Google PCA Practice Test 18 — 15 Questions

Question 1

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before loading it into BigQuery. Which Google Cloud service should they use?

Accepted Answer

Cloud DLP. Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to scan, classify, and de-identify sensitive data such as PII. It can inspect data in Cloud Storage and apply de-identification transformations like masking, tokenization, or redaction before loading into BigQuery. This is a core use case for Cloud DLP.

Answer

Cloud Dataprep

Answer

Cloud Composer

Answer

Cloud Data Fusion

Question 2

A financial services company runs a three-tier web application on Compute Engine across three zones in us-central1. Their security team mandates that database traffic must never traverse the public internet, and that the database subnet must be reachable only from the application subnet. The network team has already created a custom VPC named fin-vpc with separate subnets for web, app, and db tiers. Which combination of controls should the architect implement to satisfy these requirements?

Accepted Answer

Create a firewall rule on fin-vpc that allows ingress to the db subnet only from the app subnet's CIDR range, and do not assign external IP addresses to the database instances.. Restricting access at the subnet level with a VPC firewall rule that permits ingress only from the application tier's CIDR, combined with withholding external IP addresses from database instances, directly implements both the least-privilege reachability requirement and the no-public-internet mandate. No additional networking products are needed because VPC firewall rules already scope traffic by source range and target, and internal-only addressing keeps the tier off the public internet.

Answer

Create a second VPC for the database tier and peer it to fin-vpc, then rely on the default firewall rules to block non-app traffic.

Answer

Enable Private Google Access on the db subnet and remove external IPs from the database instances so all traffic stays internal to Google's network.

Answer

Assign internal IP addresses to the databases and place them behind an external TCP proxy load balancer so only the app tier can resolve the backend.

Question 3

A startup is deploying a new web application on Compute Engine. The architect needs to ensure that the application can automatically recover from a zone failure and that the instances are distributed across multiple zones within a region. The application must also scale automatically based on traffic. Which Compute Engine feature should the architect use?

Accepted Answer

Managed instance group with regional distribution and autoscaling.. A regional managed instance group spreads instances across multiple zones, ensuring that the application survives a zone failure. It also supports autoscaling based on traffic, allowing the application to handle varying loads. The other options either lack zone distribution, automatic scaling, or reliability, making them unsuitable for the startup's requirements.

Answer

Sole-tenant nodes with autoscaling.

Answer

Preemptible VMs with a managed instance group.

Answer

Unmanaged instance group with instances in a single zone.

Question 4

A logistics company is planning its first Google Cloud landing zone. It has three business units that must be billed separately, a central network team that manages shared VPCs, and a security team that needs to apply guardrails across everything. Which resource hierarchy design should the architect recommend?

Accepted Answer

Create folders per business unit and per environment under the organization, place application projects inside those folders, and create a separate shared networking project owned by the central network team.. The scenario calls for delegated administration, separate billing, central networking, and organization-wide guardrails. A hierarchy of folders by business unit and environment lets policy and IAM inherit cleanly, projects give billing and isolation boundaries, and a dedicated shared networking project is the canonical host for shared VPC. Flattening everything, collapsing into one project, or splitting into multiple organizations each breaks at least one of these requirements.

Answer

Create one project per business unit, place all projects directly under the organization node, and use labels to separate billing and security policies.

Answer

Create a single project for the whole company and use IAM roles and labels to separate business units, environments, and network administration.

Answer

Create one organization per business unit, each with its own projects, and link them with VPC peering for shared network services.

Question 5

A company is deploying a new application on Google Kubernetes Engine (GKE). They need to ensure that the application can automatically scale based on custom metrics, such as the number of pending requests in a queue. They also want to minimize operational overhead. Which TWO actions should they take? (Choose two.)

Accepted Answer

Export the custom metric to Cloud Monitoring using the Cloud Monitoring API or a sidecar.. To scale based on custom metrics in GKE, the metrics must be exported to Cloud Monitoring, and then the Horizontal Pod Autoscaler can be configured to use those metrics. This approach leverages managed GKE features, minimizing operational overhead. Cluster Autoscaler and VPA address different scaling dimensions and are not required for custom metric scaling.

Answer

Use a Kubernetes Cluster Autoscaler to add nodes when pods are pending.

Answer

Configure a Vertical Pod Autoscaler (VPA) to adjust resource requests.

Answer

Deploy the application as a DaemonSet to ensure one pod per node.

Question 6

A retail company runs a customer-facing API on GKE Autopilot in a single region. During a quarterly sales event, traffic triples for six hours and then returns to baseline. The SRE team wants to keep the API responsive during the spike, control spend, and avoid manual intervention. They have already configured a Horizontal Pod Autoscaler based on CPU utilization with a target of 60%. Which additional action best addresses the remaining scaling bottleneck?

