Google PCA Practice Exam 3 — 20 Questions

Question 1

A company is deploying a web application on Compute Engine behind a global HTTP(S) load balancer. They want to restrict access to only traffic from specific IP ranges. Which load balancer feature should they use?

Accepted Answer

Cloud Armor security policies.. Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Answer

VPC firewall rules.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud CDN.

Question 2

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) across three zones in us-central1. The application uses a Cloud Spanner database. Recently, the application experienced increased latency and timeouts during peak hours. The operations team noticed that the MIG's CPU utilization is consistently above 80% during peak hours, and the autoscaler is configured to scale based on CPU utilization with a target of 60%. However, the autoscaler is not adding new instances quickly enough, causing performance degradation. The team also observed that new instances take over 5 minutes to become healthy and serve traffic. The health check is a simple TCP check on port 8080. The application startup script downloads large configuration files from Cloud Storage. What should the team do to improve the autoscaling response time and reduce latency?

Accepted Answer

Create a custom Compute Engine image that includes the application and configuration, and use it in the MIG.. Option C is correct because the primary bottleneck is the long instance startup time (over 5 minutes) caused by downloading large configuration files from Cloud Storage at boot. By creating a custom Compute Engine image that bakes the application and configuration into the image, new instances can start serving traffic almost immediately, drastically reducing the time before they become healthy and the autoscaler can consider them in scaling decisions. This directly addresses the root cause of slow autoscaling response, as the autoscaler cannot add instances faster than they become healthy.

Answer

Increase the minimum number of instances in the MIG to handle peak load.

Answer

Reduce the autoscaler target CPU utilization to 40% so it scales earlier.

Answer

Change the health check to HTTP and reduce the initial delay and check intervals.

Question 3

Which THREE of the following are best practices when using Deployment Manager to manage infrastructure? (Choose three.)

Accepted Answer

Use templates to define resources modularly.. Using templates promotes reusability and modularity. Imports allow you to define common resources across deployments. Composite types bundle related resources into a single entity. YAML files are basic, but using Python or Jinja allows dynamic generation. The three best practices are using templates, imports, and composite types.

Answer

Use raw REST API calls in templates.

Answer

Use only YAML configuration files.

Question 4

Your organization has a policy that all Compute Engine instances must have specific labels (env, team, cost-center) applied. You want to enforce this automatically when instances are created. What should you do?

Accepted Answer

Use the Organization Policy service with a custom constraint to require labels on Compute Engine instances.. Option D is correct because Organization Policy Service with a custom constraint allows you to enforce that all Compute Engine instances must have specific labels (env, team, cost-center) at creation time. This is a preventive control that blocks creation of non-compliant instances, unlike reactive or permission-based approaches. Custom constraints use the `compute.googleapis.com/instance` resource type and can require label keys or values using CEL (Common Expression Language) syntax.

Answer

Enable Cloud Audit Logs and set up a metric-based alert to detect instances without labels.

Answer

Create a Cloud Function that listens for instance creation events and adds labels automatically.

Answer

Assign a custom IAM role that includes permission to label instances, and remove the default compute.instances.create permission.

Question 5

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

Accepted Answer

Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.. Option B is correct because rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

Answer

Refactor the application into microservices and deploy on Google Kubernetes Engine.

Answer

Containerize the application with Docker and run it on Cloud Run.

Answer

Migrate the database to Firestore and rewrite the application to use Firestore APIs.

Question 6

A company wants to enable a new DevOps team to have read-only access to logs in the default Cloud Logging bucket for their project, but prevent them from modifying log views or creating linked datasets in BigQuery. Which two IAM roles should be granted to the team?

Accepted Answer

roles/logging.viewAccessor. The roles/logging.viewAccessor role grants read-only access to log entries in Cloud Logging buckets, including the default bucket, without allowing modifications to log views or linked datasets. The roles/logging.viewer role provides broader read-only access to all Logging resources, including logs, but still prevents modifying log views or creating linked datasets in BigQuery. Together, these two roles satisfy the requirement of read-only log access while explicitly excluding permissions to alter log views or manage BigQuery linked datasets.

Answer

roles/logging.configWriter

Answer

roles/logging.admin

Answer

roles/bigquery.dataViewer

Question 7

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

Accepted Answer

Cloud DLP. Cloud DLP (option C) is correct because it provides native content inspection and de-identification (redaction) of sensitive data like credit card numbers using built-in infoType detectors. Cloud Functions (option D) is correct because it can be triggered by Cloud Storage events (e.g., finalize/create) to invoke the DLP API on newly uploaded CSV files, enabling serverless, event-driven processing without managing infrastructure.

