Google PCA Practice Test 2 — 10 Questions

Question 1

A security engineer wants to configure Identity-Aware Proxy (IAP) for an HTTPS load-balanced application to enforce zero-trust access. Users will authenticate with their Google accounts. What is the minimum set of IAM roles needed for a user to access the application behind IAP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

roles/iap.httpsResourceAccessor. To access an application protected by IAP over HTTPS, a user must have the IAP-secured Web App User role (roles/iap.httpsResourceAccessor) on the resource. This role grants permission to access the resource through IAP. The other roles are not sufficient: roles/iam.serviceAccountUser is for managing service accounts, roles/iap.tunnelResourceAccessor is for TCP forwarding, and roles/compute.viewer only allows viewing Compute Engine resources, not accessing the application.

Answer

roles/iam.serviceAccountUser

Answer

roles/iap.tunnelResourceAccessor

Answer

roles/compute.viewer

Question 2

A company is designing a disaster recovery strategy for a Cloud SQL for PostgreSQL database with a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 2 hours. They are using the Regional Cloud SQL tier. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure cross-region replication by creating a cross-region replica.. Option C is correct because a cross-region replica protects against a regional outage, which the Regional tier alone cannot survive; promoting the cross-region replica gives a failover target that can meet the 2-hour RTO, and Cloud SQL's asynchronous replication keeps replica lag well within the 1-hour RPO. Option E is correct because automated backups combined with point-in-time recovery let you restore the instance to any moment within the retention window (transaction logs are retained, typically up to 7 days by default), which is essential for recovering from data corruption or accidental deletion within the 1-hour RPO. Option A is not correct because adding CPUs only improves performance and does not provide any recovery capability or reduce RPO/RTO. Option B is not correct because a read replica in the same region shares the same regional failure domain as the primary, so it cannot satisfy a disaster recovery strategy for a regional outage. Option D is not correct because deletion protection only prevents accidental instance deletion; it does not provide backup, replication, or recovery capability to meet the stated RPO and RTO.

Answer

Increase the number of CPUs on the primary instance.

Answer

Create a read replica in the same region.

Answer

Enable deletion protection on the database.

Question 3

A developer needs to grant a Compute Engine instance the ability to read from a Cloud Storage bucket. The instance does not have a service account attached. What should the developer do?

Accepted Answer

Create a service account and assign it the Storage Object Viewer role, then attach the service account to the instance.. A Compute Engine instance must have a service account attached to obtain Google Cloud credentials for API calls. The developer should create a service account, grant it the Storage Object Viewer role (or a custom role with storage.objects.get/list), and attach it to the instance. The instance can then use the metadata server to obtain short-lived tokens and read the bucket.

Answer

Add the instance's external IP to the bucket permissions.

Answer

Generate a JSON key for a user account and store it on the instance.

Answer

Create a firewall rule to allow access to Cloud Storage.

Question 4

An organization wants to manage Google Cloud infrastructure as code using declarative configuration files. They need a solution that supports Python and Jinja templating languages. Which service should they choose?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager is Google Cloud's native infrastructure-as-code service that uses YAML declarative configuration files and explicitly supports Python and Jinja2 templating for parameterization and reuse. It integrates directly with GCP IAM and APIs, making it the correct choice when the requirement calls out Python and Jinja support. Terraform uses HCL, not Python/Jinja, so it fails the stated requirement.

Answer

Cloud Composer

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 5

Match each GCP monitoring/logging tool to its purpose.

Accepted Answer

Cloud Monitoring: Provides visibility into performance, uptime, and health of applications and infrastructure.. Correct matches: Cloud Monitoring monitors performance, Cloud Logging manages logs, Error Reporting tracks errors. Confusion often arises between logging and monitoring roles.

Answer

Cloud Monitoring: Real-time log management and analysis for applications and services.

Answer

Cloud Logging: Counts, analyzes, and aggregates errors in cloud services.

Question 6

A company uses Cloud Armor to protect an HTTPS Load Balancer. They want to allow traffic only from users who have passed a reCAPTCHA challenge. Cloud Armor supports which feature for this?

Accepted Answer

WAF rules with reCAPTCHA. Cloud Armor supports reCAPTCHA integration through WAF rules that use the 'token.recaptcha_session.score' or 'token.recaptcha_action.score' attributes to allow, deny, or redirect traffic based on the reCAPTCHA assessment score. This is configured as a security policy rule with a reCAPTCHA challenge action, enabling the load balancer to enforce human verification before granting access.

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Answer

Rate limiting

Question 7

A developer wants to monitor the CPU usage of a single Compute Engine VM and receive alerts when it exceeds 80%. What is the simplest way to achieve this?

Accepted Answer

Install the Cloud Monitoring agent and create an alerting policy based on the metric 'cpu.utilization'.. The Cloud Monitoring agent (formerly Stackdriver agent) collects CPU utilization metrics from Compute Engine VMs and sends them to Cloud Monitoring. You can then create an alerting policy directly on the metric 'cpu.utilization' with a threshold of 80% without any custom scripting or additional infrastructure. This is the simplest and most native approach for a single VM.

Answer

Query the Compute Engine API periodically and check CPU usage.

Answer

Configure a Cloud Logging sink to BigQuery and set a scheduled query to detect high CPU.

Answer

Use the managed instance group's autoscaling metric to trigger a notification.

Question 8

An organization needs to implement a change management process for a mission-critical application on GKE. They want to validate performance before full rollout and be able to roll back quickly. Which THREE practices should they adopt? (Choose THREE.)

Accepted Answer

Implement canary deployments with traffic splitting. Option B is correct because canary deployments with traffic splitting (e.g., via GKE Ingress, Anthos Service Mesh, or Istio VirtualService weights) let the team expose a new version to a small percentage of traffic, validating performance on real workloads before full rollout. Option C is correct because feature flags decouple deployment from release, allowing features to be toggled dynamically without redeploying, which supports fast rollback by disabling a flag rather than reverting a build. Option E is correct because Cloud Deploy supports automated rollback policies tied to rollout failures or verification results, enabling rapid, deterministic rollback of a bad release. Option A is wrong because deploying directly to production bypasses validation and contradicts the requirement to test performance before full rollout. Option D is wrong because manual monitoring and rollback is slow, error-prone, and does not meet the goal of rolling back quickly compared to automated policies.

Answer

Deploy changes directly to production

Answer

Manually monitor and roll back if issues appear

Question 9

An e-commerce application uses Firestore for product catalog. They need to run complex analytical queries on the catalog data, such as aggregations and joins, without impacting production performance. What is the best approach?

Accepted Answer

Export Firestore data to BigQuery for analytics. The best approach is to export Firestore data to BigQuery for analytics. BigQuery is a columnar, serverless analytics warehouse designed for aggregations and joins at scale, and it can query exported Firestore data without touching the production Firestore instance. This isolates analytical workloads from production traffic and provides the SQL capabilities Firestore lacks.

Answer

Create a second Firestore database for analytics

Answer

Use Cloud SQL to query Firestore directly

Answer

Use Firestore `!=` operator to filter data

Question 10

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

Accepted Answer

Create a regional Cloud SQL instance with automatic failover.. A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Answer

Create a read replica in a different region.

Answer

Export the database daily and import into a new instance if failure occurs.

Answer

Deploy Cloud SQL across multiple regions using cross-region replication.