Google PCA Practice Test 14 — 15 Questions

Question 1

A company wants to connect their on-premises data center to Google Cloud with a dedicated private connection that provides 99.99% availability and supports up to 100 Gbps bandwidth. They have a colocation facility near a Google Cloud region. Which connectivity option should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the customer's colocation facility and Google's network, supporting up to 100 Gbps per link (with 10 Gbps or 100 Gbps circuits) and offering a 99.99% SLA when configured with redundant connections. Because the company already has a colocation facility near a Google region, Dedicated Interconnect is the correct fit for the stated bandwidth and availability requirements.

Answer

Partner Interconnect

Answer

Direct Peering

Answer

HA VPN

Question 2

A media company stores video files in Cloud Storage for streaming. Infrequently accessed videos older than 90 days are currently in Standard storage. To reduce costs, they want to automatically move these files to a lower-cost storage class and delete them after 3 years. Which configuration should they use?

Accepted Answer

Use a lifecycle rule with condition 'age > 90 days' to set storage class to Nearline, and another rule with 'age > 1095 days' to delete.. Cloud Storage lifecycle rules are the native, automated way to transition objects between storage classes and delete them based on age. A rule with condition 'age > 90 days' setting storage class to Nearline (or Coldline) reduces cost for infrequent access, and a second rule with 'age > 1095 days' (3 years) deletes the objects. This is declarative, server-side, and requires no custom code.

Answer

Configure a Pub/Sub notification on object changes and process via Dataflow.

Answer

Use gsutil rewrite command with -s option manually for each file.

Answer

Create a Cloud Function that moves objects monthly using a cron job.

Question 3

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles. Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.

Answer

Use VPC Service Controls to restrict the bucket to only the GKE cluster's VPC

Answer

Use firewall rules to allow traffic only from the GKE cluster's pod CIDR

Answer

Use Cloud Armor to restrict access based on source IP

Question 4

A company uses Cloud Storage for backup data. They want to protect against accidental deletion. Which option is best?

Accepted Answer

Enable object versioning.. Object versioning in Cloud Storage preserves every version of an object, including overwrites and deletions. When versioning is enabled, a delete operation creates a delete marker instead of permanently removing the object, allowing easy recovery. This directly protects against accidental deletion by retaining all previous object versions.

Answer

Use a lifecycle policy.

Answer

Set a retention policy.

Answer

Use object holds.

Question 5

A company has a Cloud Run service that processes images uploaded by users. The service reads the images from a Cloud Storage bucket and writes processed images to another bucket. The team recently updated the service to use a custom service account named 'image-processor-sa' with minimal permissions. After the update, the service fails with permission errors when trying to read from the source bucket. The team verified that the service account has the Storage Object Viewer role on the source bucket and Storage Object Creator role on the destination bucket. What should the architect do to resolve the issue?

Accepted Answer

Ensure the Cloud Run service uses the correct service account by redeploying with the --service-account flag set to 'image-processor-sa@project-id.iam.gserviceaccount.com'.. The error occurs because the Cloud Run service is not using the custom service account 'image-processor-sa' despite it being created and granted permissions. By default, Cloud Run uses the Compute Engine default service account unless explicitly overridden. Redeploying with the --service-account flag attaches the correct identity to the Cloud Run revision, allowing it to authenticate with Cloud Storage using the minimal permissions already assigned.

Answer

Grant the service account the Cloud Run Invoker role on the Cloud Run service.

Answer

Assign the Storage Admin role to the service account.

Answer

Enable the Cloud Storage API for the project.

Question 6

Your company runs a containerized microservices application on Google Kubernetes Engine (GKE) with a regional cluster. The application consists of a frontend service, a backend API service, and a background worker service that processes messages from Cloud Pub/Sub. The worker service uses a Deployment with 3 replicas. Recently, the team noticed that the worker service is frequently failing with 'ContainerCreating' errors. The error message in the pod events is: 'Failed to pull image "gcr.io/my-project/my-worker:latest": rpc error: code = DeadlineExceeded desc = context deadline exceeded'. The image is stored in Container Registry in the same project. The cluster nodes are n1-standard-2 VMs with 10 GB of disk space. The team has confirmed that the image exists and that the nodes have internet access. What is the most likely cause of the issue?

Accepted Answer

The nodes have insufficient disk space to pull the new image, causing the pull to time out.. The error 'context deadline exceeded' when pulling an image indicates that the kubelet timed out while trying to download the container image. With only 10 GB of disk space on n1-standard-2 nodes, the node's disk may be nearly full, causing the image pull to stall or fail due to insufficient space to unpack the layers. This is the most likely cause because the image exists and internet access is confirmed, ruling out authentication or connectivity issues.

Answer

The worker pods require node affinity to a specific node pool that is not configured.

Answer

The nodes do not have the necessary permissions to access Container Registry.

Answer

The cluster is a regional cluster, but the worker pods are all scheduled in the same zone, causing resource contention.

Question 7

A company is deploying a new application on Compute Engine and wants to automate the installation of a custom agent on every newly created VM in a specific project. Which Google Cloud service should they use?

Accepted Answer

VM Manager (OS Config) with a guest policy to install the agent.. VM Manager (OS Config) with a guest policy is the correct choice because it provides a native, agent-based configuration management service that can enforce the installation of a custom agent on all existing and newly created VMs in a project without requiring changes to instance templates or startup scripts. Guest policies are evaluated and applied at VM boot time and periodically thereafter, ensuring consistent agent deployment across the fleet.

Answer

Instance templates with startup scripts.

Answer

Deployment Manager with a template that includes the agent installation.

