Google PCA Practice Test 17 — 15 Questions

Question 1

An engineer runs the command above. A few days later, the instance becomes unresponsive. Upon investigation, you find that the boot disk is 100 GB and 95% full. The data disk is 500 GB and only 20% full. What is the most likely cause of the unresponsiveness?

Accepted Answer

The boot disk is too small and has run out of space.. The boot disk is 95% full, which leaves insufficient free space for the operating system to write temporary files, logs, or perform essential system operations. When a Linux or Windows boot disk runs out of space, the OS can become unresponsive because critical processes (e.g., systemd, journald, or the Windows Registry) cannot write to disk. In Google Cloud, the boot disk is the root device (typically /dev/sda1), and filling it to 95% on a 100 GB disk means only 5 GB remains, which is easily exhausted by normal system activity.

Answer

The data disk is pd-standard, which is causing I/O bottlenecks for the OS.

Answer

The boot disk is pd-ssd, which is too slow for the workload.

Answer

The instance has run out of IOPS on the boot disk.

Question 2

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) with autoscaling. During a traffic spike, some instances become unhealthy but are not automatically replaced. What is the most likely cause?

Accepted Answer

The autohealing health check is misconfigured.. The most likely cause is that the autohealing health check is misconfigured. In a managed instance group, autohealing relies on a health check to detect unhealthy instances and trigger replacement. If the health check is misconfigured (e.g., wrong port, path, or protocol), the MIG will not recognize instances as unhealthy and will not automatically replace them, even during a traffic spike.

Answer

The MIG is regional and one zone failed.

Answer

The instance template has a startup script error.

Answer

The HTTP load balancer's health check is failing.

Question 3

A company deploys a stateful workload using StatefulSets on GKE. They want to ensure that if a pod is evicted, its persistent volume claim (PVC) is reattached to the replacement pod in the same zone. Which configuration achieves this?

Accepted Answer

Use a StatefulSet with a volumeClaimTemplate referencing a persistent disk in the same zone.. StatefulSets are designed for stateful workloads and guarantee stable network identities and persistent storage. When a pod is evicted, the StatefulSet controller ensures the replacement pod uses the same PVC, which is bound to a GCE Persistent Disk in the same zone as the original pod, provided the volumeClaimTemplate specifies a disk in that zone. This maintains data locality and avoids cross-zone reattachment.

Answer

Use a Deployment with a PVC that has allowedTopologies restricting to the desired zone.

Answer

Use a Deployment with a persistent volume that is manually attached after pod creation.

Answer

Use a StatefulSet with a persistent disk that has access mode ReadOnlyMany.

Question 4

A company wants to optimize their network costs for inter-region traffic using Cloud VPN. What is the most cost-effective configuration?

Accepted Answer

Use a single VPN tunnel with dynamic routing.. Option D is correct because a single VPN tunnel with dynamic routing (BGP) is the most cost-effective configuration for inter-region traffic using Cloud VPN. Cloud VPN charges per tunnel-hour and per GB of data processed, so using a single tunnel minimizes the hourly cost while dynamic routing ensures automatic failover and route advertisement without needing multiple tunnels.

Answer

Use partner interconnect.

Answer

Use Cloud NAT.

Answer

Use dedicated interconnect.

Question 5

Refer to the exhibit. This is an IAM policy for a BigQuery dataset. What does the policy allow?

Accepted Answer

Alice to view data and analysts to run jobs.. The policy grants the `roles/bigquery.dataViewer` role to Alice, which allows her to view dataset metadata and query data, and the `roles/bigquery.jobUser` role to analysts, which allows them to run jobs (queries, load, export) but not view data directly. This combination matches option A.

Answer

Alice and analysts to run jobs.

Answer

Alice to run jobs and analysts to view data.

Answer

Alice and analysts to view data.

Question 6

A company stores large amounts of data in Cloud Storage and wants to reduce costs. Which two actions should they take? (Choose two.)

Accepted Answer

Enable object versioning and configure lifecycle rules to delete noncurrent versions after 90 days.. Option B is correct because enabling object versioning and configuring lifecycle rules to delete noncurrent versions after 90 days directly reduces storage costs by automatically removing older object versions that are no longer needed. Option D is correct because transitioning objects to Nearline or Coldline storage classes after 30 days leverages lower-cost storage tiers for infrequently accessed data, aligning cost with access patterns.

Answer

Disable object versioning to prevent multiple versions.

Answer

Add bucket labels to track cost by department.

Answer

Change the default storage class to Standard for all buckets.

Question 7

Refer to the exhibit. A DevOps engineer created this Terraform configuration to deploy a Compute Engine instance. After applying, they notice the instance is not accessible from the internet. What is the most likely cause?

Accepted Answer

No firewall rule allows ingress traffic to the instance.. The most likely cause is that no firewall rule allows ingress traffic to the instance. By default, GCP instances are created with a VPC network that has implied deny-all ingress rules, and unless a specific firewall rule (e.g., allowing tcp:22 for SSH or tcp:80 for HTTP) is applied to the instance's network tags or service account, all inbound traffic from the internet is blocked. The Terraform configuration shown in the exhibit likely omitted a `google_compute_firewall` resource or did not assign the necessary network tags to the instance.

Answer

The machine type e2-medium does not support public IP addresses.

Answer

The instance is not attached to a VPC network.

Answer

The boot disk size is too small to run the operating system.

