Google PCA Practice Test 23 — 15 Questions

Question 1

Your company runs a critical multi-tier application: a global HTTP(S) load balancer, multiple regional managed instance groups (MIGs) for the web tier, and Cloud Spanner for the data tier. You need to design for zone-level and region-level failures. What architecture ensures the highest availability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a global HTTP(S) load balancer with regional MIGs in multiple regions, each spanning zones, and a multi-region Cloud Spanner instance.. It combines a global HTTP(S) load balancer (which can route traffic to healthy backends across regions), regional MIGs that span multiple zones within each region (providing zone-level redundancy), and a multi-region Cloud Spanner instance (which provides synchronous replication across regions for strong consistency and automatic failover). This architecture ensures that if an entire zone or region fails, traffic is automatically redirected to healthy backends in other zones/regions, and Spanner continues to serve reads and writes without manual intervention.

Answer

Use a global HTTP(S) load balancer with a single global MIG and a multi-region Cloud Spanner instance.

Answer

Use a global HTTP(S) load balancer with a single zonal MIG and Cloud Spanner single-region.

Answer

Use a regional HTTP(S) load balancer with a regional MIG and Cloud SQL with cross-region replication.

Question 2

Which GCP service should be used to automatically scale a GKE cluster's number of nodes based on pending pods?

Accepted Answer

Cluster Autoscaler. The GKE Cluster Autoscaler watches for pods that cannot be scheduled due to insufficient node capacity and automatically adds nodes to the node pool (and removes underutilized nodes). This is exactly the behavior described — scaling the cluster's node count based on pending pods.

Answer

Vertical Pod Autoscaler (VPA)

Answer

Node Auto-Provisioning

Answer

Horizontal Pod Autoscaler (HPA)

Question 3

Which TWO are required to allow on-premises hosts to access Google APIs using internal IP addresses (Private Google Access)? (Choose 2)

Accepted Answer

A Cloud Interconnect or Cloud VPN connection between on-premises and VPC. Option A is correct because Private Google Access for on-premises hosts requires a hybrid connectivity path — either Cloud Interconnect or Cloud VPN — to carry traffic from the on-premises network into the VPC, where it can then reach Google APIs via internal IP addresses. Option D is correct because Private Google Access must be enabled on the specific subnet that the on-premises traffic will use; this setting allows resources in that subnet to reach Google APIs using internal IP addresses rather than external ones. Option B is incorrect because Cloud Router is a Google Cloud resource used for dynamic routing (e.g., BGP) within the VPC, not something configured in the on-premises network. Option C is incorrect because VPC Service Controls is a security perimeter feature for mitigating data exfiltration, not a requirement for Private Google Access. Option E is incorrect because a private DNS zone for googleapis.com is not required; Google provides the necessary DNS resolution for private.googleapis.com and restricted.googleapis.com automatically when Private Google Access is configured.

Answer

A Cloud Router instance configured in the on-premises network

Answer

VPC Service Controls enabled

Answer

A private DNS zone for googleapis.com

Question 4

You are responsible for incident management for a production service. You want to reduce manual toil during the initial response to common issues like high latency. What is the best approach?

Accepted Answer

Use Cloud Monitoring to trigger a Cloud Function that performs automated checks and rolls back the last deployment if latency spikes.. It directly reduces manual toil by automating the initial response to common issues like high latency. Cloud Monitoring triggers a Cloud Function that performs automated checks and, if latency spikes, rolls back the last deployment, eliminating the need for human intervention during the critical first response phase.

Answer

Set up Cloud Monitoring alerts with email notifications to the on-call engineer.

Answer

Create detailed runbooks and require the on-call to follow them step by step.

Answer

Enable Cloud Logging and set up a custom dashboard for the on-call.

Question 5

A developer needs to deploy a containerized application on Google Kubernetes Engine (GKE) with minimal operational overhead. They want to automatically scale the number of pods based on CPU utilization. Which GKE feature should they use?

Accepted Answer

Horizontal Pod Autoscaler.. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically scales the number of pod replicas in a GKE deployment based on observed CPU utilization (or other custom metrics). This directly meets the requirement of scaling pods with minimal operational overhead, as HPA is a native Kubernetes resource that requires no manual intervention once configured.

Answer

Node auto-repair.

Answer

Vertical Pod Autoscaler.

Answer

Cluster Autoscaler.

Question 6

A global e-commerce site uses an external HTTPS load balancer with a backend service pointing to a managed instance group. Some users report 503 errors during peak traffic. The backend instances are healthy and not overloaded. What is the most likely cause?

Accepted Answer

The load balancer's max rate per backend is configured too low. A 503 error from an external HTTPS load balancer with healthy backends typically indicates that the load balancer is throttling requests. The 'max rate per backend' setting limits the number of requests per second that the load balancer forwards to each backend instance. When this limit is exceeded, the load balancer returns 503 errors even though the instances themselves are not overloaded, which matches the scenario of peak traffic.

Answer

The CDN cache is not warming up properly

Answer

The backend service's health check interval is too short

Answer

The SSL certificate is expired

Question 7

A company wants to restrict network access to Cloud SQL instances such that only applications running in a specific VPC can connect. Which GCP feature should they use?

Accepted Answer

Private Service Access. Private Service Access (PSA) is the GCP feature that allows private connectivity from a VPC network to Google-managed services like Cloud SQL. It uses VPC peering with the Google-managed service's VPC to enable private IP communication. Private Service Connect, on the other hand, is used for publishing services to consumers, not for consuming services like Cloud SQL.

