Google PCA Practice Exam 3 — 20 Questions

Question 1

A company is migrating a stateful application to Google Cloud. The application requires persistent disks with low latency and high IOPS for database workloads. They plan to use Compute Engine instances with SSD persistent disks. However, the database performance is lower than expected. Which action should the company take to improve disk performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use local SSDs with RAID 0 configuration for the database data.. Local SSDs provide the highest IOPS and lowest latency of any disk option on Compute Engine, and striping them with RAID 0 aggregates their performance. This directly addresses the need for high IOPS and low latency for database workloads, unlike persistent disks which have performance ceilings tied to disk size and instance limits.

Answer

Change the persistent disk type to standard persistent disk.

Answer

Increase the disk size to increase baseline IOPS.

Answer

Enable disk encryption to improve I/O throughput.

Question 2

A company runs a microservices-based application on Google Kubernetes Engine (GKE) with a Regional cluster. They want to improve reliability by implementing best practices for pod scheduling and resilience. Which TWO actions should they take? (Choose two.)

Accepted Answer

Define a PodDisruptionBudget for each deployment to limit the number of concurrent disruptions. A PodDisruptionBudget (PDB) limits the number of Pods of a replicated application that can be down simultaneously from voluntary disruptions, such as node maintenance or cluster upgrades. This ensures that a minimum number of replicas remain available, improving application reliability during planned events.

Answer

Set terminationGracePeriodSeconds to 0 for faster pod termination during scale-down

Answer

Enable cluster autoscaler to automatically add nodes when pods are pending

Answer

Set resource requests equal to limits to ensure guaranteed QoS class

Question 3

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Accepted Answer

Deployment with pod anti-affinity rules spread across zones. The correct option is B: a Deployment with pod anti-affinity rules spread across zones. Deployments are the standard GKE workload for stateless microservices, providing declarative rolling updates (via RollingUpdate strategy with maxSurge/maxUnavailable) and integration with the Horizontal Pod Autoscaler for automatic scaling, while pod anti-affinity (or topologySpreadConstraints) spreads replicas across multiple zones for high availability. StatefulSet (A) is designed for stateful workloads needing stable network identities and per-pod PersistentVolumes, not for stateless services requiring rolling updates and autoscaling. Job (C) runs finite batch tasks to completion rather than long-running services, and DaemonSet (D) schedules one pod per node for node-level agents, not scalable service replicas.

Answer

StatefulSet with volumeClaimTemplates for persistent storage

Answer

Job for batch processing

Answer

DaemonSet to ensure one pod per node

Question 4

Which IAM role should be granted to a user who needs to view but not modify resources in a project?

Accepted Answer

roles/viewer. The roles/viewer role grants read-only access to all resources within a project, allowing the user to view but not modify them. This aligns with the principle of least privilege for a user who only needs to inspect resources. It includes permissions to list and get resources but not to create, update, or delete.

Answer

roles/editor

Answer

roles/owner

Answer

roles/browser

Question 5

Which THREE actions can help reduce costs for a BigQuery workload that runs frequent, ad-hoc analytical queries on a large dataset?

Accepted Answer

Partition the table by a date or timestamp column.. Option B is correct because partitioning the table by a date or timestamp column lets BigQuery prune irrelevant partitions, so ad-hoc queries that filter on that column scan far less data and incur lower on-demand query costs. Option C is correct because materialized views precompute and cache the results of common aggregation queries, so repeated ad-hoc aggregations read the much smaller materialized view instead of rescanning the full large dataset. Option D is correct because clustering on columns frequently used in filter clauses co-locates related data in storage blocks, allowing BigQuery to skip blocks that don't match the filter and further reduce bytes scanned. Option A is not correct because automatic schema detection only simplifies loading data and has no effect on query cost. Option E is not correct because flat-rate pricing with reserved slots provides predictable capacity billing rather than reducing the cost of a sporadic ad-hoc query workload, which is typically cheaper on on-demand pricing.

Answer

Enable automatic schema detection to avoid manual schema definition.

Answer

Use flat-rate pricing with reserved slots.

Question 6

A developer needs to build a serverless event-driven application that responds to Cloud Storage object uploads by processing the file and storing results in Firestore. Which compute service is the best fit?

Accepted Answer

Cloud Functions. Cloud Functions is a serverless event-driven compute service that can be triggered directly by Cloud Storage events, ideal for simple processing tasks.

Answer

App Engine Flexible Environment

Answer

Cloud Run for Anthos

Answer

Compute Engine with startup scripts

Question 7

Match each GCP security service to its function.

Accepted Answer

Cloud Armor: Protects against DDoS attacks and web application firewall. Cloud Armor protects against DDoS and web attacks; IAP controls access based on identity; KMS handles encryption keys; DLP protects sensitive data. Distractors swap these functions.

Answer

Cloud Armor: Manages encryption keys for cloud services

Answer

Cloud Identity-Aware Proxy (IAP): Scans for vulnerabilities in compute instances

Question 8

A company is deploying a new application on Compute Engine. They need to ensure that the application can automatically recover from a zone failure. What is the best approach?

