Google PCA Practice Test 19 — 15 Questions

Question 1

A company is migrating its on-premises data warehouse to BigQuery. The data is currently stored in several CSV files on a Compute Engine instance. The company needs to load the data into BigQuery once and then perform complex analytical queries. The data volume is about 10 TB, and the company wants to minimize cost and loading time. Which approach should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upload the CSV files to a Cloud Storage bucket, then use a BigQuery load job to load the data from Cloud Storage into a BigQuery table.. A BigQuery load job from Cloud Storage is the most efficient and cost-effective method for a one-time load of 10 TB. It leverages massively parallel loading, has no loading charges, and avoids the overhead of managing additional services. Uploading to Cloud Storage first is a standard best practice for large-scale data ingestion into BigQuery.

Answer

Create a Dataproc cluster and run a Spark job to read the CSV files and write them to BigQuery.

Answer

Use BigQuery Data Transfer Service to schedule a recurring transfer from the Compute Engine instance.

Answer

Use the bq command-line tool to load the CSV files directly from the Compute Engine instance into BigQuery.

Question 2

A media company runs a public web application behind a global external Application Load Balancer. They need to block traffic from specific countries subject to sanctions and rate-limit abusive clients, all without changing application code. Which Google Cloud service should the architect configure?

Accepted Answer

Cloud Armor security policies with geographic-based rules and rate-based ban rules attached to the backend service. Cloud Armor security policies bind to the backend service of an external Application Load Balancer and inspect requests at Google's edge. Geographic rules deny traffic by source region, and rate-based ban rules throttle or temporarily ban clients exceeding thresholds, delivering sanctions blocking and abuse mitigation without modifying the application.

Answer

VPC firewall rules applied to the load balancer's backend instances

Answer

Identity-Aware Proxy with context-aware access levels based on device and location

Answer

Cloud CDN with signed URLs and cache key policies

Question 3

A multinational retailer must comply with a regulation stating that customer personal data collected in the European Union may not be stored or processed outside the EU, including by support staff. The company uses Google Cloud and wants a platform-level mechanism that enforces this at the data-residency level while still allowing the global analytics team to query aggregated, non-personal results. Which Google Cloud capability should the architect use as the foundation?

Accepted Answer

Assured Workloads with the EU data boundary and data residency controls enabled on the folder. Assured Workloads is purpose-built to apply regulatory compliance regimes, including data residency, to a folder of projects. It enforces location restrictions and personnel access controls for the chosen jurisdiction, which directly addresses the legal requirement. Data Loss Prevention, VPC Service Controls, and regional CMEK keys are useful supporting controls but none of them establishes or enforces residency on their own.

Answer

Cloud KMS CMEK keys stored in an EU region and bound to all datasets

Answer

Cloud Data Loss Prevention templates applied to all BigQuery datasets holding customer data

Answer

VPC Service Controls perimeters around each EU project with restricted egress

Question 4

A software company wants to give a third-party analytics vendor read access to a specific BigQuery dataset containing aggregated, non-sensitive sales data, without creating service account keys that the vendor must store and rotate. The security team also wants to be able to revoke access quickly and to see which vendor identities accessed the data. The vendor already uses its own identity provider that supports OpenID Connect. Which TWO approaches together meet these requirements? (Choose two.)

Accepted Answer

Grant the federated principal the BigQuery Data Viewer role on the specific dataset rather than at the project level. Workload Identity Federation removes the need for service account keys by exchanging the vendor's OIDC tokens for short-lived Google credentials, and dataset-level BigQuery Data Viewer grants exactly the read access required. Together they deliver keyless authentication, least-privilege access, fast revocation, and attributable audit records. Static keys and broad project roles fail the security and least-privilege requirements.

Answer

Create a service account with a JSON key and share the key file with the vendor through a secure channel

Answer

Enable VPC Service Controls on the project to prevent the vendor from copying the dataset out

Answer

Assign the vendor the BigQuery Admin role at the project level to simplify permission management

Question 5

An e-commerce company exposes a public API through an external HTTP(S) load balancer on Google Cloud. The security team wants to block traffic from known malicious IP ranges and apply rate limiting per client IP, while keeping legitimate customers unaffected. They want the least operational overhead and no changes to backend applications. What should they do?

Accepted Answer

Deploy Cloud Armor security policies with IP deny rules and a rate-based ban rule, and attach the policy to the load balancer's backend service.. Cloud Armor is the native edge security service for external HTTP(S) load balancers, attaching at the backend service where it can evaluate client IP rules and rate-based bans before traffic reaches backends. This satisfies both blocking malicious ranges and per-client-IP throttling without touching application code or managing instance-level firewalls.

Answer

Configure Cloud CDN with signed URLs and require all API clients to authenticate before reaching the backend.

Answer

Use Identity-Aware Proxy to require Google account authentication for all API requests.

