Google PCA Practice Test 24 — 15 Questions

Question 1

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

Accepted Answer

Ensure either Cloud SQL Proxy is running or a VPC connector is configured, and IAM permissions are correct.. A Cloud Function with a private IP Cloud SQL instance requires either the Cloud SQL Proxy (which uses the Cloud SQL Auth proxy to establish an encrypted connection via the public IP, but if the instance has only a private IP, the proxy must be run within the same VPC) or a VPC connector to enable private networking. Additionally, proper IAM permissions (e.g., Cloud SQL Client role) are necessary for the proxy or connector to authenticate and connect. Without both the network path and IAM permissions, the connection will fail.

Answer

Ensure the Cloud SQL Proxy is running and configured.

Answer

Verify the Cloud Function's network settings.

Answer

Configure a VPC connector for the Cloud Function.

Question 2

A company wants to automatically rotate cryptographic keys on a schedule without manual intervention. Which service should they use?

Accepted Answer

Cloud Key Management Service (KMS). Cloud KMS provides built-in key rotation capabilities that allow you to automatically rotate cryptographic keys on a schedule (e.g., every 90 days) without manual intervention. You define a rotation period, and KMS automatically generates a new primary key version while retaining older versions for decryption of existing data. This is the correct service because it is specifically designed for managing encryption keys with automated lifecycle policies.

Answer

Secret Manager

Answer

Cloud Audit Logs

Answer

Cloud IAM

Question 3

Drag and drop the steps to set up a Cloud VPN tunnel between Google Cloud and an on-premises network into the correct order.

Accepted Answer

1. Create a Cloud Router
2. Create a VPN gateway
3. Create a tunnel with the on-premises public IP and pre-shared key
4. Establish BGP sessions. Cloud Router is used for dynamic routing. The tunnel requires the on-premises public IP and pre-shared key.

Answer

1. Create a VPN gateway
2. Create a Cloud Router
3. Establish BGP sessions
4. Create a tunnel with the on-premises public IP and pre-shared key

Answer

1. Create a VPN gateway
2. Create a tunnel with the on-premises public IP and pre-shared key
3. Establish BGP sessions

Answer

1. Create a tunnel with the on-premises public IP and pre-shared key
2. Create a VPN gateway
3. Create a Cloud Router
4. Establish BGP sessions

Question 4

Drag and drop the steps to migrate a Compute Engine VM to a different region using a snapshot into the correct order.

Accepted Answer

Create a snapshot of the existing disk, then create a new disk in the target region from the snapshot, then create a new VM in the target region using that disk.. Snapshots are global resources, but disks are regional. Create the disk in the target region, then create the VM.

Answer

Create a new disk in the target region, then create a snapshot of the existing disk, then create a new VM in the target region using the new disk.

Answer

Create a snapshot of the existing disk, then create a new VM in the target region, then create a new disk in the target region from the snapshot.

Answer

Create a new VM in the target region, then create a snapshot of the existing disk, then create a new disk in the target region from the snapshot.

Question 5

An e-commerce platform uses Cloud SQL (MySQL) for its transactional database. They are experiencing performance degradation during peak hours due to high read traffic. They need to improve read throughput without modifying the application code. Which TWO actions should they take? (Choose 2)

Accepted Answer

Increase the number of vCPUs on the primary instance. To improve read throughput without modifying application code, the best approaches are increasing the number of vCPUs on the primary instance (B) to handle more concurrent read operations, and enabling read replicas (E) to offload read traffic from the primary instance. Cloud SQL Auth Proxy (A) only provides a secure tunnel and does not offer connection pooling; connection pooling requires separate middleware. Using Memorystore (C) for session data caching reduces database load but does not directly improve read throughput for transactional queries, and query caching (D) is deprecated and not recommended.

Answer

Add a Cloud SQL Auth Proxy with connection pooling

Answer

Use Cloud Memorystore for caching session data

Answer

Enable query caching in Cloud SQL

Question 6

A company uses Terraform to manage Google Cloud infrastructure. They want to store the Terraform state file in a remote backend with state locking to prevent concurrent modifications. Which Google Cloud service supports this natively?

