Google PCA Practice Test 22 — 15 Questions

Question 1

A developer wants to store a database password that is used by a Cloud Function. The password must be automatically rotated every 30 days and accessed securely without storing it in the source code. Which GCP service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Secret Manager. Secret Manager stores secrets like API keys and passwords. It supports automatic rotation via Cloud Scheduler and Cloud Functions, and provides fine-grained access control.

Answer

Cloud KMS

Answer

Cloud Runtime Configuration

Answer

Firestore

Question 2

A security engineer wants to prevent data exfiltration from a project 'prod-data' by ensuring that only approved VPC networks can access BigQuery datasets. Which GCP service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that protect resources by restricting access from outside the perimeter. They can be used to limit BigQuery access to specific VPC networks or IP ranges.

Answer

Private Google Access

Answer

Cloud Armor

Answer

Cloud NAT

Question 3

A company wants to implement a zero-trust access model for internal web applications running on Compute Engine. They need to authenticate users using corporate credentials and enforce context-aware access based on device posture and IP address. Which TWO services should they use?

Accepted Answer

Cloud Identity. Identity-Aware Proxy (IAP) provides context-aware access control and integrates with Cloud Identity for authentication. Device posture and IP can be assessed via Access Context Manager (part of VPC Service Controls) or IAP's own context conditions.

Answer

VPC Service Controls

Answer

Cloud VPN

Answer

Cloud Armor

Question 4

A company is designing a highly available web application on Google Cloud. The application consists of stateless compute instances behind a global HTTP(S) Load Balancer. The compute instances must be able to handle sudden spikes in traffic. Which TWO strategies should the company implement? (Choose two.)

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization.. A managed instance group with autoscaling based on CPU utilization automatically adjusts the number of stateless compute instances in response to traffic spikes, ensuring the application can handle sudden load increases without manual intervention. This aligns with the requirement for stateless instances behind a global load balancer, as autoscaling adds or removes instances based on real-time CPU metrics, providing elasticity and high availability.

Answer

Use Cloud CDN to cache all responses from the application servers.

Answer

Use a single Compute Engine instance in a single zone with a large machine type.

Answer

Use vertical scaling by selecting a machine type with more vCPUs and memory.

Question 5

A gaming company needs to store player session data that is frequently updated and requires strong consistency within a single region. The data model is simple key-value with few attributes. They expect up to 1 million concurrent players, each performing 10 writes per second. Which database is most suitable?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is a NoSQL wide-column database designed for high-throughput, low-latency workloads. It can handle millions of writes per second and provides strong consistency within a single cluster.

Answer

Cloud SQL

Answer

Firestore

Answer

Memorystore

Question 6

A company is deploying a new application on Compute Engine. They need to ensure that the application can automatically recover from a zone failure. What is the best approach?

Accepted Answer

Create a managed instance group with instances in multiple zones.. A managed instance group (MIG) with instances in multiple zones provides automatic recovery from a zone failure by distributing instances across zones and using auto-healing to recreate failed instances. If one zone becomes unavailable, the load balancer routes traffic to healthy instances in other zones, ensuring high availability without manual intervention.

Answer

Use a global load balancer in front of a single instance.

Answer

Create a single VM in a single zone and rely on live migration.

Answer

Use Cloud Storage to store application state and restore from a snapshot.

Question 7

Drag and drop the steps to implement a disaster recovery plan using Cloud Storage and Cloud Functions in the correct order.

Accepted Answer

Enable versioning on the primary bucket, then create a Cloud Function to copy new objects to the DR bucket, then test the procedure.. Versioning protects against accidental deletion. The Cloud Function copies objects to the DR bucket.

Answer

Create a Cloud Function to copy new objects to the DR bucket, then enable versioning on the primary bucket, then test.

Answer

Create a Cloud Function, then test, then enable versioning.

Answer

Enable versioning, then test, then create the Cloud Function.

Question 8

Which TWO statements are true about Google Cloud HTTPS Load Balancers?

Accepted Answer

They can forward traffic to backends in multiple regions, including instances in different VPC networks.. Google Cloud HTTPS Load Balancers are global external load balancers that can distribute traffic to backends across multiple regions, and they support cross-VPC connectivity via Shared VPC or VPC Network Peering, allowing instances in different VPC networks to serve as backends.

Answer

They support only external backends, such as internet-facing instances.

Answer

They support only IPv4 traffic.

