Google PCA Practice Exam 3 — 20 Questions

Question 1

You are configuring a Cloud Monitoring alerting policy to notify your SRE team when the error rate of a service exceeds 5% over a 5-minute window. Which type of metric evaluation should you use?

Accepted Answer

Window-based. A window-based metric evaluation (e.g., rate, ratio, or count over a sliding window) is appropriate for error rate over a 5-minute window. Request-based is for latency SLOs.

Answer

Log-based

Answer

Request-based

Answer

Health check-based

Question 2

A company is migrating its on-premises data center to Google Cloud. They need a dedicated, low-latency, high-bandwidth connection between their on-premises network and VPC. They anticipate consistent traffic above 10 Gbps. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection with bandwidth up to 100 Gbps per circuit, ideal for high-throughput, low-latency requirements. Partner Interconnect relies on a service provider and typically offers lower bandwidth. HA VPN is over the public internet and may not meet high bandwidth or low latency. Classic VPN is a single tunnel without high availability.

Answer

Partner Interconnect

Answer

HA VPN

Answer

Classic VPN

Question 3

Your company runs a critical application on Google Kubernetes Engine (GKE) in us-central1. The application consists of a frontend deployment with 3 replicas and a backend statefulset with 5 replicas using persistent volumes (SSD). Recently, the team noticed that during a regional outage in us-central1, the application became completely unavailable. They want to design a multi-region architecture that can survive a regional failure with RPO of 1 hour and RTO of 30 minutes. The application is stateless on the frontend but the backend stores critical data on persistent disks. The backend can operate in a read-only mode from a secondary region if needed. They have a limited budget and want to minimize ongoing costs. Which approach should they take?

Accepted Answer

Deploy the frontend and backend in a regional GKE cluster across us-central1, and use a CronJob to take snapshots of persistent volumes every hour and copy them to a secondary region. In disaster, restore the snapshots to a new cluster in the secondary region.. Meets the RPO of 1 hour by using a CronJob to take hourly snapshots of PersistentVolume data and copy them to a secondary region. In a disaster, you restore those snapshots to a new GKE cluster in the secondary region, achieving an RTO of 30 minutes by automating the restore process. This approach minimizes ongoing costs because snapshots are incremental and you only pay for storage in the secondary region when needed, while the frontend remains stateless and can be redeployed quickly.

Answer

Migrate the backend to Cloud SQL for MySQL with cross-region replication, and keep the frontend on GKE with multi-region ingress.

Answer

Deploy the frontend and backend in a regional GKE cluster and use regional persistent disks for the statefulset, replicating data synchronously across zones.

Answer

Deploy the frontend and backend in a single zonal cluster in us-central1-a, and use scheduled snapshots of persistent disks to a different region.

Question 4

A data analytics company runs nightly batch jobs using Compute Engine instances. The jobs can tolerate interruptions, and the company wants to minimize costs. What should they do?

Accepted Answer

Use preemptible VMs for the batch jobs.. Preemptible VMs (now called Spot VMs) are Compute Engine instances that last up to 24 hours and can be terminated at any time by Google Cloud. Because the batch jobs are interruptible, using preemptible VMs reduces compute costs by up to 60-91% compared to standard on-demand VMs, directly meeting the goal of minimizing costs.

Answer

Use C2 high-CPU machine types for faster processing.

Answer

Use standard (on-demand) VMs and commit to a 1-year resource-based commitment.

Answer

Deploy VMs on Sole-tenant nodes for cost isolation.

Question 5

A team is designing a disaster recovery (DR) plan for a critical application. Which THREE components are essential for a robust DR plan? (Choose 3)

Accepted Answer

Failover procedures and runbooks. Failover procedures and runbooks (A) are essential because they provide step-by-step instructions for executing a controlled transition to the secondary site, ensuring minimal downtime and consistent recovery actions. Without documented runbooks, teams risk misconfigurations during a disaster, which can extend recovery time objectives (RTO) beyond acceptable limits.

Answer

A single-region deployment for consistency

Answer

Load testing to validate performance

Question 6

A user wants to store a database password that will be used by a Compute Engine instance. What is the most secure and manageable approach?

Accepted Answer

Use Secret Manager and grant the instance's service account access to the secret. Secret Manager is the most secure and manageable approach because it provides encrypted storage, automatic rotation, and fine-grained access control via IAM. By granting the Compute Engine instance's service account access to the secret, the password is never exposed in plaintext metadata, logs, or disk files, and access can be audited and revoked independently of the instance lifecycle.

Answer

Set the password as an environment variable in instance metadata

Answer

Store the password in Cloud Storage bucket metadata

Answer

Store the password in a file on the instance's boot disk

Question 7

A security administrator wants to ensure that a Cloud Storage bucket named `gs://my-bucket` is only accessible by service accounts, not user accounts. Which action should they take?

