Google PCA Practice Test 17 — 15 Questions

Question 1

A company wants to store application secrets such as API keys and database passwords securely and audit access. They also need to automatically rotate secrets periodically. Which TWO Google Cloud services should they use? (Choose 2)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Scheduler. Secret Manager stores secrets with versioning and IAM control, and Cloud Scheduler can trigger rotations.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Cloud Key Management Service

Question 2

A company is migrating a legacy application that uses a file server to GCP. The application requires a shared file system that supports the NFS protocol and can be mounted by multiple Compute Engine instances. The team also needs to use Cloud NAT to allow the instances to download updates. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud NAT. Filestore provides NFS file shares, and Cloud NAT allows instances without public IPs to access the internet for updates.

Answer

Cloud VPN

Answer

Cloud Storage Fuse

Answer

Private Google Access

Question 3

A data science team wants to run training jobs on a GKE cluster. The jobs are resource-intensive and can tolerate interruptions. To reduce costs, the team wants to use preemptible VMs for the node pool. Which additional step should they take to ensure training jobs are not lost when nodes are preempted?

Accepted Answer

Enable cluster autoscaler on the node pool. A cluster autoscaler with a node pool of preemptible VMs will replace preempted nodes. For job resilience, the application should be designed to handle interruptions, but at the infrastructure level, enabling cluster autoscaler ensures new nodes are added.

Answer

Use a PodDisruptionBudget

Answer

Set up a Cloud Scheduler job to recreate nodes

Answer

Configure a Vertical Pod Autoscaler

Question 4

A company wants to enforce that only container images built and signed by their CI/CD pipeline can be deployed in their GKE cluster. Which Google Cloud service should they use?

Accepted Answer

Binary Authorization. Binary Authorization enforces that only trusted images (signed by authorities) are deployed. It integrates with GKE and Cloud Build to verify signatures.

Answer

Artifact Analysis

Answer

Cloud Audit Logs

Answer

Cloud Security Command Center

Question 5

A company wants to implement a CI/CD pipeline for a microservices application on GKE. They require automated canary deployments with gradual traffic shifting and automatic rollback on metric failure. Which Google Cloud service is most suitable?

Accepted Answer

Cloud Deploy with Skaffold.. Cloud Deploy with Skaffold is the most suitable because it provides native support for progressive delivery on GKE, including automated canary deployments with gradual traffic shifting (using Service Mesh or Ingress) and automatic rollback based on Cloud Monitoring metrics. Skaffold handles the build and deploy configuration, while Cloud Deploy manages the rollout pipeline, approval gates, and metric-driven rollback logic without requiring manual intervention.

Answer

Cloud Build with Deployment Manager.

Answer

Spinnaker on GKE.

Answer

Istio with manual traffic management.

Question 6

A company has a multi-region deployment of App Engine and wants to optimize request routing for latency and cost. Which GCP service should they use?

Accepted Answer

Cloud Load Balancing with global anycast.. Cloud Load Balancing with global anycast uses Google's global network and anycast IP addresses to route user traffic to the nearest healthy backend, minimizing latency. It also supports premium tier routing for lower latency and standard tier for lower cost, directly addressing the optimization goals for a multi-region App Engine deployment.

Answer

Cloud Endpoints.

Answer

Cloud DNS with latency-based routing.

Answer

Cloud Traffic Director.

Question 7

What is the purpose of a Pod Disruption Budget (PDB) in GKE?

Accepted Answer

To ensure a minimum number of pods are always available during voluntary disruptions. A PDB limits the number of pods of a replicated application that can be down simultaneously from voluntary disruptions (e.g., node upgrades, cluster autoscaler evictions).

Answer

To automatically scale pods based on CPU usage

Answer

To distribute pods across different zones

Answer

To prevent any pod from being terminated

Question 8

A DevOps engineer needs to automate the deployment of a containerized application to Google Kubernetes Engine (GKE) using a CI/CD pipeline. The pipeline should build a Docker image, store it in Artifact Registry, and then deploy it to a GKE cluster. Which two Google Cloud services should be used together to achieve this?

Accepted Answer

Cloud Build and Cloud Deploy. Cloud Build can build the Docker image and push it to Artifact Registry. Cloud Deploy can then deploy the image to GKE using a delivery pipeline. Cloud Run is for serverless containers, not GKE. Cloud Source Repositories is a code repository, not a deployment service. Compute Engine is not needed for this use case.

