Google PCA Practice Exam 2 — 20 Questions

Question 1

Your company is using Cloud Storage to store sensitive customer data. The security team requires that all objects be encrypted with a customer-managed encryption key (CMEK) and that the key be automatically rotated every 90 days. You need to implement this without changing the application code. You have created a Cloud KMS key ring and a key with rotation period set to 90 days. What additional configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the default encryption key of the Cloud Storage bucket to the Cloud KMS key.. Setting the default encryption key of the Cloud Storage bucket to the Cloud KMS key ensures that all objects written to the bucket are automatically encrypted with that CMEK, without requiring any application code changes. The Cloud KMS key's rotation period of 90 days is already configured, so the key will be rotated automatically, meeting the security team's requirement.

Answer

Set a bucket lifecycle rule to transition objects to a different storage class.

Answer

Create a custom customer-supplied encryption key (CSEK) and provide it in each request.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.

Question 2

A company is adopting Site Reliability Engineering (SRE) practices. After a major incident, they want to conduct a review to understand what went wrong and how to prevent recurrence, without blaming individuals. Which SRE practice should they follow?

Accepted Answer

Conduct a blameless postmortem. A blameless postmortem focuses on learning from incidents without assigning blame. Error budgets are for measuring reliability, SLOs/SLIs are for defining targets, and capacity planning is for scaling.

Answer

Define SLOs and SLIs

Answer

Create an error budget policy

Answer

Perform capacity planning

Question 3

A data analytics company runs nightly batch jobs using Compute Engine instances. The jobs can tolerate interruptions, and the company wants to minimize costs. What should they do?

Accepted Answer

Use preemptible VMs for the batch jobs.. Preemptible VMs (now called Spot VMs) are Compute Engine instances that last up to 24 hours and can be terminated at any time by Google Cloud. Because the batch jobs are interruptible, using preemptible VMs reduces compute costs by up to 60-91% compared to standard on-demand VMs, directly meeting the goal of minimizing costs.

Answer

Use C2 high-CPU machine types for faster processing.

Answer

Use standard (on-demand) VMs and commit to a 1-year resource-based commitment.

Answer

Deploy VMs on Sole-tenant nodes for cost isolation.

Question 4

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is a GCP service designed to store, manage, and access secrets such as API keys, passwords, and certificates. It supports automatic rotation of secrets via integration with Cloud Functions and other services, and provides versioning and audit logging.

Answer

Cloud HSM

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 5

A team is designing a disaster recovery (DR) plan for a critical application. Which THREE components are essential for a robust DR plan? (Choose 3)

Accepted Answer

Failover procedures and runbooks. Failover procedures and runbooks (A) are essential because they provide step-by-step instructions for executing a controlled transition to the secondary site, ensuring minimal downtime and consistent recovery actions. Without documented runbooks, teams risk misconfigurations during a disaster, which can extend recovery time objectives (RTO) beyond acceptable limits.

Answer

A single-region deployment for consistency

Answer

Load testing to validate performance

Question 6

Which TWO of the following are benefits of using a VPC Service Controls perimeter?

Accepted Answer

Prevent data exfiltration from managed services like BigQuery and Cloud Storage. VPC Service Controls perimeters are designed to mitigate data exfiltration risks for managed services such as BigQuery, Cloud Storage, and other Google Cloud APIs, so option A is correct because the perimeter restricts data movement across its boundary even when credentials are valid. Option E is also correct because a perimeter defines an authorized boundary (based on VPC networks, projects, and access levels) from which managed services can be reached, effectively allowing access only from authorized VPC networks. Option B is wrong because VPC Service Controls is not a network firewall for Compute Engine instances; that role belongs to VPC firewall rules and hierarchical firewall policies. Option C is wrong because encryption in transit between on-premises and Google Cloud is handled by mechanisms such as Cloud VPN, Cloud Interconnect with MACsec, or application-layer TLS, not by VPC Service Controls. Option D is wrong because VPC Service Controls complements rather than replaces IAM; IAM still governs identities and permissions, while the perimeter adds an independent context-aware boundary.

Answer

Act as a network firewall for Compute Engine instances

Answer

Provide encryption of data in transit between on-premises and Google Cloud

Answer

Replace Identity and Access Management (IAM) for service access control

Question 7

An organization requires that only container images signed by a trusted authority can be deployed on Google Kubernetes Engine (GKE). Which Google Cloud service should they implement?

Accepted Answer

Binary Authorization. Binary Authorization is a Google Cloud service that enforces deploy-time policies on GKE, allowing only container images signed by trusted authorities to be deployed. It integrates with Container Analysis and attestations to verify signatures before admission.

Answer

Artifact Registry

Answer

Secret Manager

Answer

Cloud Deploy

Question 8

Your organization has a policy that all Compute Engine instances must have specific labels (env, team, cost-center) applied. You want to enforce this automatically when instances are created. What should you do?

