Google PCA Practice Exam 2 — 20 Questions

Question 1

A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?

Accepted Answer

The service project admin lacks the compute.subnetworks.create permission on the host project.. In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.

Answer

Only the Shared VPC host project admin can create subnets.

Answer

The Shared VPC is not enabled for the service project.

Answer

Subnets must be created in the service project, not the host project.

Question 2

Your organization stores critical financial data in Cloud Storage. You need to ensure that if an object is deleted or overwritten, you can recover it within 30 days. What feature should you enable?

Accepted Answer

Enable object versioning on the bucket. Cloud Storage offers object versioning and retention policies to protect data. Versioning keeps non-current versions of objects, allowing recovery from accidental deletion or overwrites. Object retention policies (e.g., retention policy or hold) prevent deletion or modification for a specified period, but versioning is the primary mechanism to recover from deletion.

Answer

Set a retention policy with a 30-day retention period

Answer

Configure lifecycle management to delete objects after 30 days

Answer

Enable Bucket Lock with a retention policy

Question 3

A financial services company uses Cloud Storage to store sensitive transaction records. They need to ensure that objects cannot be deleted or overwritten for a retention period of 7 years, even by the bucket owner. Which feature should they enable?

Question 4

A company needs to store and serve large media files (each up to 5 GB) to users globally. The files are accessed infrequently (once a quarter) but must be available with low latency. Which THREE Cloud Storage classes and features should they consider? (Choose three.)

Accepted Answer

Cloud CDN. Nearline is suitable for data accessed less than once a month. Cloud CDN caches content at edge locations for low latency. Object lifecycle management can transition objects to colder storage automatically. Standard is for frequently accessed data. Coldline is for data accessed less than once a quarter. Archive is for data accessed less than once a year.

Answer

Coldline storage class

Answer

Standard storage class

Question 5

A company has a GKE cluster with Workload Identity enabled. A pod needs to access a BigQuery dataset in a different project. The team has created a service account in the pod's project and granted it BigQuery Data Viewer on the dataset. They also created an IAM policy binding between the Kubernetes service account and the Google service account. The pod still gets permission denied. What is missing?

Accepted Answer

The Google service account needs the iam.workloadIdentityUser role on itself. Workload Identity requires the Google service account to be granted the iam.workloadIdentityUser role on the Google service account itself, not just on the Kubernetes service account.

Answer

The Kubernetes service account needs the iam.workloadIdentityUser role

Answer

The pod needs a node pool with Workload Identity enabled

Answer

The BigQuery dataset must be in the same project as the cluster

Question 6

A company deploys a global application on Cloud Run and uses Cloud SQL for user data. They need sub-10ms read latency for frequently accessed user profiles across regions. Traffic is unpredictable but consistently high. The database must support strong consistency. Which approach meets these requirements?

Accepted Answer

Use Cloud Spanner with multi-region configuration. Cloud Spanner with a multi-region configuration is the only option that provides strong consistency, sub-10ms read latency, and automatic scaling for unpredictable, high traffic across regions. It uses synchronous replication with Paxos-based consensus to ensure globally consistent reads without sacrificing performance.

Answer

Use Cloud Bigtable with replication across regions

Answer

Use Cloud SQL with read replicas in each region and enable synchronous replication

Answer

Use Cloud SQL with cross-region replication and Memorystore cache in each region

Question 7

Refer to the exhibit. The SLO for the payments-api service is 99.9% availability over 30 days. The current compliance is 99.89% and the error budget is exhausted. Which action should the SRE team take FIRST?

Accepted Answer

Pause all non-critical deployments and investigate the cause of the increased error rate.. The error budget is exhausted, meaning the service has already consumed its allowed downtime for the 30-day window. The immediate priority is to stop further budget erosion by pausing non-critical deployments and investigating the root cause of the increased error rate. This aligns with SRE best practices: when the error budget is depleted, the team should shift focus from feature velocity to reliability, halting all non-essential changes until the cause is understood and mitigated.

Answer

Increase the SLO target to 99.99% to reduce future burn rate.

Answer

Trigger a rollback of the latest deployment to stabilize the service.

Answer

Scale up the service to handle more traffic and reduce error rate.

Question 8

Your company runs a production application on Compute Engine instances behind a managed instance group (MIG). You need to perform a rolling update with canary testing, gradually shifting traffic to the new version only if performance metrics are healthy. Which approach should you use?

