Google PCA Practice Test 15 — 15 Questions

Question 1

Your organization runs a global e-commerce platform on Google Kubernetes Engine (GKE). The security team requires that all container images deployed to the cluster are scanned for vulnerabilities and that deployments are blocked if critical vulnerabilities are found. They also want to minimize operational overhead. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Binary Authorization in the cluster and configure a policy that requires attestations from a vulnerability scanner before deployment.. Binary Authorization is a Google Cloud service that enforces deploy-time policies by requiring attestations. By integrating with Container Analysis, you can automatically attest only images that pass vulnerability scanning, and the policy blocks images without attestations. This automates enforcement and reduces manual review, satisfying both security and operational efficiency.

Answer

Configure a Kubernetes admission controller that calls the Container Analysis API to check for vulnerabilities and rejects pods with critical findings.

Answer

Enable Pod Security Policies to restrict images to those from trusted registries, and rely on registry scanning to prevent vulnerable images.

Answer

Use Cloud Build to scan images with Container Analysis, and manually review the scan results before approving each deployment.

Question 2

A financial services company uses VPC Service Controls to protect their project containing BigQuery datasets and Cloud Storage buckets. They have a perimeter that includes the BigQuery service. Users report that they cannot export data from BigQuery to Cloud Storage using the web console. The export job fails with an access denied error. The team needs to allow exports while maintaining data exfiltration prevention. The users have the necessary IAM permissions (BigQuery Data Editor, Storage Object Admin) on the appropriate resources. What should the architect do?

Accepted Answer

Add Cloud Storage to the same VPC Service Controls perimeter.. VPC Service Controls perimeters enforce data exfiltration prevention by default, blocking egress from protected services (like BigQuery) to unprotected services (like Cloud Storage). Adding Cloud Storage to the same perimeter allows BigQuery to export data to Cloud Storage while still preventing data from leaving the perimeter. The users already have the necessary IAM roles (BigQuery Data Editor and Storage Object Admin), so the issue is solely the perimeter boundary, not permissions.

Answer

Remove BigQuery from the VPC Service Controls perimeter.

Answer

Create an access level that permits exports during business hours.

Answer

Grant the users the Storage Object Admin role at the bucket level.

Question 3

Your team manages a production web application on Compute Engine behind an external Application Load Balancer. During a recent incident, the load balancer's backend service marked all instances as unhealthy because the health check endpoint returned HTTP 200 but the application was actually in a degraded state. You need Cloud Monitoring to alert the operations team when the application's error rate exceeds 5% over a 5-minute window. You also need to ensure that the alert does not fire during planned maintenance windows. Which approach should you take?

Accepted Answer

Create a log-based metric that counts HTTP 5xx responses from the load balancer logs, then create an alerting policy on that metric with a threshold of 5% error rate and configure a maintenance window for planned downtime.. The requirement is to alert on application error rate exceeding 5% over 5 minutes, with suppression during maintenance. A log-based metric from load balancer logs captures every request's status, enabling an accurate error rate calculation. Alerting policies on such metrics support threshold conditions and maintenance windows. The other options either alter health checks in a harmful way, rely on uptime checks that miss application-level errors, or use sampled trace data that is not representative.

Answer

Use Cloud Trace to sample requests and create an alerting policy based on the latency of traces that return errors, triggering when error traces exceed 5% of total traces.

Answer

Create an uptime check that sends HTTP requests to the application's health endpoint every minute and alerts when the check fails from more than one region.

Answer

Configure a custom health check on the load balancer that returns HTTP 500 when the application is degraded, and create an alerting policy on the backend service's unhealthy instance count.

Question 4

A retail company runs an e-commerce platform on GKE. The SRE team wants to measure the error budget for a service level objective (SLO) defined as the proportion of requests served with HTTP 2xx or 3xx status over a 28-day window. They need a monitoring configuration that computes the burn rate and alerts when the budget is being consumed too quickly, while avoiding noisy alerts during brief spikes. What should they do?