Accepted Answer

Cloud Storage. Google Cloud Storage (GCS) is the only option that natively supports Terraform's remote state backend with state locking. Terraform uses GCS's object versioning and a write-lock mechanism via a separate lock file (e.g., `default.tflock`) stored in the same bucket, leveraging GCS's strong consistency for atomic operations. This prevents concurrent `terraform apply` commands from corrupting the state.

Answer

Cloud Firestore

Answer

Cloud Spanner

Answer

Bigtable

Answer

Cloud SQL

Question 7

A company runs a multi-tier web application on Google Kubernetes Engine (GKE) with a frontend service, a backend service, and a Cloud SQL for PostgreSQL database. During peak hours, the frontend pod CPU usage is high (consistently above 80%), while the backend service shows moderate CPU usage (around 50%). Response times for user requests increase significantly, often exceeding the 200ms p99 latency target. Cloud SQL metrics show low query latency and no contention. The team wants to improve performance in a cost-effective manner. Which initial step should they take?

Accepted Answer

Increase the number of frontend pods by adjusting the horizontal pod autoscaler's target CPU utilization.. The frontend pods are CPU-bound during peak hours, causing increased response times. Increasing the number of frontend pods via the Horizontal Pod Autoscaler (HPA) by lowering the target CPU utilization threshold distributes the load across more replicas, directly addressing the bottleneck without additional infrastructure cost. This is the most cost-effective initial step because it leverages existing resources and autoscaling capabilities.

Answer

Add a read replica for Cloud SQL to offload read queries.

Answer

Migrate the backend service to a custom machine type with more vCPUs.

Answer

Enable vertical pod autoscaling for the backend service.

Question 8

Which THREE of the following are best practices when using Deployment Manager to manage infrastructure? (Choose three.)

Accepted Answer

Use templates to define resources modularly.. Option B is correct because Deployment Manager templates let you define resources modularly, so reusable building blocks (for example a VM template) can be instantiated multiple times with different properties instead of duplicating configuration. Option D is correct because imports allow a configuration or template to reference shared, external templates (such as a common network or firewall template), promoting reuse and consistent configuration across deployments. Option E is correct because composite types bundle multiple related resources into a single reusable type, which simplifies managing and repeating multi-resource patterns. Option A is not a best practice: raw REST API calls inside templates bypass the declarative template model and make configurations harder to maintain and reuse. Option C is not a best practice: Deployment Manager supports both YAML and Jinja/Python templates, so restricting yourself to only YAML configuration files unnecessarily limits templating and logic capabilities.

Answer

Use raw REST API calls in templates.

Answer

Use only YAML configuration files.

Question 9

A company is designing a disaster recovery strategy for a critical application running on Compute Engine with a regional managed instance group (MIG) and an HTTP load balancer. They require an RTO of 10 minutes and RPO of 1 hour. The application state is stored in Cloud SQL for PostgreSQL. What is the most cost-effective approach?

Accepted Answer

Use Cloud SQL cross-region replica with a warm standby MIG in the secondary region. Cloud SQL for PostgreSQL supports cross-region replication with a default replication lag typically under 1 hour. For RPO of 1 hour, cross-region replica is sufficient. For RTO of 10 minutes, having a warm standby in another region with a MIG and load balancer configuration that can be promoted quickly meets the requirement. Full active-active is more expensive; restoring from backups is slower; a cold standby may not meet RTO.

Answer

Deploy an active-active configuration across two regions using Cloud Spanner

Answer

Configure a cold standby with a Cloud SQL backup and MIG template in another region

Answer

Take daily exports of Cloud SQL to Cloud Storage and restore in another region

Question 10

Your company runs a critical application on Compute Engine instances in a managed instance group across three zones. The application writes logs to local disk. You are asked to improve the reliability of log retention and ensure logs are available in case of instance failure. You have already configured a health check that automatically recreates instances. However, after a recent zonal outage, logs from the affected instances were lost. You need to implement a solution that preserves logs even when instances are terminated. What should you do?

Accepted Answer

Install the Cloud Logging agent on each instance and configure it to stream application logs to Cloud Logging.. The Cloud Logging agent streams logs directly to Cloud Logging (now part of Google Cloud's operations suite), which stores logs independently of the Compute Engine instances. This ensures logs are preserved even if instances are terminated due to a zonal outage or health check recreation, as logs are sent to a centralized, durable logging service rather than being stored on local disk.