Accepted Answer

Use the Organization Policy service with a custom constraint to require labels on Compute Engine instances.. Organization Policy Service with a custom constraint allows you to enforce that all Compute Engine instances must have specific labels (env, team, cost-center) at creation time. This is a preventive control that blocks creation of non-compliant instances, unlike reactive or permission-based approaches. Custom constraints use the `compute.googleapis.com/instance` resource type and can require label keys or values using CEL (Common Expression Language) syntax.

Answer

Enable Cloud Audit Logs and set up a metric-based alert to detect instances without labels.

Answer

Create a Cloud Function that listens for instance creation events and adds labels automatically.

Answer

Assign a custom IAM role that includes permission to label instances, and remove the default compute.instances.create permission.

Question 9

A financial services company is migrating a monolithic Java application to Google Kubernetes Engine (GKE) for improved scalability and reliability. The application serves real-time trading data and has strict latency requirements. Post-migration, the team observes frequent pod restarts due to OutOfMemory (OOM) errors, increased latency during peak trading hours, and occasional database connection timeouts. The current setup uses a single GKE cluster with a node pool of n1-standard-4 machines, a stateless application deployed as a Deployment with resource requests and limits set to 512 Mi memory and 1 CPU. The database is a Cloud SQL PostgreSQL instance with 2 vCPUs and 7.5 GB memory, and applications connect using a hardcoded connection string. The team wants to ensure reliable operation under load and during node maintenance events. Which course of action best addresses the reliability issues?

Accepted Answer

Adjust resource requests to 1 Gi memory and 2 CPU, set limits to 2 Gi and 4 CPU, create an HPA based on a custom metric (e.g., requests per second), enable cluster autoscaler, implement Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max connection pool size, and configure PDB with maxUnavailable 1.. Best addresses all reliability issues. Adjusting resource requests to 1 Gi memory and 2 CPU ensures proper scheduling, while limits of 2 Gi and 4 CPU prevent OOM errors. The HPA based on custom metrics (e.g., requests per second) scales pods proactively during peak trading hours. Cluster autoscaler handles node capacity, and Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max pool size prevents database connection timeouts. Finally, a PDB with maxUnavailable 1 ensures availability during node maintenance. Option B misses resource tuning, autoscaling, and connection pooling. Option C unnecessarily moves the database to GKE, increasing complexity and losing managed DB benefits. Option D lacks custom metric HPA, cluster autoscaler, and PDB, leaving gaps in scalability and maintenance handling.

Answer

Enable GKE node auto-upgrade, configure Pod Disruption Budgets (PDB) with minAvailable 1, and set readiness probes to check application health.

Answer

Migrate the database to a StatefulSet in GKE with persistent volumes, increase node count to 10, and enable cluster autoscaler.

Answer

Increase memory limits to 2 Gi and CPU to 2, add Horizontal Pod Autoscaler (HPA) based on CPU utilization, and implement connection pooling using Cloud SQL Auth Proxy.

Question 10

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Question 11

An organization deploys a web application on Compute Engine behind a global HTTPS load balancer. They want to reduce latency for users worldwide and minimize load on backend instances. Which GCP service should they use?

Accepted Answer

Cloud CDN. Cloud CDN uses Google's global edge caches to serve content closer to users, reducing latency and backend load. Cloud Armor provides security, Cloud NAT is for outbound connectivity, and VPC peering is for network connectivity, not caching.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC Network Peering

Question 12

Which THREE steps can reduce processing costs in a Dataflow streaming pipeline? (Choose three.)

Accepted Answer

Use side inputs instead of a cross join.. Option A is correct because replacing a cross join with side inputs avoids the expensive fan-out of every element being paired with every element of the other collection, which drastically reduces the number of elements processed and shuffled in the streaming pipeline. Option B is correct because running non-critical data through a batch pipeline lets Dataflow use cheaper batch pricing and more efficient batch-optimized execution rather than paying for continuously running streaming workers. Option C is correct because GroupByKey in streaming mode forces a shuffle and holds state for each key until the window fires, so minimizing it (for example by using Combine or pre-aggregation) lowers shuffle volume, state storage, and processing cost. Option D is not correct because a custom runner does not reduce Dataflow processing costs and is not a cost-optimization step. Option E is not correct because increasing the number of workers raises the amount of compute used and therefore increases, rather than reduces, processing costs.

Answer

Use a custom runner.

Answer

Increase the number of workers.

Question 13

A financial services company requires a globally distributed relational database with strong consistency and horizontal scalability to serve a multi-region banking application. Write conflicts are rare. Which database should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is Google's globally distributed, horizontally scalable, strongly consistent relational database. It uses TrueTime and Paxos to provide external consistency across regions, making it the only option that meets all three requirements: global distribution, strong consistency, and horizontal scalability for a relational workload.

Answer

Firestore in Native mode

Answer

Cloud SQL with cross-region replication

Answer

Cloud Bigtable

Question 14

A company is planning a phased migration of their on-premises database to Cloud SQL. They want to minimize downtime and ensure data consistency. Which approach should they use?

