Google PCA Practice Test 20 — 15 Questions

Question 1

A healthcare company runs a patient portal on Google Kubernetes Engine (GKE). Auditors require that all container images be scanned for vulnerabilities before deployment and that only images from a trusted registry be admitted to the cluster. You are configuring Binary Authorization. Which TWO actions should you take to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Container Analysis API and configure a vulnerability scanning policy so that images pushed to Artifact Registry are analyzed automatically.. Binary Authorization enforces deploy-time policy based on attestations. Enabling Container Analysis provides automated vulnerability scanning of registry images, and defining an attestor that your trusted build pipeline signs ensures only verified images are admitted. Together they create a verifiable chain from scanning to admission, which satisfies the auditors' requirements.

Answer

Apply a Kubernetes NetworkPolicy that allows egress only to the trusted registry so nodes cannot pull other images.

Answer

Configure a PodSecurityPolicy that restricts images to those hosted in Artifact Registry.

Answer

Set the cluster's default namespace to use the kube-system service account for all workloads so admission checks are bypassed.

Question 2

A government agency must retain Cloud Storage objects for seven years in a bucket that also serves live traffic. Regulators require that no user, including project owners, can delete or shorten retention during that period. The architect needs a control that satisfies this. Which should the architect configure?

Accepted Answer

A bucket lock applied after configuring a retention policy on the bucket.. A Cloud Storage retention policy enforces a minimum age before objects can be deleted or overwritten, and locking the bucket makes that policy permanent and irreversible. Locking removes the ability of any principal, including project owners, to delete the policy or shorten the retention period, which is exactly the immutability regulators require for the seven-year window.

Answer

Object Versioning combined with a lifecycle rule that deletes noncurrent versions after seven years.

Answer

A Cloud Storage retention policy set to seven years without locking the bucket.

Answer

A bucket-level IAM condition that denies storage.objects.delete when the request comes from outside the agency's VPC.

Question 3

A company runs a web application on Compute Engine behind a Global HTTPS Load Balancer. Users report slow page loads, especially for static assets. The development team wants to cache content closer to users without modifying code. Which GCP service should they enable?

Accepted Answer

Cloud CDN. Cloud CDN is the correct service because it caches HTTP(S) load balancer content at Google's globally distributed edge points of presence, reducing latency for static assets without any application code changes. It integrates directly with the Global HTTPS Load Balancer, so enabling it requires only a checkbox or gcloud command on the backend service. This satisfies the requirement to cache content closer to users while keeping the existing architecture intact.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

Cloud DNS

Question 4

A company is migrating its on-premises Hadoop cluster to Google Cloud. They want to use a fully managed service that supports HDFS, Hive, and Spark, and allows them to run ephemeral clusters that can be created and deleted on demand. They also want to minimize infrastructure management. Which Google Cloud service should they use?

Accepted Answer

Cloud Dataproc. Cloud Dataproc is the only service that provides a managed Hadoop and Spark environment with support for HDFS, Hive, and ephemeral clusters. It allows you to create clusters on demand and delete them when jobs are complete, reducing operational overhead. The other services are not Hadoop-compatible or do not support the required tools.

Answer

Cloud Bigtable

Answer

BigQuery

Answer

Cloud Dataflow

Question 5

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

Accepted Answer

Run gcloud deployment-manager deployments update --config . Cloud Deployment Manager does not provide a native rollback command; the documented way to revert to a prior state is to re-run an update using the previous configuration and manifest files. Running 'gcloud deployment-manager deployments update --config ' reapplies the earlier desired state, effectively rolling the deployment back to that point.

Answer

Use gcloud deployment-manager deployments rollback --deployment <name>

Answer

Use the --update-policy=PARTIAL flag to selectively revert changes

Answer

Delete the deployment and recreate it from the previous template

Question 6

A logistics company runs a Cloud Run service that processes shipment events. They want to be notified and to trigger an automated rollback when the error rate of a new revision exceeds a threshold shortly after deployment. Which Google Cloud feature should they use?

Accepted Answer

Create a Cloud Monitoring alerting policy on the Cloud Run error rate and use Cloud Deploy with a deployment verification and automated rollback.. Cloud Deploy deployment verification evaluates a new Cloud Run revision against defined criteria, such as a Cloud Monitoring alert on error rate, and automatically rolls back to the prior stable release when verification fails. Pairing it with a Cloud Monitoring alerting policy delivers both the notification and the automated rollback the logistics team requires.

Answer

Use Error Reporting to group exceptions and configure a Pub/Sub notification that emails the on-call engineer to perform a rollback.

Answer

Enable Cloud Run's built-in automatic rollback by setting a maximum error rate in the service YAML.

Answer

Configure Cloud Run gradual rollout with canary traffic splitting and manually monitor the revision before shifting all traffic.

Question 7

A financial services company is designing a Google Cloud landing zone. Regulators require that production workloads be isolated from non-production workloads, that each business unit control its own billing and quotas, and that a central team enforce network and security policies across everything. The company wants to minimize the number of projects it must manage manually. Which structure should the architect propose?

Accepted Answer

A folder per business unit, with production and non-production subfolders under each, projects created inside those subfolders, and organization policies plus shared VPC set at the folder level.. The recommended Google Cloud resource hierarchy nests environment subfolders inside business-unit folders, because organization policies, IAM, and Shared VPC settings attached at a folder are inherited by every project beneath it, including projects created later. This satisfies workload isolation, delegated billing and quota ownership per unit, and centralized policy enforcement while keeping manual per-project work to a minimum as the estate grows.