Answer

They can be used to load balance internal HTTP(S) traffic within a VPC.

Question 9

A company wants to deploy a stateful application with strict low-latency requirements across multiple zones in a single region. They need to minimize inter-zone latency. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place application instances in the same zone to minimize network hops. Placing all application instances in the same zone eliminates cross-zone network hops, which directly reduces inter-zone latency to near zero. For a stateful application with strict low-latency requirements, this co-location ensures that traffic between instances stays within a single failure domain, avoiding the additional latency introduced by traversing zone boundaries.

Answer

Deploy instances in a managed instance group across multiple zones

Answer

Use Dedicated Interconnect for on-premises connection

Question 10

Refer to the exhibit. A Deployment Manager template deploys a GKE cluster and a job that publishes to Pub/Sub. The job fails with a permission error. Which change would fix the issue?

Accepted Answer

Add a serviceAccount field to nodeConfig with a custom service account that has roles/pubsub.publisher.. The node pool's service account needs the Pub/Sub Publisher role. The exhibit shows the nodes are using the default compute engine service account with only pubsub scope (no roles). The fix is to assign a service account with the necessary IAM role.

Answer

Set the job's serviceAccountName to the default compute service account.

Answer

Change the oauthScopes to include https://www.googleapis.com/auth/cloud-platform.

Answer

Add dependsOn: [my-job] to the cluster resource to ensure the cluster is ready.

Question 11

An engineer needs to view the logs of a specific Compute Engine instance in near real-time from the command line. Which gcloud command should they use?

Question 12

Which THREE are best practices for designing a highly available application on Compute Engine?

Accepted Answer

Use managed instance groups with autoscaling. Managed instance groups (MIGs) with autoscaling are a best practice for high availability because they automatically maintain a target number of healthy instances across zones, replacing failed instances and scaling based on load. This ensures the application can withstand instance failures and traffic spikes without manual intervention, directly supporting high availability.

Answer

Use local SSDs for stateful data

Answer

Use a single large machine type

Question 13

A company is migrating a legacy on-premises application to Google Cloud. The application has strict low-latency requirements between its components and requires stateful TCP sessions. Which TWO design decisions should the architect recommend?

Accepted Answer

Use regional managed instance groups with internal load balancing.. Regional managed instance groups (MIGs) with internal load balancing are correct because they keep all compute instances within a single region, minimizing network hops and latency between components. Internal load balancing provides a single IP address for stateful TCP sessions without introducing the latency of a global proxy, and it supports session affinity (e.g., client IP affinity) to maintain stateful connections.

Answer

Use Cloud NAT for outbound connectivity.

Answer

Use global load balancing with Cloud CDN.

Answer

Use Cloud VPN for on-premises connectivity.

Question 14

A media streaming company is deploying a new video transcoding pipeline on Google Cloud. The pipeline receives raw video files uploaded to Cloud Storage, triggers a Cloud Function that submits transcoding jobs to a Compute Engine worker pool, and stores the transcoded output in another Cloud Storage bucket. The workers are managed by a managed instance group (MIG) running a custom container image. Currently, when there is a spike in uploads, the MIG takes 5-7 minutes to scale up new workers, causing processing delays. The architect needs to reduce the time to add new workers to under 2 minutes. The workers are stateless and the container image is about 2 GB. What should the architect do?

Accepted Answer

Create a custom Compute Engine image that includes the container runtime and pre-pulled container. Creating a custom Compute Engine image that includes the container runtime and pre-pulls the 2 GB container image eliminates the need to download the image during scale-up. This reduces the instance startup time from 5-7 minutes to under 2 minutes, as the container is already cached locally on the image, bypassing the network pull delay.

Answer

Use Cloud Run instead of Compute Engine to run the transcoding workers

Answer

Increase the minimum number of instances in the MIG to 10

Answer

Replace the Compute Engine workers with Cloud Functions to handle the transcoding

Question 15

Which THREE are best practices for designing a highly available Cloud SQL for MySQL instance? (Choose 3)

Accepted Answer

Enable automatic backups. Automatic backups in Cloud SQL for MySQL provide point-in-time recovery (PITR) capabilities, which are essential for data durability and disaster recovery. Enabling automatic backups ensures that transaction logs are retained, allowing you to restore your database to any point within the backup retention period, typically up to 7 days.

Answer

Configure cross-region replication

Answer

Set a maintenance window in off-peak hours