Answer

Cloud Dataflow

Answer

Cloud Run

Answer

BigQuery

Question 8

A company is using Cloud NAT to allow instances in a private subnet to access the internet for updates. The security team wants to audit outbound connections. Which TWO steps should be taken to enable flow logs for Cloud NAT?

Accepted Answer

Configure a log sink to export Cloud NAT logs to BigQuery. Cloud NAT flow logs provide detailed records of outbound connections and are enabled directly on the Cloud NAT gateway itself. Option B is correct because configuring a log sink to export Cloud NAT logs to BigQuery is a valid step to audit outbound connections, but the primary step to enable logging is to update the existing Cloud NAT gateway to enable flow logs (Option E). Together, these two steps (B and E) allow you to capture and analyze outbound traffic for auditing.

Answer

Enable private Google access on the subnet

Answer

Enable VPC Flow Logs on the subnet

Answer

Create a new Cloud NAT gateway with logging enabled

Question 9

A company has a Cloud SQL for PostgreSQL instance that is experiencing high latency. They suspect a connection pooling issue. Which TWO configurations should be checked? (Choose two.)

Accepted Answer

Cloud SQL Auth Proxy configuration. The Cloud SQL proxy provides secure connections and connection pooling to reduce latency. The max_connections parameter affects how many connections are allowed and can be a bottleneck. Query insights helps but is not a configuration. Private IP vs public IP affects network path but not connection pooling per se.

Answer

Private IP assignment

Answer

Database query insights

Answer

Database version

Question 10

A company is using Cloud Load Balancing to distribute traffic to a managed instance group (MIG) of web servers. The web servers are currently running in us-central1. To improve availability, the company plans to add a second MIG in us-west1. What must be done to ensure traffic is automatically routed to the closest healthy backend?

Accepted Answer

Use a global external HTTP(S) load balancer and add both MIGs as backends.. A global external HTTP(S) load balancer can route traffic to backends in multiple regions and automatically directs requests to the closest healthy backend based on the client's geographic location and backend health. Adding both MIGs as backends to this single anycast IP ensures traffic is distributed to the nearest region without additional DNS-based routing or redirects.

Answer

Use a Network Load Balancer in us-central1 and configure a redirect to the new MIG.

Answer

Use an internal TCP/UDP load balancer in each region and configure DNS-based routing.

Answer

Use an external TCP/UDP Network Load Balancer with the new MIG as an additional backend.

Question 11

An organization is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single server with an on-premises database. The application is stateful and requires low-latency access to the database. The migration must minimize downtime and ensure high availability. Which architecture should the company adopt?

Accepted Answer

Deploy on Compute Engine with a regional persistent disk and use Cloud SQL for PostgreSQL with regional high availability.. Option B is correct because it combines Compute Engine with a regional persistent disk for synchronous replication across zones, ensuring high availability with minimal downtime during a zonal failure. Cloud SQL for PostgreSQL with regional high availability provides a managed, low-latency database with automatic failover, meeting the stateful application's need for low-latency access and high availability without the complexity of container orchestration.

Answer

Deploy on GKE with StatefulSets and use Cloud Spanner for global consistency.

Answer

Deploy on App Engine Standard Environment and use Cloud Firestore in Datastore mode.

Answer

Deploy on Cloud Run and use Cloud SQL with read replicas.

Question 12

A company uses Cloud SQL for MySQL to host its production database. The database experiences high read traffic. The team wants to improve read performance without modifying the application. What should they do?

Accepted Answer

Add read replicas and configure the application to use them for read queries.. Option C is correct because adding read replicas offloads read queries from the primary Cloud SQL instance, distributing the read load across multiple replicas. This improves read performance without any application code changes, as the application can be configured to direct read queries to the replica endpoints. Cloud SQL for MySQL replicas use asynchronous replication, ensuring near-real-time data consistency for read-heavy workloads.

Answer

Increase the number of CPUs on the primary Cloud SQL instance.

Answer

Use Cloud SQL Proxy with connection pooling.

Answer

Enable automatic storage increase to allow more data.

Question 13

A company is running a critical application on Compute Engine. The application writes logs to a local persistent disk. The operations team wants to ensure logs are not lost if the VM fails. What should they do?

Accepted Answer

Configure the application to write logs to Cloud Logging using the Logging agent.. Option D is correct because Cloud Logging with the Logging agent provides a centralized, durable, and managed log storage solution. The agent streams logs from the VM to Cloud Logging in near real-time, ensuring logs are preserved even if the VM or its local persistent disk fails. This decouples log storage from the VM's lifecycle, meeting the operations team's requirement for log durability.

Answer

Use a regional persistent disk to replicate data across zones.

Answer

Schedule persistent disk snapshots every 5 minutes.

Answer

Create a script to copy logs to a Cloud Storage bucket every minute.