Answer

Cloud Build triggered on new VM creation events.

Question 8

An application running on GKE Autopilot is experiencing intermittent failures due to resource limits. The team wants to ensure that the application always has enough CPU and memory without manual node management. What should they do?

Accepted Answer

Increase the resource requests and limits in the pod specification. In GKE Autopilot, nodes are fully managed by Google, so the team cannot create or resize node pools. The correct lever is to set appropriate CPU and memory requests (and limits) in the pod specification so the scheduler and Autopilot's autoscaler provision nodes with sufficient capacity. Autopilot uses the requests to bin-pack pods and to decide when to add nodes, so undersized requests cause intermittent failures under load.

Answer

Use horizontal pod autoscaling only

Answer

Create a new node pool with larger machine types

Answer

Switch to GKE Standard and manage node pools manually

Question 9

A company has a Cloud SQL for PostgreSQL instance that experiences high connection overhead. Developers frequently open and close connections. Which solution reduces connection overhead without code changes?

Accepted Answer

Configure PgBouncer as a sidecar. PgBouncer is a lightweight connection pooler that sits between the application and Cloud SQL for PostgreSQL, maintaining a pool of persistent backend connections and multiplexing many short-lived client connections onto them. This eliminates the TCP/TLS handshake and PostgreSQL authentication overhead per request without any application code changes, since the app simply connects to PgBouncer's endpoint instead of directly to the database.

Answer

Increase max_connections in Cloud SQL

Answer

Switch to Private IP

Answer

Use Cloud SQL Auth Proxy

Question 10

A company has a VPC Service Perimeter that protects a project containing BigQuery datasets. They want to allow an external customer's BigQuery job to query data across the perimeter boundary using a private connection. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter that allows access from the external customer's VPC network.. VPC Service Controls perimeters block access to protected services (like BigQuery) from outside the perimeter by default. To allow an external customer's BigQuery job to query data across the boundary using a private connection, you must create an ingress rule in the service perimeter that specifies the source (the external VPC network or project) and the allowed identities, services, and resources. Ingress rules are the designed mechanism for permitting inbound cross-perimeter access without removing the project from protection.

Answer

Remove the project from the service perimeter temporarily.

Answer

Use Access Transparency to log cross-perimeter access.

Answer

Grant the external customer's service account the BigQuery User role.

Question 11

A financial services company runs a critical PostgreSQL database on Cloud SQL. They need to ensure automatic failover to a replica in another zone within the same region with minimal data loss. What configuration should they choose?

Accepted Answer

Configure a Cloud SQL HA instance with a failover replica in a different zone. Cloud SQL High Availability (HA) provisions a standby instance in a different zone within the same region and performs automatic failover with synchronous replication, giving near-zero RPO and minimal downtime. This directly satisfies the requirement for automatic cross-zone failover with minimal data loss.

Answer

Use Database Migration Service to replicate to a second Cloud SQL instance

Answer

Enable point-in-time recovery (PITR) and increase backup retention

Answer

Create a cross-region read replica and manually promote it on failure

Question 12

An engineer needs to create a custom dashboard in Cloud Monitoring to track the 99th percentile latency of their application over the last 7 days. Which type of metric should they use?

Accepted Answer

Distribution metric. Distribution metrics capture a histogram of values across a population of samples, preserving the full value distribution rather than collapsing it to a single number. This is essential for computing percentile aggregations like p99, since percentiles require the underlying histogram buckets to be calculated. Cloud Monitoring's distribution metrics (e.g., from OpenCensus/OpenTelemetry or load balancer latency) support aligner/aggregation functions such as percentile, count, and mean over a time window.

Answer

Delta metric

Answer

Cumulative metric

Answer

Gauge metric

Question 13

A company wants to use BigQuery with a predictable monthly cost, regardless of query volume. They have a steady state of around 500 concurrent slots. Which pricing model should they choose?

Accepted Answer

Slot reservations (flat-rate). BigQuery slot reservations (flat-rate) provide a fixed monthly cost based on reserved slots, suitable for predictable workloads. On-demand pricing charges per query and can vary.

Answer

Sustained use discounts

Answer

Committed use discounts for BigQuery

Answer

On-demand pricing

Question 14

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

Accepted Answer

Cloud DLP. Cloud DLP (option C) is correct because it provides native content inspection and de-identification (redaction) of sensitive data like credit card numbers using built-in infoType detectors. Cloud Functions (option D) is correct because it can be triggered by Cloud Storage events (e.g., finalize/create) to invoke the DLP API on newly uploaded CSV files, enabling serverless, event-driven processing without managing infrastructure.

Answer

Cloud Dataflow

Answer

Cloud Run

Answer

BigQuery

Question 15

An administrator is configuring firewall rules in a VPC. Two rules apply to the same traffic: rule 1 allows ingress from 0.0.0.0/0 on TCP 80, rule 2 denies ingress from 10.0.0.0/8 on TCP 80. Rule 1 has priority 1000, rule 2 has priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because rule 2 has higher priority.. In Google Cloud VPC firewall rules, rules are evaluated in priority order, with lower numbers having higher priority. Rule 2 (priority 500) is evaluated before rule 1 (priority 1000), and since rule 2 explicitly denies ingress from 10.0.0.0/8 on TCP 80, traffic from 10.0.0.1 is denied. Google Cloud firewall rules are stateful, and the first matching rule determines the outcome; there is no implicit override between allow and deny.

Answer

The result is unpredictable without knowing the rule creation order.

Answer

Traffic is allowed because allow rules override deny rules.

Answer

Traffic is allowed because rule 1 has a lower priority number.