destination and delivery mechanism for alerts, and an email-type channel is exactly what is needed to receive alert notifications via email. Option B, Alerting policies, is correct because alerting policies define the conditions (metrics, thresholds, filters) that determine when an alert fires and which notification channels are used, making them the core component for monitoring and alerting on the GKE application. Together, an alerting policy detects the condition and routes it to the email notification channel, satisfying the email alerting requirement. Option C, Cloud Shell, is just an interactive command-line environment and provides no monitoring or alerting capability. Option D, Cloud Logging, stores and queries logs but does not itself define alert conditions or deliver email notifications. Option E, Pub/Sub, can be used as a notification channel for automation, but it is not required to receive email alerts and is not one of the two components needed for the stated email alerting requirement.

Answer

Cloud Shell

Answer

Cloud Logging

Answer

Pub/Sub

Question 4

You are designing a disaster recovery plan for a critical application running on GKE. You need to back up the cluster's state and application data. Which TWO services should you use together? (Choose 2)

Accepted Answer

Velero (formerly Heptio Ark). Velero (A) is correct because it is the standard open-source tool for backing up and restoring Kubernetes cluster state, including namespaces, deployments, services, and persistent volume snapshots, making it ideal for GKE disaster recovery. Cloud Storage (E) is correct because Velero stores its backups and volume snapshots in an object storage backend, and Google Cloud Storage is the native, durable, and highly available GCS bucket option for GKE environments. Together, Velero orchestrates the backup and restore operations while Cloud Storage provides the persistent, off-cluster repository for those backups. Pub/Sub (B) is a messaging service, not a backup or storage solution, so it does not back up cluster state or application data. Cloud SQL (C) is a managed relational database service that could host application data but does not back up GKE cluster state, and Filestore (D) is a managed NFS file share for persistent volumes, not a backup repository for cluster-wide state.

Answer

Pub/Sub

Answer

Cloud SQL

Answer

Filestore

Question 5

Match each GCP storage service to its typical use case.

Accepted Answer

Cloud Storage: Object storage for unstructured data. Cloud Storage is for unstructured object storage, Cloud SQL for relational data, Cloud Bigtable for wide-column NoSQL analytics, and Firestore for document NoSQL apps. Common confusions involve mixing storage types with database services.

Answer

Cloud Storage: Relational database for transactional workloads

Answer

Cloud SQL: Object storage for media files

Question 6

A company uses Cloud Spanner for a global financial application. They experience increased latency and transaction aborts during peak hours. Which measure should they take first to improve reliability?

Accepted Answer

Optimize transactions to reduce lock contention.. Transaction aborts and latency in Cloud Spanner are most commonly caused by lock contention during peak hours. By optimizing transactions—such as reducing their scope, using read-only transactions where possible, and avoiding hot-spot writes—you directly address the root cause of contention without incurring additional cost or schema changes. This aligns with Google's best practices for Spanner reliability.

Answer

Increase the number of nodes in the Spanner instance.

Answer

Reduce the number of indexes on frequently updated columns.

Answer

Use interleaved tables to co-locate related data.

Question 7

A data engineer needs to analyze data in BigQuery but must mask personally identifiable information (PII) based on user roles. Which service should they use?

Accepted Answer

BigQuery column-level security. BigQuery column-level security allows you to apply fine-grained access controls to specific columns containing PII, such as by using policy tags to restrict access based on user roles. This directly meets the requirement to mask sensitive data in BigQuery without moving or duplicating data, as it integrates with Cloud IAM to enforce role-based access at query time.

Answer

Cloud Key Management Service

Answer

Cloud Data Catalog

Answer

Cloud Data Loss Prevention (DLP)

Question 8

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

Accepted Answer

Enable Binary Authorization to ensure only signed container images are deployed.. Option B is correct because Binary Authorization is a GKE security control that enforces deploy-time verification, allowing only container images that are attested or signed by trusted authorities to be admitted to the cluster, which prevents untrusted or tampered images from running. Option D is correct because Workload Identity is the recommended way to let GKE workloads access Google Cloud services: it binds a Kubernetes service account to an IAM service account via IAM policy bindings and the GKE metadata server, eliminating the need to export long-lived service account keys. The other options are not recommended: disabling HTTP load balancing (A) is not a standard GKE hardening practice and does not meaningfully reduce the cluster's attack surface, using the default Compute Engine service account for all nodes (C) grants overly broad, shared permissions and violates least privilege, and enabling basic authentication (E) is deprecated and insecure because it relies on static username/password credentials rather than modern identity-based access.

Answer

Disable HTTP load balancing to reduce attack surface.

