Google PCA Practice Test 22 — 15 Questions

Question 1

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) across three zones in us-central1. The application uses a Cloud Spanner database. Recently, the application experienced increased latency and timeouts during peak hours. The operations team noticed that the MIG's CPU utilization is consistently above 80% during peak hours, and the autoscaler is configured to scale based on CPU utilization with a target of 60%. However, the autoscaler is not adding new instances quickly enough, causing performance degradation. The team also observed that new instances take over 5 minutes to become healthy and serve traffic. The health check is a simple TCP check on port 8080. The application startup script downloads large configuration files from Cloud Storage. What should the team do to improve the autoscaling response time and reduce latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom Compute Engine image that includes the application and configuration, and use it in the MIG.. The primary bottleneck is the long instance startup time (over 5 minutes) caused by downloading large configuration files from Cloud Storage at boot. By creating a custom Compute Engine image that bakes the application and configuration into the image, new instances can start serving traffic almost immediately, drastically reducing the time before they become healthy and the autoscaler can consider them in scaling decisions. This directly addresses the root cause of slow autoscaling response, as the autoscaler cannot add instances faster than they become healthy.

Answer

Increase the minimum number of instances in the MIG to handle peak load.

Answer

Reduce the autoscaler target CPU utilization to 40% so it scales earlier.

Answer

Change the health check to HTTP and reduce the initial delay and check intervals.

Question 2

A startup wants to deploy a containerized web application with zero server management and automatic scaling based on HTTP requests. They expect very low traffic initially but want to scale to thousands of requests per second without configuration changes. Which compute service is most appropriate?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that abstracts all infrastructure, scales automatically from zero to thousands of requests per second based on HTTP traffic, and requires no cluster or server management. It directly matches the requirements of zero server management, automatic HTTP-based scaling, and no configuration changes as traffic grows.

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine (GKE) Standard

Answer

App Engine Standard

Question 3

A company runs a stateful application on GKE using StatefulSets. Which THREE practices improve reliability?

Accepted Answer

Use headless services.. A headless service (clusterIP: None) allows direct pod-to-pod communication without load balancing, which is essential for stateful applications like databases that require stable network identities. Each pod in a StatefulSet gets a unique DNS name (e.g., pod-0.service.namespace.svc.cluster.local), enabling reliable discovery and ordering for replication, leader election, and failover. This ensures that clients always reach the correct pod instance, improving overall reliability.

Answer

Use horizontal autoscaling based on disk usage.

Answer

Use persistent volumes with reclaim policy Delete.

Question 4

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Accepted Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Create a VPC peering connection from Project B to Project A.
4. Verify the peering status and network connectivity.. VPC peering requires bidirectional connections; both sides must initiate peering. IP ranges must not overlap.

Answer

1. Verify that the VPC networks have non-overlapping IP ranges.
2. Create a VPC peering connection from Project A to Project B.
3. Verify the peering status and network connectivity. (No peering from Project B to Project A)

Answer

1. Create a VPC peering connection from Project A to Project B.
2. Create a VPC peering connection from Project B to Project A.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Answer

1. Create a VPC peering connection from Project B to Project A.
2. Create a VPC peering connection from Project A to Project B.
3. Verify that the VPC networks have non-overlapping IP ranges.
4. Verify the peering status and network connectivity.

Question 5

An organization has a security policy that prohibits the use of external IP addresses on Compute Engine instances to reduce attack surface. They want to enforce this policy across all new and existing projects. Which approach should they use?

Accepted Answer

Use Organization Policy with constraint compute.vmExternalIpAccess. The Organization Policy constraint `compute.vmExternalIpAccess` is the correct approach because it allows you to set a policy at the organization, folder, or project level that denies the assignment of external IP addresses to Compute Engine instances. This policy is enforced at resource creation time and applies to all new and existing VM instances, ensuring compliance with the security policy across the entire resource hierarchy. It directly prevents the use of external IPs, reducing the attack surface without requiring per-project or per-instance configuration.

Answer

Use IAM conditions to prevent creation of instances with external IPs

Answer

Use Cloud Security Command Center to detect and alert on external IPs

Answer

Use VPC Firewall rules to block traffic to external IPs

Question 6

A company deploys a web application on Compute Engine behind an HTTP Load Balancer. They want to ensure only healthy instances receive traffic. What should they configure?

