Google PCA Practice Test 13 — 15 Questions

Question 1

A global e-commerce site uses an external HTTPS load balancer with a backend service pointing to a managed instance group. Some users report 503 errors during peak traffic. The backend instances are healthy and not overloaded. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The load balancer's max rate per backend is configured too low. A 503 error from an external HTTPS load balancer with healthy backends typically indicates that the load balancer is throttling requests. The 'max rate per backend' setting limits the number of requests per second that the load balancer forwards to each backend instance. When this limit is exceeded, the load balancer returns 503 errors even though the instances themselves are not overloaded, which matches the scenario of peak traffic.

Answer

The CDN cache is not warming up properly

Answer

The backend service's health check interval is too short

Answer

The SSL certificate is expired

Question 2

A team wants to allow a service account to be used only on specific Compute Engine VMs. Which IAM condition should be applied to the service account's roles?

Accepted Answer

resource.name. The `resource.name` IAM condition allows you to restrict a service account's roles to specific Compute Engine VM instances by matching the VM's resource name (e.g., `projects/project-id/zones/zone/instances/instance-name`). This ensures the service account can only be used on designated VMs, enforcing fine-grained access control.

Answer

resource.service

Answer

resource.owner

Answer

resource.type

Answer

resource.labels

Question 3

You need to create a private GKE cluster with Workload Identity enabled to allow pods to access Google Cloud APIs without static service account keys. What must you configure for the cluster?

Accepted Answer

Enable Workload Identity on the cluster and set the --workload-pool flag at cluster creation. Workload Identity requires a GKE cluster with Workload Identity enabled and a Google-managed service account for the node pool or individual pods.

Answer

Enable Binary Authorization on the cluster

Answer

Create a node pool with a service account that has the necessary IAM roles and assign that SA to pods

Answer

Use Cloud NAT to allow pods to communicate with Google APIs

Question 4

A developer is migrating a stateful application to GKE. The application requires persistent storage with high IOPS for a database. Which storage option is most suitable?

Accepted Answer

Persistent Disk SSD. Persistent Disk SSD (pd-ssd) is the most suitable option for a stateful database on GKE requiring high IOPS because it provides block storage with consistent, high-performance IOPS and can be dynamically provisioned via PersistentVolumeClaims. Unlike Local SSD, pd-ssd persists data independently of the node lifecycle, ensuring data durability during pod rescheduling or node failures.

Answer

Local SSD

Answer

Cloud Storage Fuse

Answer

Persistent Disk Standard

Question 5

A company runs a batch processing workload on Compute Engine instances. The workload is triggered every hour and runs for about 10 minutes. They want to reduce costs. They currently use preemptible VMs, but they notice that sometimes the workload fails because VMs are preempted before completion. They need a cost-effective solution that ensures the workload completes reliably. What should they do?

Accepted Answer

Create a custom machine type with minimal resources and use a managed instance group with preemptible VMs, combined with a startup script that retries on failure.. It combines the cost savings of preemptible VMs with reliability through a managed instance group (MIG) and a retry startup script. The MIG automatically recreates VMs if preempted, and the startup script ensures the batch workload restarts from where it left off or retries the entire job, guaranteeing completion at minimal cost.

Answer

Increase the machine size of the preemptible VMs to finish faster.

Answer

Provision a commitment-based discount for standard VMs.

Answer

Use standard (non-preemptible) VMs to avoid preemption.

Question 6

A team is deploying a microservice on Cloud Run that needs to access a Cloud SQL database securely. They want to avoid using public IPs and ensure traffic stays within Google's network. Which configuration should they use?

Accepted Answer

Use Serverless VPC Access and assign a private IP to the Cloud SQL instance. Serverless VPC Access allows Cloud Run to connect to a VPC network via a VPC connector. Combined with Private Services Access, Cloud SQL can be configured with a private IP (within the VPC) and accessed without traversing the public internet. Cloud SQL Proxy is a sidecar pattern that can use public IP with SSL, but it does not keep traffic entirely within Google's network if the Cloud SQL instance uses a public IP. Private Google Access is for on-premises or VM access to Google APIs, not for Cloud Run to Cloud SQL.

Answer

Configure Cloud SQL with a public IP and use Cloud SQL Proxy in the Cloud Run service

Answer

Enable Private Google Access on the VPC subnet

Answer

Create a VPC network peering between the Cloud Run tenant project and the Cloud SQL project

Question 7

A financial services company requires that all audit logs be retained for 7 years in a cost-effective, immutable storage. They also need to run ad-hoc SQL queries on the logs. Which configuration should they use?