Accepted Answer

Create a new IAM policy that removes all user members and adds a service account member with `roles/storage.objectAdmin`.. The requirement is to ensure that only service accounts, not user accounts, can access the bucket. By creating a new IAM policy that removes all user members and adds only a service account member with `roles/storage.objectAdmin`, the administrator directly enforces that no user account (Google Account or Google Workspace user) has any IAM role on the bucket. This is the simplest and most effective way to restrict access exclusively to service accounts.

Answer

Remove the user from the `roles/storage.objectViewer` binding and add a condition to deny user access.

Answer

Add a bucket IAM condition that requires `resource.name.startsWith("projects/_/buckets/my-bucket/objects/")`

Answer

Use a VPC Service Controls perimeter to block user access.

Question 8

A company wants to implement a disaster recovery strategy for a critical application running on Compute Engine with state stored on persistent disks. They need an RTO of less than 15 minutes and an RPO of less than 1 hour. Which TWO steps should they take? (Choose two.)

Accepted Answer

Use regional persistent disks for the application data. Regional persistent disks replicate data synchronously across zones, providing low RPO. A managed instance group with a health check and auto-healing enables fast failover for low RTO. Snapshots have higher RPO. Cloud DNS is for DNS failover, not for compute failover. Global load balancer is for traffic distribution, not stateful failover.

Answer

Set up scheduled snapshots to a multi-regional Cloud Storage bucket

Answer

Use Cloud DNS with a failover policy

Answer

Configure a global HTTP(S) load balancer in front of the application

Question 9

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Question 10

Company A runs a containerized application on Google Kubernetes Engine (GKE) with 3 node pools: one for frontend, one for backend, and one for stateful databases. The backend services experience periodic latency spikes. After investigation, they found that the spikes correlate with the node pool autoscaler scaling down nodes. The backend services are deployed as Deployments with resource requests and limits set to 100m CPU and 200Mi memory each. The node pool uses n1-standard-2 machine types. The cluster autoscaler is enabled. What should they do to prevent the latency spikes?

Accepted Answer

Configure a PodDisruptionBudget for the backend Deployment with minAvailable set to a high value.. The latency spikes occur because the cluster autoscaler is terminating nodes that host backend Pods, causing those Pods to be rescheduled and disrupting traffic. A PodDisruptionBudget (PDB) with a high minAvailable value ensures that a minimum number of backend Pods remain available during voluntary disruptions like node scale-down, preventing the sudden loss of capacity that leads to latency spikes. This directly addresses the root cause without disabling autoscaling or misconfiguring scheduling.

Answer

Disable cluster autoscaler for the backend node pool.

Answer

Use node taints and tolerations to isolate the backend services.

Answer

Increase the resource requests for the backend services to ensure they are scheduled on dedicated nodes.

Question 11

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Accepted Answer

Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage. Enabling CMEK on Cloud SQL and Cloud Storage allows the company to use their own encryption keys, which is often required by PCI DSS to demonstrate control over key management. CMEK ensures data at rest is encrypted with keys managed via Cloud KMS, providing auditability and separation of duties beyond Google-managed default encryption.

Answer

Configure client-side encryption in the application code

Answer

Rely on Google-managed default encryption for all data

Answer

Use Cloud HSM with a key generated outside of Google Cloud

Question 12

Your organization is moving a legacy monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single virtual machine with a local MySQL database. You need to design a cloud-native architecture that improves scalability and reliability. Which two actions should you take? (Choose TWO.)

Accepted Answer

Refactor the application into microservices and deploy each as a separate deployment in GKE.. Refactoring the monolithic application into microservices and deploying each as a separate Deployment in GKE aligns with cloud-native principles, enabling independent scaling, fault isolation, and easier updates. This approach improves scalability and reliability by allowing each microservice to scale horizontally based on demand, and failures in one service do not cascade to others.

Answer

Deploy the entire application in a single container with a large custom machine type to handle load.

Answer

Expose the application using a simple Service of type LoadBalancer with round-robin distribution.

Answer

Use a single Pod with multiple containers that communicate via localhost to reduce latency.

Question 13

Your company uses HA VPN to connect on-premises to Google Cloud. You need to ensure the VPN connection meets a 99.99% SLA. Which configuration is required?

Accepted Answer

Two Cloud VPN gateways in different regions, each with two tunnels to the same on-premises peer gateway.. HA VPN provides 99.99% SLA when configured with two Cloud VPN gateways (one per region) and two tunnels per gateway (four tunnels total) from each gateway to the on-premises peer gateway. Each gateway uses a different external IP. A single VPN gateway with two tunnels does not meet the SLA requirement because the gateway itself is a single point of failure.