Question 8

A company is using BigQuery for data analytics. They want to optimize costs while maintaining query performance. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Partition tables by date.. Partitioning tables by date (Option C) is correct because it allows BigQuery to prune partitions during query execution, scanning only the relevant date ranges instead of the entire table. This reduces the amount of data processed, directly lowering query costs under on-demand pricing while maintaining performance through reduced I/O.

Answer

Use reserved slots with flat-rate pricing.

Answer

Always use SELECT *.

Answer

Materialize frequently used queries as tables.

Question 9

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Accepted Answer

The VM was created without an external IP address. The most likely reason for the timeout is that the VM was created without an external (public) IP address. Without an external IP, the VM is not directly reachable from the internet, even if nginx is running and firewall rules allow HTTP traffic. The timeout occurs because the internet has no route to the VM's private IP address.

Answer

The VM is in a subnet without a Cloud NAT

Answer

The firewall rule allowing HTTP traffic is missing

Answer

The startup script failed to install nginx

Question 10

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization?

Accepted Answer

service-account@project-id.iam.gserviceaccount.com. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts IAM role grants to members from specified domains. The value 'gserviceaccount.com' is implicitly allowed for service accounts because they are managed by Google and are not subject to domain restrictions. Therefore, service-account@project-id.iam.gserviceaccount.com can be granted an IAM role on a project in this organization.

Answer

external@otherdomain.com

Answer

admin@another-customer-domain.com

Question 11

You are investigating a Vertex AI Workbench instance (instance-2) that is showing UNHEALTHY status. Based on the exhibit, what is the most likely cause of the issue?

Accepted Answer

The container image gcr.io/my-project/my-image:latest does not exist, or the service account used by the Workbench instance does not have storage.objectViewer access to the container registry.. The UNHEALTHY status in Vertex AI Workbench typically occurs when the instance fails to start its container. The most likely cause is that the specified container image (gcr.io/my-project/my-image:latest) does not exist in the Container Registry, or the service account attached to the instance lacks the storage.objectViewer role on the registry bucket. Without this permission, the instance cannot pull the image, leading to a container creation failure and an UNHEALTHY state.

Answer

The container registry endpoint is blocked by a firewall rule that does not allow egress to gcr.io.

Answer

The instance's underlying Compute Engine resources are exhausted, causing the container creation to timeout.

Answer

The Workbench instance is using an outdated custom image that is not compatible with the latest runtime version.

Question 12

A startup wants to deploy a web application on Google Cloud with a MySQL database. They anticipate low traffic initially but want the ability to scale seamlessly. They also want to minimize operational overhead. Which combination of services should they choose?

Accepted Answer

App Engine Standard Environment with Cloud SQL.. App Engine Standard Environment provides a fully managed, autoscaling platform for web applications, while Cloud SQL offers a managed MySQL database with automatic replication and backups. This combination minimizes operational overhead because Google handles infrastructure provisioning, patching, and scaling, and Cloud SQL integrates natively with App Engine via the Cloud SQL proxy or Unix socket, requiring no manual configuration for connectivity.

Answer

Compute Engine with a self-managed MySQL instance.

Answer

Cloud Run with Cloud Spanner.

Answer

Google Kubernetes Engine (GKE) with Cloud SQL.

Question 13

A DevOps team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the pods can securely access Google Cloud APIs (e.g., Cloud Storage) without managing service account keys. Which TWO steps should they take? (Choose two.)

Accepted Answer

Create a dedicated GCP service account with necessary roles and bind it to Kubernetes service accounts via Workload Identity.. Option A is correct because Workload Identity allows you to bind a Kubernetes service account to a GCP service account, enabling pods to authenticate to Google Cloud APIs (e.g., Cloud Storage) without managing or storing service account keys. This eliminates the security risk of key leakage and simplifies credential rotation. Option D is correct because Workload Identity must be explicitly enabled on the GKE cluster (using the `--workload-pool` flag or via the console) before the binding can be established.

Answer

Use the Compute Engine default service account on each node.

Answer

Use a secrets management solution like HashiCorp Vault to store service account keys and retrieve them at runtime.

Answer

Store service account keys in a Kubernetes Secret and mount them into pods.

Question 14

Which TWO strategies should a company implement to optimize costs for a production GKE cluster? (Choose two.)

Accepted Answer

Enable GKE usage metering.. Option C is correct because GKE usage metering provides detailed cost allocation by breaking down cluster resource consumption (CPU, memory, storage) per Kubernetes namespace or label. This enables teams to track and optimize spending across different projects or departments, directly supporting cost optimization for a production cluster.

Answer

Use Istio for traffic management.

Answer

Use a regional cluster.

Answer

Use node local DNS cache.

Question 15

A developer accidentally deleted a bucket in Cloud Storage. The bucket had object versioning enabled. How can the bucket and its objects be restored?

Accepted Answer

Contact Cloud Support to restore the bucket from the undisclosed backup within a limited time window.. When a Cloud Storage bucket is deleted, even with versioning enabled, the bucket itself is removed along with its objects. Google Cloud does not provide a self-service restore option for deleted buckets; instead, it maintains an internal, undisclosed backup for a limited time (typically 7 days). Only Cloud Support can initiate the restoration process from this backup, making Option A the correct approach.

Answer

Restore the bucket from the Trash in the Cloud Console.

Answer

Enable bucket lock and then undo deletion.

Answer

Use the gsutil ls -a command to list deleted buckets and gsutil cp to restore.