Google PCA Practice Test 14 — 15 Questions

Question 1

A company wants to automatically move data from Cloud Storage Standard to Nearline after 30 days and to Archive after 90 days. Which approach should they use?

Accepted Answer

Set up a Cloud Storage lifecycle policy with rules to transition to Nearline after 30 days and to Archive after 90 days. Cloud Storage lifecycle policies can automatically transition objects between storage classes based on age or other conditions. This is the simplest and most cost-effective method. Manually moving data is not practical. Object versioning helps with retention but not automatic tiering. Requester pays shifts costs but does not move data.

Answer

Write a custom script using Cloud Functions triggered by Pub/Sub to move objects

Answer

Use Object Versioning to automatically change storage class

Answer

Enable Requester Pays on the bucket to reduce storage costs

Question 2

An organization is using Cloud Build to build container images and push them to Artifact Registry. Which step in the cloudbuild.yaml file is necessary to tag and push the image?

Accepted Answer

A step that runs 'docker push' with the Artifact Registry URL. The 'docker push' step with the destination in Artifact Registry is required to push the built image to a registry.

Answer

A step that runs 'gcloud container images push'

Answer

A step that runs 'gsutil cp' to upload the image

Answer

A step that runs 'kubectl apply'

Question 3

You are designing a multi-region deployment for a critical application on GKE. The application must withstand a regional outage and automatically redirect traffic to the healthy region. Which THREE components must be configured? (Choose 3)

Accepted Answer

Cloud Spanner. Multi-region GKE with global load balancing, multi-cluster ingress, and a multi-region database like Spanner are required.

Answer

Regional Cloud SQL

Answer

Cloud NAT

Question 4

A DevOps team uses Cloud Build to deploy Docker images to GKE. They want to ensure that only images that have passed a vulnerability scan and been signed by a trusted authority can be deployed. Which service should they integrate with Cloud Build and GKE?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require images to be signed by trusted authorities and verified before deployment on GKE.

Answer

Artifact Analysis

Answer

Cloud Security Scanner

Answer

Cloud Key Management Service

Question 5

A team uses Cloud Build to build container images and deploy to Cloud Run. They want to automate deployments whenever a new image is pushed to Container Registry. What is the best approach?

Accepted Answer

Configure a Cloud Build trigger that runs on a push to the container image in Container Registry. Cloud Build triggers can be configured to fire on a push to a container image in Container Registry, using the 'cloud-builds' Pub/Sub topic that Container Registry publishes to when an image is pushed. This allows Cloud Build to automatically run a build step (e.g., gcloud run deploy) to deploy the new image to Cloud Run without any polling or external infrastructure.

Answer

Use Cloud Deploy with a delivery pipeline that polls for new images

Answer

Create a Cloud Function that subscribes to Pub/Sub and calls Cloud Run deploy

Answer

Set up a Cloud Scheduler job to run a script that deploys the latest image

Question 6

A team is using GKE with cluster autoscaling enabled. They notice that some nodes are underutilized but the cluster autoscaler does not remove them. What could be the reason?

Accepted Answer

The node has pods with restrictive PodDisruptionBudgets. The cluster autoscaler does not remove a node if there are pods that cannot be rescheduled elsewhere. This can happen due to PodDisruptionBudgets, local storage, or node-specific constraints.

Answer

The node is in a different zone

Answer

The node has running pods that are part of a DaemonSet

Answer

The cluster autoscaler is not configured to scale down

Question 7

A DevOps team wants to manage Google Cloud resources declaratively using Infrastructure as Code. They need to version control their configuration and automate deployments. Which two tools are natively supported by Google Cloud for this purpose?

Accepted Answer

Cloud Deployment Manager and Terraform. Cloud Deployment Manager uses YAML, Python, or Jinja templates, and Terraform is a popular IaC tool with a native Google Cloud provider. Both allow declarative management and version control.

Answer

Cloud Shell and gcloud CLI

Answer

AWS CloudFormation and Terraform

Answer

Ansible and Puppet

Question 8

A financial services company needs a disaster recovery plan for a critical application running on GKE. The application uses Cloud SQL for MySQL. The RPO is 5 minutes and RTO is 15 minutes. Which design meets these requirements cost-effectively?

