Google PCA Practice Exam 4 — 20 Questions

Question 1

A startup deploys a web application on Compute Engine instances behind an HTTP load balancer. They need to handle unpredictable spikes in traffic with minimal operational overhead. What is the simplest scaling approach?

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization. Using a managed instance group with autoscaling automatically adds/removes instances based on demand, requiring minimal manual intervention. Other options either require more complex setup or are not optimal.

Answer

Set up a Kubernetes cluster with horizontal pod autoscaling

Answer

Migrate the application to Cloud Run

Answer

Add more instances manually during peak hours

Question 2

A development team uses Cloud Build for their CI/CD pipeline. They want to reduce build times. Which action is most effective?

Accepted Answer

Enable parallel builds by separating build steps into multiple jobs. Enabling parallel builds by separating build steps into multiple jobs reduces total build time by running independent steps concurrently. Other options are less effective or add complexity.

Answer

Store build artifacts in a Cloud Storage bucket and reuse them

Answer

Use more powerful build machines by specifying larger machine types

Answer

Use a Cloud Run service to run builds asynchronously

Question 3

Refer to the exhibit. A team wants to grant the ability to run queries (but not modify) on BigQuery datasets to a new set of users who have email addresses in the 'example.com' domain. What is the simplest way to achieve this?

Accepted Answer

No action needed; new users with 'example.com' accounts already have the dataViewer role through the existing domain membership. The domain 'example.com' is already bound to the dataViewer role, so any user with an email in that domain automatically has query access. No action is needed.

Answer

Create a new binding with role 'roles/bigquery.dataViewer' and include the new users as members

Answer

Remove the domain binding and only grant access to individual users

Answer

Add the new users to the existing 'domain:example.com' member list

Question 4

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to optimize costs without sacrificing availability. They have varying traffic patterns. Which strategy should they recommend?

Accepted Answer

Use node auto-provisioning with preemptible nodes.. Node auto-provisioning with preemptible nodes automatically creates node pools based on workload demands and uses cheaper preemptible VMs, reducing cost for variable traffic. Regional clusters focus on high availability, not cost. Committed use discounts lock in usage and are not optimal for variable traffic. GKE Autopilot provides convenience but may not be the most cost-efficient with preemptible options.

Answer

Use committed use discounts with a 3-year term on all nodes.

Answer

Use GKE Autopilot with a single node pool.

Answer

Use a regional cluster with node pools of different machine types.

Question 5

A company runs a large-scale data processing pipeline using Dataflow with streaming data from Pub/Sub. They notice increasing costs due to high data shuffle operations. They want to optimize the pipeline performance and cost. Which approach should they take?

Accepted Answer

Optimize the pipeline by partitioning data and using Combine transforms.. Optimizing pipeline logic to minimize shuffle reduces resource usage and cost. Increasing workers or using larger machine types may improve performance but increase cost. Switching to batch mode would lose real-time processing capability.

Answer

Use a larger machine type for workers.

Answer

Increase the number of workers to reduce shuffle.

Answer

Switch to batch mode overnight.

Question 6

Which TWO actions reduce egress costs when transferring data from Compute Engine to the internet? (Choose 2)

Accepted Answer

Use Cloud CDN to cache content. Options A and D are correct. Using a Cloud CDN caches content at edge locations, reducing egress from origin. Using a Premium Tier network does not reduce egress costs; it may increase. Compressing data reduces egress volume, but it's not always applicable and may affect latency. Moving to a different region does not reduce egress cost. There are only two correct: A and D. Actually, compressing data reduces the amount of data transferred, so that reduces egress cost. Let's reconsider. The correct answers: Using Cloud CDN (caches content, reduces origin egress) and using data compression (reduces size). Option A is correct, option D is correct. Option B (move to lower-cost region) does not reduce egress cost because egress is per GB, same worldwide. Option C (use Premium Tier) increases cost. Option E (use a NAT gateway) does not reduce egress.

Answer

Use Cloud NAT for outbound traffic

Answer

Move instances to a lower-cost region

Answer

Use Premium Tier networking

Question 7

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Question 8

Drag and drop the steps to migrate a Compute Engine VM to a different region using a snapshot into the correct order.