Accepted Answer

Use Database Migration Service (DMS). Database Migration Service (DMS) supports continuous replication with minimal downtime. Export and import involves downtime. Lift-and-shift is not a GCP service. VM migration is for servers, not databases.

Answer

Lift and shift the database server to Compute Engine

Answer

Export the database to a SQL dump file and import into Cloud SQL

Answer

Use VM migration to move the database server

Question 15

You are the lead cloud architect for a startup that runs a web application on Google Kubernetes Engine (GKE) with a standard (zonal) cluster. The application is deployed with 3 replicas of a stateless frontend service. During a recent incident, a zone outage caused all GKE nodes to become unavailable, leading to application downtime of 45 minutes. You need to redesign the cluster to tolerate a single zone failure with no more than 5 minutes of downtime. Your budget allows for at most a 20% increase in compute costs. Which approach should you take?

Accepted Answer

Migrate the cluster to a regional GKE cluster with nodes in 3 zones and distribute replicas across zones. D is correct because a regional GKE cluster distributes nodes across three zones, ensuring that if one zone fails, the remaining two zones continue serving traffic. By spreading the 3 replicas across zones (e.g., one per zone), the application tolerates a single zone outage with near-zero downtime, and the 20% cost increase covers the additional node pool overhead without exceeding the budget.

Answer

Increase the number of replicas from 3 to 9 and keep the zonal cluster

Answer

Change the frontend deployment to use regional persistent disks

Answer

Deploy second GKE cluster in another region and use global load balancer for failover

Question 16

An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?

Accepted Answer

Increase the memory allocated to the Cloud Function.. The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Answer

Increase the maximum number of concurrent function instances.

Answer

Enable Pub/Sub batching to reduce the number of function invocations.

Answer

Split the function into multiple smaller functions, each handling a subset of the data.

Question 17

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

Accepted Answer

A firewall rule with the name 'my-firewall' already exists in the project.. The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer

The user lacks IAM permissions to create firewall rules.

Answer

The network reference in the firewall rule is incorrect.

Answer

The deployment does not include a 'delete' policy for existing resources.

Question 18

A company deploys a microservices application on Google Kubernetes Engine (GKE). Pods in one deployment are frequently OOMKilled. The team sets memory requests and limits, but pods still crash. What is the most likely remaining cause?

Accepted Answer

The application has a memory leak that eventually exceeds the limit.. OOMKilled errors occur when a container exceeds its memory limit. Setting memory requests and limits prevents unbounded usage, but if the application has a memory leak, it will continue to consume memory until it hits the configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the pod. The fact that pods still crash after setting limits indicates the application itself is the root cause, not resource configuration.

Answer

CPU requests are too low, causing throttling and eventual crash.

Answer

The node pool is too small, causing memory pressure on the node.

Answer

Memory limits are set higher than the node's allocatable memory.

Question 19

A company is using Cloud NAT to allow private instances to access the internet. They notice that outbound connections are failing intermittently. What is the most likely cause?

Accepted Answer

The number of concurrent connections exceeds the Cloud NAT source port capacity for the assigned NAT IPs.. Cloud NAT uses source network address translation (SNAT) to map private instance IPs to a single public IP address. Each NAT IP has a limited pool of source ports (typically 64,512 per IP for TCP/UDP). When concurrent connections exceed this capacity, new outbound connections are dropped, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures.

Answer

The private instances are using the wrong DNS server.

Answer

The VPC firewall rules are blocking egress traffic.

Answer

Cloud NAT does not support TCP connections.

Question 20

A team is designing a disaster recovery plan for a critical application. They need to ensure RPO of less than 1 hour and RTO of less than 4 hours. The application runs on Compute Engine with persistent disks and uses Cloud SQL for MySQL. Which THREE actions should they take? (Choose 3.)

Accepted Answer

Store application configuration and scripts in a multi-regional Cloud Storage bucket. Option C is correct because storing application configuration and scripts in a multi-regional Cloud Storage bucket ensures they remain available even if one region fails, supporting recovery within the 4-hour RTO without manual rebuild delays. Option D is correct because Cloud SQL cross-region replication continuously replicates the MySQL database to a replica in another region, enabling a low RPO (well under 1 hour) and a fast promotion/failover path to meet the 4-hour RTO. Option E is correct because regular persistent disk snapshots replicated to another region via Cloud Storage provide a restorable copy of Compute Engine disk data in the DR region, which is necessary to rebuild instances within the RTO and keep data loss under the RPO. Option A is not appropriate because Transfer Appliance is an offline, batch data-transfer appliance with weekly cadence, which cannot meet an RPO under 1 hour or an RTO under 4 hours. Option B is not sufficient because a regional managed instance group only provides automatic failover across zones within a single region, not cross-region disaster recovery, so a region-wide outage would still exceed the required RTO/RPO.

Answer

Deploy a Transfer Appliance to copy data to another region weekly

Answer

Use a regional managed instance group and rely on Google's automatic failover