Accepted Answer

Create a managed instance group with instances in multiple zones.. A managed instance group (MIG) with instances in multiple zones provides automatic recovery from a zone failure by distributing instances across zones and using auto-healing to recreate failed instances. If one zone becomes unavailable, the load balancer routes traffic to healthy instances in other zones, ensuring high availability without manual intervention.

Answer

Use a global load balancer in front of a single instance.

Answer

Create a single VM in a single zone and rely on live migration.

Answer

Use Cloud Storage to store application state and restore from a snapshot.

Question 9

Drag and drop the steps to implement a disaster recovery plan using Cloud Storage and Cloud Functions in the correct order.

Accepted Answer

Enable versioning on the primary bucket, then create a Cloud Function to copy new objects to the DR bucket, then test the procedure.. Versioning protects against accidental deletion. The Cloud Function copies objects to the DR bucket.

Answer

Create a Cloud Function to copy new objects to the DR bucket, then enable versioning on the primary bucket, then test.

Answer

Create a Cloud Function, then test, then enable versioning.

Answer

Enable versioning, then test, then create the Cloud Function.

Question 10

A company wants to improve the performance of their Cloud SQL for PostgreSQL instance. They notice many idle connections and slow queries. Which THREE actions could help? (Choose 3)

Accepted Answer

Add appropriate indexes. Option A (Add appropriate indexes) is correct because missing indexes force sequential scans on large tables, and creating B-tree or other suitable indexes lets PostgreSQL satisfy WHERE, JOIN, and ORDER BY clauses with index scans, directly reducing slow query latency. Option B (Add read replicas) is correct because Cloud SQL read replicas offload read-only SELECT traffic from the primary instance, increasing read throughput and reducing contention on the primary for read-heavy workloads. Option C (Use PgBouncer for connection pooling) is correct because PgBouncer multiplexes many client connections over a small pool of backend PostgreSQL connections, which directly addresses the many idle connections consuming memory and backend process slots. Option D (Enable private IP) is not correct because private IP only changes network routing and security exposure; it does not improve query performance or reduce idle connections. Option E (Increase disk size) is not correct because disk size affects storage capacity and, on some tiers, IOPS, but it does not address idle connections or slow queries caused by poor indexing or connection churn.

Answer

Enable private IP

Answer

Increase disk size

Question 11

An application uses Cloud Bigtable and experiences high latency for reads. The row key is a timestamp prefix followed by a random ID. Queries often scan a range of timestamps for a specific ID. What design change would MOST improve read performance?

Accepted Answer

Change the row key to start with the random ID followed by timestamp. For Bigtable, row key design is critical. Scanning a range of timestamps for a specific ID is inefficient if the key starts with timestamp (scans across all IDs). Prepending the ID ensures all data for that ID is contiguous, making range scans efficient. Adding nodes increases throughput but doesn't fix the key design issue. Using a column family is about grouping columns, not performance.

Answer

Add more Bigtable nodes

Answer

Use a separate column family for the ID

Answer

Enable Bigtable replication

Question 12

A company is designing a highly available architecture for a stateful application on Compute Engine. They need to protect against zonal failures. Which THREE steps should they take?

Accepted Answer

Use a global load balancer with health checks. Option B is correct because a global external Application Load Balancer (or global external proxy Network Load Balancer) with health checks distributes traffic across healthy backends in multiple zones and automatically stops routing to unhealthy instances, providing resilience against a zonal failure. Option D is correct because regional persistent disks synchronously replicate data between two zones in the same region, so a stateful application's data remains available if one zone fails. Option E is correct because a managed instance group (MIG) spread across multiple zones maintains capacity and automatically recreates instances in surviving zones when a zone becomes unavailable. Option A is wrong because storing session state only in memory ties the state to a single instance and is lost on failure, breaking high availability. Option C is wrong because a single-zone instance group has no protection against a zonal outage.

Answer

Store session state in memory

Answer

Use a single zone instance group

Question 13

A company stores infrequently accessed data in Cloud Storage Standard class. To reduce costs, they want to automatically move objects older than 90 days to a lower-cost storage class. Which approach should they use?

Accepted Answer

Configure a lifecycle policy to transition to Archive class. Object Lifecycle Management in Cloud Storage is designed exactly for this use case: automatically transitioning objects to lower-cost storage classes based on age or other conditions. Configuring a lifecycle rule to transition objects older than 90 days to the Archive class (A) reduces cost while preserving durability and access when needed. Lifecycle policies run asynchronously and are the standard, supported mechanism for automated class transitions.

Answer

Use gsutil rewrite to manually change storage class

Answer

Set up Pub/Sub notifications for object changes

Answer

Enable object versioning

Question 14

A retail company runs a Java-based order service on Compute Engine. The service currently reads its database credentials from a plaintext file on the boot disk. A security review requires that the credentials be removed from disk, be automatically rotated every 30 days, and be retrievable by the application through a single API call. You want the least operational overhead. What should you do?