Answer

A single Cloud VPN gateway with two tunnels to the same on-premises peer gateway.

Answer

Two Cloud VPN gateways in the same region, each with one tunnel.

Answer

One Cloud VPN gateway with four tunnels to the same on-premises peer gateway.

Question 14

A company needs to store archival data that is accessed less than once a year. They want the lowest storage cost possible, but they can accept a retrieval time of up to 24 hours. Which Cloud Storage class should they use?

Accepted Answer

Archive. Archive storage is the lowest-cost storage class for long-term archival with retrieval times in hours (typically 24 hours). Coldline is for data accessed less than once a quarter. Nearline is for monthly access. Standard is for frequently accessed data.

Answer

Nearline

Answer

Standard

Answer

Coldline

Question 15

A company runs a critical application on Compute Engine that must remain available even if an entire zone fails. They have configured a managed instance group across three zones with autoscaling based on CPU utilization. The application state is stored in a Cloud SQL instance. Which additional step should they take to ensure high availability?

Accepted Answer

Configure a regional Cloud SQL instance with primary and standby in different zones.. Cloud SQL provides high availability with a standby instance in a different zone using regional persistent disk. This ensures failover if the primary zone fails.

Answer

Use a Cloud Load Balancer in front of the managed instance group.

Answer

Deploy a read replica of the Cloud SQL instance in another region.

Answer

Take frequent snapshots of the boot disk and store them in a multi-regional bucket.

Question 16

A company runs a batch processing workload on Compute Engine instances in a managed instance group (MIG). The job is CPU-intensive and takes approximately 4 hours to complete. The company wants to reduce costs without sacrificing performance. Which action should they take?

Accepted Answer

Use preemptible VMs for the MIG and implement a checkpointing mechanism to handle interruptions.. Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. For a batch processing workload that is CPU-intensive and runs for 4 hours, using preemptible VMs in a MIG with a checkpointing mechanism allows the job to resume from the last saved state after an interruption, thus reducing costs without sacrificing performance.

Answer

Purchase committed use discounts for the instance type.

Answer

Change the machine series to a smaller machine type.

Answer

Provision additional reserved VMs to ensure capacity.

Question 17

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

Accepted Answer

Implement VPC Service Controls with a service perimeter. VPC Service Controls use service perimeters to protect resources and prevent data exfiltration from authorized networks, including GKE clusters, to external resources.

Answer

Configure firewall rules to block outbound traffic to Cloud Storage

Answer

Enable Cloud Armor on the GKE cluster

Answer

Use Private Google Access for on-premises access

Question 18

You are the lead cloud architect for a startup that runs a web application on Google Kubernetes Engine (GKE) with a standard (zonal) cluster. The application is deployed with 3 replicas of a stateless frontend service. During a recent incident, a zone outage caused all GKE nodes to become unavailable, leading to application downtime of 45 minutes. You need to redesign the cluster to tolerate a single zone failure with no more than 5 minutes of downtime. Your budget allows for at most a 20% increase in compute costs. Which approach should you take?

Accepted Answer

Migrate the cluster to a regional GKE cluster with nodes in 3 zones and distribute replicas across zones. D is correct because a regional GKE cluster distributes nodes across three zones, ensuring that if one zone fails, the remaining two zones continue serving traffic. By spreading the 3 replicas across zones (e.g., one per zone), the application tolerates a single zone outage with near-zero downtime, and the 20% cost increase covers the additional node pool overhead without exceeding the budget.

Answer

Increase the number of replicas from 3 to 9 and keep the zonal cluster

Answer

Change the frontend deployment to use regional persistent disks

Answer

Deploy second GKE cluster in another region and use global load balancer for failover

Question 19

A developer needs to secure secrets (API keys, passwords) used in a Cloud Function. What is the recommended approach?

Accepted Answer

Use Secret Manager. Secret Manager is the recommended approach for securing sensitive data like API keys and passwords in Cloud Functions because it provides encrypted storage, fine-grained access control via IAM, and automatic rotation. Unlike environment variables, which are visible in the Cloud Console and logs, Secret Manager ensures secrets are never exposed in plaintext and are injected securely at runtime.

Answer

Store secrets in environment variables

Answer

Store in Cloud Storage and download at runtime

Answer

Hard-code in the function code

Question 20

A company needs to choose between Cloud Spanner and Firestore for a global inventory application that requires strong consistency and horizontal scaling. The application has a fixed schema with complex joins. Which database is most appropriate?

Accepted Answer

Cloud Spanner. Cloud Spanner is a globally distributed relational database with strong consistency and supports complex joins. Firestore is a NoSQL document database with eventual consistency (strong consistency only within a single document).

Answer

Firestore

Answer

Cloud SQL

Answer

Cloud Bigtable