Question 14

Which TWO options are best practices for ensuring high availability of an application running on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across multiple zones.. Option A is correct because pod anti-affinity ensures that pods from the same application are scheduled on different nodes across multiple zones, reducing the blast radius of a zonal failure. This is a key pattern for achieving high availability in GKE, as it prevents a single zone outage from taking down all replicas of your application.

Answer

Deploy all nodes in the same zone to simplify networking.

Answer

Prefer using preemptible VMs for cost savings.

Answer

Use a single zonal cluster to avoid cross-zone latency.

Question 15

Which TWO statements about Google Cloud VPC networks are true? (Choose two.)

Accepted Answer

Subnets are regional resources.. Subnets in Google Cloud VPC are regional resources. When you create a subnet, you specify a region and a CIDR block, and the subnet spans all zones within that region. This allows resources in different zones of the same region to use the same subnet without additional configuration.

Answer

VPC networks are project-level resources.

Answer

Firewall rules are regional.

Answer

Subnets are zonal resources.

Question 16

An organization has multiple projects in Google Cloud and wants to centralize logging and monitoring for all projects. They need to aggregate logs from all projects into a single project for analysis. Which approach should they use?

Accepted Answer

Create a logs sink in each project that exports logs to a BigQuery dataset in the central project.. Option D is correct because Google Cloud's logs sink feature allows you to route logs from multiple source projects to a centralized BigQuery dataset in a single destination project. This approach aggregates logs efficiently without requiring agents or manual import steps, and it supports real-time log export for analysis.

Answer

Export logs from each project to a Cloud Storage bucket and then import them into BigQuery.

Answer

Enable Cloud Audit Logs for all projects and view them from the central project.

Answer

Install the Stackdriver agent on all VMs and point them to the central project.

Question 17

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

Accepted Answer

Migrate for Compute Engine.. Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Answer

Cloud Endpoints.

Answer

Cloud Deployment Manager.

Answer

Cloud Foundation Toolkit.

Question 18

You are designing a CI/CD pipeline for a containerized application on Google Cloud. The application is built with Cloud Build, stored in Container Registry, and deployed to GKE. The team wants to ensure that only images that pass vulnerability scanning are deployed. What should you do?

Accepted Answer

Add a step in Cloud Build that runs a vulnerability scanner on the image and fails the build if vulnerabilities exceed a threshold.. Option A is correct because Cloud Build can include a custom step that runs a vulnerability scanner (e.g., using the Google Cloud `gcloud container images list-tags` with the `--show-occurrences-from` flag or a third-party tool like Trivy) and then evaluates the results against a threshold. If the scan finds vulnerabilities exceeding the defined threshold, the build step exits with a non-zero status, causing the Cloud Build pipeline to fail and preventing the image from being pushed to Container Registry or deployed. This directly enforces the requirement that only images passing vulnerability scanning proceed in the CI/CD pipeline.

Answer

Configure Container Analysis to automatically scan images in Container Registry and block deployment via a webhook.

Answer

Enable Binary Authorization on the GKE cluster and configure a policy to require an attestation from a trusted authority.

Answer

Use Security Command Center to detect vulnerabilities and alert the team to manually block deployments.

Question 19

Which TWO statements are true about Google Cloud HTTPS Load Balancers?

Accepted Answer

They can forward traffic to backends in multiple regions, including instances in different VPC networks.. Option C is correct because Google Cloud HTTPS Load Balancers are global external load balancers that can distribute traffic to backends across multiple regions, and they support cross-VPC connectivity via Shared VPC or VPC Network Peering, allowing instances in different VPC networks to serve as backends.

Answer

They support only external backends, such as internet-facing instances.

Answer

They support only IPv4 traffic.

Answer

They can be used to load balance internal HTTP(S) traffic within a VPC.

Question 20

A company runs a data analytics platform on Google Cloud using BigQuery, Dataflow, and Cloud Storage. They notice that Dataflow jobs are failing with 'out of memory' errors for certain large pipelines. The pipelines process variable amounts of data, sometimes spiking 10x normal. Which strategy should they use to handle these spikes cost-effectively?

Accepted Answer

Configure the Dataflow pipeline to use autoscaling with a higher maximum number of workers and use preemptible VMs for cost savings.. Option C is correct because Dataflow's autoscaling can dynamically add workers to handle sudden data spikes, and using preemptible VMs significantly reduces cost for batch pipelines that can tolerate interruptions. This approach avoids manual intervention and over-provisioning, making it cost-effective for variable workloads.

Answer

Manually monitor the job and increase the number of workers when a spike is detected.

Answer

Increase the machine type of the workers to a high-memory type and disable autoscaling.

Answer

Use Dataflow Streaming Engine to offload state to persistent storage and reduce memory usage.