Google PCA Practice Test 15 — 15 Questions

Question 1

A company has a Cloud Run service that processes high-throughput requests. They want to reduce latency by keeping a baseline of warm instances always ready to handle traffic. Which Cloud Run configuration parameters should they adjust?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set min-instances to 10 and CPU to always-on. Setting min-instances to a value greater than 0 ensures that Cloud Run keeps at least that many instances warm, ready to serve requests without cold start latency. Max-instances sets an upper limit. Concurrency controls how many requests each instance can handle. CPU allocation can be set to always-on to reduce latency, but that is a separate setting.

Answer

Set min-instances to 0 and max-instances to 100

Answer

Set max-instances to a high value and concurrency to 1

Answer

Set max-instances to 0 (unlimited) and concurrency to 80

Question 2

An organization wants to ensure that all Compute Engine instances in a project are patched with the latest security updates. They also want to enforce a custom configuration (e.g., disable root SSH login) across all instances. Which TWO Google Cloud services should they use together?

Accepted Answer

OS Config patch management. OS Config's patch management handles patching, and OS policies enforce configurations like disabling root login. Cloud Monitoring monitors but does not patch; Cloud Asset Inventory discovers resources; Deployment Manager is for infrastructure-as-code, not ongoing configuration.

Answer

Cloud Monitoring

Answer

Cloud Deployment Manager

Answer

Cloud Asset Inventory

Question 3

An engineer wants to store a database password securely and allow a Cloud Run service to access it. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables. Cloud KMS is for encryption keys. Cloud Storage is for objects. Firestore is a database.

Answer

Cloud Storage

Answer

Cloud Key Management Service (KMS)

Answer

Firestore

Question 4

A data analytics team wants to build a pipeline that processes files from a Cloud Storage bucket, transforms the data, and loads it into BigQuery. They want to trigger the pipeline only when new files arrive. Which THREE services can be used together to achieve this? (Choose 3.)

Accepted Answer

Cloud Storage triggers for Cloud Functions. Cloud Functions can be triggered by Cloud Storage events (e.g., object finalize). Cloud Workflows can orchestrate multiple steps. Cloud Build is for CI/CD, not event-driven data processing. Cloud Scheduler is for scheduled jobs, not event triggers. Cloud Run can be invoked by Cloud Functions or eventarc, but the direct trigger from storage is via Cloud Functions or Eventarc.

Answer

Cloud Scheduler

Answer

Cloud Build triggers

Question 5

You want to monitor the latency of an application running on Compute Engine and create an alert if the 99th percentile latency exceeds 500ms for more than 5 minutes. Which approach should you use?

Accepted Answer

Create a Metric Threshold alert using the 'Latency' metric with a percentile alignment. Cloud Monitoring can create alerting policies based on distribution metrics (like latency) using percentile aggregations. You can define a metric threshold with a rolling window.

Answer

Use Cloud Trace to analyze latency and set a trace-based alert

Answer

Use Error Reporting to capture latency errors

Answer

Create a log-based metric from application logs and set an alert on that metric

Question 6

A company runs a stateful application on GKE that requires persistent storage. They want to ensure that during cluster upgrades, pods are not disrupted and storage is preserved. Which configuration should they use?

Accepted Answer

Use a StatefulSet with a PodDisruptionBudget. PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like cluster upgrades. PersistentVolumeClaims with ReadWriteOnce access mode allow pods to persist data. Combining PDBs with StatefulSets provides ordered, graceful deployment and scaling while preserving storage. The cluster autoscaler only adjusts node count, not pod disruptions. HorizontalPodAutoscaler scales pods based on metrics but does not protect against disruptions.

Answer

Enable Cluster Autoscaler on the node pool

Answer

Use a Deployment with a HorizontalPodAutoscaler

Answer

Use PersistentVolumeClaims with ReadWriteMany access mode

Question 7

A developer is writing a Cloud Function that processes files uploaded to a Cloud Storage bucket. Which trigger should they use?

Accepted Answer

Cloud Storage trigger. Cloud Functions can be triggered by Cloud Storage events such as object finalize, delete, etc.

Answer

HTTP trigger

Answer

Firestore trigger

Answer

Pub/Sub trigger

Question 8

A company uses Terraform to manage infrastructure. They want to store the Terraform state file remotely and enable state locking to prevent concurrent modifications. Which three Google Cloud services or features should they use? (Choose three.)

Accepted Answer

Object versioning on the state bucket. Cloud Storage is used as a backend for Terraform state. Object versioning provides history and locking via the storage object's generation number. Cloud KMS can encrypt the state file. Cloud NAT is for outbound connectivity. Cloud Shell is not required for state management. Secret Manager is for secrets, not state.

Answer

Cloud NAT

Answer

Cloud Shell

Question 9

A company is deploying a critical application on GKE and wants to ensure high availability during node upgrades and failures. Which TWO configurations should they implement? (Choose 2.)

