Google PCA Practice Test 22 — 15 Questions

Question 1

Match each GCP networking concept to its definition.

Question 2

Match each IAM role type to its description.

Question 3

Match each GCP migration term to its description.

Question 4

Match each GCP compute service to its characteristic.

Question 5

Match each GCP monitoring/logging tool to its purpose.

Question 6

Refer to the exhibit. The process-image function fails intermittently with a memory limit exceeded error. Which action will MOST effectively resolve the issue?

Accepted Answer

Increase the function memory to 256MB.. The error indicates memory limit exceeded. Increasing the memory allocation will give the function more memory to process images, and is the direct fix.

Answer

Increase the function timeout to 120 seconds.

Answer

Reduce the maximum concurrent executions to 5.

Answer

Change the trigger to Cloud Pub/Sub to reduce load.

Question 7

Refer to the exhibit. A user alice@example.com is unable to list objects in bucket 'bucket-b'. What is the most likely reason?

Accepted Answer

The condition restricts access only to bucket-a.. Option B is correct. The IAM condition restricts the storage.objectViewer role to only objects whose name starts with 'bucket-a'. Since alice is trying to list objects in bucket-b, the condition prevents access. Option A is incorrect because the objectViewer role is sufficient to list objects. Option C is incorrect because legacyBucketReader is not required for listing. Option D is incorrect because the condition expression is valid.

Answer

The IAM policy is missing the roles/storage.objectAdmin role.

Answer

The condition expression is invalid.

Answer

The user needs the roles/storage.legacyBucketReader role.

Question 8

A company is migrating a legacy on-premises application to Google Cloud. The application has strict low-latency requirements between its components and requires stateful TCP sessions. Which TWO design decisions should the architect recommend?

Accepted Answer

Use regional managed instance groups with internal load balancing.. Options B and D are correct. Placing all components in the same VPC network minimizes latency by leveraging Google's internal network, and avoids SNAT issues that could break stateful sessions. Using regional managed instance groups with internal load balancing preserves source IP and supports session affinity, which is essential for stateful TCP. Option A is incorrect because global load balancing and Cloud CDN are optimized for web content, not stateful low-latency inter-component traffic. Option C is incorrect because Cloud NAT is used for outbound internet access and would break stateful sessions. Option E is incorrect because Cloud VPN connects on-premises to GCP, but does not directly address low-latency between cloud components.

Answer

Use Cloud NAT for outbound connectivity.

Answer

Use global load balancing with Cloud CDN.

Answer

Use Cloud VPN for on-premises connectivity.

Question 9

A company is designing a data pipeline to ingest streaming data from IoT devices and store it in BigQuery for analysis. They need to minimize latency and operational overhead. Which two Google Cloud services should they use? (Choose two.)

Accepted Answer

Cloud Dataflow. Cloud Pub/Sub is the recommended service for ingesting streaming data, and Cloud Dataflow can process the data and write it directly to BigQuery with low latency. Cloud Storage is for batch uploads, Cloud Functions is event-driven but not ideal for high-throughput streaming, and Cloud Dataproc is for batch processing.

Answer

Cloud Dataproc

Answer

Cloud Storage

Answer

Cloud Functions

Question 10

Refer to the exhibit. A cloud administrator is attempting to grant the BigQuery Data Viewer role to an external user (user@example.com) but receives the error shown. What is the most likely cause?

Accepted Answer

The organization policy constraints/iam.allowedPolicyMemberDomains blocks external domains.. The error message indicates that the request is prohibited by an organization policy constraint 'iam.allowedPolicyMemberDomains'. This constraint restricts which domains can be added as members in IAM policies. Since the user is from an external domain (example.com), the policy blocks the addition unless that domain is allowed.

Answer

The BigQuery dataset requires domain-wide delegation.

Answer

The user does not have the resourcemanager.projects.setIamPolicy permission.

Answer

The external user must first be added to a Google Group.

Question 11

Your company runs a global e-commerce platform on Google Cloud. The application is deployed across multiple regions for low latency. You use Cloud SQL for transactional data and Cloud Spanner for global consistency of inventory. Recently, the operations team reported that the application is experiencing increased latency during peak hours, and the monthly cloud bill has risen significantly. Upon investigation, you find that the Cloud SQL instance is underutilized (CPU < 20%) while Cloud Spanner split utilization is over 80%. The application instances are fronted by a global external HTTPS load balancer. Network egress costs are high. Which course of action would best address both the latency and cost issues?

