Google PCA Practice Test 18 — 15 Questions

Question 1

Which two GCP audit log types are available by default? (Choose TWO).

Accepted Answer

Admin Activity audit logs. Admin Activity and System Event audit logs are enabled by default. Data Access logs must be explicitly enabled.

Answer

Cloud Audit Logs

Answer

Policy Denied audit logs

Answer

Data Access audit logs

Question 2

A company runs a microservices-based application on Google Kubernetes Engine (GKE) with a Regional cluster. They want to improve reliability by implementing best practices for pod scheduling and resilience. Which TWO actions should they take? (Choose two.)

Accepted Answer

Define a PodDisruptionBudget for each deployment to limit the number of concurrent disruptions. A PodDisruptionBudget (PDB) limits the number of Pods of a replicated application that can be down simultaneously from voluntary disruptions, such as node maintenance or cluster upgrades. This ensures that a minimum number of replicas remain available, improving application reliability during planned events.

Answer

Set terminationGracePeriodSeconds to 0 for faster pod termination during scale-down

Answer

Enable cluster autoscaler to automatically add nodes when pods are pending

Answer

Set resource requests equal to limits to ensure guaranteed QoS class

Question 3

A company runs a stateful application on Compute Engine with persistent disks. They want to ensure data durability across a zone failure. What is the best approach?

Accepted Answer

Use regional persistent disks. Regional persistent disks (RPDs) synchronously replicate data between two zones in the same region, providing an RPO of zero and automatic failover without application-level changes. This ensures data durability across a zone failure while maintaining consistent performance and low latency.

Answer

Replicate data at application level to another instance in a different zone

Answer

Use Google Cloud NetApp Volumes with replication

Answer

Take regular snapshots of the persistent disks and store them in a multiregional bucket

Question 4

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role includes permissions to create, delete, and manage service accounts.

Answer

roles/owner

Answer

roles/editor

Answer

roles/iam.workloadIdentityUser

Question 5

A company wants to use their own HSM to hold encryption keys for Google Cloud services, but they want Google Cloud to perform cryptographic operations without exposing the keys. Which service should they use?

Accepted Answer

Cloud HSM. Cloud HSM is a cloud-hosted HSM that allows customers to manage keys in FIPS 140-2 Level 3 HSMs, with Google performing operations without exposing key material.

Answer

Cloud KMS (software)

Answer

CSEK

Answer

Secret Manager

Question 6

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) clusters are signed by an authorized authority and only those images are allowed to run. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment-time policies that require container images to be signed by trusted authorities before they can be deployed to GKE.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 7

A company wants to give a new employee read-only access to all projects in their GCP organization. Which IAM role should they assign at the organization level to grant this access?

Accepted Answer

roles/viewer. The Viewer primitive role (roles/viewer) grants read-only access to all resources in the organization. Owner and Editor roles are too broad. Organization Viewer is not a valid role.

Answer

roles/owner

Answer

roles/editor

Answer

roles/orgadmin

Question 8

Which TWO features help reduce costs for batch processing workloads on Compute Engine?

Accepted Answer

Preemptible VMs. Preemptible VMs are short-lived, low-cost instances that can be terminated at any time by Compute Engine, making them ideal for batch processing workloads that are fault-tolerant and can handle interruptions. They offer up to 80% cost savings compared to standard VMs, directly reducing costs for batch jobs that can checkpoint and resume.

Answer

GPU accelerators

Answer

Sole-tenant nodes

Answer

Committed use discounts

Question 9

A startup is migrating a monolithic application to Google Cloud. They want to minimize operational overhead and auto-scale based on HTTP request load. Which compute solution should they choose?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it is a fully managed serverless platform that automatically scales from zero based on HTTP request load, minimizing operational overhead. It abstracts away infrastructure management, supports containerized applications, and charges only for resources used during request processing, aligning perfectly with the requirement to auto-scale based on HTTP traffic.

Answer

Compute Engine managed instance groups with autoscaling

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Functions

Question 10

A company wants to encrypt data at rest in Cloud Storage using a key that they generate and manage themselves, not stored in Google Cloud. Which encryption type should they use?

Accepted Answer

CSEK. CSEK (Customer-Supplied Encryption Keys) allows customers to provide their own encryption keys for Cloud Storage objects, which are used and then discarded by GCP.

Answer

Default encryption

Answer

Cloud HSM

Answer

CMEK with Cloud KMS

Question 11

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

Accepted Answer

VPC Service Controls. VPC Service Controls with access levels can restrict access based on IP address ranges, including the VPN tunnel's egress IP.

Answer

Cloud NAT

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 12

A financial services company runs workloads on GKE and wants to ensure only container images that have been approved by the security team can be deployed. The approval process involves signing images after vulnerability scanning. Which GCP service should be integrated with GKE to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization enforces that only signed container images from trusted authorities can be deployed on GKE. It integrates with Cloud KMS for signing and can be configured with attestors.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 13

A security engineer wants to ensure that all admin activity in their GCP organization is logged and retained for 3 years. They also need to be alerted if a new firewall rule is created. Which logs should they enable?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls that modify configuration or metadata, such as creating firewall rules. Data Access audit logs record reads/writes to data, not admin actions. VPC flow logs record network traffic, not admin actions. Cloud DNS logging records DNS queries.

Answer

Data Access audit logs

Answer

VPC flow logs

Answer

Cloud DNS logging

Question 14

A company needs to grant a data scientist read-only access to BigQuery datasets in the project 'analytics-prod' without granting permissions to any other resources. Which IAM role should be assigned at the project level?

Accepted Answer

roles/bigquery.dataViewer. The BigQuery Data Viewer role (roles/bigquery.dataViewer) grants read access to BigQuery datasets and tables. Assigning at the project level applies to all datasets in that project.

Answer

roles/viewer

Answer

roles/bigquery.user

Answer

roles/bigquery.jobUser

Question 15

A company wants to use Cloud Key Management Service (Cloud KMS) to manage encryption keys for multiple applications. They have the following requirements: 1) Keys must be automatically rotated every 90 days. 2) Different applications should have access only to their own keys. 3) All key operations must be logged for audit purposes. Which THREE steps should they take? (Choose three.)

Accepted Answer

Enable Cloud Audit Logs for the Cloud KMS API. Cloud KMS supports key rotation schedules, IAM for access control, and Cloud Audit Logs for logging.

Answer

Grant the roles/cloudkms.admin role to each application's service account

Answer

Store the keys in Cloud HSM