Question 9

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Accepted Answer

The service account lacks IAM permissions to read from Cloud Storage. Option A is correct because the scopes=cloud-platform grants all cloud API scopes, but authentication may fail if the service account does not have the proper IAM permissions (e.g., storage.objectViewer). Option B is wrong because pd-ssd is fine. Option C is wrong because the tags are for firewall rules, not storage access. Option D is wrong because the SA is specified.

Answer

The service account is not attached to the instance

Answer

The tags http-server and https-server block outbound traffic

Answer

The boot disk type is SSD, which is not compatible with Cloud Storage

Question 10

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.

Question 11

Drag and drop the steps to set up a Cloud SQL for PostgreSQL instance with high availability into the correct order.

Question 12

A company is planning a hybrid cloud architecture using Anthos to manage workloads across on-premises data centers and Google Cloud. They need to select two key components that enable consistent configuration, policy, and security across environments. Which two should they choose?

Accepted Answer

GKE on-prem. GKE on-prem (now Anthos clusters on bare metal or VMware) is correct because it provides a consistent Kubernetes platform that runs on-premises, enabling the same container orchestration, policy enforcement, and security controls as GKE in Google Cloud. Config Sync is correct because it continuously reconciles the desired state of cluster configurations from a Git repository, ensuring that policies, RBAC, and security settings remain identical across all Anthos clusters, whether on-prem or in the cloud.

Answer

Cloud Interconnect

Answer

Cloud Build

Answer

Cloud Load Balancing

Question 13

Drag and drop the steps to set up a Cloud VPN tunnel between Google Cloud and an on-premises network into the correct order.

Question 14

Drag and drop the steps to implement a disaster recovery plan using Cloud Storage and Cloud Functions in the correct order.

Question 15

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Accepted Answer

Cloud Run (fully managed).. Cloud Run is a fully managed serverless platform for containers that scales to zero and charges per request. Option A is wrong because GKE requires cluster management. Option B is wrong because App Engine Standard is for specific runtimes, not custom containers. Option D is wrong because Compute Engine requires provisioning and scaling management.

Answer

App Engine Standard Environment with a custom runtime.

Answer

Google Kubernetes Engine (GKE) with a multi-node pool.

Answer

Compute Engine with a managed instance group.

Question 16

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Accepted Answer

Deployment with pod anti-affinity rules spread across zones. Option C is correct because Deployments support rolling updates and pod anti-affinity can spread pods across zones for high availability. StatefulSets are for stateful workloads, DaemonSets for node-level daemons, and Jobs for batch tasks.

Answer

StatefulSet with volumeClaimTemplates for persistent storage

Answer

Job for batch processing

Answer

DaemonSet to ensure one pod per node

Question 17

A company is designing a VPC architecture for a multi-tenant SaaS platform. Each tenant has isolated workloads that must not communicate with each other. They also need centralized network security and logging. Which VPC design meets these requirements?

Accepted Answer

Use a Shared VPC with separate subnets for each tenant and firewall rules to enforce isolation. Option A is correct because Shared VPC with separate subnets per tenant and firewall rules for isolation provides centralized management. Option B is wrong because VPC peering requires explicit peering and does not provide isolation easily. Option C is wrong because Cloud VPN is not for multi-tenant isolation. Option D is wrong because a single VPC without subnets is insecure.

Answer

Dedicated Cloud VPN connections per tenant

Answer

Single VPC with network tags and IAP tunnels

Answer

Peered VPCs for each tenant with Cloud NAT

Question 18

Which THREE are best practices for designing a highly available Cloud SQL for MySQL instance? (Choose 3)

Accepted Answer

Enable automatic backups. Option B is correct because automatic backups in Cloud SQL for MySQL provide point-in-time recovery (PITR) capabilities, which are essential for data durability and disaster recovery. Enabling automatic backups ensures that transaction logs are retained, allowing you to restore your database to any point within the backup retention period, typically up to 7 days.

Answer

Configure cross-region replication

Answer

Set a maintenance window in off-peak hours

Question 19

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Accepted Answer

The developer is assigned only the objectViewer role. Option C is correct because the developer only has roles/storage.objectViewer (read-only), not write access. Option A is wrong because there is no explicit deny. Option B is wrong because the service account has admin, but that doesn't affect the user. Option D is wrong because the user is included.

Answer

An organization policy denies all write operations

Answer

The developer is not a member of the project

Answer

The service account my-sa overrides the developer's permissions

Question 20

Match each GCP storage service to its typical use case.