Accepted Answer

Expose a custom metric such as requests per second and configure the HPA to scale on it.. CPU-based autoscaling reacts after CPU rises, which is too late for a sudden threefold traffic surge, particularly when the API spends time waiting on network or database calls. Scaling on a request-oriented custom metric tied to actual load lets the HPA add pods proactively. This keeps latency stable during the event and lets replicas fall back to baseline afterward, satisfying responsiveness, cost control, and automation goals together.

Answer

Add a PodDisruptionBudget and increase the minimum replica count in the Deployment.

Answer

Configure a Vertical Pod Autoscaler in recommendation mode to right-size pod requests.

Answer

Increase the HPA target CPU utilization to 80% so pods are added more aggressively.

Question 7

A media company's analytics team runs a nightly Apache Spark ETL job on a Dataproc cluster with 20 worker nodes. The job processes raw logs from Cloud Storage and writes Parquet files back to Cloud Storage. The cluster is created before the job starts and deleted after the job finishes, taking about 90 minutes total. The team wants to reduce the cost of this workload without changing the Spark code or increasing job runtime. What should they do?

Accepted Answer

Use Spot VMs for the Dataproc worker nodes and set a graceful decommissioning timeout.. Spot VMs are the standard cost lever for fault-tolerant, ephemeral Dataproc batch workloads. Because the cluster exists only for the job duration and Spark tolerates task retries, preemption is an acceptable risk that is offset by a large discount. Autoscaling and resizing do not reduce the per-hour price of compute for a continuously busy job, and moving to Serverless changes the execution model rather than guaranteeing savings.

Answer

Move the Spark job to a Dataproc Serverless for Spark workload to eliminate cluster management.

Answer

Replace the 20 n1-standard-4 workers with 10 n1-standard-8 workers to reduce node count.

Answer

Enable Dataproc's autoscaling policy on the cluster so worker nodes scale down during idle periods.

Question 8

A financial services company runs a containerized trading platform on Google Kubernetes Engine (GKE). Compliance requires that all inter-pod traffic be encrypted without modifying application code, and that the encryption keys be managed by the company rather than Google. The security team wants to enforce this at the infrastructure level. Which approach should they take?

Accepted Answer

Configure Istio with mutual TLS (mTLS) and a custom certificate authority managed by the company.. Istio's mutual TLS encrypts all service-to-service traffic within the mesh without requiring application changes. By integrating Istio's certificate authority with a company-managed CA, the organization retains control over encryption keys. NetworkPolicy and VPC Service Controls do not encrypt traffic, and Application-layer Secrets Encryption only protects secrets at rest, not network data in transit.

Answer

Enable Application-layer Secrets Encryption with a Cloud KMS key on the GKE cluster.

Answer

Use VPC Service Controls to create a service perimeter around the GKE cluster.

Answer

Enable GKE network policy enforcement and create NetworkPolicy resources to allow only encrypted traffic.

Question 9

Refer to the exhibit. A DevOps engineer created this Terraform configuration to deploy a Compute Engine instance. After applying, they notice the instance is not accessible from the internet. What is the most likely cause?

Accepted Answer

No firewall rule allows ingress traffic to the instance.. The most likely cause is that no firewall rule allows ingress traffic to the instance. By default, GCP instances are created with a VPC network that has implied deny-all ingress rules, and unless a specific firewall rule (e.g., allowing tcp:22 for SSH or tcp:80 for HTTP) is applied to the instance's network tags or service account, all inbound traffic from the internet is blocked. The Terraform configuration shown in the exhibit likely omitted a `google_compute_firewall` resource or did not assign the necessary network tags to the instance.

Answer

The machine type e2-medium does not support public IP addresses.

Answer

The instance is not attached to a VPC network.

Answer

The boot disk size is too small to run the operating system.

Question 10

A financial services firm runs a regulated workload in a Google Cloud organization. Compliance requires that no resource in any project can be created outside a defined set of approved regions, and that violations are blocked before resource creation rather than reported afterward. The organization has many projects and new projects are created frequently. Which approach should the architect implement?

Accepted Answer

Create an organization policy with the location restriction constraint (constraints/gcp.resourceLocations) applied at the organization node. Organization policies are preventive controls that inherit through the resource hierarchy, so a location restriction set at the organization node automatically applies to every existing and future project. VPC Service Controls, VPC peering constraints, and asset-based remediation either govern the wrong thing or act only after the fact, so none of them blocks resource creation in a prohibited region.