Accepted Answer

Create two log sinks: one to BigQuery for querying, and one to Cloud Storage with object retention policy for immutable storage. Logging can export logs to BigQuery for SQL querying, and BigQuery offers time-based partitioning and long-term retention. However, for immutable storage, Cloud Storage with retention policy is recommended. The best approach is to use a log sink to BigQuery for analysis, and another sink to Cloud Storage with a retention policy for long-term immutable storage. Option D combines both sinks correctly.

Answer

Create a log sink to BigQuery with a 7-year partition expiration and use BigQuery's SQL capabilities

Answer

Use Cloud Logging's default retention and set up a log-based metric to trigger a Cloud Function that copies logs to BigQuery

Answer

Export logs to Cloud Storage with a retention policy set to 7 years and use Cloud Storage SQL interface

Question 8

Which TWO actions can reduce costs for a Cloud SQL for MySQL instance? (Choose two.)

Accepted Answer

Use committed use discounts.. Committed use discounts (CUDs) provide significant cost savings (up to 57%) for Cloud SQL instances when you commit to a 1- or 3-year term. Resizing to a smaller machine type during off-peak hours directly reduces compute costs by lowering the vCPU and memory allocation when demand is low, and Cloud SQL supports live instance resizing with minimal downtime.

Answer

Use database flags to limit connections.

Answer

Use preemptible instances.

Answer

Use high availability configuration.

Question 9

An engineer needs to share a VPC network across multiple projects in an organization while maintaining centralized network administration. Which approach should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to share its VPC network with service projects, enabling centralized network administration. VPC peering connects separate VPCs but does not allow centralized administration.

Answer

VPC peering between all projects

Answer

Private Google Access

Answer

Cloud VPN between projects

Question 10

A company wants to use Cloud Deploy to automate deployments to GKE. They need to configure an approval gate that requires manual approval before promoting a release to a production cluster. Where is this approval gate defined?

Accepted Answer

In the delivery pipeline YAML under the 'target' definition. In Cloud Deploy, approval gates are defined per target in the delivery pipeline configuration. The target resource specifies whether an approval is required.

Answer

In the Cloud Scheduler job

Answer

In the GKE cluster as a constraint

Answer

In the cloudbuild.yaml file

Question 11

An organization wants to manage Google Cloud infrastructure as code using declarative configuration files. They need a solution that supports Python and Jinja templating languages. Which service should they choose?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager supports YAML templates with optional Python or Jinja helpers, making it the correct choice for declarative infrastructure management with those languages.

Answer

Cloud Composer

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 12

A company is migrating a stateful application to Google Cloud. The application requires persistent disks with low latency and high IOPS for database workloads. They plan to use Compute Engine instances with SSD persistent disks. However, the database performance is lower than expected. Which action should the company take to improve disk performance?

Accepted Answer

Use local SSDs with RAID 0 configuration for the database data.. Local SSDs provide the highest IOPS and lowest latency of any disk option on Compute Engine, and striping them with RAID 0 aggregates their performance. This directly addresses the need for high IOPS and low latency for database workloads, unlike persistent disks which have performance ceilings tied to disk size and instance limits.

Answer

Change the persistent disk type to standard persistent disk.

Answer

Increase the disk size to increase baseline IOPS.

Answer

Enable disk encryption to improve I/O throughput.

Question 13

A developer wants to deploy a containerized web application on Google Cloud that can scale to zero when not in use and charges only for resources consumed during request processing. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when idle and charges per request, making it cost-effective for intermittent traffic. GKE requires at least one node to be running, so it cannot scale to zero. Compute Engine instances incur costs even when idle. App Engine Flexible Environment also runs at least one instance.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Flexible Environment

Answer

Compute Engine instance group

Question 14

Which GCP service provides distributed tracing to help analyze latency in microservices applications?

Accepted Answer

Cloud Trace. Cloud Trace collects latency data from applications and provides near-real-time traces. Cloud Profiler provides continuous profiling. Cloud Monitoring provides metrics and dashboards. Cloud Logging provides log management.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 15

An organization wants to manage DNS records for a domain they own (e.g., example.com) and use Google Cloud for authoritative DNS. They also need to resolve internal hostnames for resources within their VPC. Which Cloud DNS configuration should they use?

Accepted Answer

Create a public managed zone for example.com and a private managed zone for internal VPC resources. Cloud DNS public zones manage public DNS records for internet-facing domains. Cloud DNS private zones are used for internal DNS resolution within VPCs. The correct approach is to create a public zone for example.com and a private zone for internal hostnames attached to the VPC.

Answer

Create a single public managed zone and use DNS peering for internal resolution

Answer

Create a single private managed zone for both external and internal DNS resolution

Answer

Use Google Groups DNS to manage both public and private records