Answer

Create a VPC firewall rule that denies traffic from the malicious IP ranges to the load balancer's backend instances.

Question 6

A financial services firm stores sensitive customer records in Cloud Storage and must ensure that only identities in its corporate domain can read the objects, that no object can ever be made publicly accessible, and that access decisions are evaluated centrally. The firm wants the least administrative overhead while keeping these guarantees across many buckets created by different teams. What should the architect implement?

Accepted Answer

Apply an organization policy constraint with the storage.publicAccessPrevention enforced across the organization, and grant bucket access through IAM conditions that restrict principals to the corporate domain.. The firm needs a preventive control that no team can bypass and an access model that is scoped to the corporate domain. Enforcing the public access prevention organization policy makes the no-public-access guarantee inherited and non-overridable at lower levels. IAM conditions limiting principals to the corporate domain keep read access inside the firm while allowing centralized administration. This pairing addresses both the exposure guarantee and the identity restriction with minimal per-bucket work.

Answer

Use a customer-managed encryption key for every bucket and grant roles/storage.objectAdmin only to a single service account that proxies all reads for the corporate domain.

Answer

Enable VPC Service Controls with a service perimeter around the projects and grant roles/storage.objectViewer to the domain using a Google Group.

Answer

Set each bucket's default object ACL to private and rely on Cloud Storage's default uniform bucket-level access to block public reads, while granting roles/storage.objectViewer to all authenticated users.

Question 7

Your team is deploying a new internal web application on Compute Engine. The security team requires that all outbound internet traffic from the instances be inspected by a third-party firewall appliance running on a separate VM. You need to implement this with minimal changes to the application instances. What should you do?

Accepted Answer

Configure a custom route in the VPC that sends all traffic destined for 0.0.0.0/0 to the internal IP address of the firewall appliance. Enable IP forwarding on the firewall instance and configure it to forward traffic to the internet.. Routing outbound traffic through a third-party firewall is typically done by creating a custom route for 0.0.0.0/0 with the firewall's internal IP as the next hop, and enabling IP forwarding on the firewall VM. This transparently redirects traffic without modifying application instances. Other options involve services not designed for this purpose or require unsupported configuration changes.

Answer

Use VPC peering to connect the application subnet to the firewall appliance's subnet. Configure the application instances to send all traffic to the firewall's IP by setting a static route on each instance's operating system.

Answer

Create a new VPC network with a global external HTTP(S) load balancer and set the backend service to the firewall appliance. Configure the application instances to use the load balancer's IP as their default gateway.

Answer

Deploy the firewall appliance as a managed instance group and configure an internal TCP/UDP load balancer. Set the application instances' default gateway to the load balancer's IP address using a startup script.

Question 8

A startup runs a stateless web front end on a managed instance group in a single zone. Traffic is unpredictable, and the team wants the instance group to add or remove instances automatically based on CPU utilization without manual intervention. The architect must choose the simplest managed approach. Which option should the architect configure?

Accepted Answer

Attach an autoscaling policy based on CPU utilization to the managed instance group and set minimum and maximum instance counts.. A managed instance group supports autoscaling policies directly, including CPU utilization targets, and honors minimum and maximum instance counts so capacity tracks demand automatically. This is a built-in, fully managed capability that requires no custom scheduler or external automation, making it the simplest way to scale a stateless front end in response to unpredictable traffic.

Answer

Replace the managed instance group with a single large Compute Engine instance and enable live migration for maintenance events.

Answer

Deploy the front end to a second zone and use a global external Application Load Balancer to distribute traffic between the two instance groups.

Answer

Create a Cloud Scheduler job that calls the Compute Engine API every five minutes to resize the managed instance group based on a Cloud Monitoring metric.

Question 9

A company runs a critical application on a managed instance group in a single zone. The application stores data on a zonal persistent disk. The company wants to ensure that the application can survive a zone failure with minimal data loss and automatic failover. They also want to minimize changes to the application. Which approach should they take?

Accepted Answer

Convert the zonal persistent disk to a regional persistent disk and configure the managed instance group to be regional.. A regional persistent disk replicates data synchronously across two zones, ensuring zero data loss on zone failure. When combined with a regional managed instance group, the application can automatically fail over to the healthy zone. This approach requires minimal changes to the application and meets the requirements for survival and automatic failover. The other options either involve data loss or are not designed for cross-zone failover.

Answer

Use a multi-writer persistent disk and attach it to instances in two zones.

Answer

Create a snapshot schedule for the zonal persistent disk and configure the managed instance group to automatically create instances from the snapshot in another zone.

Answer

Deploy the application on a regional managed instance group and use a Cloud Storage bucket mounted via FUSE for data storage.

Question 10

A company wants to connect their on-premises data center to Google Cloud with a dedicated, low-latency, and highly available connection. They need bandwidth of 10 Gbps. Which option should they choose?