Answer

Private Service Connect

Answer

VPC peering

Answer

Private Services Access

Question 8

A security engineer wants to prevent data exfiltration from a project 'prod-data' by ensuring that only approved VPC networks can access BigQuery datasets. Which GCP service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls create a service perimeter around GCP resources such as BigQuery datasets, restricting access to only approved VPC networks and identities. By placing the 'prod-data' project inside a perimeter and defining access levels, the engineer can block data exfiltration from unapproved networks. This is the GCP-native control designed specifically for this scenario.

Answer

Private Google Access

Answer

Cloud Armor

Answer

Cloud NAT

Question 9

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using a specific service account without storing long-lived credentials. Which method should be used?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google Cloud service account. Workload Identity is the recommended way to allow a Kubernetes pod in GKE to access Google Cloud services like Cloud Storage using a specific service account without long-lived credentials. It binds a Kubernetes service account to a Google Cloud service account, and the pod uses the Kubernetes service account to obtain short-lived credentials via the GKE metadata server. This eliminates the need for JSON keys.

Answer

Assign the service account directly to the GKE node pool

Answer

Create a JSON key for a service account and mount it as a secret in the pod

Answer

Use Application Default Credentials on the pod

Question 10

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

Accepted Answer

Migrate for Compute Engine.. Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Answer

Cloud Endpoints.

Answer

Cloud Deployment Manager.

Answer

Cloud Foundation Toolkit.

Question 11

A company is using Cloud Load Balancing to expose a web application. They want to protect against common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides Web Application Firewall (WAF) capabilities that can inspect HTTP/HTTPS traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with Cloud Load Balancing to apply pre-configured or custom rules at the edge, blocking malicious requests before they reach the backend.

Answer

VPC Firewall rules

Answer

Identity-Aware Proxy

Answer

Cloud CDN

Question 12

Your company runs a global e-commerce platform on Google Cloud. The application is deployed across multiple regions for low latency. You use Cloud SQL for transactional data and Cloud Spanner for global consistency of inventory. Recently, the operations team reported that the application is experiencing increased latency during peak hours, and the monthly cloud bill has risen significantly. Upon investigation, you find that the Cloud SQL instance is underutilized (CPU < 20%) while Cloud Spanner split utilization is over 80%. The application instances are fronted by a global external HTTPS load balancer. Network egress costs are high. Which course of action would best address both the latency and cost issues?

Accepted Answer

Increase the number of splits in Cloud Spanner to reduce hot spots, and configure Cloud CDN in front of the load balancer to cache static content.. The primary performance issue is Cloud Spanner split utilization over 80%, indicating hot spots that cause increased latency. Increasing the number of splits redistributes load across more nodes, reducing contention. Additionally, configuring Cloud CDN caches static content at edge locations, reducing network egress costs and latency by serving content closer to users.

Answer

Reduce the Cloud SQL instance tier to a lower machine type to save costs, and add read replicas in other regions for failover.

Answer

Add more nodes to the Cloud SQL instance and enable automatic storage increase to handle peak loads.

Answer

Move the transactional database to Cloud Spanner and decommission Cloud SQL to reduce complexity.

Question 13

A company has two VPC networks in the same project: 'vpc-prod' and 'vpc-dev'. They want to allow communication between instances in both VPCs. What is the simplest method?

Accepted Answer

Create a VPC Network Peering connection between them. VPC Network Peering is the simplest method because it directly connects two VPCs using Google's internal infrastructure, allowing private RFC 1918 IP communication across the networks without requiring external gateways, VPN tunnels, or additional bandwidth costs. It requires no routes to be manually configured—Google automatically adds the necessary routes for each peered VPC's subnets—and only a single firewall rule to permit traffic between the instances.

Answer

Set up a Cloud VPN tunnel between the two VPCs

Answer

Configure a custom route in each VPC pointing to the other's subnet

Answer

Add firewall rules allowing traffic between the VPCs

Question 14

Which TWO statements about Google Cloud VPC networks are true? (Choose two.)

Accepted Answer

Subnets are regional resources.. Subnets in Google Cloud VPC are regional resources. When you create a subnet, you specify a region and a CIDR block, and the subnet spans all zones within that region. This allows resources in different zones of the same region to use the same subnet without additional configuration.

Answer

VPC networks are project-level resources.

Answer

Firewall rules are regional.

Answer

Subnets are zonal resources.

Question 15

A company has a Shared VPC with a service project hosting GKE clusters. The GKE nodes need to access Cloud SQL instances in the host project. The team wants to avoid public IP and use Private Service Access. They have configured a VPC peering between the host VPC and the service producer VPC for Cloud SQL. However, the GKE pods cannot reach the Cloud SQL instance. What is the most likely cause?

Accepted Answer

The service project is not authorized in the Cloud SQL instance. The most likely cause is that the service project is not authorized in the Cloud SQL instance. After configuring Private Service Access (VPC peering) between the host VPC and the service producer VPC, you must explicitly authorize the service project's VPC network in the Cloud SQL instance's private network configuration. Without this authorization, connection attempts from GKE pods will fail. Option B is incorrect because Private Service Connect is not required; VPC peering is sufficient for connectivity once authorization is granted. Option A is incorrect because the Cloud SQL instance is configured with a private IP via Private Service Access. Option D is incorrect because firewall rules in the host VPC do not block traffic over VPC peering by default; the issue is authorization, not firewall rules.

Answer

The Cloud SQL instance is not configured with a private IP

Answer

The service project needs a Private Service Connect endpoint to access the Cloud SQL instance

Answer

The firewall rules in the host VPC block egress from the service project