Google PCA Practice Test 16 — 15 Questions

Question 1

A financial services company runs a regulated workload on Compute Engine in a single project. Auditors require that all data written to persistent disks, including boot disks, is encrypted with keys the company controls and can revoke on demand, without the company operating its own key management infrastructure. The security lead must choose an encryption approach that satisfies this requirement with the least operational overhead. What should the security lead do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure customer-managed encryption keys (CMEK) in Cloud KMS and set the project-level default key so new persistent disks are encrypted with the company's key.. CMEK in Cloud KMS is the correct fit because the company retains ownership and control of the key while Google operates the HSM-backed key infrastructure. Setting a project-level default key ensures new persistent disks and boot disks use the company's key automatically, and disabling a key version immediately makes the data inaccessible, meeting the revocability requirement with minimal operational effort.

Answer

Enable Confidential VM on all instances so that memory and disk contents are protected by encryption keys generated and held inside the hardware.

Answer

Rely on Google-managed encryption keys, which rotate automatically, and use Cloud External Key Manager to wrap the keys after the fact.

Answer

Use customer-supplied encryption keys (CSEK) passed to the Compute Engine API so the company holds the raw key material outside of Google Cloud.

Question 2

A company is migrating its on-premises data warehouse to BigQuery. The security team requires that all data at rest in BigQuery is encrypted with keys that the company controls, and that key usage is logged for auditing. They also need to be able to revoke access to the data by disabling the key. Which configuration should they implement?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) for BigQuery, and enable Cloud KMS audit logs.. Customer-Managed Encryption Keys (CMEK) for BigQuery allow you to use your own keys in Cloud KMS to encrypt data at rest. Enabling Cloud KMS audit logs records all key usage, satisfying the auditing requirement. Disabling the key revokes access to the data. This configuration meets all security requirements.

Answer

Use BigQuery default encryption and enable Cloud Audit Logs for BigQuery.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for BigQuery, and store the keys in a secure vault.

Answer

Use Cloud HSM to generate keys, and configure BigQuery to use those keys for encryption.

Question 3

Your organization runs a microservices application on Google Kubernetes Engine (GKE). Each microservice has its own deployment and horizontal pod autoscaler. You want to implement a robust cost governance process that provides chargeback to each team and prevents budget overruns. You need to attribute costs accurately without modifying application code. What should you do?

Accepted Answer

Enable GKE cost allocation and use labels on namespaces to map costs to teams.. GKE cost allocation is designed to break down cluster costs by namespace and label, enabling accurate chargeback without code changes. By labeling namespaces with team identifiers, you can generate reports and budget alerts per team. Other options either increase cost, do not provide attribution, or require additional tooling.

Answer

Deploy a third-party cost monitoring agent as a DaemonSet on each node.

Answer

Create a separate GKE cluster for each team and enable billing export to BigQuery.

Answer

Use Kubernetes resource quotas and limit ranges to enforce budgets.

Question 4

A developer is trying to deploy a Compute Engine instance from a Cloud Build step. The build fails with the above error. What is the problem?

Accepted Answer

Cloud Build does not have the 'iam.serviceAccounts.actAs' permission on the default compute service account.. The error occurs because Cloud Build needs to impersonate the Compute Engine default service account to create a VM instance. The Cloud Build service account requires the 'iam.serviceAccounts.actAs' permission on the target service account to delegate its identity. Without this permission, the build step fails even if the Cloud Build service account has 'compute.instances.create' permission.

Answer

The project has exceeded its service account quota.

Answer

The Cloud Build service account lacks 'compute.instances.create' permission.

Answer

The developer's personal account does not have permission to use Cloud Build.

Question 5

A healthcare company stores protected health information in Cloud Storage and BigQuery. Compliance requires that access to this data be auditable and that no single administrator can both modify data and erase the audit trail. The security architect is designing the logging and access model. Which two actions should the architect take? (Choose two.)

Accepted Answer

Create a dedicated log bucket with a locked retention policy and grant the security team roles/logging.viewer on it while removing Logging Admin from data project owners.. Auditability and separation of duties require capturing Data Access logs for the services holding PHI and storing them where data administrators cannot alter them. Routing logs to a separate project's log bucket with a locked retention policy makes the trail immutable, and limiting the security team to Logging Viewer while removing Logging Admin from data owners ensures no single person can both change data and erase the evidence.

Answer

Use BigQuery row-level security to restrict which rows each analyst can read, and rely on that as the sole audit mechanism for PHI access.

Answer

Grant project owners the Logging Admin role so they can manage log sinks and adjust retention as operational needs change.