Accepted Answer

Store the credential as a version in Secret Manager, grant the VM's service account roles/secretmanager.secretAccessor on that secret, and configure a rotation schedule that publishes to a Pub/Sub topic.. The requirements point to a managed secret store with per-secret IAM and built-in rotation. Secret Manager keeps the credential off disk, lets the application retrieve it with one API call, and supports a rotation schedule that notifies a Pub/Sub topic so an automated workflow can update the underlying database password. Object storage, metadata, and KMS-wrapped files all leave the credential materialized on the instance or require custom rotation logic.

Answer

Encrypt the credentials file with a Cloud KMS key, keep it on the boot disk, and grant the VM's service account roles/cloudkms.cryptoKeyDecrypter so the application can decrypt it at startup.

Answer

Store the credentials in a Cloud Storage bucket with uniform bucket-level access and grant the VM's service account roles/storage.objectViewer, then have the application download the file at startup.

Answer

Store the credential in a custom metadata key on the instance and grant the VM's service account the compute.instanceAdmin.v1 role so it can read its own metadata.

Question 15

A developer wants to store a database password securely and have it automatically rotated every 30 days. The password is used by a Compute Engine instance. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing, versioning, and rotating secrets such as database passwords, API keys, and certificates. It supports automatic rotation via Cloud Functions or Pub/Sub triggers on a schedule (e.g., every 30 days), and Compute Engine instances can retrieve secrets at runtime using the Secret Manager API with IAM-controlled access. This directly satisfies both the secure storage and automatic rotation requirements.

Answer

Cloud Storage with customer-supplied encryption keys

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Environment variables in Compute Engine

Question 16

A company runs a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage and low-latency access across multiple zones. The application needs to perform well even during zonal failures. Which storage solution should they use?

Accepted Answer

Regional persistent disk. Regional persistent disks (RPDs) synchronously replicate data across two zones in the same region, providing both the persistent storage and low-latency access required by the stateful application. This ensures that if one zone fails, the disk can be attached to a pod in the surviving zone without data loss or significant performance degradation, meeting the high-availability and multi-zone access requirements.

Answer

Zonal persistent disk with snapshots to another zone

Answer

Local SSDs attached to nodes

Answer

Cloud Filestore

Question 17

A security admin wants to audit all 'create' and 'delete' operations on Compute Engine instances in a project for the last 90 days. Which type of audit log should they query?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all write operations (create, update, delete) on project resources, including Compute Engine instances, and are always enabled with a 400-day retention. Querying Admin Activity logs for the last 90 days will show all create and delete operations on instances. Data Access logs, by contrast, record read operations and are disabled by default.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 18

A company is deploying a web application on Compute Engine. They want to automatically scale the number of instances based on CPU utilization. Which two components are required to set up autoscaling? (Choose two.)

Accepted Answer

Instance template. Option C (Instance template) is correct because a managed instance group requires an instance template to define the machine type, boot disk image, network, and other configuration used when automatically creating new VM instances during scaling. Option D (Managed instance group) is correct because autoscaling in Compute Engine operates on a managed instance group (MIG), where the autoscaler adds or removes instances based on the specified CPU utilization target. Cloud Functions (A) is a serverless event-driven compute service and plays no role in Compute Engine autoscaling. Cloud Load Balancing (B) is commonly used to distribute traffic to the instances but is not a required component to configure the autoscaling policy itself. Cloud Monitoring (E) can surface metrics and alerts, but the autoscaler uses the MIG's built-in CPU utilization signal and does not require a separate Monitoring configuration.

Answer

Cloud Functions

Answer

Cloud Load Balancing

Answer

Cloud Monitoring

Question 19

Which TWO statements are true about Google Cloud VPC networks? (Select exactly 2.)

Accepted Answer

Subnets are regional resources and can span zones.. Google Cloud VPC subnets are regional resources that can span multiple zones within the same region. This allows resources in different zones to use the same subnet without requiring additional routing or VPN configuration, providing high availability and fault tolerance within a region.

Answer

Each VPC network is regional in scope.

Answer

By default, no firewall rules are created in a new VPC.

Answer

VPC Peering supports transitive routing.

Question 20

A global gaming company deploys a leaderboard service using Cloud Spanner with a single-region configuration. They need a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 1 minute in the event of a regional outage. What should they do?

Accepted Answer

Deploy Cloud Spanner in a multi-region configuration.. Cloud Spanner multi-region configuration replicates data synchronously across regions and provides automatic failover with strong consistency, meeting an RPO of 5 seconds and RTO of 1 minute for a regional outage. A single-region Spanner instance does not survive a regional failure, so moving to multi-region is the correct fix. Multi-region also preserves the leaderboard's low-latency reads and writes globally.

Answer

Set up a cross-region read replica using Cloud SQL.

Answer

Use Compute Engine instances in multiple zones with a global load balancer to replicate data.

Answer

Configure cross-region backups with a 5-second recovery window.