Accepted Answer

Use Cloud Deploy with a deployment strategy that includes a canary phase and automated verification. Cloud Deploy can be used to orchestrate canary deployments on Compute Engine. However, a more direct approach is to use a MIG with a canary configuration: you can update the MIG's instance template and use a new MIG for the canary version, then adjust the load balancer's backend weights to shift traffic gradually. Cloud Deploy supports this with deployment strategies.

Answer

Create a new MIG with the new template and use a Cloud Load Balancer's traffic splitting

Answer

Manually update each instance by SSH'ing and running a script

Answer

Use gcloud compute instance-groups managed rolling-action start-update with a maxSurge of 0

Question 9

Your organization uses Cloud Spanner for a customer database with a 99.999% availability SLA. You need a Disaster Recovery plan that ensures data consistency with zero RPO in case of a region failure. What should you do?

Accepted Answer

Use a multi-region instance configuration (e.g., nam-eur-asia) for the Spanner instance.. Cloud Spanner multi-region instance configurations (e.g., nam-eur-asia) provide synchronous replication across multiple regions, ensuring strong global consistency and zero RPO. This architecture uses Paxos-based replication to commit writes only after they are durably stored in a majority of regions, so a region failure does not lose any committed data. The 99.999% availability SLA is met by automatic failover within the multi-region setup without manual intervention.

Answer

Use a single-region instance configuration and enable read replicas.

Answer

Export the database periodically to Cloud Storage and set up a cross-region load balancer.

Answer

Configure daily backups and store them in Cloud Storage in a different region.

Question 10

Match each GCP monitoring/logging tool to its purpose.

Accepted Answer

Cloud Monitoring: Provides visibility into performance, uptime, and health of applications and infrastructure.. Correct matches: Cloud Monitoring monitors performance, Cloud Logging manages logs, Error Reporting tracks errors. Confusion often arises between logging and monitoring roles.

Answer

Cloud Monitoring: Real-time log management and analysis for applications and services.

Answer

Cloud Logging: Counts, analyzes, and aggregates errors in cloud services.

Question 11

A company runs an e-commerce platform on Google Cloud. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster (us-central1, three zones). The frontend service is exposed via an HTTP Load Balancer with Cloud CDN. Recently, during a flash sale, users experienced high latency and occasional 502 errors. The backend service is a Java application that reads from Cloud Spanner. The team has observed that Spanner CPU utilization averaged 65% during the sale, with a few spikes to 80%. The number of frontend pods was auto-scaled to 50, each running on n1-standard-2 nodes. The node pool is set to autoscale up to 100 nodes. The errors appear to correlate with periods of high CPU on the nodes, but not always. What is the most likely cause and recommended action?

Accepted Answer

Change the backend service to use a multi-zone NEG that includes endpoints from all three zones, and ensure the load balancer is configured for cross-zone load balancing.. The high latency and 502 errors are likely caused by the HTTP Load Balancer sending requests to unhealthy backend pods due to zone-imbalanced traffic. A regional GKE cluster with a multi-zone NEG and cross-zone load balancing ensures that the load balancer distributes requests evenly across all pods in all three zones, preventing node CPU spikes in a single zone from causing errors. Option B directly addresses this by enabling proper traffic distribution, which is the most probable root cause given that node CPU spikes correlate with errors but not always.

Answer

Scale up the Cloud Spanner instance to handle higher peak CPU, as the 80% spikes indicate insufficient capacity.

Answer

Increase the CPU request for the frontend pods and set a higher target CPU utilization for the Horizontal Pod Autoscaler.

Answer

Increase the health check interval and timeout settings to give pods more time to respond before being marked unhealthy.

Question 12

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) using a Deployment into the correct order.

Accepted Answer

Build the container image, then push the image to a registry, then create a Deployment manifest, then apply the Deployment to the cluster, then create a Service to expose the application.. The image must be in a registry before the Deployment can reference it. The Service provides external access.

Answer

Build the container image, then push the image to a registry, then create a Service, then create a Deployment manifest, then apply the Deployment.

Answer

Build the container image, then create a Deployment manifest, then push the image to a registry, then apply the Deployment, then create a Service.

Answer

Create a Deployment manifest, then apply the Deployment, then build the container image, then push the image to a registry, then create a Service.

Question 13

A Cloud Router BGP session is flapping. The logs show 'Interface flapping due to changes in the underlying network'. What is the most likely cause?

Accepted Answer

MTU mismatch across the network path.. The log message 'Interface flapping due to changes in the underlying network' indicates that the BGP session is unstable because the physical or logical interface is going up and down. An MTU mismatch across the network path can cause packet fragmentation issues, leading to intermittent connectivity and interface flaps as the router detects and recovers from the problem. This is the most likely cause because it directly affects the stability of the underlying network path.