Answer

Store audit logs in the same Cloud Storage bucket as the PHI so that access reviews cover both data and logs in a single IAM policy.

Question 6

A healthcare organization is designing a Google Cloud environment to comply with HIPAA. They need to ensure that all access to sensitive data is logged and that only authorized personnel can access it. They plan to use Cloud Audit Logs and IAM. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable Data Access audit logs for all services that store or process ePHI.. Enabling Data Access audit logs ensures that all access to ePHI is recorded, which is a HIPAA requirement. Using IAM Conditions restricts access based on context, ensuring only authorized personnel from trusted environments can access data. Together, these provide both logging and access control. The other options either over-provision access or address different security concerns not directly tied to the stated needs.

Answer

Set the organization policy constraint `iam.disableServiceAccountKeyCreation` to prevent key leakage.

Answer

Enable VPC Service Controls to create a service perimeter around the project containing ePHI.

Answer

Grant the `roles/iam.securityReviewer` role to all employees who need to view audit logs.

Question 7

A company wants to automate the deployment of their infrastructure on Google Cloud using a declarative approach. They need to manage resources such as VPCs, subnets, and Compute Engine instances in a repeatable and version-controlled manner. They also want to preview changes before applying them. Which tool should they use?

Accepted Answer

Terraform with the Google Cloud provider. Terraform is the industry-standard declarative infrastructure as code tool that supports version control and provides a plan phase to preview changes. The Google Cloud provider enables management of all relevant resources, ensuring repeatability and safety.

Answer

Ansible with the Google Cloud collection

Answer

Google Cloud Deployment Manager

Answer

Google Cloud Console and gcloud CLI scripts

Question 8

A company needs to connect their on-premises data center to Google Cloud with a dedicated, low-latency, and highly available connection. They require at least 10 Gbps throughput and want to avoid internet-based VPN. Which connectivity option should they choose?

Accepted Answer

Dedicated Cloud Interconnect. Dedicated Cloud Interconnect provides a direct physical connection between the on-premises network and Google Cloud, bypassing the public internet. It supports high bandwidth (10 Gbps and 100 Gbps circuits) with low latency and can be provisioned redundantly for high availability, meeting the 10 Gbps and dedicated requirements. Partner Interconnect goes through a service provider and may not guarantee the same dedicated path.

Answer

Partner Cloud Interconnect

Answer

Classic VPN

Answer

HA VPN

Question 9

A company is migrating its on-premises data warehouse to BigQuery. They want to minimize the cost of storing large amounts of historical data that is rarely queried. The data must remain available for queries but can tolerate slightly longer query times. What should they do?

Accepted Answer

Store the data in BigQuery long-term storage by ensuring the table is not modified for 90 consecutive days.. BigQuery long-term storage automatically applies lower pricing to data that hasn't been modified for 90 days. This is the simplest and most cost-effective way to store rarely queried historical data while keeping it available for queries. Other options either make data unavailable, delete it, or address query costs instead of storage.

Answer

Export the data to Cloud Storage Nearline and delete it from BigQuery.

Answer

Partition the table by date and set a partition expiration to delete old data.

Answer

Use BigQuery's flexible pricing with flat-rate slots to reduce query costs.

Question 10

A company runs a critical application on Compute Engine. The operations team wants to improve the mean time to recovery (MTTR) for incidents. They currently use manual runbooks stored in a wiki. You need to recommend a solution that automates incident response and integrates with existing monitoring. What should you do?

Accepted Answer

Implement Cloud Monitoring alerting policies that trigger Cloud Functions to execute remediation steps.. Cloud Monitoring alerting policies can trigger Pub/Sub, which invokes Cloud Functions to perform automated remediation. This is a native, serverless, event-driven approach that integrates with existing monitoring and reduces MTTR. Other options either require architectural changes, are not event-driven, or add unnecessary complexity.

Answer

Deploy a third-party AIOps platform on Compute Engine.

Answer

Migrate the application to GKE and use liveness probes for automatic restarts.

Answer

Use Cloud Scheduler to run a script every 5 minutes that checks for issues and fixes them.

Question 11

A startup runs a public API on Compute Engine behind an external HTTP(S) load balancer. The security team wants to block common web attacks such as SQL injection and cross-site scripting at the edge, with minimal changes to the application, and they want the protection rules to be managed centrally and updated as new signatures are released. What should the architect recommend?