Answer

Use the default Compute Engine service account for all GKE nodes.

Answer

Enable basic authentication for easier access management.

Question 9

Your company plans to connect an on-premises data center to Google Cloud with a Dedicated Interconnect. You need to ensure high availability for the connection. What is the minimum configuration required to meet a 99.99% SLA for Dedicated Interconnect?

Accepted Answer

Two Dedicated Interconnect circuits, each in a different edge availability domain, with a Cloud Router for each connection. To achieve the 99.99% availability SLA for Dedicated Interconnect, Google requires at least two Dedicated Interconnect connections in two different edge availability domains (metro availability zones), each terminating on a separate Cloud Router. This topology ensures that a single circuit or router failure does not take down connectivity. The 99.99% SLA is explicitly tied to this redundant, diverse-path configuration.

Answer

A single Dedicated Interconnect circuit with a Cloud Router configured for BGP advertisements

Answer

One Dedicated Interconnect circuit and one Partner Interconnect connection as a backup

Answer

One Dedicated Interconnect circuit with two VLAN attachments on the same circuit

Question 10

A developer accidentally deleted a bucket in Cloud Storage. The bucket had object versioning enabled. How can the bucket and its objects be restored?

Accepted Answer

Contact Cloud Support to restore the bucket from the undisclosed backup within a limited time window.. When a Cloud Storage bucket is deleted, even with versioning enabled, the bucket itself is removed along with its objects. Google Cloud does not provide a self-service restore option for deleted buckets; instead, it maintains an internal, undisclosed backup for a limited time (typically 7 days). Only Cloud Support can initiate the restoration process from this backup, making Option A the correct approach.

Answer

Restore the bucket from the Trash in the Cloud Console.

Answer

Enable bucket lock and then undo deletion.

Answer

Use the gsutil ls -a command to list deleted buckets and gsutil cp to restore.

Question 11

A company has a Cloud SQL for MySQL instance with automated backups enabled. They need to recover the database to a specific point in time within the last hour. Which feature should they use?

Accepted Answer

Point-in-time recovery (PITR). Point-in-time recovery (PITR) lets Cloud SQL for MySQL restore to a specific timestamp within the retention window by combining automated backups with binary logs. It is the only option that supports recovery to an arbitrary point within the last hour. Automated backup restore only returns the database to the time of the last backup, not an arbitrary point.

Answer

Failover replica

Answer

Automated backup restore

Answer

Import using the mysqldump file

Question 12

An organization requires that all container images deployed to GKE be signed and verified before deployment. Which GCP service should be used?

Accepted Answer

Binary Authorization. Binary Authorization is a GCP service that enforces deploy-time security controls on GKE by ensuring only trusted container images are deployed. It uses attestations created by trusted authorities to verify that an image has been signed and meets specific criteria before allowing deployment. This directly satisfies the requirement for signed and verified images.

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Answer

Artifact Registry

Question 13

An organization is planning to move 500 TB of archival data from on-premises to Cloud Storage. The data is not frequently accessed, and the network bandwidth is limited to 100 Mbps. What is the most efficient migration approach?

Accepted Answer

Use Transfer Appliance. Transfer Appliance is a physical device for shipping large amounts of data when bandwidth is low. At 100 Mbps, 500 TB would take over 500 days; Transfer Appliance bypasses network constraints.

Answer

Use gsutil rsync with parallel composite uploads

Answer

Use Migrate for Compute Engine

Answer

Use Storage Transfer Service over the internet

Question 14

A company uses Cloud Logging to capture application logs. They need to alert when the number of errors exceeds 100 in a 5-minute window. Which type of alert should they create?

Accepted Answer

Log-based metric with an alerting policy. To alert on the count of error log entries exceeding 100 in a 5-minute window, the engineer must first create a log-based metric that counts matching log entries, then attach an alerting policy with a threshold condition on that metric. Cloud Logging alone cannot alert on log content; it must be converted into a metric that Cloud Monitoring can evaluate. This is the standard pattern for log-driven alerting in Google Cloud.

Answer

Notification channel with email integration

Answer

Cloud Logging sink to a Pub/Sub topic

Answer

SLO alerting policy

Question 15

To achieve a 99.999% availability SLA for a globally distributed application using Cloud Spanner, which configuration is required?

Accepted Answer

Multi-region instance configuration. Cloud Spanner multi-region configuration provides 99.999% SLA. Single-region offers 99.99%. Fine-grained access control and customer-managed encryption keys (CMEK) do not affect availability SLA.

Answer

Fine-grained access control

Answer

Single-region instance configuration

Answer

Customer-managed encryption keys (CMEK)