Answer

BGP MD5 authentication failure.

Answer

Incorrect local AS number in Cloud Router configuration.

Answer

BGP timer misconfiguration between peers.

Question 14

A financial services company requires a globally distributed relational database with strong consistency and horizontal scalability to serve a multi-region banking application. Write conflicts are rare. Which database should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud database that provides global distribution, strong consistency, and horizontal scalability for relational workloads. It uses true-time technology for external consistency. Bigtable is NoSQL; Firestore is eventually consistent; Cloud SQL is regional.

Answer

Firestore in Native mode

Answer

Cloud SQL with cross-region replication

Answer

Cloud Bigtable

Question 15

A startup is designing a real-time leaderboard for a multiplayer game. The leaderboard must update within seconds of a score change and handle millions of concurrent players. Strong consistency is not required, but availability is critical. Which database is most suitable?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is optimized for high-throughput, low-latency reads and writes, and can serve as a leaderboard backend if row keys are designed properly. It offers eventual consistency, which is acceptable here. Cloud Spanner provides strong consistency but is more expensive and may have higher latency. Firestore is good for real-time updates but may not handle millions of concurrent updates easily. Memorystore (Redis) can also do leaderboards but is not a database for persistent storage; it's a cache.

Answer

Cloud Memorystore

Answer

Cloud Spanner

Answer

Cloud Firestore

Question 16

A company runs a batch process every night that loads data into BigQuery. They want to ensure that if the job fails, it is retried automatically up to 3 times. Which configuration should they use?

Accepted Answer

Cloud Composer (Airflow) tasks with retries.. Cloud Composer (Airflow) natively supports task-level retries via the `retries` parameter in task definitions, allowing you to specify up to 3 automatic retries on failure. This is the appropriate choice for orchestrating a batch process that loads data into BigQuery, as Airflow provides robust retry logic, dependency management, and monitoring for complex workflows.

Answer

Cloud Run jobs with --max-retries=3.

Answer

Cloud Scheduler with retry policy.

Answer

BigQuery load job with maximum retries setting.

Answer

Cloud Functions with error handling.

Question 17

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud VPC: Isolated virtual network for GCP resources. These are core networking services in GCP. Cloud VPC provides isolated virtual networks, Cloud Load Balancing distributes traffic, Cloud CDN caches content at the edge, and Cloud NAT enables outbound internet for private instances. Common confusion: mixing up VPC and Load Balancing definitions, or CDN and NAT.

Answer

Cloud VPC: Distributes incoming traffic across multiple instances

Answer

Cloud CDN: Network address translation for private instances to access internet

Question 18

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

Accepted Answer

Create a regional Cloud SQL instance with automatic failover.. A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Answer

Create a read replica in a different region.

Answer

Export the database daily and import into a new instance if failure occurs.

Answer

Deploy Cloud SQL across multiple regions using cross-region replication.

Question 19

Refer to the exhibit. A Cloud Storage bucket has this IAM policy. What security recommendation should be made?

Accepted Answer

Remove the `allUsers` member and use signed URLs for public access.. The IAM policy grants `roles/storage.objectViewer` to `allUsers`, which makes the bucket's objects publicly readable by anyone on the internet. This is a security risk because it allows anonymous access without authentication or logging. The recommended practice is to remove the `allUsers` member and instead use signed URLs (which embed a time-limited access token) to grant temporary, controlled access to specific objects.

Answer

Change `allUsers` to `allAuthenticatedUsers` to allow only authenticated users.

Answer

Enable uniform bucket-level access and update the IAM policy.

Answer

Remove the `roles/storage.objectViewer` role binding entirely.

Question 20

You are responsible for incident management for a production service. You want to reduce manual toil during the initial response to common issues like high latency. What is the best approach?

Accepted Answer

Use Cloud Monitoring to trigger a Cloud Function that performs automated checks and rolls back the last deployment if latency spikes.. It directly reduces manual toil by automating the initial response to common issues like high latency. Cloud Monitoring triggers a Cloud Function that performs automated checks and, if latency spikes, rolls back the last deployment, eliminating the need for human intervention during the critical first response phase.

Answer

Set up Cloud Monitoring alerts with email notifications to the on-call engineer.

Answer

Create detailed runbooks and require the on-call to follow them step by step.

Answer

Enable Cloud Logging and set up a custom dashboard for the on-call.