Accepted Answer

Deploy Cloud Armor security policies with preconfigured WAF rules and attach the policy to the backend service of the external HTTP(S) load balancer.. Cloud Armor is Google Cloud's edge security service that attaches to external HTTP(S) load balancer backend services. Its preconfigured WAF rules, derived from the ModSecurity core rule set, detect and block SQL injection, cross-site scripting, and other OWASP-style attacks. Because Google manages the rule signatures and policies are configured once at the load balancer, the application needs no changes and protection is centralized.

Answer

Enable Identity-Aware Proxy on the backend service and require Google account authentication for all API calls.

Answer

Install a third-party WAF on each Compute Engine instance and configure it to read request bodies before the application does.

Answer

Create VPC firewall rules that deny traffic containing suspicious URL patterns to the load balancer's forwarding rule.

Question 12

A company runs a public-facing web application on Compute Engine instances behind an external HTTP(S) load balancer. They want to protect the application from common web attacks such as SQL injection and cross-site scripting, and they also want to restrict access to known IP ranges. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor security policy with preconfigured WAF rules and IP allowlist rules.. Cloud Armor is the correct choice because it provides both WAF protection against common web attacks and IP-based access control. It is designed to work with external HTTP(S) load balancers, making it the appropriate service for securing a public web application. The other options either lack WAF capabilities or are intended for different use cases such as performance or identity-based access.

Answer

VPC firewall rules to allow only specific IP ranges and block malicious traffic.

Answer

Cloud CDN with signed URLs to restrict access and cache content.

Answer

Identity-Aware Proxy (IAP) to authenticate users and enforce access policies.

Question 13

A global e-commerce company is designing a multi-region architecture on Google Cloud to ensure high availability and low latency for users worldwide. They want to use a global load balancer that can route traffic to the closest healthy backend and support HTTP(S) and TCP traffic. Which Google Cloud load balancing option should they use?

Accepted Answer

Global external HTTP(S) load balancer and global external TCP proxy load balancer. Google Cloud offers separate global load balancers for different protocols. The global external HTTP(S) load balancer handles HTTP(S) traffic with proximity-based routing, while the global external TCP proxy load balancer handles TCP traffic with global anycast IP and proximity routing. Using both together provides the required support for both protocols in a multi-region architecture.

Answer

Global external HTTP(S) load balancer with TCP proxy

Answer

Global external TCP/UDP load balancer

Answer

Global external HTTP(S) load balancer

Question 14

An online retailer is deploying a new order-processing system on Google Cloud. The system consists of a regional managed instance group (MIG) of Compute Engine VMs that read from and write to a Cloud SQL for MySQL instance. The database must tolerate the loss of an entire zone within the region with minimal downtime and no manual failover steps, while keeping costs predictable. Which Cloud SQL configuration should the architect recommend?

Accepted Answer

A Cloud SQL instance configured with high availability (regional) and a standby instance in a second zone.. Zone-level resilience for Cloud SQL comes from high availability mode, which maintains a standby in a separate zone and performs automatic failover without operator intervention. Read replicas address regional disasters and require manual promotion, while zonal deployments and vertical scaling leave the database exposed to a single-zone failure. The regional HA configuration matches the availability and operational requirements at a predictable cost.

Answer

A Cloud SQL read replica in a second region that the application promotes to primary during an outage.

Answer

A zonal Cloud SQL instance with automated backups and binary logging enabled, restored manually during an outage.

Answer

A Cloud SQL instance with a larger machine type and increased storage to improve throughput and resilience.

Question 15

A development team uses BigQuery for analytical queries. They want to reduce query costs for a large table that is frequently filtered by a date column and a customer_id column. Which TWO table design strategies will reduce the amount of data scanned? (Choose 2)

Accepted Answer

Partition the table by date.. Option A is correct because partitioning the table by the date column means BigQuery only scans the partitions that match the query's date filter, dramatically reducing bytes processed for date-filtered queries. Option E is correct because clustering on customer_id physically sorts and co-locates data by that column, so filters on customer_id prune blocks within partitions and further cut data scanned. Together, partitioning by date and clustering by customer_id directly address the two frequent filter columns in this scenario. Option B is incorrect because BigQuery does not support traditional secondary indexes on columns like customer_id; clustering is the equivalent mechanism. Option C is incorrect because wildcard tables with date suffixes are a query-time convenience for sharding, not a table design that reduces scanned data by itself. Option D is incorrect because normalizing into multiple tables does not inherently reduce bytes scanned and may even require more joins and data reads.

Answer

Create an index on customer_id.

Answer

Use wildcard tables with date suffixes.

Answer

Normalize the table into multiple tables.