Answer

Increase the size of the local SSD to accommodate more logs and set a longer retention period.

Answer

Configure each instance to write logs to a persistent disk that is retained after instance deletion.

Answer

Mount a Cloud Storage bucket using gcsfuse on each instance and write logs directly to the bucket.

Question 11

A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?

Accepted Answer

Cloud Build trigger branch filtering. Cloud Build triggers support branch filtering via the 'Branch' field (regex) in the trigger configuration, so a trigger can be scoped to only fire on pushes to a specific branch such as 'refs/heads/main' or 'release/*'. This ensures that only builds originating from the trusted branch proceed to the deploy step, satisfying the requirement with a native Cloud Build feature.

Answer

Binary Authorization attestors

Answer

Cloud Deploy delivery pipeline approvals

Answer

Artifact Registry IAM permissions

Question 12

Your company runs a critical application on Compute Engine instances in us-central1. The application requires low latency between instances that are all in the same region. You notice that network latency between instances varies and sometimes spikes. You want to ensure consistent low-latency communication. You currently use external IP addresses for communication between instances. What should you do?

Accepted Answer

Use internal IP addresses instead of external IPs for inter-instance communication.. Using internal IP addresses (RFC 1918) for inter-instance communication avoids the overhead of NAT, external routing, and potential egress bottlenecks. Traffic stays within Google's internal network fabric, reducing latency variability and eliminating spikes caused by external internet path fluctuations.

Answer

Move instances to the same zone to reduce network hops.

Answer

Upgrade to larger machine types to improve network bandwidth.

Answer

Set up a Cloud VPN connection between instances.

Question 13

A company wants to run a containerized web application that experiences unpredictable traffic spikes. They want to pay only for resources used during request processing, with no idle cost. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that runs containers and automatically scales based on traffic, including scaling to zero when there are no requests. This means you pay only for resources used during request processing, with no idle cost, making it ideal for unpredictable traffic spikes.

Answer

Google Kubernetes Engine (GKE) Autopilot

Answer

App Engine Standard

Answer

Compute Engine with managed instance groups

Question 14

A company runs a web application on Compute Engine instances behind a global HTTP(S) Load Balancer. The application uses Cloud SQL for MySQL for user data. Users report that during peak hours, the page load times increase significantly. The development team notices that the number of database connections exceeds the maximum allowed, causing some requests to fail. The application is designed to use connection pooling with a maximum pool size of 100 connections per instance. There are currently 10 instances. The Cloud SQL instance is configured with 4 vCPUs and 15 GB memory, and the maximum connections is set to 400. The application team wants to minimize cost while resolving the issue. What should the architect recommend?

Accepted Answer

Reduce the max pool size per instance to 40 connections.. With 10 instances each configured for a max pool of 100 connections, the theoretical peak is 1,000 connections — far exceeding Cloud SQL's 400-connection limit. Reducing the pool to 40 per instance yields a maximum of 400 connections, which fits within the limit and resolves the failures without any cost increase. This is the only option that addresses the root cause (over-provisioned pools) while honoring the 'minimize cost' constraint.

Answer

Increase the Cloud SQL instance tier to have more vCPUs and memory.

Answer

Implement connection pooling at the global HTTP(S) Load Balancer level.

Answer

Use Cloud SQL Proxy with connection pooling.

Question 15

A company needs to store archival data that is accessed less than once a year and must be retained for 10 years for compliance. The data retrieval time is not critical. Which Cloud Storage class is MOST cost-effective?

Accepted Answer

Archive storage class. Archive storage class is the most cost-effective option for data accessed less than once a year with a 10-year retention requirement and non-critical retrieval time. It has the lowest storage cost of all Cloud Storage classes, designed specifically for long-term archival with a minimum storage duration of 365 days. Coldline and Nearline have higher storage costs and shorter minimum durations (90 and 30 days respectively), making them less economical for this use case.

Answer

Coldline storage class

Answer

Standard storage class

Answer

Nearline storage class