Accepted Answer

Increase the number of splits in Cloud Spanner to reduce hot spots, and configure Cloud CDN in front of the load balancer to cache static content.. The symptoms suggest that the Cloud SQL instance is underutilized, but Cloud Spanner is near capacity, causing potential contention. The high egress costs could be due to cross-region traffic. Option C is the best because scaling Cloud Spanner split utilization (by adding splits or nodes) will improve throughput and reduce latency, and using Cloud CDN reduces egress costs by caching content at edge locations. Option A might increase costs without addressing Spanner bottleneck. Option B adds more Cloud SQL instances, which are already underutilized. Option D focuses on cloud SQL only, not Spanner.

Answer

Reduce the Cloud SQL instance tier to a lower machine type to save costs, and add read replicas in other regions for failover.

Answer

Add more nodes to the Cloud SQL instance and enable automatic storage increase to handle peak loads.

Answer

Move the transactional database to Cloud Spanner and decommission Cloud SQL to reduce complexity.

Question 12

A company needs to connect two VPC networks in different Google Cloud regions. The VPCs are in separate projects under the same organization. The connection must use private IP addresses and support high throughput. Which TWO options meet these requirements? (Choose 2.)

Accepted Answer

VPC Network Peering. VPC Network Peering works across regions and projects within the same organization, using private IPs and supporting high throughput. Cloud VPN also works across regions and projects, providing encrypted private connectivity. Shared VPC is for sharing subnets within a project, not for connecting separate projects. Cloud NAT is for outbound internet access. HA VPN Gateway is a component of Cloud VPN, not a standalone connection method.

Answer

HA VPN Gateway

Answer

Cloud NAT

Answer

Shared VPC

Question 13

A security administrator wants to ensure that a Cloud Storage bucket named `gs://my-bucket` is only accessible by service accounts, not user accounts. Which action should they take?

Accepted Answer

Create a new IAM policy that removes all user members and adds a service account member with `roles/storage.objectAdmin`.

Answer

Remove the user from the `roles/storage.objectViewer` binding and add a condition to deny user access.

Answer

Add a bucket IAM condition that requires `resource.name.startsWith("projects/_/buckets/my-bucket/objects/")`

Answer

Use a VPC Service Controls perimeter to block user access.

Question 14

A company runs a containerized application on Cloud Run. Which TWO actions will most improve the reliability of the service?

Accepted Answer

Deploy the service in multiple regions. Setting min instances > 0 prevents cold starts, ensuring consistent performance. Deploying in multiple regions provides regional failover. Enabling CPU always allocated is for background tasks, not reliability. Disabling concurrency limits throughput. Cloud CDN is for static content, not compute reliability.

Answer

Enable CPU always allocated

Answer

Disable concurrency

Answer

Use Cloud CDN

Question 15

A financial services company is migrating a sensitive customer data application to Google Cloud. The application runs on Compute Engine VMs in a VPC. The security team requires that all data at rest in Cloud Storage and BigQuery must be encrypted with customer-managed encryption keys (CMEK). Additionally, the keys must be stored in a different project than the data, and access to the keys must be audited. The operations team has set up a CMEK key in Cloud KMS in a separate project, assigned the Cloud KMS CryptoKey Encrypter/Decrypter role to the data project's Compute Engine service account, and enabled Cloud Storage and BigQuery to use CMEK. However, when the application tries to read from Cloud Storage, it fails with 'Access Denied.' The Cloud KMS key is in project 'kms-proj' and the data is in project 'data-proj'. What is the most likely cause?

Accepted Answer

The Cloud Storage service agent in 'data-proj' does not have the Cloud KMS CryptoKey Encrypter/Decrypter role.

Answer

The Compute Engine service account used by the VM does not have the Cloud KMS Decrypter role.

Answer

The VPC firewall rules are blocking egress to Cloud KMS.

Answer

The Cloud KMS key has been disabled due to an Organization Policy.