Accepted Answer

Configure an HTTP health check with a custom request path that returns a 200 status. An HTTP health check with a custom request path that returns a 200 status allows the HTTP Load Balancer to verify that the web application is actually serving requests correctly. This ensures that only instances passing the application-level health check are considered healthy and receive traffic, preventing requests from being routed to instances that may be running but not serving the expected content.

Answer

Configure the instance group autoscaling based on CPU utilization

Answer

Configure a TCP health check on port 80

Answer

Configure an SSL health check to verify TLS handshake

Question 7

A company's BigQuery costs are higher than expected. They run many ad-hoc queries with filters on the 'transaction_date' column and 'customer_id' column. They also have a materialized view that is rarely used. Which combination of actions will MOST effectively reduce query costs?

Accepted Answer

Partition on transaction_date, cluster on customer_id, and drop the unused materialized view. Partitioning by transaction_date reduces scanned data for date filters. Clustering by customer_id further reduces bytes billed for queries filtering on that column. Dropping unused materialized views avoids storage costs.

Answer

Convert to a clustered table on transaction_date and disable caching

Answer

Use flat-rate pricing for all queries and cluster on transaction_date

Answer

Partition on customer_id and use materialized views for all queries

Question 8

An organization uses Cloud Deployment Manager to manage infrastructure as code. They need to ensure that changes to production resources are reviewed and approved before deployment. What should they do?

Accepted Answer

Integrate Cloud Deployment Manager with Cloud Build and add a manual approval step in the Cloud Build pipeline. Integrating Cloud Deployment Manager with Cloud Build allows you to create a CI/CD pipeline that includes a manual approval step. This ensures that changes to production resources are reviewed and approved before the deployment config is applied, meeting the requirement for change control.

Answer

Use Cloud Scheduler to run deployment configs and review logs after deployment

Answer

Create a Cloud Deployment Manager preview deployment and manually approve it

Answer

Use Cloud Build with a trigger on a branch that requires pull request approval before merging

Question 9

An application running on Compute Engine is experiencing increased latency. You suspect a network bottleneck due to high egress traffic. Which gcloud command can you use to quickly check the network egress traffic for a specific VM instance?

Accepted Answer

gcloud logging read 'resource.type=gce_instance AND jsonPayload.egress_bytes'. The gcloud logging read command allows you to query Cloud Logging for specific log entries. For a Compute Engine instance, the resource type is gce_instance. You can filter for egress bytes by using the query 'resource.type=gce_instance AND jsonPayload.egress_bytes'. This will return log entries containing egress bytes information, assuming your VM is configured to send these logs (e.g., via the monitoring agent or VPC flow logs). This is the quickest way among the given options to check network egress traffic for a specific VM using a native gcloud command.

Option B is incorrect: gcloud compute instances list only displays the network IP of instances, not egress traffic metrics.
Option C is incorrect: gcloud compute instances get-serial-port-output shows the serial console output, which does not include network traffic data.
Option D is incorrect: gcloud monitoring metrics list just lists available metrics but does not retrieve the actual traffic data for a specific instance. To get the data you would need to use gcloud monitoring metric descriptors or gcloud monitoring dashboards, but the command as given does not return traffic.

Thus, A is the best choice.

Answer

gcloud compute instances list --format='value(networkInterfaces[0].networkIP)'

Answer

gcloud compute instances get-serial-port-output

Answer

gcloud monitoring metrics list

Question 10

A company runs a web application on Compute Engine with an HTTP Load Balancer. Users report intermittent 502 Bad Gateway errors. What is the most likely cause?

Accepted Answer

Backend instances are unhealthy or overloaded.. The 502 Bad Gateway error from an HTTP Load Balancer typically indicates that the backend instances are failing to respond to the load balancer's health checks or are overwhelmed, causing the load balancer to consider them unhealthy and return a 502 error. This is the most common cause because the load balancer relies on healthy backends to forward traffic, and overloaded or failing instances cannot handle requests.

Answer

Load balancer quota exceeded.

Answer

Firewall rules block health checks.

Answer

SSL certificate expired.