Accepted Answer

Configure a PodDisruptionBudget for the deployment. PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like node upgrades. Multi-zonal node pools distribute pods across zones, protecting against zone failures. Cluster Autoscaler adds nodes when needed but does not directly ensure availability. HPA scales pods but does not handle disruptions. Workload Identity is for authentication, not availability.

Answer

Enable Workload Identity for the service account

Answer

Use a HorizontalPodAutoscaler with high target utilization

Answer

Enable Cluster Autoscaler on the node pool

Question 10

A security team wants to enforce that only container images signed by their internal CI/CD pipeline can run on GKE clusters. They also need to ensure that unsigned images are rejected at admission time. Which combination of services and configurations should they use?

Accepted Answer

Binary Authorization with Cloud KMS for signing. Binary Authorization enforces policy by requiring images to be signed by trusted signers (e.g., using Cloud KMS). It integrates with GKE admission control to block unsigned images. Cloud KMS creates and manages signing keys. Artifact Registry stores signed images but does not enforce policy. Cloud Build can be used to sign images during build, but the enforcement mechanism is Binary Authorization.

Answer

GKE PodSecurityPolicy with allowed registries

Answer

Cloud Build with Container Analysis

Answer

Artifact Registry vulnerability scanning and IAM roles

Question 11

A company runs a stateful workload on GKE that requires at most one pod per node. They want to survive a zonal failure with minimal downtime. The application can be restarted on a new node. Which configuration should they use?

Accepted Answer

Use a StatefulSet with pod anti-affinity required and a regional cluster. A StatefulSet with pod anti-affinity required ensures one pod per node. A regional cluster with nodes in multiple zones allows rescheduling in another zone. A single-zone cluster would not survive a zonal failure. PDB limits disruption but does not handle zone failure.

Answer

Use a Deployment with a PodDisruptionBudget set to maxUnavailable=0

Answer

Deploy a Deployment with a nodeSelector for one zone

Answer

Use a DaemonSet with node affinity

Question 12

A team wants to collect and analyze logs from multiple projects into a centralized BigQuery dataset for long-term retention and SQL querying. They want to exclude health check logs to reduce costs. Which approach should they use?

Accepted Answer

Create a log sink to BigQuery and add a log exclusion filter for health check logs. Log sinks can route logs to BigQuery, and exclusion filters can be applied to filter out specific logs before they are ingested.

Answer

Use Cloud Monitoring to exclude health check logs

Answer

Create a log metric for health check logs and filter in BigQuery

Answer

Set up a Cloud Function to delete health check logs from BigQuery

Question 13

A team wants to enforce that only container images signed by their CI/CD system can be deployed to GKE. They have enabled Binary Authorization with a policy that requires an attestor. What additional step must they take to bind the attestor to the image signing process?

Accepted Answer

Create a Container Analysis note and grant the attestor service account the containeranalysis.notes.attacher role. After creating the attestor, you must create an AttestationAuthority note in Container Analysis and grant the attestor service account permission to bind attestations. Configuring Cloud Build to sign images is part of the process but not the binding step.

Answer

Add the attestor to the Binary Authorization policy as a required attestor

Answer

Create a Cloud Build step that signs the image and stores the signature in Cloud Storage

Answer

Configure the GKE cluster to require Binary Authorization with the --no-enforce flag

Question 14

An organization wants to export their Cloud Logging logs to a centralized BigQuery dataset for long-term analysis. They also need to exclude logs from a specific source (e.g., a test project) to reduce costs. How should they set this up?

Accepted Answer

Create a log sink to BigQuery and add a log exclusion filter that excludes the test project's logs. A log sink exports logs to BigQuery. To exclude logs from a test project, create a log exclusion filter that matches the test project's logs and apply it to the sink or the project's logs bucket.

Answer

Disable logging in the test project

Answer

Create two separate sinks: one for production logs to BigQuery and another for test logs to Cloud Storage

Answer

Create a log sink to BigQuery and use IAM to restrict access to the test project's logs

Question 15

Your company's global e-commerce platform uses a managed instance group (MIG) in us-central1 and a Cloud Load Balancer. Traffic has grown, and you want to improve availability by distributing load across multiple regions. What should you do?

Accepted Answer

Create MIGs in additional regions and add them as backends to the existing global load balancer.. A global external HTTP(S) load balancer can have backends in multiple regions. By creating managed instance groups (MIGs) in additional regions and adding them as backends to the existing global load balancer, you distribute traffic across regions, improving availability and reducing latency for users worldwide. This approach leverages the load balancer's anycast IP and cross-region load balancing capabilities.

Answer

Increase the machine type of the existing instances to handle more traffic.

Answer

Enable Cloud CDN to cache content closer to users.

Answer

Change the load balancer to global and configure a single backend.