Accepted Answer

Dedicated Cloud Interconnect. Dedicated Cloud Interconnect provides direct physical connections between on-premises and Google's network with speeds up to 100 Gbps per link. It offers high availability and low latency. HA VPN is over the public internet, Partner Interconnect depends on a partner, and Classic VPN is older.

Answer

Classic VPN

Answer

HA VPN over the public internet

Answer

Partner Cloud Interconnect

Question 11

A company runs a critical application on a managed instance group (MIG) with autoscaling enabled. The application experiences sudden traffic spikes, and the team wants to ensure that new instances are added quickly while maintaining cost efficiency. They also want to avoid over-provisioning. Which autoscaling metric should they use?

Accepted Answer

HTTP load balancing serving capacity. HTTP load balancing serving capacity is the best metric for scaling a web application behind an HTTP(S) load balancer because it directly measures the load on the backend instances. It enables rapid scaling in response to traffic spikes and helps maintain cost efficiency by avoiding over-provisioning. Other metrics may not accurately reflect the incoming traffic or may introduce delays.

Answer

CPU utilization

Answer

Custom metric based on memory usage

Answer

Cloud Pub/Sub queue depth

Question 12

A media company uses a multi-project Google Cloud organization. They want to optimize their cloud spend across all projects without sacrificing performance or reliability. They have already implemented committed use discounts for Compute Engine. Which two additional actions should the architect recommend to reduce costs? (Choose two.)

Accepted Answer

Implement automatic resource scheduling to shut down non-production VMs during off-hours.. Shutting down non-production VMs during off-hours directly cuts compute costs without impacting production reliability. Moving infrequently accessed data to Nearline or Coldline storage reduces storage costs while maintaining low-latency access when needed. Both actions are practical, low-risk optimizations that address different parts of the bill. Visibility tools and preemptible VMs for production do not meet the requirement, and additional commitments should be based on careful analysis.

Answer

Use preemptible VMs for all production workloads to reduce compute costs.

Answer

Purchase additional committed use discounts for all remaining on-demand instances.

Answer

Enable billing export to BigQuery and create cost anomaly detection dashboards.

Question 13

A startup is deploying a new web application on Google Cloud. They want to ensure that their development, staging, and production environments are isolated from each other for security and billing purposes. They also want to apply different IAM policies per environment. Which Google Cloud resource hierarchy structure should the architect recommend?

Accepted Answer

Create a separate folder for each environment under the organization node, and place projects within those folders.. Using folders under the organization node allows you to group projects by environment and apply distinct IAM policies at the folder level. This provides both security isolation and separate billing, as each project can have its own billing account. It is the standard Google Cloud best practice for multi-environment setups.

Answer

Create a single project and use labels to separate environments.

Answer

Create a separate organization for each environment.

Answer

Create a single project and use separate VPC networks for each environment.

Question 14

A media company stores millions of video files in a Cloud Storage bucket and serves them to users worldwide. Users in Asia report slow download speeds, while users in North America are satisfied. The files are immutable after upload and are read frequently for the first 30 days, then almost never. You want to improve global performance while minimizing cost. What should you do?

Accepted Answer

Create a Cloud CDN distribution with the Cloud Storage bucket as the backend, and add a lifecycle rule to move objects to Nearline Storage after 30 days.. Serving immutable objects through Cloud CDN puts copies at Google's edge points of presence, which directly improves download speeds for users far from the origin. Pairing that with a lifecycle rule that transitions rarely accessed objects to Nearline Storage after 30 days aligns storage cost with the actual access pattern, so performance improves without unnecessary expense.

Answer

Move the files to a bucket in the asia-east1 region and serve them directly from that location.

Answer

Recreate the bucket as a multi-region bucket and enable Autoclass to manage storage classes automatically.

Answer

Enable Object Versioning on the bucket and create a Cloud CDN distribution backed by the bucket.

Question 15

You are deploying a new version of a microservice to Google Kubernetes Engine (GKE). The service must remain available during the rollout, and you need to minimize the risk of exposing bugs to all users at once. You want to gradually shift traffic to the new version while monitoring key metrics. Which strategy should you use?

Accepted Answer

Implement a canary deployment using Istio or Anthos Service Mesh to route a small percentage of traffic to the new version.. A canary deployment using a service mesh allows you to route a small portion of traffic to the new version, monitor its behavior, and then gradually increase traffic or roll back if problems occur. This minimizes risk and maintains availability. Other strategies either switch all traffic at once or lack the granular control needed for gradual, metric-based rollouts.

Answer

Perform a rolling update by changing the Deployment's pod template.

Answer

Use a blue/green deployment by creating a new Deployment and switching the Service selector.

Answer

Create a new GKE cluster and deploy the new version there, then update DNS to point to the new cluster.