Google PCA Practice Exam 4 — 20 Questions

Question 1

A company wants to run a containerized application that scales down to zero when not in use and only incurs costs when requests are being processed. They do not want to manage infrastructure. Which compute service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero and charges only for resources used during request processing. GKE Autopilot manages infrastructure but does not scale to zero (has a minimum node). Cloud Functions scales to zero but is for functions, not containers. Compute Engine always has running VMs.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE) Standard

Question 2

Which TWO methods can be used to provide secure access to a private Google Kubernetes Engine (GKE) cluster from the internet? (Choose two.)

Accepted Answer

Use Cloud VPN to connect from an on-premises network that has internet access.. Cloud VPN establishes an encrypted tunnel (using IPsec) from an on-premises network to a VPC in Google Cloud, allowing secure access to a private GKE cluster master endpoint without exposing it to the public internet. Option E is correct because Identity-Aware Proxy (IAP) with TCP forwarding enables authenticated and authorized access to the private cluster master endpoint via a bastion-like tunnel, without requiring a public IP on the master or a VPN.

Answer

Expose the cluster via an internal load balancer.

Answer

Configure a Cloud NAT to allow inbound connections from the internet.

Answer

Assign a public IP address to the cluster master endpoint.

Question 3

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

Accepted Answer

A firewall rule with the name 'my-firewall' already exists in the project.. The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer

The user lacks IAM permissions to create firewall rules.

Answer

The network reference in the firewall rule is incorrect.

Answer

The deployment does not include a 'delete' policy for existing resources.

Question 4

Refer to the exhibit. An engineer created an instance with a startup script that references a Cloud Storage bucket. The instance boots but the startup script fails. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket 'my-bucket' does not exist or the object 'startup.sh' is missing.. The error message indicates that the startup script cannot find the resource at gs://my-bucket/startup.sh. This could be because the bucket does not exist, the object does not exist, or the instance does not have permission to access the bucket. Given that the bucket is named 'my-bucket', it's likely that the bucket does not exist or the name is incorrect.

Answer

The startup script is not executable.

Answer

The instance does not have the appropriate IAM permissions to read from Cloud Storage.

Answer

The instance has no network connectivity to access Cloud Storage.

Question 5

A developer wants to monitor the CPU usage of a single Compute Engine VM and receive alerts when it exceeds 80%. What is the simplest way to achieve this?

Accepted Answer

Install the Cloud Monitoring agent and create an alerting policy based on the metric 'cpu.utilization'.. The Cloud Monitoring agent (formerly Stackdriver agent) collects CPU utilization metrics from Compute Engine VMs and sends them to Cloud Monitoring. You can then create an alerting policy directly on the metric 'cpu.utilization' with a threshold of 80% without any custom scripting or additional infrastructure. This is the simplest and most native approach for a single VM.

Answer

Query the Compute Engine API periodically and check CPU usage.

Answer

Configure a Cloud Logging sink to BigQuery and set a scheduled query to detect high CPU.

Answer

Use the managed instance group's autoscaling metric to trigger a notification.

Question 6

A startup uses Cloud Functions with a Pub/Sub trigger to process incoming orders. They notice that the function sometimes fails to process messages, and those messages are lost. What is the most likely cause?

Accepted Answer

The Cloud Function is configured with retry on failure set to false.. When a Cloud Function fails to process a Pub/Sub message and retry on failure is set to false, the message is not redelivered. Pub/Sub relies on the subscriber (the Cloud Function) to acknowledge messages; without retries, a failed execution causes the message to be dropped after the ack deadline expires, leading to message loss.

Answer

The subscription has an ackDeadlineSeconds of 600.

Answer

The Cloud Function has a timeout of 540 seconds.

Answer

The Pub/Sub topic has a retention duration of 10 minutes.

Question 7

A startup wants to store application secrets (e.g., API keys, database passwords) securely on Google Cloud. They need to support automatic rotation of secrets and fine-grained access control. Which TWO services should they use? (Choose 2.)