Accepted Answer

Use Cloud Monitoring SLO monitoring to define the request-based SLO, then create a multi-window, multi-burn-rate alerting policy on that SLO.. Cloud Monitoring SLO monitoring natively models request-based SLOs, tracks error budgets, and supports burn-rate alerting. Multi-window, multi-burn-rate policies combine a short window for fast detection with a longer window for confirmation, which filters out brief spikes. This is the supported, least-effort way to alert on rapid budget consumption for a 28-day SLO.

Answer

Create an alerting policy on a log-based metric that counts 5xx responses and alert when the count exceeds a static threshold.

Answer

Export request metrics to BigQuery and run a scheduled query that emails the team when the 28-day success ratio drops below the target.

Answer

Create a Cloud Monitoring uptime check on the service endpoint and alert when two consecutive checks fail.

Question 5

A retail company runs a stateful PostgreSQL database on a Compute Engine VM in project prod-db. The database writes nightly backups to a regional Cloud Storage bucket in a separate project, backup-archive. The security team requires that the VM's service account can upload objects but must not be able to delete or overwrite existing backups. Which IAM configuration should the architect implement?

Accepted Answer

Grant roles/storage.objectCreator on the bucket to the VM's service account.. The VM's service account needs write-only access to the backup bucket, which maps exactly to the storage.objects.create permission contained in the objectCreator role. Applying that role on the specific bucket limits the grant to backup-archive and prevents deletion or overwriting of existing backups. Broader roles such as objectAdmin or legacyBucketWriter include delete and overwrite permissions that violate the immutability requirement.

Answer

Grant roles/storage.legacyBucketWriter on the bucket to the VM's service account.

Answer

Grant roles/storage.objectViewer on the bucket to the VM's service account.

Answer

Grant roles/storage.objectAdmin on the bucket to the VM's service account.

Question 6

A data engineer needs to automatically detect and redact sensitive data such as credit card numbers from text files uploaded to Cloud Storage before the data is loaded into BigQuery. Which GCP service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API is purpose-built to discover, classify, and redact sensitive data such as credit card numbers, social security numbers, and other PII from text and structured content. It can be integrated into a pipeline that scans files in Cloud Storage before loading into BigQuery, applying de-identification transformations like masking or tokenization. No other listed service provides sensitive-data detection and redaction capabilities.

Answer

Cloud KMS

Answer

Cloud Audit Logs

Answer

Cloud Vision API

Question 7

A financial services company runs a payment API on Compute Engine behind an internal passthrough Network Load Balancer. The compliance team requires that all administrative actions on the project be attributable to a named human, that production changes be reviewed before taking effect, and that no single engineer can delete the production database. Which combination of Google Cloud controls should the cloud architect implement?

Accepted Answer

Assign least-privilege predefined roles to engineers, require all production changes to go through a CI/CD pipeline that uses a dedicated service account in a separate project, and protect the production database with a resource-level deny policy and separation of duties.. The compliance demands map to preventive controls: least privilege to limit permissions, a reviewed CI/CD pipeline with a dedicated service account in a separate project to enforce change review and attribution, and a resource-level deny policy plus separation of duties to stop any one engineer from deleting the production database. Detective measures like audit logging and alerting are useful but insufficient on their own. The combination of IAM restrictions, automation, and deny policies satisfies all three requirements.

Answer

Require all engineers to use hardware security keys for two-factor authentication, enable Identity-Aware Proxy for SSH access to instances, and create an alerting policy that notifies the security team when the database is deleted.

Answer

Grant the Project Owner role to all senior engineers, enable Cloud Audit Logs for Admin Activity, and require them to use a shared break-glass account for emergency changes.

Answer

Enable VPC Service Controls around the production project, grant engineers the Editor role, and configure Cloud Logging sinks to export audit logs to a separate project for long-term retention.

Question 8

A media company runs a video transcoding service on GKE Standard. The service experiences sudden traffic spikes, and the operations team wants to ensure that the cluster can scale nodes automatically and that pods are rescheduled quickly when a node fails. The team also wants to monitor and alert on resource saturation. Which two actions should the cloud architect take to meet these requirements? (Choose two.)