Question 11

Which Google Cloud service allows you to create alerting policies based on log entries?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver) is the Google Cloud service that lets you create alerting policies, including log-based alerts that trigger on specific log entries. You define a query against Cloud Logging data, and Cloud Monitoring evaluates it and fires alerts when matching entries appear. This is the correct service for alerting based on log content.

Answer

Cloud Logging

Answer

Cloud Audit Logs

Answer

Error Reporting

Question 12

Your company has migrated its legacy web application from a single Compute Engine instance to a managed instance group (MIG) behind an HTTP(S) load balancer. The application was updated to a new version as part of the migration. After the migration, users report intermittent 502 Bad Gateway errors. The application logs show no errors, and the load balancer backend health checks are reported as healthy. On investigation, the developers discover that the new version requires a specific environment variable for authentication to a downstream service. This variable was set manually on the original instance but is missing from the MIG's instance template. The health check endpoint does not depend on this variable and always returns a 200 status even when the variable is absent. As a result, instances created from the template are considered healthy by the load balancer, but when they receive requests that require authentication, they fail and return a 502 error to the client. What is the most likely cause of the 502 errors?

Accepted Answer

The missing environment variable causes authentication failures on new instances.. The 502 errors occur because the new application version requires a specific environment variable for authentication to a downstream service. The health check endpoint does not depend on this variable, so instances are marked healthy even though they cannot authenticate real requests. When the load balancer routes traffic to these instances, the missing variable causes authentication failures, leading to 502 Bad Gateway errors.

Answer

The health check is configured to check the old application path, which no longer exists.

Answer

The load balancer's backend timeout is too short for the application's response time.

Answer

The MIG is not scaling out fast enough to handle peak traffic.

Question 13

Refer to the exhibit. A user reports that the instance 'batch-vm' is unavailable. Based on the output, what is the most likely cause of the unavailability?

Accepted Answer

The preemptible VM was terminated by Google due to its preemptible nature.. The exhibit shows the instance 'batch-vm' with a status of 'TERMINATED' and the 'preemptible' flag set to 'true'. Preemptible VMs in Google Cloud have a maximum runtime of 24 hours and can be terminated at any time by Google Compute Engine due to resource constraints. The termination reason is typically 'preemption', which matches the scenario of a user reporting unavailability without manual intervention.

Answer

The VM was stopped manually by a user.

Answer

The VM lost its external IP address.

Answer

The VM crashed due to an out-of-memory error.

Question 14

A company runs a stateful application on Compute Engine with persistent disks. They want to ensure data durability across a zone failure. What is the best approach?

Accepted Answer

Use regional persistent disks. Regional persistent disks (RPDs) synchronously replicate data between two zones in the same region, providing an RPO of zero and automatic failover without application-level changes. This ensures data durability across a zone failure while maintaining consistent performance and low latency.

Answer

Replicate data at application level to another instance in a different zone

Answer

Use Google Cloud NetApp Volumes with replication

Answer

Take regular snapshots of the persistent disks and store them in a multiregional bucket

Question 15

A company runs multiple microservices on Cloud Run. Each service uses a Serverless VPC Access connector to connect to a shared Cloud Memorystore for Redis instance (standard tier) in a VPC network. The Redis instance is configured with a firewall rule that allows TCP connections on port 6379 from the VPC connector's subnet (10.8.0.0/28). After a recent code update, the order-service fails to connect to Redis, while the user-service continues to work. The error logs in order-service show 'connection refused'. The engineer verifies that both services use the same VPC connector, the same Redis instance IP, and the same service account. The VPC connector's metrics show no errors. What is the most likely cause?

Accepted Answer

The order-service code now attempts to connect to Redis on port 6380.. The order-service successfully connects to the same Redis instance before the code update. After the update, it fails with 'connection refused', while the user-service still works. Since both services share the same networking configuration and the firewall only allows port 6379, the most likely cause is that the order-service code now attempts to connect on a different port (e.g., 6380) that is not allowed by the firewall. Other options would affect both services or are inconsistent with the symptoms.

Answer

The order-service is deployed in a different region than the Redis instance.

Answer

The VPC connector is out of memory.

Answer

The Redis instance has reached its maximum number of connections.