Answer

Deploy an organization policy using compute.restrictVpcPeering and rely on network topology to limit regions

Answer

Enable VPC Service Controls perimeters around each project and restrict egress to unapproved regions

Answer

Write a Cloud Asset Inventory feed that triggers a Cloud Function to delete non-compliant resources

Question 11

An engineering team runs workloads on Compute Engine instances in a single VPC. The security team wants the instances to reach Google APIs such as Cloud Storage and BigQuery without any traffic traversing the public internet, and without managing service account key files on disk. The architect must choose the configuration that meets both goals. Which approach should the architect recommend?

Accepted Answer

Enable Private Google Access on the subnet and attach a user-managed service account to the instances. Private Google Access allows instances that have no external IP address to reach Google APIs and services through internal Google routing, keeping traffic off the public internet. Attaching a user-managed service account lets the instance obtain short-lived tokens from the metadata server, so no long-lived key files are stored on disk. The other options either route traffic over the internet or retain static keys.

Answer

Deploy a third-party NAT gateway and route all Google API traffic through it with static service account keys

Answer

Configure Cloud VPN to an on-premises proxy that forwards API calls to Google

Answer

Assign an external IP to each instance and configure firewall rules to allow egress to Google API IP ranges

Question 12

Refer to the exhibit. An engineer deploys this Terraform configuration. After deployment, they can SSH into the VM using its public IP. However, they want to restrict SSH access to only a specific IP range (203.0.113.0/24). What change is required?

Accepted Answer

Change the 'source_ranges' in the firewall rule to ['203.0.113.0/24']. The instance already has the required tag.. The firewall rule already targets the instance via the 'ssh-allowed' tag, so the only change needed is to narrow the source_ranges from the current open range (e.g., 0.0.0.0/0) to ['203.0.113.0/24']. Since the instance already carries the required tag, no tag modification is necessary — just update the source range in the existing rule. This is the minimal, correct change to restrict SSH to the specified CIDR.

Answer

Modify the instance to use a network tag 'restricted-ssh' and update the firewall rule target_tags accordingly.

Answer

Add a new firewall rule with higher priority allowing SSH from 203.0.113.0/24, and keep the existing rule but change its priority to 100.

Answer

Update the 'source_ranges' in the firewall rule to ['203.0.113.0/24'] and remove the 'ssh-allowed' tag from the instance.

Question 13

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is Google's petabyte-scale, low-latency NoSQL wide-column store, purpose-built for time-series and IoT workloads with single-digit millisecond latency at millions of reads/writes per second. Its row-key design supports efficient range scans by timestamp, and it scales horizontally by adding nodes, making it the best fit for high-throughput sensor data with simple key-value access.

Answer

Firestore

Answer

Cloud Spanner

Answer

BigQuery

Question 14

A healthcare company stores patient records in Cloud Storage buckets across several projects. Compliance auditors require that no object can ever be made publicly readable, even by a project Owner, and that any attempt to do so must be blocked centrally. The security team must enforce this without breaking existing application access. What should they do?

Accepted Answer

Create an organization policy with the `storage.publicAccessPrevention` constraint set to enforced at the organization node.. The `storage.publicAccessPrevention` organization policy constraint is the only mechanism here that centrally and preventively blocks public access grants at the organization level, regardless of a principal's project-level permissions. Because organization policies are inherited, enforcing it once at the org node covers all current and future projects while leaving legitimate IAM bindings untouched.

Answer

Grant the `roles/storage.admin` role only to a dedicated security group and remove it from all project Owners.

Answer

Enable uniform bucket-level access on every bucket and rely on IAM conditions to deny public members.

Answer

Configure VPC Service Controls perimeters around each project to restrict access to Cloud Storage.

Question 15

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.

Accepted Answer

First, create a health check. Then, create an instance group. Next, create a backend service that uses the health check and add the instance group as a backend. After that, create a URL map to route requests to the backend service. Then, create a target HTTP(S) proxy using the URL map. Finally, create a forwarding rule to assign an IP address and port to the proxy.. Health checks ensure traffic only goes to healthy instances; URL map defines routing; forwarding rule exposes the IP.

Answer

First, create a URL map. Then, create a target proxy. Next, create a forwarding rule. After that, create a health check. Then, create an instance group. Finally, create a backend service (with health check) and add the instance group.

Answer

First, create an instance group. Then, create a backend service (without a health check). Next, create a URL map. Then, create a target proxy. After that, create a forwarding rule. Finally, create a health check (too late to attach to the backend service).

Answer

First, create a forwarding rule. Then, create a target proxy. Next, create a URL map. After that, create a backend service. Then, create an instance group. Finally, create a health check.