Accepted Answer

Secret Manager. Secret Manager is the primary service for storing secrets, with support for versioning, automatic rotation, and IAM. Cloud KMS can be used to encrypt secrets stored in Secret Manager, providing an additional layer of security. Cloud Key Management Service (KMS) is used for managing encryption keys, but Secret Manager already encrypts secrets at rest using Google-managed keys by default; using CMEK via Cloud KMS adds customer-managed key control. Cloud Storage is not designed for secrets. IAM alone does not provide secret storage. Cloud Functions can access secrets but is not a storage service.

Answer

Cloud Storage with object versioning

Answer

Cloud Functions

Answer

Cloud Identity and Access Management (IAM)

Question 8

A company uses Google Cloud Armor to protect their HTTP load balancer from OWASP Top 10 attacks. After deploying a security policy with pre-configured WAF rules, they notice that some legitimate user requests are being blocked because they match a rule incorrectly. The security team wants to fine-tune the rules to reduce false positives while maintaining strong protection. They also want to evaluate the impact of changes before enforcing them. What should they do?

Accepted Answer

Set the WAF rules to 'preview' mode to test their impact without blocking traffic, then adjust thresholds or exclusions based on logs.. Google Cloud Armor's 'preview' mode allows you to apply a security policy to a backend service or load balancer without actually blocking traffic. Instead, all matched requests are logged, enabling you to analyze false positives in the logs before enforcing the rules. This approach lets you fine-tune thresholds, add exclusions, or adjust rule priorities based on real traffic patterns, reducing false positives while maintaining strong protection.

Answer

Disable the WAF rules entirely and implement IP-based allowlists.

Answer

Add a higher priority allow rule to permit the traffic that is being incorrectly blocked.

Answer

Remove the WAF rules and rely solely on rate limiting to protect the application.

Question 9

A company wants to deploy a containerized application on Google Cloud and needs persistent storage that can be accessed by multiple pods in a GKE cluster concurrently. Which storage solution should they use?

Accepted Answer

Filestore. Filestore is the correct choice because it provides a managed NFS file server that supports the ReadWriteMany (RWX) access mode, allowing multiple pods in a GKE cluster to concurrently read from and write to the same persistent storage volume. This is essential for workloads like content management systems or shared data processing that require simultaneous access from multiple pods.

Answer

Persistent Disk with ReadWriteMany access mode

Answer

Cloud Storage via Storage FUSE

Answer

Compute Engine persistent disk attached to each node

Question 10

A financial services company must run a PostgreSQL database with strong consistency across three regions. They need to support high write throughput and require automatic failover with zero data loss. Which database service should they choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only Google Cloud managed database that provides globally distributed, strongly consistent transactions with automatic failover and zero data loss via multi-region configurations.

Answer

AlloyDB for PostgreSQL

Answer

Bigtable

Answer

Cloud SQL for PostgreSQL with cross-region replication

Question 11

A company runs batch processing jobs nightly that can tolerate interruptions. They want to minimize compute costs for these jobs. Which Compute Engine machine type and provisioning model is most cost-effective?

Accepted Answer

Preemptible VMs with custom machine types. Preemptible/Spot VMs offer significant discounts (up to 91%) and are ideal for fault-tolerant, interruptible workloads like batch processing.

Answer

E2 custom VMs with sole-tenant nodes

Answer

N2 standard VMs with committed use discounts

Answer

GPU-accelerated VMs

Question 12

A media company runs a stateless web application on Compute Engine behind an HTTP(S) load balancer. They want to automatically replace unhealthy VMs and maintain a fixed number of running instances across two zones. What should they use?

Accepted Answer

A regional managed instance group with a fixed target size and autohealing. A managed instance group (MIG) with autoscaling based on average CPU utilization can maintain a target CPU level, but to keep a fixed number of instances, they should use a MIG without autoscaling and rely on autohealing to replace unhealthy VMs.

Answer

An unmanaged instance group with health checks

Answer

A zonal managed instance group with autoscaling

Answer

Compute Engine with instance templates and no group

Question 13

A company deploys a web application on Compute Engine behind a global HTTP(S) Load Balancer. Users report intermittent 502 errors. Investigation shows backend instances are healthy. What is the MOST likely cause?