Accepted Answer

Use Cloud SQL cross-region replication (MySQL) with a failover replica in another region, and deploy GKE cluster in that region with the same configuration.. Cloud SQL cross-region replication provides an asynchronous replica in another region with a typical replication lag of a few seconds, meeting the 5-minute RPO. The failover replica can be promoted in minutes, and deploying a GKE cluster in the same region with identical configuration allows the application to connect to the promoted replica, achieving the 15-minute RTO. This approach is cost-effective because you only pay for the replica and the second GKE cluster when needed for failover testing or actual disaster recovery.

Answer

Use Cloud SQL for MySQL with multi-region database flag and route traffic to nearest region via Cloud Load Balancing.

Answer

Set up VPC peering between two regions and use Cloud DNS to direct traffic in failover.

Answer

Use Cloud SQL backups to Cloud Storage and restore in another region, with GKE cluster recreated via Deployment Manager.

Question 9

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/artifactregistry.writer. The Cloud Build service account (usually project-number@cloudbuild.gserviceaccount.com) needs the Artifact Registry Writer role to push images. Editor role is too broad; Viewer is read-only; Storage Object Admin is for Cloud Storage, not Artifact Registry.

Answer

roles/artifactregistry.viewer

Answer

roles/editor

Answer

roles/storage.objectAdmin

Question 10

An organization has multiple GCP projects managed by a central operations team. They want to define a common VPC configuration in a host project and allow service projects to use it. Which networking feature should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to contain shared VPC networks that service projects can use. VPC peering is for connecting separate networks. Private Service Connect is for accessing managed services. Cloud VPN is for on-premises connectivity.

Answer

Private Service Connect

Answer

Cloud VPN

Answer

VPC peering

Question 11

A developer needs to store a database password securely and access it from a Cloud Run service. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager securely stores secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables.

Answer

Cloud Storage

Answer

Firestore

Answer

Cloud KMS

Question 12

Which TWO services can be used to create a CI/CD pipeline for a containerized application on Google Cloud? (Choose 2)

Accepted Answer

Cloud Deploy. Cloud Build builds and tests, and Cloud Deploy promotes releases. Both are essential for CI/CD.

Answer

Cloud Functions

Answer

Cloud Scheduler

Answer

Cloud Run

Question 13

A development team wants to automate the process of building container images from their GitHub repository and storing them in Artifact Registry. Which Google Cloud service should they use to create a build trigger that runs on every push to the main branch?

Accepted Answer

Cloud Build. Cloud Build is the CI/CD service that can be configured with build triggers to automatically build images on source code changes and push them to Artifact Registry.

Answer

Container Registry

Answer

Artifact Registry

Answer

Cloud Deploy

Question 14

A finance company needs to ensure that all compute instances in their VPC can only communicate with Google APIs (e.g., Cloud Storage) over internal IPs. Additionally, instances without external IPs should be able to access the internet for updates. Which TWO configurations should they implement?

Accepted Answer

Configure Cloud NAT. Private Google Access allows VMs to use internal IPs to access Google APIs. Cloud NAT enables outbound internet access for instances without external IPs.

Answer

Create a firewall rule allowing egress to 0.0.0.0/0

Answer

Assign external IPs to all instances

Answer

Use VPC peering with Google's public network

Question 15

A Cloud Run service needs to access resources in a VPC network (e.g., a Cloud SQL instance). The service should be able to send requests to the VPC and receive responses. What is the correct configuration?

Accepted Answer

Create a VPC connector and configure the Cloud Run service to use it for egress. Cloud Run can use a VPC connector (Serverless VPC Access) to send requests to a VPC. It does not allow inbound traffic from the VPC without additional setup.

Answer

Place the Cloud Run service in a VPC subnet

Answer

Use Cloud NAT to allow Cloud Run to access the VPC

Answer

Use VPC peering between Cloud Run and the VPC