Accepted Answer

Enable cluster autoscaler on the node pools and set appropriate minimum and maximum node counts based on expected peak load.. Automatic node scaling requires cluster autoscaler on the node pools, and it works correctly only when pods declare accurate resource requests and limits so the scheduler and autoscaler can size capacity. Together these ensure nodes are added during spikes and pods are placed and rescheduled efficiently. Pod disruption budgets, Cloud CDN, and HorizontalPodAutoscaler address different concerns and do not provide node-level scaling or rapid recovery from node failure.

Answer

Create a HorizontalPodAutoscaler based on CPU utilization for the transcoding deployment to add more pods when demand increases.

Answer

Enable Cloud CDN in front of the transcoding service to cache video segments and reduce load on the GKE pods.

Answer

Configure pod disruption budgets for the transcoding deployment to guarantee a minimum number of available pods during voluntary disruptions.

Question 9

A healthcare company runs a critical application on Google Kubernetes Engine (GKE) that processes patient data. The compliance team requires that all container images be scanned for vulnerabilities before deployment, and that only images from a trusted registry be allowed. The security team wants to enforce this policy across all clusters in the organization. They also need to audit any attempts to deploy untrusted images. Which combination of Google Cloud services should they use?

Accepted Answer

Use Binary Authorization with a policy that requires attestations from a trusted authority, and enable audit logging for GKE.. Binary Authorization is the Google Cloud service designed to enforce deploy-time policies on GKE by requiring attestations. By setting a policy that requires attestations from a trusted authority, the company ensures that only images that have been built and scanned by trusted processes are admitted. Enabling audit logging provides a record of all deployment attempts, including those that violate the policy. This satisfies both the enforcement and auditing requirements across all clusters in the organization.

Answer

Enable GKE Sandbox on all nodes and use Anthos Config Management to apply a policy that restricts image registries.

Answer

Use Container Analysis to scan images and configure a GKE admission controller to reject images with vulnerabilities.

Answer

Use Artifact Registry with vulnerability scanning enabled and configure IAM policies to restrict which projects can pull images.

Question 10

Your company runs a stateful application on Compute Engine instances in a managed instance group (MIG). The application writes data to a persistent disk attached to each instance. You need to ensure that the application can automatically recover from a zone failure by recreating instances in another zone with their persistent disks. You also want to minimize data loss. Which configuration should you implement?

Accepted Answer

Create a regional MIG with instances distributed across multiple zones in the region, and configure each instance to use a regional persistent disk that is replicated across those zones.. A regional MIG spreads instances across multiple zones and can automatically recreate instances in healthy zones if one zone fails. Regional persistent disks are replicated across two zones, ensuring that data is available in another zone with minimal loss. Together, they provide automatic recovery and data redundancy. Zonal MIGs cannot move instances across zones, and standard persistent disks are not replicated.

Answer

Create a zonal MIG in a single zone and use a snapshot schedule to back up persistent disks every hour to a multi-region bucket. In case of zone failure, manually restore the snapshots to new instances in another zone.

Answer

Create a regional MIG and attach a standard persistent disk to each instance. Configure the MIG to recreate instances in other zones, and rely on the persistent disk's automatic replication across zones.

Answer

Create a zonal MIG and configure an autoscaler to add instances in other zones when the primary zone fails. Use a Cloud Storage bucket to store application data instead of persistent disks.

Question 11

A retail company runs a web application on Compute Engine instances behind an external HTTP(S) load balancer. During a flash sale, the operations team notices that the load balancer is returning HTTP 502 errors for a subset of requests. The backend service health checks are passing, and the instances are not under heavy CPU load. The team wants to identify the root cause quickly and prevent recurrence. Which action should they take first?

Accepted Answer

Review the load balancer's logs in Cloud Logging for HTTP 502 status codes and examine the backend service's health check logs.. The most effective first step is to use Cloud Logging to examine load balancer logs and health check logs. These logs provide detailed information about the 502 errors, including which backend instances are involved and any error messages. By analyzing this data, the team can pinpoint the root cause, such as a misconfigured backend, an application error, or a network issue. Only after identifying the cause should they take corrective action to prevent recurrence.