Accepted Answer

The backend service's timeout setting is too low. HTTP 502 errors from a load balancer often indicate that the backend is closing the connection or not responding in time. The backend connection timeout or request timeout might be too low. Instance health checks passing means the instance is responsive to health check probes, but the actual application requests may be timing out. SSL certificate errors usually cause 400-level errors. Insufficient capacity would cause 503 or 504 errors. Incorrect firewall rules would prevent health checks from passing.

Answer

The SSL certificate has expired

Answer

The firewall rules are blocking traffic from the load balancer

Answer

The backend instances are running out of memory

Question 14

A company needs to design a disaster recovery strategy for a critical application running on Cloud SQL for PostgreSQL. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 30 minutes. Which THREE actions should they take to meet these objectives? (Choose THREE.)

Accepted Answer

Configure cross-region replication for the Cloud SQL instance. Cross-region replication with failover replicas can achieve RPO of a few seconds and RTO of minutes. Point-in-time recovery and automated backups provide additional recovery options but may not meet RPO as low as 5 minutes alone.

Answer

Take regular on-demand exports to Cloud Storage

Answer

Create a failover replica in the same region

Question 15

A company is migrating a monolithic application to a microservices architecture on GCP. They want to use an event-driven approach to decouple services and ensure reliable message delivery. Which TWO services should they use for inter-service communication? (Choose TWO.)

Accepted Answer

Eventarc. Pub/Sub is a fully managed messaging service for asynchronous event-driven communication between services. Eventarc allows routing events from various sources to services like Cloud Run, enabling event-driven architecture.

Answer

Cloud Scheduler

Answer

Cloud Functions

Answer

Cloud Tasks

Question 16

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Answer

Firestore

Answer

Cloud Spanner

Answer

BigQuery

Question 17

A team is migrating a stateful application to GKE. The application requires persistent storage with ReadWriteMany (RWX) access across multiple pods. Which Kubernetes volume type should they use to meet this requirement on GKE?

Accepted Answer

Filestore. Filestore provides a managed NFS file share that supports RWX access. GKE can mount Filestore volumes via CSI driver. Persistent Disk supports only ReadWriteOnce (RWO). Cloud Storage FUSE is not a standard Kubernetes volume and does not provide POSIX file system semantics. ConfigMap is for configuration data.

Answer

Persistent Disk (Compute Engine persistent disks)

Answer

Cloud Storage FUSE

Answer

ConfigMap

Question 18

A company wants to deploy a microservices architecture on Google Cloud. They need a service mesh to manage traffic, security, and observability across services. They also want to run workloads on both GKE and Compute Engine. Which solution should they use?

Accepted Answer

Cloud Service Mesh (Anthos Service Mesh). Anthos Service Mesh (based on Istio) provides traffic management, security, and observability for microservices across GKE, Compute Engine, and on-premises. Cloud Service Mesh is the same. Istio alone is open-source but not fully managed. Cloud Run for Anthos is for serverless. Traffic Director is for VM-based load balancing but not a full service mesh.

Answer

Cloud Run for Anthos

Answer

Istio open-source installation on GKE

Answer

Traffic Director

Question 19

A company is moving a legacy monolithic application to a microservices architecture on Google Cloud. They want to minimize operational overhead and automatically scale each service independently. Which TWO compute services should they consider? (Choose two.)

Accepted Answer

Cloud Run. Cloud Run and GKE Autopilot both offer automatic scaling and reduced operational overhead. Cloud Run is serverless for containers; GKE Autopilot manages the cluster infrastructure. Compute Engine requires manual scaling. Cloud Functions is for functions, not full services. GKE Standard requires node management.

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Cloud Functions

Question 20

A company wants to connect their on-premises network to Google Cloud with a dedicated, high-bandwidth, low-latency connection that has a Service Level Agreement (SLA) of 99.99% uptime. Which connectivity option should they choose?

Accepted Answer

Dedicated Cloud Interconnect. Dedicated Cloud Interconnect provides a direct physical connection with high bandwidth, low latency, and a 99.99% SLA. Partner Interconnect uses a third-party provider and has a lower SLA. HA VPN offers 99.99% SLA but lower bandwidth. Classic VPN has no SLA.

Answer

High Availability VPN (HA VPN)

Answer

Partner Cloud Interconnect

Answer

Classic VPN