Answer

Cloud Build and Cloud Run

Answer

Artifact Registry and GKE alone

Answer

Cloud Source Repositories and Compute Engine

Question 9

A data engineering team wants to ingest streaming data from Pub/Sub, transform it using Apache Beam, and load it into BigQuery for real-time analytics. They need a fully managed solution that handles autoscaling and does not require managing servers. Which TWO Google Cloud services should they use?

Accepted Answer

Cloud Dataflow. Dataflow is the fully managed service for executing Apache Beam pipelines, with autoscaling and serverless execution. Pub/Sub is the ingestion service. Cloud Composer is Airflow, not streaming; Dataproc is for Spark/Hadoop; Dataprep is for data preparation.

Answer

Cloud Dataproc

Answer

Cloud Dataprep

Answer

Cloud Composer

Question 10

Which TWO statements are true regarding the benefits of using VPC Network Peering over Cloud VPN for connecting two VPC networks?

Accepted Answer

VPC Network Peering provides lower latency because traffic stays within Google's network.. VPC Network Peering uses Google's internal infrastructure to route traffic directly between VPC networks, avoiding the public internet and reducing the number of network hops. This results in lower latency compared to Cloud VPN, which typically encrypts and tunnels traffic over the public internet, introducing additional overhead and potential variability in latency.

Answer

VPC Network Peering requires a separate VPN gateway appliance.

Answer

VPC Network Peering can only be established within the same organization.

Answer

Cloud VPN encrypts traffic, which VPC Network Peering does not.

Question 11

A company uses Cloud SQL for PostgreSQL. They want to minimize downtime during maintenance. Which feature should they enable?

Accepted Answer

High availability with a standby in another zone.. High availability (HA) with a standby in another zone ensures that Cloud SQL for PostgreSQL automatically fails over to a standby instance in a different zone if the primary zone experiences an outage. This minimizes downtime during maintenance because Cloud SQL performs a controlled failover to the standby, typically completing within a few seconds, rather than requiring a full instance restart or rebuild.

Answer

Read replicas.

Answer

Point-in-time recovery.

Answer

Automated backups.

Question 12

A team is using Cloud Functions and wants to ensure retries on failure. What is the best practice?

Accepted Answer

Configure maximum retries and set dead-letter topic.. Cloud Functions (2nd gen) and Cloud Run allow configuring maximum retry attempts and a dead-letter topic to handle messages that repeatedly fail processing. This ensures that transient failures are retried automatically, while persistent failures are captured in a dead-letter queue for later analysis, preventing message loss and enabling reliable event-driven processing.

Answer

Increase function timeout.

Answer

Use background functions with Pub/Sub.

Answer

Use synchronous invocation.

Question 13

A company runs a stateful application on GKE using StatefulSets. Which THREE practices improve reliability?

Accepted Answer

Use headless services.. A headless service (clusterIP: None) allows direct pod-to-pod communication without load balancing, which is essential for stateful applications like databases that require stable network identities. Each pod in a StatefulSet gets a unique DNS name (e.g., pod-0.service.namespace.svc.cluster.local), enabling reliable discovery and ordering for replication, leader election, and failover. This ensures that clients always reach the correct pod instance, improving overall reliability.

Answer

Use horizontal autoscaling based on disk usage.

Answer

Use persistent volumes with reclaim policy Delete.

Question 14

Which TWO options are best practices for ensuring high availability of an application running on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across multiple zones.. Pod anti-affinity ensures that pods from the same application are scheduled on different nodes across multiple zones, reducing the blast radius of a zonal failure. This is a key pattern for achieving high availability in GKE, as it prevents a single zone outage from taking down all replicas of your application.

Answer

Deploy all nodes in the same zone to simplify networking.

Answer

Prefer using preemptible VMs for cost savings.

Answer

Use a single zonal cluster to avoid cross-zone latency.

Question 15

You are running a Kubernetes cluster in GKE with the default node pool configuration shown in the exhibit. Your application requires high disk I/O performance. You notice that the application is experiencing high latency for disk operations. What is the most likely cause?

Accepted Answer

The default node pool uses pd-standard disks, which have low IOPS.. The default node pool in GKE uses pd-standard (standard persistent disk) which provides lower IOPS compared to pd-ssd. For applications requiring high disk I/O performance, pd-standard disks become a bottleneck, causing high latency. Upgrading to pd-ssd or using local SSDs would resolve this issue.

Answer

Node auto-repair is causing disk contention.

Answer

The OAuth scopes restrict disk access, causing high latency.

Answer

The machine type n1-standard-2 does not have enough CPU.