Answer

Configure a Cloud Armor security policy to block traffic from suspicious IP addresses.

Answer

Enable Cloud CDN on the backend service to cache static content and reduce load on the instances.

Answer

Increase the backend service's timeout setting from 30 seconds to 60 seconds.

Question 12

A retail company runs a stateless web tier on a managed instance group (MIG) of Compute Engine VMs behind an external Application Load Balancer. Traffic spikes every evening and the operations team currently resizes the MIG manually. They want the group to add and remove VMs automatically based on CPU utilization without changing the instance template. What should the architect configure?

Accepted Answer

An autoscaling policy on the managed instance group using a CPU utilization target.. A managed instance group autoscaling policy is the native mechanism for adding and removing Compute Engine VMs in response to load signals such as CPU utilization. Because the web tier is stateless and already behind a load balancer, horizontal scaling is safe and does not require rebuilding the instance template.

Answer

A Cloud Scheduler job that calls the Compute Engine API to resize the managed instance group every evening.

Answer

A network endpoint group (NEG) that automatically registers new VM instances when CPU usage rises.

Answer

A preemptible VM pool that the load balancer adds to the backend service during peak hours.

Question 13

A security team needs to detect and redact personally identifiable information (PII) from documents uploaded to Cloud Storage before they are stored. Which GCP service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API is purpose-built to inspect, classify, and de-identify sensitive data such as PII, PHI, and credentials. It can scan Cloud Storage objects and apply infoType detectors (e.g., US_SOCIAL_SECURITY_NUMBER, EMAIL_ADDRESS) with redaction, masking, tokenization, or bucketing transforms before the data is persisted. This directly matches the requirement to detect and redact PII prior to storage.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Access Transparency

Question 14

A healthcare analytics company stores sensitive patient datasets in a Cloud Storage bucket in the us-central1 region. A new regulation requires that the data never leave the United States and that access be restricted to a defined set of projects. The security team wants a guardrail that prevents any future project from reading the bucket unless it is explicitly authorized, while keeping administration simple. What should the architect implement?

Accepted Answer

Create a VPC Service Controls perimeter around the authorized projects with the Cloud Storage bucket as a protected resource, and grant access only through the perimeter.. The regulation requires both a location boundary and a hard restriction on which projects may read the data. VPC Service Controls builds a perimeter that denies access to protected services from outside the perimeter, so even a project that later receives an IAM role cannot read the bucket unless it is inside the perimeter. This gives a centralized guardrail that IAM or resource location constraints alone cannot provide.

Answer

Create an organization policy with the constraints/gcp.resourceLocations constraint set to allow only us-central1, and attach it to the organization node.

Answer

Enable Object Versioning and a retention policy on the bucket, then share the bucket with the authorized projects using signed URLs.

Answer

Apply a bucket-level IAM policy that grants roles/storage.objectViewer only to the authorized projects' service accounts and enable uniform bucket-level access.

Question 15

Your company has a service running on Google Kubernetes Engine (GKE) that experiences occasional spikes in traffic. You need to ensure that the service remains available during these spikes by automatically scaling the number of pods based on CPU utilization. You also want to minimize cost by scaling down when traffic decreases. Which Kubernetes resource should you configure?

Accepted Answer

A HorizontalPodAutoscaler with a target CPU utilization of 80% and a minimum of 2 replicas and a maximum of 10 replicas.. HorizontalPodAutoscaler is the Kubernetes resource designed to scale the number of pods based on metrics like CPU utilization. By setting a target CPU utilization and replica bounds, it can automatically add pods during spikes and remove them when demand drops, ensuring availability and cost efficiency. The other options either adjust resources vertically, scale nodes, or manage disruptions, none of which directly scale pods based on CPU.

Answer

A Cluster Autoscaler with a node pool that has a minimum of 2 nodes and a maximum of 10 nodes.

Answer

A VerticalPodAutoscaler with a target CPU utilization of 80%.

Answer

A PodDisruptionBudget with minAvailable set to 80%.