Answer

A flat set of projects directly under the organization node, with a distinct service account per project and firewall rules copied into each project's VPC.

Answer

One project per environment (production, staging, development) under the organization node, with folders used only for IAM groups.

Answer

Two folders, one for production and one for non-production, with all business unit projects placed in the matching folder and billing separated by project labels.

Question 8

A company is running a web application on Compute Engine instances that average 20% CPU utilization. They want to reduce costs without impacting performance. What is the most effective action?

Accepted Answer

Rightsize instances to a smaller machine type based on usage metrics.. The instances are averaging only 20% CPU utilization, indicating they are over-provisioned. Rightsizing to a smaller machine type directly reduces the compute cost per instance while maintaining adequate performance for the current workload, as the smaller instance can handle the existing load without degradation.

Answer

Change instance type to e2-standard-4.

Answer

Purchase 3-year committed use discounts.

Answer

Use preemptible instances for all traffic.

Question 9

A company uses Assured Workloads to meet FedRAMP compliance. They need to ensure that only authorized personnel can access data access audit logs for their projects. Which IAM role should they grant to the security team?

Accepted Answer

roles/logging.privateLogViewer. roles/logging.privateLogViewer grants read access to private logs, which includes Data Access audit logs, and is the least-privilege role designed for viewing sensitive audit data. Data Access logs are classified as private logs in Cloud Logging, so the security team needs a role that explicitly includes logging.privateLogs.view permission. This satisfies the FedRAMP requirement that only authorized personnel can view data access audit logs.

Answer

roles/logging.viewer

Answer

roles/iam.securityReviewer

Answer

roles/logging.admin

Question 10

An organization wants to enforce that all Compute Engine VMs are created with specific disk encryption keys. Which policy mechanism should they use?

Accepted Answer

Organization policies with constraints/compute.restrictDiskEncryptionKeyTypes. The Organization Policy constraint `constraints/compute.restrictDiskEncryptionKeyTypes` allows administrators to enforce that all Compute Engine VMs must use specific disk encryption key types (e.g., CMEK or CSEK). This policy is evaluated at resource creation time and blocks any VM that does not comply with the allowed key types, providing a preventive control rather than a reactive one.

Answer

IAM roles with compute.diskEncryptionKey permissions

Answer

VPC Service Controls

Answer

Cloud Scheduler to check compliance

Question 11

A company is migrating a 200 TB on-premises file server to Cloud Storage. The network bandwidth is limited to 100 Mbps. The migration must complete within 30 days. Which approach should they use?

Accepted Answer

Use Transfer Appliance. Transfer Appliance is a physical device shipped to the customer, loaded with data, and shipped back to Google, making it ideal for large datasets (200 TB) over limited bandwidth (100 Mbps). At 100 Mbps, transferring 200 TB would take far longer than 30 days, so a physical transfer method is required.

Answer

Use Storage Transfer Service from another cloud

Answer

Use gsutil rsync over the network

Answer

Use Cloud Data Fusion

Question 12

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

Accepted Answer

Create an attestor and attach it to a Binary Authorization policy. Binary Authorization requires attestors to verify that an image meets specific criteria. An attestor is a trusted authority that signs attestations, and it must be attached to a Binary Authorization policy to enforce that only images with valid attestations are deployed. Without creating an attestor and attaching it to the policy, the policy cannot verify image signatures.

Answer

Configure a VPC Service Perimeter

Answer

Enable Container Registry vulnerability scanning

Answer

Assign the container.deployer role to the GKE service account

Question 13

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Accepted Answer

Create separate subnets for each application tier.. Creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Answer

Disable VPC Flow Logs to reduce cost.

Answer

Use a single subnet for all tiers to simplify IP management.

Answer

Rely on the default priority of firewall rules to ensure proper ordering.

Question 14

A company runs a batch processing application on Compute Engine that reads data from Cloud Storage and writes results to BigQuery. The application runs on a managed instance group (MIG) with autoscaling. Recently, job failures occurred because instances could not authenticate to BigQuery. You need to ensure that the instances have the necessary permissions without embedding credentials in the application. What should you do?

Accepted Answer

Create a service account with the BigQuery Data Editor role and assign it to the MIG as the instance service account.. Assigning a dedicated service account with the BigQuery Data Editor role to the managed instance group allows instances to obtain credentials from the metadata server, adhering to security best practices. This avoids key management and ensures least privilege. The other options either use insecure key files or grant excessive permissions to the default service account.

Answer

Enable the BigQuery API on the project and grant the Compute Engine default service account the BigQuery Data Editor role.

Answer

Generate a service account key file and store it in Cloud Storage. Configure the application to download the key at startup and use it for authentication.

Answer

Use Application Default Credentials (ADC) by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a JSON key file stored on each instance's local SSD.

Question 15

An organization runs a Kubernetes cluster on GKE with cluster autoscaling enabled. They notice that pods are frequently in 'Pending' state due to insufficient CPU, but the cluster autoscaler does not add nodes quickly enough. What is the most likely cause?

Accepted Answer

The node pool has reached the maximum node count limit.. The cluster autoscaler cannot add new nodes if the node pool has already reached its maximum node count limit. This limit is configured at the node pool level in GKE, and once reached, the autoscaler will not scale up further, leaving pods in 'Pending' state due to insufficient CPU resources.

Answer

The cluster autoscaler is using the 'least-waste' expander.

Answer

The horizontal pod autoscaler (HPA) is misconfigured.

Answer

The pod disruption budget (PDB) is too restrictive.